Method for analyzing taint propagation path

Abstract

The invention provides a method for analyzing the taint propagation path to achieve the technical purpose of analyzing the taint propagation path based on the program dependence. The method comprises the steps that firstly, a program is analyzed through the LLVM compiler architecture, a source code is converted into an IR expression, and the IR expression of the LLVM is based on the static single assignment form; secondly, the variable data dependence analysis in a basic block is carried out on the IR expression obtained in the first step; thirdly, the control dependence analysis among basic blocks is carried out on the IR expression obtained in the first step; fourthly, the dependence of a PHI node at the aggregation position of the basic blocks is processed, the PHI function is placed at the aggregation position of the basic blocks in the static single assignment form expression and used for selecting different living examples of the variables in different branches, the dependence relation of the left variable of the PHI function is worked out according to the analysis result of the second step and the analysis result of the third step, the dependence of the basic blocks to the basic block aggregation position is linked, and therefore the taint propagation path can be analyzed.

Description

technical field [0001] The invention relates to a stain propagation path analysis method, which belongs to the technical field of software detection. Background technique [0002] Taint propagation analysis originated from Perl's Tainting mechanism. It is currently used in software defect detection, automatic generation of type-based vulnerability signatures, software testing, etc. Untrustworthy data input from outside is usually marked as taint. Taint propagation analysis is the process of tracking and preventing incorrect use of taint. Discovering the taint propagation path is of great significance to discovering potential vulnerabilities. [0003] Taint analysis marks the data flowing into the program from outside as a taint, and then tracks the propagation process of the tainted data in the program. The general idea: 1) mark the source of tainted data; 2) record the spread of tainted data; 3) alert the use of tainted data, when it is detected that tainted data flows in...

AI Technical Summary

Problems solved by technology

[0005] However, the existing taint analysis technology has relatively little research on the taint propagation path, and more attention is paid to the discovery of taints.

Existing research on dynamic taint analysis requires the use of instrumentation technology, which requires a certain amount of performance and requires specific inputs to drive the program to run. It takes a certain amount of time to construct specific inputs.

Images