| 摘要: |
| 在DevOps 持续集成实践中, Web 应用的高频代码迭代对传统静态分析工具提出了严峻挑战: 全量扫描模式导致计算资源浪费与分析延迟, 而现有增量分析技术因缺失对多样化漏洞检测能力, 且精度、效率与一致性间存在矛盾, 难以满足实际需求. 对此, 提出一种面向Web 应用漏洞检测的增量静态分析框架AWTaint. 该框架具备域敏感、上下文敏感与流敏感能力, 其利用函数摘要表征输入输出变量之间的映射关系, 产出与各类检测规则相关的污点传播信息. 该框架采用一种细粒度的增量计算方法, 首先利用调用图估算保守的增量变化范围, 其次利用函数摘要变化感知具体影响范围. 从而有效满足工业级Web应用漏洞检测对分析精度、计算效率与结果一致性的3项核心要求. 实验表明, 在包含10 个真实Java Web应用的测试集上, AWTaint可以支持多种Web应用漏洞检测需求, 其增量分析模式相较全量分析模式平均加速3.63 倍, 内存峰值控制在8 GB以内, 且漏洞检测具有完全一致性. 该框架为安全左移实践提供了工程化解决方案, 在保障检测精度的前提下, 显著优化了资源利用率与开发迭代效率. |
| 关键词: 静态分析 污点分析 增量分析 函数摘要 Web 应用安全 |
| DOI：10.13328/j.cnki.jos.007600 |
| 分类号:TP311 |
| 基金项目: |
|
| AWTaint: Incremental Static Analysis Framework for Vulnerability Detection in Web Applications |
|
LUO Tian-Han1, XIAO Qing1, DAI Jia-Run2, TAN Jie1
|
|
1.Hangzhou Orange Shield Information Technology Co. Ltd., Hangzhou 311121, China;2.School of Computer Science and Technology, Fudan University, Shanghai 200437, China
|
| Abstract: |
| In DevOps continuous integration practices, the high-frequency code iteration of Web applications poses significant challenges to traditional static analysis tools: full analysis techniques cause computational resource waste and delays, while existing incremental analysis techniques struggle to meet practical requirements due to limitations in detecting diverse vulnerabilities and inherent trade-offs between accuracy, efficiency, and consistency. To address these challenges, this study proposes AWTaint, an incremental static analysis framework for Web application vulnerability detection. The framework features field-, context-, and flow-sensitivity, leveraging function summaries to characterize relationships between input and output variables, generating taint propagation information associated with various detection rules. A fine-grained incremental computation approach is adopted in this framework: first, a conservative incremental change scope is estimated through call graph analysis, and then function summary changes are utilized to determine impact ranges. This effectively satisfies the three core requirements of industrial Web application vulnerability detection: precision, efficiency, and consistency. Experimental results on a dataset containing 10 real-world Java Web applications demonstrate that AWTaint supports multiple Web application vulnerability detection requirements. Compared to full analysis, its incremental analysis achieves an average speedup of 3.63×, with memory peak kept within 8 GB, while maintaining complete consistency in vulnerability detection results. This framework provides an engineering solution for shift-left security practices, significantly optimizing resource utilization and development iteration efficiency without compromising detection accuracy. |
| Key words: static analysis taint analysis incremental analysis function summary Web application security |
