In accordance with regulations and requirements, the editorial department's website domain has been changed to arocmag.cn. The original domain (arocmag.com) has been redirecting to new domain since Jan. 1st, 2025.
See More
Software Technology Research
|
App. Res. of Comp. Printed Article
Vol. 40, 2023 No. 11
3377-3381,3393

Intermediate language representation for vulnerability detection

Zhang Guodong1
Liu Zilong1
Jin Zhuo1
Yao Tianyu1
Qin Jiawei2
Sun Donghong3
1. School of Computer Science, Shenyang Aerospace University, Shenyang 110136, China
2. National Computer Network Emergency Response Technical Team/Coordination Center of China, Beijing 100029, China
3. Institute for Network Sciences & Cyberspace, Tsinghua University, Beijing 100084, China
DOI: 10.19734/j.issn.1001-3695.2023.03.0119

Abstract

The intermediate language adopted in existing Web vulnerability detection methods is designed for a specific programming language. However, when abstracting a vulnerability from the source code of multiple programming languages, a unified intermediate language cannot represent the same type of vulnerability in multiple languages, which increases the difficulty of subsequent vulnerability analysis. To deal with this problem, this paper proposed an intermediate language based on taint analysis to realize the unified abstract representation of the same type of vulnerability information in multiple programming languages. In the design process of the intermediate language, it firstly abstracted the process of vulnerability as a triple representation, and the code elements related to the triple were abstracted as the keywords of the intermediate language. Secondly, it designed the syntax of the intermediate language according to the semantic relationship between the triples. Thirdly, it utilized the taint analysis method to trace the execution path of the taint source when escaping, and the intermediate language representation could be obtained by escaping the source code in the path. Finally, it applied the intermediate language to the vulnerability detection model. The experimental results show that compared with the other intermediate languages' abstract representation of vulnerability information in programming languages, the proposed intermediate language is more universal and more effective for vulnerability detection.

Foundation Support

航空科学基金资助项目(2019ZE054009)
辽宁省自然科学基金资助项目(2020-MS-239,2019-ZD-0234)
辽宁省教育厅科技基金资助项目(LJKZ0210,JYT19053,JYT19040)

Publish Information

DOI: 10.19734/j.issn.1001-3695.2023.03.0119
Publish at: Application Research of Computers Printed Article, Vol. 40, 2023 No. 11
Section: Software Technology Research
Pages: 3377-3381,3393
Serial Number: 1001-3695(2023)11-027-3377-05

Publish History

[2023-07-05] Accepted Paper
[2023-11-05] Printed Article

Cite This Article

张国栋, 刘子龙, 靳卓, 等. 用于漏洞检测的中间语言表示方法 [J]. 计算机应用研究, 2023, 40 (11): 3377-3381,3393. (Zhang Guodong, Liu Zilong, Jin Zhuo, et al. Intermediate language representation for vulnerability detection [J]. Application Research of Computers, 2023, 40 (11): 3377-3381,3393. )

About the Journal

  • Application Research of Computers Monthly Journal
  • Journal ID ISSN 1001-3695
    CN  51-1196/TP

Application Research of Computers, founded in 1984, is an academic journal of computing technology sponsored by Sichuan Institute of Computer Sciences under the Science and Technology Department of Sichuan Province.

Aiming at the urgently needed cutting-edge technology in this discipline, Application Research of Computers reflects the mainstream technology, hot technology and the latest development trend of computer application research at home and abroad in a timely manner. The main contents of the journal include high-level academic papers in this discipline, the latest scientific research results and major application results. The contents of the columns involve new theories of computer discipline, basic computer theory, algorithm theory research, algorithm design and analysis, blockchain technology, system software and software engineering technology, pattern recognition and artificial intelligence, architecture, advanced computing, parallel processing, database technology, computer network and communication technology, information security technology, computer image graphics and its latest hot application technology.

Application Research of Computers has many high-level readers and authors, and its readers are mainly senior and middle-level researchers and engineers engaged in the field of computer science, as well as teachers and students majoring in computer science and related majors in colleges and universities. Over the years, the total citation frequency and Web download rate of Application Research of Computers have been ranked among the top of similar academic journals in this discipline, and the academic papers published are highly popular among the readers for their novelty, academics, foresight, orientation and practicality.

Indexed & Evaluation

  • The Second National Periodical Award 100 Key Journals
  • Double Effect Journal of China Journal Formation
  • the Core Journal of China (Peking University 2023 Edition)
  • the Core Journal for Science
  • Chinese Science Citation Database (CSCD) Source Journals
  • RCCSE Chinese Core Academic Journals
  • Journal of China Computer Federation
  • 2020-2022 The World Journal Clout Index (WJCI) Report of Scientific and Technological Periodicals
  • Full-text Source Journal of China Science and Technology Periodicals Database
  • Source Journal of China Academic Journals Comprehensive Evaluation Database
  • Source Journals of China Academic Journals (CD-ROM Version), China Journal Network
  • 2017-2019 China Outstanding Academic Journals with International Influence (Natural Science and Engineering Technology)
  • Source Journal of Top Academic Papers (F5000) Program of China's Excellent Science and Technology Journals
  • Source Journal of China Engineering Technology Electronic Information Network and Electronic Technology Literature Database
  • Source Journal of British Science Digest (INSPEC)
  • Japan Science and Technology Agency (JST) Source Journal
  • Russian Journal of Abstracts (AJ, VINITI) Source Journals
  • Full-text Journal of EBSCO, USA
  • Cambridge Scientific Abstracts (Natural Sciences) (CSA(NS)) core journals
  • Poland Copernicus Index (IC)
  • Ulrichsweb (USA)