摘要：

隐式流对于污点分析方法的准确性有重要影响。为此，提出一种基于程序单静态赋值形式的隐式流检测方法。通过生成控制流图的必经节点树检测控制依赖关系，计算必经边界发现程序汇合点，引入虚拟取值函数获得汇合点变量的多个赋值，从而判别变量取值分歧并标记污点属性。与人工审计结果的对比证明，该方法能够诊断2个污点分析工具的污染缺失和污染过度问题，有效降低隐式流分析的误报率和漏报率。

关键词: 污点分析, 隐式流, 显式流, 控制依赖, 单静态赋值, 必经边界

Abstract:

Implicit flow has a major impact on the accuracy of the taint analysis. In this paper, a method for implicit flow detection is proposed, which is based on the Static Single Assignment(SSA) form of program, including detecting control dependencies relationship by generating dominate tree on control flow graph, finding re-convergence point by computing dominance frontier, acquiring values by inserting virtual function at re-convergence point in SSA, and marking the correct taint type of variables. Compared with the manual auditing results, test results show that this method can diagnose the undertainting and overtainting problem of two analysis tools, and reduce false-positive and false-negative rate of implicit flow effectively.

Key words: taint analysis, implicit flow, explicit flow, control dependence, Static Single Assignment(SSA), dominance frontier

中图分类号: 

• TP311