面向对象语言中的漏洞发现方法  

Vulnerability Detection Methods on Object-Oriented Language

作　　者：陈永艳[1] 束洪春[2] 戴伟[3] 曹靖国 

机构地区：[1]昆明理工大学计算中心,云南昆明650500 [2]昆明理工大学研究生院,云南昆明650500 [3]昆明理工大学云南省计算机技术应用重点实验室,云南昆明650500 [4]中国石油天然气公司贵州分公司,贵州兴义562400

出　　处：《昆明理工大学学报（自然科学版）》2013年第3期56-61,共6页Journal of Kunming University of Science and Technology(Natural Science)

基　　金：国家自然科学基金(11103005)

摘　　要：大多数行业定制软件漏洞检测困难,而传统的静态漏洞检测方法不但报告很多错误的和虚假的信息,同时针对面向对象的函数(方法)检测并未提及.针对函数调用前后存在的漏洞问题,首先用XML文法来表示出面向对象情况下,对象存在继承关系时,从祖先类搜索开始,建立函数调用前后安全契约规则,利用基于上下文无关的自顶向下与自底向上相结合的语法解析树的方法,解析函数的调用是否违反了安全契约规则并报告漏洞的内容.实验表明,与同类型安全分析工具比较,具有避免函数重复分析、规则的可扩展性良好、准确率高等优点.Most of Custom software vulnerability detection is difficult. Lots of static vulnerability detection ap- proaches usually not only give many inaccurate information and false results, but also can＇ t deal with code on object - oriented language. Extending the rules of XML grammar, the searching process will be done from top an- cestor class on XML tree with object - oriented. The pre - condition and post - condition are built with objects which belong to inheritance relationship＇ s class. A new parsing algorithm is established by combining top - down and bottom - up method in a parsing tree to check whether the parse result breaks the safety rules of contract and to report the contents of the vulnerability. The experiments show that, compared with the same code analysis tools, this method has the advantage nf n. t;r; 1..~＇~

关 键 词：契约规则 面向对象 解析树 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]