CN118211221A - Multi-programming language software back door detection method based on intermediate representation - Google Patents

Abstract

The invention relates to a multi-programming language software back door detection method based on intermediate representation, belonging to the field of software security. In order to solve the problem that the detection efficiency and precision are poor when the traditional technology discovers a deeper software backdoor, the invention can realize cross-language analysis of software internal logic comprising a plurality of programming languages by establishing a unified intermediate representation model, thereby discovering the deeper and more concealed backdoor problem and making up the defect of precision deficiency caused by the need of processing different languages respectively in the traditional analysis means.

Description

A multi-programming language software backdoor detection method based on intermediate representation

Technical Field

The invention belongs to the field of software security, and in particular relates to a multi-programming language software backdoor detection method based on intermediate representation.

Background technique

A software backdoor is a piece of code that is maliciously implanted into a software system, allowing attackers to bypass normal security monitoring mechanisms and steal information or execute instructions. Static code analysis technology is an important means of detecting software backdoors. It locates suspicious backdoor fragments by scanning the source code.

Static code analysis technology is an analysis method that does not rely on the actual execution of code. It can analyze the code without running the program to find potential software backdoors. At present, static code analysis technology has been widely used in software development and security fields, such as source code security scanning, code obfuscation, taint analysis, data flow analysis, control flow analysis and other technologies.

However, in software composed of multiple programming languages, traditional static code analysis technology will have difficulty in discovering deeply hidden software backdoors because it needs to distinguish and detect various programming languages. Some scholars have proposed some solutions, such as symbolic execution-based methods and deep learning-based methods, but they are limited in effectiveness in actual scenarios due to problems with detection efficiency and accuracy.

Summary of the invention

1. Technical issues to be resolved

The technical problem to be solved by the present invention is to provide a backdoor detection method for software including multiple programming languages to discover the backdoor logic hidden deeper inside the software.

(II) Technical solution

In order to solve the above technical problems, the present invention provides a multi-programming language software backdoor detection method based on intermediate representation, comprising the following steps:

Step 1: Collect source code files of various programming languages in the software under test;

Step 2: Map the source code of various programming languages to a unified intermediate representation IR;

Step 3: Based on the intermediate representation IR, establish the data flow model VFG;

Step 4: Traverse each node in the VFG to locate possible backdoor implantation points and backdoor triggering points;

Step 5: Perform flow tracking in VFG to search whether there is a feasible program path between the backdoor implantation point and the backdoor trigger point, so as to determine whether there is a software backdoor.

Preferably, when collecting source code files in the first step, if both Java and Python are used in the software, source code files with suffixes of ".java" and ".py" are collected.

Preferably, in the second step, the source code is uniformly converted into an intermediate representation IR, which is an abstraction of program logic, in which relevant details of the programming language are hidden and the structural characteristics of the program instructions are retained.

Preferably, the specific conversion method in the second step is:

For declaration statements in different programming language codes, a unified DeclareStatement data structure is created, which will store the type, name and initialization expression of the declared variable;

For assignment statements in different programming language codes, a unified AssignStatement data structure is created, which stores the left value, right value and assignment symbol corresponding to the assignment statement;

For loop statements in different programming language codes, a LoopStatement data structure is uniformly created, which stores the loop exit conditions, the initialization of iteration variables, and the statements inside the loop body.

For branch statements in different programming language codes, a BranchStatement data structure is uniformly created, which stores the judgment conditions of the branch statements, the statements executed when the conditions are true, and the statements executed when the conditions are false;

For function call statements in different programming language codes, a CallStatement data structure is uniformly created, which stores the function name and parameter list of the function call statement;

For return statements in different programming languages, a unified ReturnStatement data structure is created, which will store the expression of the return statement;

For parameter declarations in different programming languages, a unified ArgStatement data structure is created, which will store the name and type of the parameter variable;

For binary expressions in different programming language codes, a unified BinaryExpression data structure is created, which will store the left variable, right variable and used operators of the binary expression;

For unary expressions in different programming language codes, a unified UnaryExpression data structure is created, which stores the variables and operators of the unary expressions.

Preferably, in the third step, a data flow model VFG is constructed to represent the value transfer relationship in the program.

