基于符号执行的注入类安全漏洞的分析技术  

Static Analysis of Injection Security Vulnerabilities Based on Symbolic Execution

作　　者：孙基男[1] 潘克峰 陈雪峰 张君福 

机构地区：[1]北京大学软件工程国家工程研究中心,北京100871 [2]卫士通信息产业股份有限公司北京总部,北京100070 [3]北京北大软件工程股份有限公司,北京100080

出　　处：《北京大学学报（自然科学版）》2018年第1期1-13,共13页Acta Scientiarum Naturalium Universitatis Pekinensis

摘　　要：采用符号值作为输入,模拟程序执行,提取执行路径上相应的约束条件,即安全约束、攻击约束以及防御约束,并构成可满足矩阵(SAT)以及不可满足矩阵(UNSAT)两个注入类漏洞安全分析与检测模型,矩阵模型的求解结果可映射为注入类安全漏洞的安全状态。对Web应用注入类漏洞的检测实验表明,与目前安全分析主流工具相比,该分析技术具有降低误报率、漏报率、能自动生成攻击向量等优点。This research work receives symbols as input variables, simulates the execution of program, extracts the constraints binding with execution paths, such as security constraints, attack constraints and defense constraints, and constructs the SAT judgment matrix and UNSAT judgment matrix as injection vulnerabilities analysis models. According to the logical reduction results of the matrices, the states of injection vulnerabilities are decided. In the controlled experiments, the false positive and false negative ratios are greatly reduced, and the prototype system can generate correct exploits automatically.

关 键 词：注入类安全漏洞 符号执行 程序静态分析 WEB应用安全 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]