| 摘要: |
| 作为Web应用安全漏洞检测的核心技术之一, 静态应用安全测试 (static application security testing, SAST)具备广泛的业界应用场景. 然而, 现有静态分析工具受限于底层污点分析算法设计, 难以应对现代Web应用中的异步请求模式和多源输入语义等复杂逻辑, 直接影响其漏洞检测性能. 对此, 提出了一种面向Web安全漏洞检测的多数据流静态分析方法, 旨在对传统污点分析算法能力进行多维度扩展, 以提升其检测能力与泛用性: 在纵向维度上, 引入多段数据流分析, 通过关联与迭代算法综合考虑不同控制流路径上的数据依赖关系, 有效支撑需要多次异步调用触发的深层漏洞检测需求; 在横向维度上, 引入多标签数据流分析, 利用污染标签区分不同输入来源, 获取更细致的程序上下文语义信息, 提升与复杂语义相关的漏洞检测精确率. 基于上述方法实现了面向Java/JavaScript Web应用的漏洞检测原型系统MultiFlow, 实验评估结果表明, 在包含60个真实Web应用与第三方组件的数据集中, MultiFlow的多数据流分析方法具备良好的有效性, 在存储型、越权、原型链污染等复杂Web漏洞检测任务上分别取得了87.18%、75.00%与83.72%的精确率, 已获得8个CVE编号; 与现有方法相比, MultiFlow以更少的分析开销实现了更高的漏洞检测准召率, 验证了其实用价值. |
| 关键词: Web应用安全 漏洞检测 静态分析 污点分析 数据流分析 |
| DOI：10.13328/j.cnki.jos.007581 |
| 分类号:TP311 |
| 基金项目: |
|
| Multi-data Flow Static Analysis Method for Vulnerability Detection in Web Applications |
|
MAO Xiang-Yu1, XIAO Qing1, DAI Jia-Run2, HE Jun-Yao1, TAN Jie1
|
|
1.Hangzhou Orange Shield Information Technology Co. Ltd., Hangzhou 311121, China;2.College of Computer Science and Artificial Intelligence, Fudan University, Shanghai 200437, China
|
| Abstract: |
| As a core technology for vulnerability detection in Web applications, static application security testing (SAST) holds widespread industrial applications. However, existing static analysis tools face challenges in handling complex logical structures in modern Web applications, such as asynchronous request patterns and multi-source input semantics, due to limitations in the underlying design of taint analysis algorithms. To this end, this study proposes a multi-data flow static analysis method for security vulnerability detection in Web applications, which is aimed at extending the ability of traditional taint analysis algorithms in multiple dimensions to improve both detection performance and generalization. Vertically, the multi-stage data flow analysis is introduced to comprehensively consider the data dependency across different control flow paths via correlation and iterative algorithms, thereby effectively supporting the detection of deep vulnerabilities that require multiple asynchronous calls to be triggered. Horizontally, the multi-tag data flow analysis is introduced to distinguish different input sources via taint tags, thereby obtaining more detailed program context semantic information and enhancing vulnerability detection Precision related to complex semantics. Based on the above-mentioned method, a vulnerability detection prototype system named MultiFlow is developed for Java/JavaScript Web applications. Experimental evaluations demonstrate that MultiFlow’s multi-data flow analysis method features sound effectiveness on a dataset containing 60 real-world Web applications and third-party components, yielding Precision of 87.18%, 75.00%, and 83.72% respectively on complex Web vulnerability detection tasks including stored vulnerabilities, broken access control, and prototype pollution, with eight CVE IDs obtained. Compared with the existing methods, MultiFlow achieves higher Precision and Recall with less analysis overhead, thereby validating its practical significance. |
| Key words: Web application security vulnerability detection static analysis taint analysis data flow analysis |
