软件脆弱性问题中的信息流分析方法研究

项目名称： 软件脆弱性问题中的信息流分析方法研究

项目编号： No.61070208

项目类型： 面上项目

立项/批准年度： 2011

项目学科： 金属学与金属工艺

项目作者： 郭世泽

作者单位： 北京邮电大学

项目金额： 12万元

中文摘要： 信息流分析广泛应用于编译器优化和软件测试技术，近年来成为软件脆弱性问题研究的热点。脆弱性分析的关键是如何触发软件中潜在的各种异常，然而目前针对软件脆弱性问题的信息流分析方法，无论是模糊测试、污点分析，还是符号执行，都普遍存在着分析精度差、效率低、漏报率高的问题，制约了其在软件脆弱性分析中的进一步应用。本课题致力于动态污点分析和符号执行关键技术的研究及核心算法的改进，通过汇编指令语义形式化分析以及中间语言的建立，在动态污点分析中引入控制流分析并与数据流分析有效结合，生成优化的测试用例；在符号执行中采用启发式搜索、学习和函数摘要算法有效遏制路径爆炸；通过信息流分析优化选择算法设计，建立起一种高效、自动的软件脆弱性分析模型，触发传统方式无法发现的软件异常，提高软件脆弱性发现的效率、精度和准确性。

中文关键词： 脆弱性；信息流；动态污点分析；符号执行

英文摘要： The information analysis is well-known and widely used in the area of the compiler optimization and the software testing. In the recent years, it is becoming the hot pot in the aspect of the software vulnerability analysis. The key problem of the software vulnerability analysis is to discover the impled faults of the software.The existed information analysis methods, including the fuzzing, tainting analysis, and symbolic execution, all have some problems such as the deviation of the precision, the inefficiency, and the high rate of missing report when used in softare fault discovery, which restrains the further application of the information analysis. This project will focus on the research of the tainting analysis, the symbolic execution and the improvements of the key algorithms. First of all, we will establish the intermediate language by the means of the formal analysis of the assembly instructions. Then we will combine the control flow and the data flow to generate optimized test cases. To restrain the path explosion, we will apply the heuristic search algorithms, the study and the function digest algorithms to the symbolic execution. We will establish an efficient and automatic software vulnerability analysis model by the way of the design of the optimization selection algorithm of the information analysis, which can trigger the software faults and improve the efficiency, precision and accuracy of the software fault discovery. The project also gives the design proposal of the prototype system.

英文关键词： vulnerability; information flow; tainting analysis; symbolic execution