Loophole finding method based on loophole correlation distribution model

Abstract

The invention discloses a loophole finding method based on a loophole correlation distribution model. The method comprises the following steps of 1, building a loophole knowledge base, completing collecting and cooperative sharing work for specific information system loophole knowledge to form a loophole correlation simple graph; 2, on the basis of the loophole knowledge base, adopting a loophole correlation calculation module for calculating the loophole influence degree and loophole correlation compactness; 3, according to the calculated loophole influence degree and relevancy indexes, perfecting the loophole correlation simple graph into the loophole correlation distribution model; 4, by comparing a detected loophole set and the loophole correlation distribution graph, predicting loophole positions. According to the loophole finding method based on the loophole correlation distribution model, the loophole correlation distribution graph comparison mode is adopted for performing known security loophole finding work, then, the conventional loophole excavation work is guided cooperatively, and the loophole finding efficiency and accuracy are improved.

Description

technical field [0001] The invention belongs to the technical field of information security, and in particular relates to a method for testing and analyzing the security of an information system. Background technique [0002] Most of the network attacks and malicious programs (viruses, worms, Trojan horses, etc.) on the Internet are related to vulnerabilities, so it is imperative to study vulnerability discovery technology. Research on vulnerability discovery technology can improve the security and reliability of software products, reduce the number of malicious programs, avoid network attacks, and provide strong technical support for the software industry and security industry. [0003] The discovery of security vulnerabilities includes the mining of unknown vulnerabilities and the identification of known vulnerabilities. Unknown vulnerability mining technology refers to analyzing and testing the target through manual or auxiliary tools, mining the target operation process...

AI Technical Summary

Problems solved by technology

Among them, the patch comparison technology based on source code is relatively mature, and it is of little significance to find vulnerabilities. The patch comparison technology based on binary code is easily affected by compiler optimization, and cannot accurately match unstructured changes.

[0008] The fuzzing tool provides some form of input data to the input interface of the target software and monitors its processing to find potential security vulnerabilities. However, when it finds some vulnerabilities, there will be problems such as access control defects, poor design logic, and memory corruption.

Images