Detection device, detection method, and detection program
AssigneeNTT, Inc.
InventorsTatsuhiro Aoshima, Toshinori Usui, Yuhei Kawakoya, Makoto Iwamura, Jun Miyoshi
Life of this patent
Estimating the term…
Abstract
An unsafe location enumeration unit (131) enumerates, based on a code of a program, locations that do not satisfy a predetermined condition indicating that type conversion is safe among locations where a type casting occurs in the program. A context extraction unit (132) transition an automaton corresponding to the locations enumerated by the unsafe location enumeration unit (131) and extract a context reaching the locations. A vulnerability verification unit (133) verifies whether the location extracted by the context extraction unit (132) satisfies an annotation prepared in advance.
Claims20
A detection device comprising a processor configured to execute operations comprising:
- enumerating, based on a code of a program, a plurality of locations in the code of the program, wherein the plurality of locations does not satisfy a predetermined condition, and the predetermined condition indicates that type conversion is safe at the plurality of locations where a type casting occurs in the program;
- transitioning an automaton corresponding to the plurality of locations, wherein the automaton further includes a first sub automaton specifying a variable included in a conditional expression and a second sub automaton that indicates a structure of the conditional expression;
- extracting a context reaching the plurality of location and updates the automaton;
- verifying whether a location of the plurality of locations satisfies a predetermined annotation;
- and
- transmitting a result of verifying to an application configured to display the result of verifying the code of the program, wherein the result of verifying describes a type confusion vulnerability of the code of the program.
A detection method, comprising:
- enumerating, based on a code of a program, a plurality of locations in the code of the program, wherein the plurality of locations does not satisfy a predetermined condition, and the predetermined condition indicates that type conversion is safe at the location where a type casting occurs in the program;
- transitioning an automaton corresponding to the plurality of locations, wherein the automaton further includes a first sub automaton specifying a variable included in a conditional expression and a second sub automaton that indicates a structure of the conditional expression;
- extracting a context reaching the plurality of locations and updates the automaton;
- verifying whether a location of the locations satisfies a predetermined annotation;
- and
- transmitting a result of verifying to an application configured to display the result of verifying the code of the program, wherein the result of verifying describes a type confusion vulnerability of the code of the program.
A computer-readable non-transitory recording medium storing computer-executable program instructions that when executed by a processor cause a computer to execute operations comprising:
- enumerating, based on a code of a program, a plurality of locations in the code of the program, wherein the plurality of locations does not satisfy a predetermined condition, and the predetermined condition indicates that type conversion is safe at the plurality of locations where a type casting occurs in the program;
- transitioning an automaton corresponding to the plurality of locations, wherein the automaton further includes a first sub automaton specifying a variable included in a conditional expression and a second sub automaton that indicates a structure of the conditional expression;
- extracting a context reaching the plurality of location and updates the automaton;
- and
- verifying whether a location of the plurality of locations satisfies a predetermined annotation;
- and
- transmitting a result of verifying to an application configured to display the result of verifying the code of the program, wherein the result of verifying describes a type confusion vulnerability of the code of the program.
Dependencies are inferred from the claim text.