基于源代码同源比对的缺陷检测系统设计与实现

发布时间：2018-09-04 16:25

【摘要】：随着计算机网络的快速发展和开源思想的普及,网络上开源代码、算法和功能模块等与软件开发相关的信息不断丰富着计算机软件的开发工作,并且一些软件在一定程度上会借鉴或引用网络上的相关开源代码或者开源框架以减少开发复杂度和提高开发效率。但是,网络上的这些开源代码和功能模块可能存在着各种潜在的缺陷,如:安全漏洞、后门代码和木马病毒等,在软件开发过程中,如果软件源代码中引用了有缺陷问题的代码,该软件就很可能把缺陷代码的缺陷问题引入到开发的软件中。这种软件安全问题,是当前安全领域研究的热点,也是本论文研究的重点。论文介绍了源代码同源比对及缺陷分析相关技术,在此基础上,首先对抽象语法树比对技术进行了改进,提出了基于抽象语法树剪枝比对算法。该算法能够有效地发现一些针对底层数据修改的同源代码,在一定程度上提高了源代码同源比对结果的准确度。其次,把源代码程序依赖图技术应用到缺陷代码检测之中,改进了静态污点分析技术的相关算法,提出了基于程序依赖关系的缺陷检测算法。该算法能够在程序依赖图结构基础上结合源代码静态污点分析技术来实现针对缺陷代码的检测。论文设计和实现了一种基于源代码同源比对的缺陷检测系统,该系统使用了基于文本和抽象语法树的同源比对技术,通过将参与检测的源代码文本同系统缺陷代码库中缺陷代码进行同源比对来实现针对源代码的缺陷检测;系统支持缺陷代码库的管理功能,用户能够根据自身需要选择、添加和删除相应的缺陷代码库。通过测试,验证了系统开发过程中所用到的相关技术的有效性,对系统进行了整体验证,取得了很好的效果。
[Abstract]:With the rapid development of computer network and the popularization of open-source ideas, the information related to software development, such as open source code, algorithms and function modules, is enriching the work of computer software development. And to some extent, some software will use or reference the related open source code or open source framework on the network to reduce the development complexity and improve the development efficiency. However, these open source code and functional modules on the network may have a variety of potential defects, such as security vulnerabilities, backdoor code and Trojan viruses, in the process of software development, If the source code of the software refers to the defective code, the software is likely to introduce the defect problem of the defect code into the developed software. This kind of software security is a hot topic in the field of security, and it is also the focus of this paper. This paper introduces the related technologies of source code homology alignment and defect analysis. On this basis, the abstract syntax tree alignment technology is improved, and the pruning matching algorithm based on abstract syntax tree is proposed. The algorithm can effectively find some source code modified for the underlying data, and improve the accuracy of source code homology alignment to a certain extent. Secondly, the source code dependency graph technology is applied to defect code detection, and the related algorithms of static stain analysis are improved, and a defect detection algorithm based on program dependency is proposed. The algorithm can detect the defect code based on the structure of the program dependency graph and the static stain analysis technology of the source code. A defect detection system based on source code homology alignment is designed and implemented in this paper. The system uses the technology of homology alignment based on text and abstract syntax tree. The source code text involved in the detection is compared with the defect code in the system defect code base to realize the defect detection for the source code, the system supports the management function of the defect code base, and the user can choose according to his own needs. Add and delete the defect code base. The validity of the related technologies used in the development of the system is verified through the test. The system is verified as a whole and good results are obtained.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP311.52

【参考文献】