基于词法分析的DICOM开源库漏洞检测工具实现  

Implementation of a Vulnerability Detection Tool for DICOM Open Source Library Based on Lexical Analysis

作　　者：张之睿 王志强[1,2] 孟苏陇 ZHANG Zhirui;WANG Zhiqiang;MENG Sulong(Beijing Electronic Science and Technology Institute,Beijing 100070,P.R.China;State Information Center,Beijing 100045,P.R.China)

机构地区：[1]北京电子科技学院,北京市100070 [2]国家信息中心,北京市100045

出　　处：《北京电子科技学院学报》2021年第3期27-36,共10页Journal of Beijing Electronic Science And Technology Institute

基　　金：国家重点研发计划项目(2018YFB1004100);公安部信息网络安全重点实验室(C19614);中国博士后科学基金(2019M650606);北京电子科技学院一流学科建设项目(3201012)。

摘　　要：DIC0M(Digital Imaging and Communications in Medicine)标准作为医学图像和相关信息的国际标准,被广泛应用于放射医疗,心血管成像等方面。当前使用DICOM协议的医疗信息系统大都通过DIC0M开源库实现数据交换的功能,但该开源库在协议实现上安全性考虑较少,存在大量的安全隐患。针对该问题,本文对DICOM开源库开展静态漏洞挖掘技术研究,采用词法分析技术对DICOM开源库的源码进行静态分析,设计DICOM开源库漏洞挖掘架构,使用Python开发基于词法分析的漏洞检测工具,用于检测DICOM开源库源码中存在的安全漏洞。As an international standard for medical images and related information,DICOM(Digital Imaging and Communications in Medicine)standard is widely used in radiology,cardiovascular imaging,etc.At present,most medical information systems using the DICOM protocol accomplish the data exchange function by the DICOM open source library.However,the DICOM open source library has fewer security considerations when implementing the protocols,and amount of hidden security risks exist.To address this problem,this paper presents conducting static vulnerability mining technology research on the DICOM open source library,using lexical analysis technology to statically analyze the source code of the DICOM open source library,and designing a DICOM open source library vulnerability mining architecture.In addition,a vulnerability detection tool based on lexical analysis using Python is developed to detect the security vulnerabilities in the source code of the DICOM open source library.

关 键 词：DICOM库 安全漏洞 词法分析 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]