静态与动态分析相结合的PHP代码缺陷检测技术研究与实现

发布时间：2018-06-12 12:15

本文选题：数据流分析 + AST　；参考：《北京邮电大学》2017年硕士论文

【摘要】：随着互联网的快速发展,中国网民规模日益扩张,网站总量日益增多,Web应用与人民的生活越来越密切,web页面不再只是简单的静态html页面,而是由各种动态脚本语言开发,PHP由于语法简单上手容易,是目前web应用开发中占比最大的编程语言。然而,Web系统由于存储了大量用户数据而遭受越来越多的黑客攻击,不时有大量用户信息泄露的事件发生。许多初级开发人员都不具备基本的安全知识,所以在产品上线前都得经过安全人员的代码审计。然而人工审计的效率实在太低,而且典型的开源静态代码工具Rips和商业工具Fortify的检测效果都不太好,误报率太高,同时动态工具既不适合某些特定场景又需要大量人工干预,也没有理想的开源动态分析工具,因此,研究并设计一款准确可靠的代码审计系统是当前国内外研究的一个热点。本文在对词法分析、语法分析、数据流分析、Fuzzing技术和反射技术进行研究后,结合作者遇到的实际场景以及做渗透测试时的实际经验,提出了一种静态分析与动态分析相结合的代码缺陷检测技术。静态分析相对效率较高,主要用于分析代码语法,根据自定义的安全规则,通过遍历分析PHP-Parser生成的抽象语法树,准确定位危险函数并进行污点回溯,详细输出污点传播路径。动态分析主要基于反射技术与Fuzzing技术来实现,利用反射技术来动态调用用户自定义的过滤函数,根据预先定义的安全规则,通过对比输入与输出来判断是否为净化函数。
[Abstract]:With the rapid development of the Internet, the scale of Chinese Internet users is expanding day by day, and the total number of web sites is increasing the number of web applications and people's lives is getting closer and closer. The web pages are no longer just simple static html pages. It is developed by all kinds of dynamic scripting languages. It is the largest programming language in the application development of web because of its simple syntax and easy to use. However, more and more hackers attack the Web system because of storing a large amount of user data. From time to time, a large number of user information leaks occur. Many junior developers do not have a basic knowledge of security, so they have to be audited by a security officer before the product goes online. However, the efficiency of manual audit is too low, and the detection effect of Rips, a typical open source static code tool, and Fortify, a commercial tool, is not very good, the false alarm rate is too high, and dynamic tools are not suitable for certain scenarios and require a lot of human intervention. There is no ideal open source dynamic analysis tool. Therefore, the research and design of an accurate and reliable code audit system is a hot topic at home and abroad. After studying lexical analysis, grammatical analysis, data flow analysis and fuzzing and reflection techniques, this paper combines the actual situation encountered by the author and the practical experience in the penetration test. A code defect detection technique combining static analysis and dynamic analysis is proposed. Static analysis is relatively efficient, which is mainly used to analyze code syntax. By traversing the abstract syntax tree generated by PHP-Parser according to the self-defined security rules, the risk function can be accurately located and the stain trace can be traced back, and the contamination propagation path can be outputted in detail. Dynamic analysis is mainly based on reflection technology and fuzzing technology. The reflection technology is used to dynamically call the user-defined filter function. According to the pre-defined security rules, the input and output are compared to determine whether the filter function is a purification function.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【参考文献】