一种面向Trace与漏洞验证的污点分析方法

doi:10.19678/j.issn.1000-3428.0055290

计算机工程 ›› 2020, Vol. 46 ›› Issue (5): 157-166. doi: 10.19678/j.issn.1000-3428.0055290

一种面向Trace与漏洞验证的污点分析方法

秦彪¹, 郭帆¹, 杨晨霞²

1. 江西师范大学计算机信息工程学院, 南昌 330022;
2. 豫章师范学院计算机系, 南昌 330105

收稿日期:2019-06-24 修回日期:2019-08-22 发布日期:2019-08-20
作者简介:秦彪(1993-),男,硕士研究生,主研方向为信息安全、程序验证;郭帆,副教授、博士;杨晨霞,讲师。
基金资助:
国家自然科学基金（61562040）；江西省教育厅科学技术研究项目（GJJ161305，GJJ151330）。

A Taint Analysis Approach for Trace and Vulnerability Validation

QIN Biao¹, GUO Fan¹, YANG Chenxia²

1. College of Computer Information Engineering, Jiangxi Normal University, Nanchang 330022, China;
2. Department of Computer Science, Yuzhang Normal University, Nanchang 330105, China

Received:2019-06-24 Revised:2019-08-22 Published:2019-08-20

摘要/Abstract

摘要： 静态分析方法被广泛用于Android应用的隐私泄露检测，其以（Source，Sink）对形式检测潜在漏洞，但同时会产生大量虚警。针对该问题，提出一种上下文敏感和域敏感的污点分析方法。对污点传播的操作语义和一致性约束进行形式化定义，保证污点传播的语义正确性，同时分析插桩运行Android应用后产生的Trace片段，验证漏洞是否存在虚警。基于Soot实现原型系统并对DroidBench数据集中的70个应用进行分析，实验结果表明，该方法可成功验证4个虚警并发现8个漏报，表明其能有效判断静态分析结果的正确性。

关键词: 污点分析, 上下文敏感, 域敏感, 污点传播, 形式化定义

Abstract: Static analysis methods are widely used to detect privacy leaks in the Android applications and potential bugs are detected by the form of (Source,Sink),but many false alarms are generated as well.To address the problem,this paper proposes a context-sensitive and field-sensitive taint analysis approach.The operational semantics of taint propagation and the consistent constraints are formally defined to ensure taint propagation to be semantically correct.Trace segments generated after instrumenting and running an Android applications is also analyzed to verify if a potential bug is really true.A prototype system is implemented based on Soot and tested on seventy applications from the DroidBench dataset. Experimental results show that the proposed method can successfully verified four false positives and found eight false negatives,demonstrating that the proposed method is capable of verifying the correctness of static analysis results.

Key words: taint analysis, context sensitivity, field sensitivity, taint propagation, formal definition

中图分类号:

TP311.53

秦彪, 郭帆, 杨晨霞. 一种面向Trace与漏洞验证的污点分析方法[J]. 计算机工程, 2020, 46(5): 157-166.

QIN Biao, GUO Fan, YANG Chenxia. A Taint Analysis Approach for Trace and Vulnerability Validation[J]. Computer Engineering, 2020, 46(5): 157-166.

