基于语法解析树的函数漏洞发现方法  

Function Vulnerability Detection Method Based on Parse Tree

作　　者：陈永艳[1] 束洪春[2] 戴伟[3] 

机构地区：[1]昆明理工大学计算中心,昆明650500 [2]昆明理工大学研究生院,昆明650500 [3]昆明理工大学省计算机技术应用重点实验室,昆明650500

出　　处：《计算机科学》2013年第8期119-123,135,共6页Computer Science

基　　金：国家自然科学基金项目(11103005)资助

摘　　要：大多数行业定制软件的漏洞检测较困难,而传统的静态漏洞检测方法会产生很多错误的和虚假的信息。针对函数调用前后存在的漏洞问题,提出了基于上下文无关的自顶向下与自底向上相结合的语法解析树的方法,它能够在对函数内部定义不了解或者部分了解的情况下,解析函数调用前后安全契约规则:前置规则和后置规则。同时通过扩展规则表示的XML文法来表示面向对象下,规则中的属性存在继承关系下的契约规则。实验表明,与同类型安全分析工具比较,该方法具有避免函数重复分析、规则可扩展性良好、尤其在自定义对象类和特定环境下自定义参数准确率高等优点。Custom software vulnerability detection is difficult. Most of static vulnerability detection approach usually produces large amount of false information and positives results. A new method is able to understand the analyzed source code when a function is called. This paper proposed a method of combination top-down and bottom-up parsing tree which is based on CFL（context-free language）. In a case of not understanding or partially understanding inside code of a function definition, it can analyze function contract before or after function called, named precondition and post- condition. Extending the rules of XML grammar on object-oriented, pre-eondition and post-condition can deal with ob- jects belonging to inheritance relationship＇ s class. The experiments show that, compared with the same type of security analysis tools, it can avoid repeat function analysis, has good rules scalability and high accuracy for custom defined ob- ject classes and parameters in custom environmental especially.

关 键 词：函数弱点 继承关系 契约规则 语法解析树 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]