【作者】 张若愚；

【导师】 戚正伟；

【作者基本信息】 上海交通大学 ， 软件工程， 2010， 硕士

【摘要】 随着计算机技术高速普及和发展,大量的计算机应用正在越来越深入地影响着人们的工作生活,也带来了日益严重和广泛的安全问题及隐患。这些年来对于程序分析技术的研究方兴未艾,目前已经存在许多工具能够通过对目标代码的分析,对其中可能引发安全问题的设计缺陷进行识别和保护。大多数的此类工具是通过动态软件测试技术或是静态的程序分析技术来达到目的。其中前者虽然具有较高的准确率但是每个用例只能覆盖有限的代码,一次很难提供较为完备的分析结果。而后者虽然能够覆盖所有代码,但在准确率上有所欠缺,存在大量的误报情况。针对目前同类技术的缺陷,本文通过综合静态以及动态程序分析各自的特性,提出了一种新方法,做到了既能覆盖绝大多数的程序中路径,也在准确性上超越了传统的静态分析。论文中实现了一个静态程序分析辅助的动态污染传播跟踪机制,在传统的污染跟踪过程中,同时进行函数级的静态代码的控制流图补全,并以路径为单位实施静态的污染传播分析,以达到动静结合的分析效果。本文的研究主要包含了如下贡献和具体工作:1)提出了一种新颖的结合动态与静态程序分析的方法,综合两者的优点,对其缺点进行互补,达到代码覆盖率,准确率和效率的提高。2)基于前面提出的动静态分析结合方法,本毕业论文实现了一个软件漏洞挖掘工具SDCF。该系统针对二进制代码,在动态污染行为分析的同时,对并未得到执行的指令也实施静态的控制流信息补全和污染相关分析。3)文章提出了一种基于API过滤的效率优化机制,通过对一些行为可以预测的系统调用的污染相关行为的规约,简化整个污染分析过程。实验表明通过静态程序分析辅助的动态污染跟踪机制,SDCF在仅仅引入4.16倍的运行时负荷的情况下,不但能够对目标程序实施基于动态污染跟踪的运行时保护,也能够在某些软件漏洞被恶意用户利用之前实施挖掘,其分析的平均代码覆盖率达到90%以上。更多还原

【Abstract】 With the evolution and prevalence of the computer science, increasing amount of computer applications have influenced our lives in the recent years, and exposed us to the growing gravity of the security problems and threats. The researches on this field has drawn much attention, and there already exist many program analyzing tools which are able to identify the suspicious code and provide protection in the software by applying related analysis on the code. Many of these tools are designed with the technique of program testing which is part of the dynamic analysis, or static program analysis. Program testing is very accurate but each test case can only cover little code of the program, thus difficult to provide complete results. On the other hand, the static approach is able to cover all the code of the target program, but it will generate a lot of false positive.This essay proposes a novel program analysis to combine the two methods based on their characteristics. My approach achieves a goal of high code coverage of the target program and exceeds the traditional static program analysis in accuracy. I realize a mechanism which contains a major procedure of dynamic taint analysis and provides additional information to it by static methods. During the taint tracking, the system apply control flow graph (CFG) competition in the level of function, and implement static taint analysis based on the paths in the control flow graph to combine the technique of static and dynamic program analysis.The research contained in this paper includes contributions and efforts listed as follow: 1) A novel approach to integrate the dynamic and static program analysis to make the best use of the strong points of them while counteracting their weak points. 2) Based on the method proposed in the previous description, the paper implements a software vulnerability discovery system SDCF, which is developed to process the binary code. The system performs static analysis during the dynamic taint tracing procedure. 3) The paper presents an API filter to optimize the system. By formalizing the tainting related behavior of the system functions, this module is able to reduce the time cost of SDCF.The experiments show that SDCF is not only able to provide efficient runtime protection by introducing an overhead of 4.16x based on the taint tracing technique, but also capable to discover latent software vulnerabilities which has not been exploited, and achieve the code coverage of more than 90%.更多还原