Web应用程序漏洞检测关键技术研究

发布时间：2019-06-28 18:30

【摘要】：随着互联网的普及和Web开发技术的兴起与发展,Web应用程序已成为最重要的互联网应用之一,在各领域承载了举足轻重的作用。Web应用程序的安全问题得到了研究界及工业界的广泛关注。Web应用程序的安全漏洞是攻防双方最为重要的战场,如何有效识别Web应用程序中的安全漏洞,即漏洞检测,是Web安全领域的核心问题。根据是否运行被检测的程序,可将漏洞检测技术分为静态漏洞检测技术和动态漏洞检测技术。静态漏洞检测技术及动态漏洞检测技术均面临诸多挑战。静态漏洞检测技术通常误报率高,提高静态漏洞检测精确度的同时,保证方法的性能,是静态漏洞检测面临的关键挑战之一。静态漏洞检测通常运用程序分析技术,发现Web应用程序的安全问题。然而,由于Web应用程序所具有的特性,使得传统的程序分析技术无法直接被使用进行静态漏洞检测。基于模糊测试的动态漏洞检测技术具有误报率低的优势。但是,由于输入向量的随机性,模糊测试的代码覆盖率低,难以发现程序中深藏的漏洞。基于混合执行的测试输入生成方法能够提高模糊测试的代码覆盖率。然而,现代Web应用程序逻辑复杂、规模庞大,混合执行在遍历可达执行路径时,面临路径爆炸问题。本文围绕Web应用程序静态漏洞检测与动态漏洞检测面临的问题与挑战,结合Web应用程序的特性,重点研究了Web应用程序局部调用图生成、输入验证漏洞检测及混合执行中的路径搜索等关键技术。本文主要贡献如下：1.为支持静态漏洞检测中的过程间分析,针对全程序分析效率低和Web应用程序库代码缺失的问题,本文提出了一种Web应用程序局部调用图生成方法。该方法的分析对象为Web应用程序的应用部分代码、应用部分所引用的库部分代码中方法的签名、类的域和类层次结构。首先,使用混合堆模型对程序中的内存位置进行抽象,区分应用部分及库部分的抽象内存位置。然后,利用规则对与指针相关的应用部分和库部分交互行为进行建模,推断库部分代码的指针信息。最后,为库部分维护指针指向集合,利用该集合解析库回调边,并限制回流进入应用部分指针指向集合的抽象对象。实验结果表明,该方法的运行时间分别比werroes和Spark快4.9倍和13.7倍,同时能在一定程度上保证局部调用图的完整性和精确性。2.针对静态漏洞检测误报率高的问题,本文提出了一种基于静态信息流跟踪技术的输入验证漏洞检测方法。首先,集成指针分析,识别程序中堆内数据的依赖关系以及变量之间的别名关系。然后,通过过程内数据流分析计算程序中方法的数据依赖关系摘要,提高过程间分析的效率。最后,提出双向数据流分析技术来静态跟踪信息流,缩短污点数据传播路径长度。本文在开源静态代码分析工具FindBugs上实现该方法,并在基准程序SecuriBench上对该方法进行验证。实验结果表明,该方法在不明显降低静态漏洞检测方法性能的前提下,提高了输入验证漏洞的检测精确度。3.针对混合执行的路径爆炸问题,本文提出了一种混合执行中的路径搜索策略。该搜索策略对被测试程序各个分支的代码覆盖率进行实时估算,并选择覆盖率最低的分支继续探索执行。实验结果表明,该路径搜索策略能够有效缓解混合执行的路径爆炸问题,为提高基于模糊测试的动态漏洞检测技术的代码覆盖率提供支持。
[Abstract]:With the popularization of the Internet and the rise and development of the Web development technology, the Web application has become one of the most important Internet applications, and plays a very important role in all fields. The security of Web application has been widely concerned by the research and industry. The security hole of Web application is the most important battlefield of the defense and defense, and how to effectively identify the security holes in the Web application, that is, the detection of the vulnerability, is the core problem in the field of Web security. According to whether the detected program is to be run, the vulnerability detection technology can be divided into a static vulnerability detection technology and a dynamic vulnerability detection technology. The static vulnerability detection technology and the dynamic vulnerability detection technology face many challenges. The technique of static vulnerability detection is usually too high to improve the accuracy of the static hole detection, and the performance of the method is one of the key challenges to the detection of the static vulnerability. The static vulnerability detection usually uses the program analysis technique to find the security problem of the Web application. However, due to the nature of the Web application, traditional program analysis techniques cannot be used directly for static vulnerability detection. The dynamic vulnerability detection technology based on the fuzzy test has the advantage of low error rate. However, due to the randomness of the input vector, the code coverage of the fuzzy test is low, and it is difficult to find a hidden vulnerability in the program. The test input generation method based on the hybrid execution can improve the code coverage of the fuzzy test. However, the modern Web application logic is complex, large in scale, and is faced with the problem of path explosion when traversing up to the execution path. In this paper, the problems and challenges facing the detection and dynamic vulnerability detection of the Web application are discussed, and the key technologies such as the local call graph generation, the input verification vulnerability detection and the path search in the mixed execution of the Web application are studied. The main contribution of this paper is as follows:1. In order to support the process-to-process analysis in the static vulnerability detection, the paper presents a local call graph generation method for Web application aiming at the problem of low efficiency of all-program analysis and the missing of the Web application library code. The analysis object of this method is the application part code of the Web application, the signature of the method in the library part code referenced by the application part, the domain of the class and the class hierarchy. First, the memory location in the program is abstracted by using the mixed-stack model, and the abstract memory location of the application part and the library part is distinguished. Then, using the rule to model the interaction behavior of the application part and the library related to the pointer, and the pointer information of the library part code is deduced. Finally, a pointer to the collection is maintained for the library portion, the library callback edge is parsed using the set, and the abstract object that returns to the application portion pointer to the set is limited. The experimental results show that the operation time of the method is 4.9 times and 13.7 times faster than that of werroes and Spark, and the integrity and accuracy of the local call graph can be guaranteed to a certain extent. In this paper, an input verification vulnerability detection method based on static information flow tracking technology is presented in this paper. First, an integrated pointer analysis is used to identify the dependency of the data in the heap and the alias relationship between the variables. And then, the data dependency relation summary of the method in the program is analyzed through the data flow in the process, and the efficiency of the inter-process analysis is improved. Finally, a two-way data flow analysis technique is proposed to keep track of information flow and shorten the path length of the spot data. This paper implements this method on the open source static code analysis tool FindBugs and verifies the method on the reference program SecuriBench. The experimental results show that the method can improve the detection accuracy of the input verification vulnerability without significantly reducing the performance of the static hole detection method. In order to solve the problem of the path explosion, a path search strategy is proposed in this paper. The search strategy estimates the code coverage of each branch of the test program in real time, and selects the branch with the lowest coverage to continue to explore the execution. The experimental results show that the route search strategy can effectively mitigate the path explosion problem of the hybrid execution and support the code coverage of the dynamic vulnerability detection technology based on the fuzzy test.
【学位授予单位】：浙江大学
【学位级别】：博士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】