https://www.ecice06.com/CN/Y2020/V46/I5/157

图/表 14

20200513203715

20200513203719

20200513203723

20200513203727

20200513203730

20200513203734

20200513203738

20200513203744

20200513203748

20200513203754

20200513203757

20200513203801

20200513203806

20200513203810

参考文献

[1] GORDON M I,KIM D,PERKINS J H,et al.Information flow analysis of Android applications in droidsafe[C]//Proceedings of 2015 NDSS Symposium.[S.l.]:Internet Society,2015:1-5.
[2] WANG Lei,LI Feng,LI Lian,et al.Principle and practice of taint analysis[J].Journal of Software,2017,28(4):860-882.(in Chinese)王蕾,李丰,李炼,等.污点分析技术的原理和实践应用[J].软件学报,2017,28(4):860-882.
[3] TRIPP O,PISTOIA M,FINK S J,et al.TAJ:effective taint analysis of Web applications[J].ACM SIGPLAN Notices,2009,44(6):87-97.
[4] LIVSHITS V B,LAM M S.Finding security vulnerabilities in Java applications with static analysis[C]//Proceedings of the 14th USENIX Security Symposium.Baltimore,USA:USENIX,2005:18-19.
[5] HUANG W,DONG Y,MILANOVA A.Type-based taint analysis for Java Web applications[C]//Proceedings of International Conference on Fundamental Approaches to Software Engineering.Berlin,Germany:Springer,2014:140-154.
[6] ARZT S,RASTHOFER S,FRITZ C,et al.FlowDroid:precise context,flow,field,object-sensitive and lifecycle-aware taint analysis for Android apps[J].ACM SIGPLAN Notices,2014,49(6):259-269.
[7] ARZT S,BODDEN E.StubDroid:automatic inference of precise data-flow summaries for the Android framework[C]//Proceedings of the 38th IEEE/ACM International Conference on Software Engineering.Washington D.C.,USA:IEEE Press,2016:725-735.
[8] YANG Shengqian,YAN Dacong,WU Haowei,et al.Static control-flow analysis of user-driven callbacks in Android applications[C]//Proceedings of the 37th IEEE/ACM IEEE International Conference on Software Engineering.Washington D.C.,USA:IEEE Press,2015:89-99.
[9] WEI F,ROY S,OU X.Amandroid:a precise and general inter-component data flow analysis framework for security vetting of Android apps[C]//Proceedings of 2014 ACM SIGSAC Conference on Computer and Communications Security.New York,USA:ACM Press,2014:1329-1341.
[10] RICE H G.Classes of recursively enumerable sets and their decision problems[J].Transactions of the American Mathematical Society,1953,74(2):358-366.
[11] ROGERS H.Theory of recursive functions and effective computability[M].New York,USA:McGraw-Hill,1967.
[12] ZHAO Yunshan,GONG Yunzhan,ZHOU Ao,et al.False positive elimination in static defect detection[J].Journal of Computer Research and Development,2012,49(9):1822-1831.(in Chinese)赵云山,宫云战,周傲,等.静态缺陷检测中的误报消除技术研究[J].计算机研究与发展,2012,49(9):1822-1831.
[13] WANG Lei,ZHOU Qing,HE Dongjie,et al.Multi-source taint analysis technique for privacy leak detection of Android apps[J].Journal of Software,2019,30(2):211-230.(in Chinese)王蕾,周卿,何东杰,等.面向Android应用隐私泄露检测的多源污点分析技术[J].软件学报,2019,30(2):211-230.
[14] LI Xiao,ZHOU Yan,LI Mengchen,et al.Automatically validating static memory leak warnings for C/C++programs[J].Journal of Software,2017,28(4):827-844.(in Chinese)李筱,周严,李孟宸,等.C/C++程序静态内存泄漏警报自动确认方法[J].软件学报,2017,28(4):827-844.
[15] ENCK W,GILBERT P,HAN S,et al.TaintDroid:an information-flow tracking system for realtime privacy monitoring on smartphones[J].ACM Transactions on Computer Systems,2014,57(3):99-106.
[16] TAM K,KHAN S J,FATTORI A,et al.CopperDroid:automatic reconstruction of Android malware behaviors[C]//Proceedings of 2015 NDSS Symposium.[S.l.]:Internet Society,2015:6-10.
[17] PRAVIN M N P.Vetdroid:analysis using permission for vetting undesirable behaviours in Android applications[J].International Journal of Innovative and Emerging Research in Engineering,2015,2(3):131-136.
[18] XU R,SAÏDI H,ANDERSON R.Aurasium:practical policy enforcement for Android applications[C]//Proceedings of the 21st USENIX Security Symposium.Baltimore,USA:USENIX,2012:539-552.
[19] YANG Zhemin,YANG Min,ZHANG Yuan,et al.AppIntent:analyzing sensitive data transmission in Android for privacy leakage detection[C]//Proceedings of 2013 ACM SIGSAC Conference on Computer and Communications Security.New York,USA:ACM Press,2013:1043-1054.
[20] VALLÉERAI R,CO P,GAGNON E,et al.Soot:a Java bytecode optimization framework[C]//Proceedings of CASCON'10.New York,USA:ACM Press,2010:214-224.
[21] ARZT S.Static data flow Analysis for Android applications[D].Darmstadt,Germany:Technische Universität Darmstadt,2017.

选择文件类型/文献管理软件名称

选择包含的内容

一种面向Trace与漏洞验证的污点分析方法

A Taint Analysis Approach for Trace and Vulnerability Validation

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 14

参考文献

相关文章 13

编辑推荐

Metrics

本文评价

[1]	郑鹏, 沙乐天. 基于混合分析的Java反序列化漏洞检测方法[J]. 计算机工程, 2023, 49(12): 136-145.
[2]	张超, 潘祖烈, 樊靖. 基于符号执行的堆溢出fastbin攻击检测方法[J]. 计算机工程, 2020, 46(10): 151-158.
[3]	张婧,周安民,刘亮,贾鹏,刘露平,贾丽. 基于动态污点分析的栈溢出Crash判定技术[J]. 计算机工程, 2018, 44(4): 168-173,180.
[4]	郭帆,周轩. 基于依赖的J2EE程序污点分析方法[J]. 计算机工程, 2016, 42(6): 131-138.
[5]	史大伟，袁天伟. 一种粗细粒度结合的动态污点分析方法[J]. 计算机工程, 2014, 40(3): 12-17,22.
[6]	邓朝日，张玉萍，陈雄，梁辰. 上下文敏感的纵向传播算法[J]. 计算机工程, 2014, 40(2): 62-66.
[7]	陈立根,刘胜利,肖达,彭飞. 一种Cisco IOS启发式模糊测试方法[J]. 计算机工程, 2014, 40(12): 68-73.
[8]	刘杰, 王嘉捷, 欧阳永基, 王清贤. 基于污点指针的二进制代码缺陷检测[J]. 计算机工程, 2012, 38(24): 46-49.
[9]	刘杰, 张普含, 尹中旭, 宋晓龙. 污点分析中的隐式污染检测方法[J]. 计算机工程, 2012, 38(23): 28-32.
[10]	仇丽青, 李伟明. 上下文敏感的多文档自动摘要生成方法[J]. 计算机工程, 2010, 36(21): 265-266,269.
[11]	顾勋梅, 虞慧群. 功能点分析方法的一种形式化定义[J]. 计算机工程, 2010, 36(14): 10-12.
[12]	陈建敏;舒辉;熊小兵. 基于符号化执行的Fuzzing测试方法[J]. 计算机工程, 2009, 35(21): 33-35.
[13]	邢娜;金蓓弘. 服务自适应模型及其应用[J]. 计算机工程, 2007, 33(08): 30-32.

模态框（Modal）标题

选择文件类型/文献管理软件名称

选择包含的内容

一种面向Trace与漏洞验证的污点分析方法

A Taint Analysis Approach for Trace and Vulnerability Validation

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 14

参考文献

相关文章 13

编辑推荐

Metrics

本文评价