基于隐式编程规则挖掘的安全缺陷检测及自动修复技术研究

A large number of programming rules are implied in programs. If the programmer ignores or violates security related implicit programming rules, security defects could be caused. In most current implicit programming rules mining approaches, semantic constraints of programs are typically ignored. As a result, the implicit programming rules and corresponding detected defects are not precise enough. At the same time, many automated defects repair methods strongly depend on complete test suites, and the comprehensibility of repair patches is poor. In view of the above problem, this project proposes to mine implicit programming rules for detecting security defects, and automatically confirm and repair defects based on the mined rules. Firstly, security related variables and function calls in programs are localized by static analysis, and the semantic information of the program is introduced to improve the accuracy of mining implicit programming rules; secondly, the implicit programming rules are used to find suspicious security defects, and a target-guided symbolic execution technique is proposed to automatically confirm suspicious defects; finally, based on the implicit programming rules, repair patches are generated for security defects, and the original program are waved with the patches to repair the defects. The results of this project will improve the accuracy of detecting security defects based on mining implicit programming rules, reduce the cost of confirming security defects, and improve the understandability of repair patches.

程序中通常会隐含大量缺少规范文档描述的编程规则，若程序员忽视或违反了安全相关的隐式编程规则，则有可能引发安全缺陷。现有隐式编程规则挖掘方法较少关注程序语义层面的约束信息，导致挖掘到的隐式编程规则和检测到的缺陷不够精确；同时，现有的大部分缺陷自动修复方法存在补丁可理解性较差、对充分测试用例集依赖性较强等问题。针对上述问题，本课题拟对面向安全缺陷检测的隐式编程规则挖掘技术，及基于隐式编程规则的安全缺陷自动确认和修复技术进行研究。首先，通过静态分析聚焦程序中安全相关的变量访问和函数调用，引入程序语义信息提高隐式编程规则挖掘精度；其次，检测违反隐式编程规则的疑似安全缺陷，并通过目标制导的符号执行技术自动对其进行确认；最后，基于隐式编程规则为安全缺陷生成修复补丁，并与原程序进行编织以完成修复。本课题研究成果将有助于提高基于隐式编程规则的安全缺陷检测精度，降低缺陷确认成本，提高修复补丁可理解性。

程序中通常会隐含大量缺少规范文档描述的编程规则，若程序员忽视或违反了隐式编程规则，则有可能引发相关的缺陷。现有的隐式编程规则挖掘方法精度较低，导致检测到的缺陷误报率和漏报率较高，人工核查开销大。为此，本项目提出了基于函数调用序列模式挖掘的缺陷检测方法，基于关联性分析的隐式编程规则自动过滤方法，以及基于多版本程序设计的软件缺陷修复方法，并对安全缺陷预测方法进行了实证研究。首先，利用数据流和控制流等可通过静态分析获取的信息，提出了基于函数调用序列模式挖掘的缺陷检测方法，自动检测程序中违反函数调用序列模式的疑似缺陷，并报告可疑度较高的缺陷。然后，针对候选隐式编程规则和疑似缺陷的数量都非常巨大，将带来大量人工验证开销的问题，提出了一种基于关联性分析的隐式编程规则自动过滤方法，分析隐式编程规则的组成元素之间的关联性，以进行自动过滤。第三，针对软件自动修复方法存在修复率偏低，甚至会引入新缺陷的问题，提出了一种基于多版本程序设计的软件缺陷修复方法，生成多个修复版程序，并对其适应度进行评分，将其中适应度值较高的修复版程序作为候选版修复程序并行运行，程序运行时通过多数决机制投票输出，以提高缺陷程序的修复率。此外，由于基于隐式编程规则挖掘检测到的缺陷误报率较高，缺陷预测对软件存在缺陷的倾向性和数量有一定的指导作用，还对代价感知的安全缺陷预测方法进行了实证研究，取得了初步研究结果。总体上，项目取得了符合预期的成果。