基于程序分析与测试的二进制软件漏洞挖掘技术研究

As software size increases and functionality increases, software vulnerabilities are unavoidable and bring serious threats and tests to to the reliability and security of information systems.Against the low efficiency of current software vulnerabilities detection and the limited types of software vulnerabilities detected, this project studies a vulnerability detection method combined with program analysis and testing. Based on the translation of binary code to LLVM IR intermediate code, it first uses data flow analysis and abstract interpretation to locate the suspicious vulnerability on intermediate code; and then backward slices the intermediate code based on suspicious vulnerabilities, deletes the code which are not related to the suspicious vulnerability points to reduce the pressure of symbolic execution and fuzzing test; finally, the backward symbolic execution based on call graph and the vulnerability guided fuzzing test are used to verify the suspicious vulnerabilities. The research results of this project will enrich the theory and method of vulnerabilities detection, improve the efficiency of vulnerabilities detection and promote the security of cyberspace.

随着软件规模增大和功能增多，软件存在安全漏洞不可避免，给信息系统的可靠性和安全性带来严峻的威胁和考验。针对当前软件漏洞挖掘效率低，可挖掘的漏洞种类有限等问题，本项目研究一种程序分析与测试相结合的漏洞挖掘方法。在将二进制代码转换为LLVM IR中间代码的基础上，首先利用数据流分析和抽象解释在中间代码上对可疑漏洞进行初定位；然后在中间代码上根据可疑漏洞进行后向切片，删除与可疑漏洞点不相关的代码，减轻符号执行和模糊测试的压力；最后，利用基于调用图的逆向符号执行方法和漏洞导向的模糊测试方法对可疑漏洞进行验证。本项目的研究成果将丰富漏洞挖掘的理论和方法，提升漏洞挖掘效率，促进网络空间安全。

针对当前软件漏洞挖掘面对的主要问题，项目把程序分析与测试相结合，取长补短，提高漏洞挖掘的效率。项目从基于数据流分析和抽象解释的静态漏洞挖掘方法、面向漏洞的程序切片技术、基于调用图的逆向符号执行和基于漏洞导向的模糊测试技术等方面开展研究。通过研究给出了基于数据流分析的UAF和DF漏洞检测算法，用于漏洞的初定位；通过研究面向漏洞的程序切片技术，发现其能不同程度的减少漏洞不相关代码，减轻程序测试的压力；基于调用图的逆向符号执行技术可以利用较小的计算量排除误报的漏洞；通过研究漏洞导向的模糊测试技术，给出了漏洞导向模糊测试的算法和实现思路，验证了其有效性。