The vulnerability based on deserialization is a code defect that does great harm but is not easy to be detected by the machine. This vulnerability requires a combination of multiple trigger functions. Once a complete ...
详细信息
ISBN:
(数字)9781665458641
ISBN:
(纸本)9781665458641
The vulnerability based on deserialization is a code defect that does great harm but is not easy to be detected by the machine. This vulnerability requires a combination of multiple trigger functions. Once a complete utilizationchain is formed, arbitrary file reading and even remote command execution can be achieved. In this scheme, the maliciouscode generates an abstract syntax tree through syntax analysis, takes the class name and member method name as the root node and intermediate node, uses keyword regular matching as the basis for identifying the main functions of member methods, and takes the main functions of member methods as leaf nodes. Finally, the code audit problem is transformed into the path traversal problem of the spanning tree. Through the spanning tree traversal algorithm, the automatic detection of maliciouscode is realized, and the efficiency and accuracy of code audit are improved.
暂无评论