Preferably, the process of constructing VFG in the third step is:

31. Determine the variables defined by the program statements with the help of the data structure type: DeclareStatement defines the variables it declares, AssignStatement defines the left value, and ArgStatement defines the parameters;

32. Determine the variables used by program statements with the help of the data structure type: variables in variable initialization expressions in DeclareStatement; variables in right values in AssignStatement; variables in loop iterations in LoopStatement; variables in conditional expressions in BranchStatement; variables in each parameter in CallStatement; variables in returned expressions in ReturnStatement;

33. Establish the value transfer relationship within the function. Based on the analysis results of steps 31 and 32, clarify the definition and use of variables in each program statement, and establish the association between variable definition and variable use based on the variable name, that is, the value transfer relationship within the function;

34. Establish a value transfer relationship between functions. For the function call point CallStatement, find the specific function called according to the function name, so as to establish the association between the actual parameter list in the function call point and the formal parameter list of the specific function, that is, the value transfer relationship between functions;

35. Create a node for each program statement in VFG, and then create directed edges between nodes based on the analysis results of steps 33 and 34, connecting the definition point of the variable to the use point of the variable to represent the transfer of data.

Preferably, in the fourth step, the possible backdoor implantation points found by traversing the nodes in the VFG refer to instructions that may support the attacker to input data externally, which are distinguished according to the functions called and the variables used in the program; the possible backdoor triggering points found by traversing the nodes in the VFG refer to instructions that may be instructions for the attacker to implement specific backdoor behaviors, which are also distinguished according to the functions called and the variables used in the program.

Preferably, the fifth step: searching in the VFG whether there is a feasible program path between the implantation point and the trigger point, that is, starting the search from the implantation point in the VFG, if there is a path that can reach the trigger point, it is considered that there may be a software backdoor.

The present invention also provides a system for implementing the method.

The invention also provides a network security analysis method implemented based on the method.

(III) Beneficial effects

By establishing a unified intermediate representation model, the present invention can realize cross-language analysis of the internal logic of software including multiple programming languages, so as to discover deeper and more hidden backdoor problems and make up for the lack of precision caused by the need to process different languages separately in traditional analysis methods.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is an overall flow chart of the multi-programming language software backdoor analysis method based on intermediate representation of the present invention, which is divided into five stages, namely, collecting source code files in the software, converting the source code into intermediate representation, constructing a data flow model, locating implantation points and trigger points, and searching for feasible backdoor execution paths;

Figure 2 is a screenshot of the Java code of the software under test;

Figure 3 is a screenshot of the Python code of the software under test;

Figure 4 is the VFG model corresponding to the embodiment code. For the sake of clarity, only the instruction nodes related to the backdoor are retained in the figure. The overall process can be divided into two parts: Java data reception and Python console. The overall process of the software backdoor involved runs through these two parts and consists of two language modules. However, in the VFG model shown in the figure, because it is built based on the intermediate representation, it can be directly connected at the script call point, and there will be no difference at the syntax level, which is easy to perform unified analysis.

Detailed ways

In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the accompanying drawings and examples.

The present invention provides a multi-programming language software backdoor detection method based on intermediate representation, which is a backdoor detection method for software including multiple programming languages. By establishing a unified intermediate representation model for various programming languages, and then constructing a unified model structure on this basis, cross-language data flow tracking is achieved, and the backdoor logic hidden deeper inside the software is discovered, thereby realizing a detection method for the backdoor hidden deeper in complex software including multiple programming languages.

Referring to FIG1 , the technical solution of the present invention comprises the following steps:

Step 1: Collect source code files of various programming languages in the software under test;

Step 2: Map the source code of various programming languages to a unified intermediate representation IR (Intermediate Representation);

Step 3: Based on the intermediate representation IR, establish the data flow model VFG (Value Flow Graph);

Step 4: Traverse each node in the VFG to locate possible backdoor implantation points and backdoor triggering points;

Step 5: Perform flow tracking in VFG to search for a feasible program path between the backdoor implantation point and the backdoor trigger point, and determine whether there is a software backdoor based on this.

When collecting source code files in the first step, if both Java and Python are used in the software, source code files with suffixes of ".java" and ".py" are collected.

In the second step, the source code is uniformly converted into an intermediate representation IR. The intermediate representation is an abstraction of the program logic, which hides the relevant details of the programming language and retains the structural characteristics of the program instructions. Statement types such as variable declaration, function call and function return still have clear distinctions in the intermediate representation. This step only eliminates the differences between different languages.

The specific conversion method is:

For declaration statements in different programming language codes, a unified DeclareStatement data structure is created, which will store the type, name and initialization expression of the declared variable;

For assignment statements in different programming language codes, a unified AssignStatement data structure is created, which stores the left value, right value and assignment symbol corresponding to the assignment statement;

For loop statements in different programming language codes, a LoopStatement data structure is uniformly created, which stores the loop exit conditions, the initialization of iteration variables, and the statements inside the loop body.

