摘要
基于结构化的补丁比对是软件漏洞辅助分析的重要方法。在分析总结已有补丁比对技术及反补丁比对技术的基础上,针对结构化比对存在无法进行语义分析而导致误报的问题,提出了基于函数语义分析的软件补丁比对方法。利用传统的结构化比对方法,在函数级进行语法差异比较得到最大同构子图;通过程序依赖分析,构建函数输入输出之间的路径包络,基于符号执行以包络为对象计算函数输出特征;通过函数摘要进行语义级比对,结合最大同构子图的匹配函数结果,进一步分析得出发生语义变化的函数。最终,通过实验比对测试,验证了所提方法的可行性和优势。
Patch comparison provides support for software vulnerability,and structural comparison has been developed.Based on summarizing binary files comparison and anti-comparison methods,comparison technology was proposed by semantic analysis on function to address the issue that structural comparison cannot carry on semantic analysis.Through traditional structural comparison,syntax differences in function-level were analyzed to find the maximum common subgraph.Then,the path cluster was built between the input and output of the function depend on program dependency analysis.Function output characteristics was established based on symbolic execution.Semantic differences of functions were compared by functional summaries.Based on the maximum isomorphic subgraph,the matched functions which there are possible semantic changes between was further analyzed.Ultimately,the experimental results showed the feasibility and advantages of the proposed method.
作者
曹琰
刘龙
王禹
王清贤
CAO Yan;LIU Long;WANG Yu;WANG Qingxian(State Key Laboratory of Mathematical Engineering&Advanced Computing,Zhengzhou 450000,China;Henan University of Engineering,Zhengzhou 450000,China)
出处
《网络与信息安全学报》
2019年第5期56-63,共8页
Chinese Journal of Network and Information Security
基金
国家重点研发计划基金资助项目(No.2017YFB0803202,No.2016QY07X1404)~~
关键词
漏洞分析
补丁比对
符号执行
语义分析
vulnerability analysis
patch comparison
symbolic execution
semantic analysis
作者简介
通信作者:曹琰(1983-),男,河南郑州人,博士,数学工程与先进计算国家重点实验室讲师,主要研究方向为网络空间安全,vspyan@hotmail.com。刘龙(1983-),男,河南尉氏人,数学工程与先进计算国家重点实验室讲师,主要研究方向为网络空间安全和机器学习。王禹(1984-),男,河北博野人,博士,河南工程学院讲师,主要研究方向为网络空间安全和IPv6。王清贤(1960-),男,河南新乡人,数学工程与先进计算国家重点实验室教授、博士生导师,主要研究方向为网络空间安全和软件分析。
