基于静态语义流图的漏洞检测模型  

Vulnerability detection model based on static semantic flow graph

作　　者：李春艳 陈世阳 易仲铁 林周勇 黄突 LI Chunyan;CHEN Shiyang;YI Zhongtie;LIN Zhouyong;HUANG Tu(Guoneng(Quanzhou)Thermal Power Co.,Ltd.,Quanzhou,Fujian 362100,China)

机构地区：[1]国能(泉州)热电有限公司,福建泉州362100

出　　处：《计算机应用文摘》2024年第20期159-161,共3页

摘　　要：随着软件系统的复杂性不断增加和规模的扩大,漏洞检测成为确保软件安全性和稳定性的重要环节,但传统的静态分析方法在应对复杂漏洞时表现出一定的局限性。文章提出了一种基于静态语义流图(Static Semantic Flow Graph,SSFG)的漏洞检测模型。该模型结合了程序的语义信息和数据流分析,通过构建语义流图实现对软件漏洞的精准检测。实验结果表明,该方法在检测常见漏洞类型(如缓冲区溢出与SQL注入等)时具有较高的准确率和较强的有效性。With the increasing complexity and scale of software systems,vulnerability detection has become an important link to ensure software security and stability.The traditional static analysis method has some limitations in dealing with complex vulnerabilities.This paper proposes a vulnerability detection model based on Static Semantic Flow Graph(SSFG).The model combines the semantic information and data flow analysis of the program,and realizes the accurate detection of software vulnerabilities by constructing semantic flow graph.The experimental results show that this method has high accuracy and strong effectiveness in detecting common vulnerability types such as buffer overflow and SQL injection.

关 键 词：静态语义流图 漏洞检测 软件漏洞 缓冲区溢出 SQL注入 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]