For branch statements in different programming language codes, a BranchStatement data structure is uniformly created, which stores the judgment conditions of the branch statements, the statements executed when the conditions are true, and the statements executed when the conditions are false;

For function call statements in different programming language codes, a CallStatement data structure is uniformly created, which stores the function name and parameter list of the function call statement;

For return statements in different programming languages, a unified ReturnStatement data structure is created, which will store the expression of the return statement;

For parameter declarations in different programming languages, a unified ArgStatement data structure is created, which will store the name and type of the parameter variable;

For binary expressions in different programming language codes, a unified BinaryExpression data structure is created, which will store the left variable, right variable and used operators of the binary expression;

For unary expressions in different programming language codes, a unified UnaryExpression data structure is created, which stores the variables and operators of the unary expressions.

By sequentially executing the above conversion process for the statements and expressions in the tested code, the same logic in different programming languages can be mapped to a unified data structure, wherein the Statement type data structure can correspond to a specific program statement, and the Expression type data structure corresponds to the expression in a more fine-grained statement. These two data structures together constitute the intermediate representation model adopted by the present invention, that is, through the above conversion process, the conversion of multiple programming languages to intermediate representation can be realized.

In the third step, a data flow model VFG is constructed to represent the value transfer relationship in the program. The construction process is:

31. Determine the variables defined by the program statements with the help of the data structure type: DeclareStatement defines the variables it declares, AssignStatement defines the left value, and ArgStatement defines the parameters;

32. Determine the variables used by program statements with the help of the data structure type: variables in variable initialization expressions in DeclareStatement; variables in right values in AssignStatement; variables in loop iterations in LoopStatement; variables in conditional expressions in BranchStatement; variables in each parameter in CallStatement; variables in returned expressions in ReturnStatement;

33. Establish the value transfer relationship within the function. Based on the analysis results of 31 and 32, clarify the definition and use of variables in each program statement, and establish the association between variable definition and variable use based on the variable name, that is, the value transfer relationship within the function;

34. Establish a value transfer relationship between functions. For the function call point CallStatement, find the specific function called according to the function name, so as to establish the association between the actual parameter list in the function call point and the formal parameter list of the specific function, that is, the value transfer relationship between functions;

35. Create a node for each program statement in VFG, and then create directed edges between the nodes based on the analysis results of 33 and 34, connecting the definition point of the variable to the use point of the variable to represent the transfer of data.

After the above steps, VFG can be generated based on IR. Because the logic of software backdoors is usually related to the transmission of values and system instructions, the subsequent steps will be detected in VFG according to the data transmission mode unique to software backdoors.

In the fourth step, the possible backdoor implantation points found by traversing the nodes in the VFG refer to instructions that may support attackers to input data externally, such as user input points, network interfaces, reading file contents, etc., which can be distinguished according to the functions called and variables used in the program; the possible backdoor triggering points found by traversing the nodes in the VFG refer to instructions that may be used by attackers to implement specific backdoor behaviors, such as executing system commands, creating files, and remotely transmitting data, which can also be distinguished according to the functions called and variables used in the program.

Step 5: In VFG, search whether there is a feasible program path between the implantation point and the trigger point, that is, starting from the implantation point in VFG, the search can reach the trigger point. If such a path exists, it is considered that there may be a software backdoor and the problem is reported.

Example 1

This embodiment is used to illustrate a multi-programming language software backdoor analysis method based on intermediate representation.

The software under test consists of two pieces of code, Java and Python. The specific example code is shown in the Java code in Figure 2 and the Python code (process_input.py script) in Figure 3.

In the code in Figure 2, network transmission is created through the socket, and then the input of the network transmission is passed to the local process_input.py script for processing. This Java code does not contain the complete backdoor logic.

In this code, the parameters passed in by the console will be received. If the download parameter is included, the file download operation will be executed, and the downloaded file is also determined by the parameter.

The above two pieces of code constitute the complete logic of the entire sample software. The Java code is used to establish a network connection and receive data. The command line system call is used to pass the external input to the Python script. Then, the relevant operations are performed inside the Python script. The download parameter can be used to execute file downloads. Attackers can use this method to download files to the server.

First, an intermediate representation IR is established for the two pieces of code, and then a data flow model VFG is established based on the IR to represent the numerical transfer of multi-programming language software. The constructed VFG model is shown in Figure 4.

Finally, flow tracing is performed on the VFG model. The backdoor implantation point located is "socket", which is the input point of external data and is recorded as source. The trigger point of the backdoor is located as "canisrufus.commit", which is the execution point of the system call and is recorded as sink. Then, the execution path between the two is searched, and a feasible path is found [socket -> … ->command -> …->exec("python") -> … ->args.download -> … ->canisrufus.commit]. The path does not contain operations to determine whether the external input data is compliant. Therefore, it can be determined that there is a suspected backdoor in the multi-programming language software.

