摘要
大多数行业定制软件漏洞检测困难,而传统的静态漏洞检测方法不但报告很多错误的和虚假的信息,同时针对面向对象的函数(方法)检测并未提及.针对函数调用前后存在的漏洞问题,首先用XML文法来表示出面向对象情况下,对象存在继承关系时,从祖先类搜索开始,建立函数调用前后安全契约规则,利用基于上下文无关的自顶向下与自底向上相结合的语法解析树的方法,解析函数的调用是否违反了安全契约规则并报告漏洞的内容.实验表明,与同类型安全分析工具比较,具有避免函数重复分析、规则的可扩展性良好、准确率高等优点.
Most of Custom software vulnerability detection is difficult. Lots of static vulnerability detection ap- proaches usually not only give many inaccurate information and false results, but also can＇ t deal with code on object - oriented language. Extending the rules of XML grammar, the searching process will be done from top an- cestor class on XML tree with object - oriented. The pre - condition and post - condition are built with objects which belong to inheritance relationship＇ s class. A new parsing algorithm is established by combining top - down and bottom - up method in a parsing tree to check whether the parse result breaks the safety rules of contract and to report the contents of the vulnerability. The experiments show that, compared with the same code analysis tools, this method has the advantage nf n. t;r; 1..~＇~
出处
《昆明理工大学学报（自然科学版）》
CAS
北大核心
2013年第3期56-61,共6页
Journal of Kunming University of Science and Technology(Natural Science)
基金
国家自然科学基金(11103005)
关键词
契约规则
面向对象
解析树
contract condition
object - oriented language
parse tree