The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims (10)

1. A method for detecting backdoors in multiple programming language software based on intermediate representation, characterized in that it comprises the following steps: Step 1: Collect source code files of various programming languages in the software under test; Step 2: Map the source code of various programming languages to a unified intermediate representation IR; Step 3: Based on the intermediate representation IR, establish the data flow model VFG; Step 4: Traverse each node in the VFG to locate possible backdoor implantation points and backdoor triggering points; Step 5: Perform flow tracking in VFG to search for a feasible program path between the backdoor implantation point and the backdoor trigger point, so as to determine whether there is a software backdoor; When collecting source code files in the first step, if both Java and Python are used in the software, source code files with suffixes of ".java" and ".py" are collected. 2. The method as claimed in claim 1 is characterized in that in the second step, the source code is uniformly converted into an intermediate representation IR, which is an abstraction of program logic, in which relevant details of the programming language are hidden and the structural characteristics of the program instructions are retained. 3. The method according to claim 2, characterized in that the specific conversion method in the second step is: For declaration statements in different programming language codes, a unified DeclareStatement data structure is created, which will store the type, name and initialization expression of the declared variable; For assignment statements in different programming language codes, a unified AssignStatement data structure is created, which stores the left value, right value and assignment symbol corresponding to the assignment statement; For loop statements in different programming language codes, a LoopStatement data structure is uniformly created, which stores the loop exit conditions, the initialization of iteration variables, and the statements inside the loop body. For branch statements in different programming language codes, a BranchStatement data structure is uniformly created, which stores the judgment conditions of the branch statements, the statements executed when the conditions are true, and the statements executed when the conditions are false; For function call statements in different programming language codes, a CallStatement data structure is uniformly created, which stores the function name and parameter list of the function call statement; For return statements in different programming languages, a unified ReturnStatement data structure is created, which will store the expression of the return statement; For parameter declarations in different programming languages, a unified ArgStatement data structure is created, which will store the name and type of the parameter variable; For binary expressions in different programming language codes, a unified BinaryExpression data structure is created, which will store the left variable, right variable and used operators of the binary expression; For unary expressions in different programming language codes, a unified UnaryExpression data structure is created, which stores the variables and operators of the unary expressions. 4. The method as claimed in claim 3 is characterized in that in the third step, a data flow model VFG is constructed to represent the numerical transfer relationship in the program. 5. The method according to claim 4, characterized in that the process of constructing the VFG in the third step is: 31. Determine the variables defined by the program statements with the help of the data structure type: DeclareStatement defines the variables it declares, AssignStatement defines the left value, and ArgStatement defines the parameters; 32. Determine the variables used by program statements with the help of the data structure type: variables in variable initialization expressions in DeclareStatement; variables in right values in AssignStatement; variables in loop iterations in LoopStatement; variables in conditional expressions in BranchStatement; variables in each parameter in CallStatement; variables in returned expressions in ReturnStatement; 33. Establish the value transfer relationship within the function. Based on the analysis results of steps 31 and 32, clarify the definition and use of variables in each program statement, and establish the association between variable definition and variable use based on the variable name, that is, the value transfer relationship within the function; 34. Establish a value transfer relationship between functions. For the function call point CallStatement, find the specific function called according to the function name, so as to establish the association between the actual parameter list in the function call point and the formal parameter list of the specific function, that is, the value transfer relationship between functions; 35. Create a node for each program statement in VFG, and then create directed edges between nodes based on the analysis results of steps 33 and 34, connecting the definition point of the variable to the use point of the variable to represent the transfer of data. 6. The method as claimed in claim 5 is characterized in that, in the fourth step, the possible backdoor implantation points found by traversing the nodes in the VFG refer to instructions that may support the attacker to input data externally, which are distinguished according to the functions called and the variables used in the program; the possible backdoor triggering points found by traversing the nodes in the VFG refer to instructions that may be instructions for the attacker to implement specific backdoor behaviors, which are also distinguished according to the functions called and the variables used in the program. 7. The method as claimed in claim 5 is characterized in that the fifth step: in the VFG, searching whether there is a feasible program path between the implantation point and the trigger point, that is, starting the search from the implantation point in the VFG, if there is a path that can reach the trigger point, it is considered that there may be a software backdoor. 8. The method as claimed in claim 5 is characterized in that the method is applied in static code analysis. 9. A system for implementing the method according to any one of claims 1 to 8. 10. A network security analysis method implemented based on the method according to any one of claims 1 to 8.