检测加密软件代码中的漏洞同时确保代码隐私
Detecting Vulnerabilities in Encrypted Software Code while Ensuring Code Privacy
AI总结：
提出结合静态分析与可搜索对称加密（SSE）的CoCoA工具，在保护代码隐私的前提下对加密源代码进行漏洞检测，实现了93%的精度和42.7%的适度开销。
摘要：
软件漏洞仍然是网络攻击的主要原因。在攻击者访问并利用应用程序源代码中的漏洞之前，识别这些漏洞至关重要。开发人员使用静态分析工具（SAT）来查找未受保护应用程序代码中的漏洞，软件测试公司也开始提供软件代码分析服务以协助开发人员进行这些发现。此类服务需要访问未受保护的代码，这引发了对其隐私和知识产权盗窃的担忧。如果攻击者能够访问代码，他们也可以使用类似工具执行此分析。因此，拥有一个能够通过加密技术保护代码隐私，同时仍允许授权人员检测加密代码中漏洞的系统是有益的。本文提出了这样一个解决方案，一种新颖的软件质量和隐私方法，允许以受保护的方式分析源代码，保护其隐私。所提出的解决方案将静态分析与可搜索对称加密（SSE）相结合，用于机密漏洞检测，支持对加密源代码进行数据流分析的数据和依赖跟踪。该解决方案将代码的数据流和控制流表示为加密倒排索引，以连接的方式使得SSE的查询能够发现漏洞。该解决方案已作为CoCoA工具实现，并使用合成和真实的PHP Web应用程序进行了评估。结果表明，CoCoA在实际应用中具有与（非机密）SAT相似的精度——93%，处理4k行代码仅需209毫秒——与非机密基线相比，开销适中，为42.7%。本文还定义了一个新的研究领域——机密代码分析——其他类型的代码分析任务可以由此衍生。
英文摘要：
Software vulnerabilities continue to be the primary cause of cyberattacks. It is crucial to identify vulnerabilities in applications' source code before attackers gain access to them and exploit any vulnerability they may contain. Developers have used static analysis tools (SATs) to find vulnerabilities in unprotected application code, and software testing companies have started offering software code analysis as a service to assist developers in these findings. Such services require access to unprotected code, which raises concerns about its privacy and intellectual property theft. Attackers can also perform this analysis using similar tools, if they gain access to the code. It is, therefore, beneficial to have a system that can maintain code privacy by protecting it with cryptographic techniques, while still allowing authorised people to detect vulnerabilities in the encrypted code. This paper presents such a solution, a novel approach to Software Quality and Privacy that allows source code to be analysed in a protected manner, preserving its privacy. The proposed solution combines Static Analysis with Searchable Symmetric Encryption (SSE) for confidential vulnerability detection, enabling data and dependency tracking for data flow analysis over encrypted source code. The solution represents the code's data and control flows as an Encrypted Inverted Index, in a connected way that enables SSE's queries for vulnerability discovery. The solution was implemented as the CoCoA tool and evaluated with synthetic and real PHP web applications. Results show that CoCoA has similar precision as (non-confidential) SATs - 93% - with real applications, requiring only 209 ms to process 4k LoC - a modest overhead of 42.7% compared to a non-confidential baseline. This paper also defines a new research field - Confidential Code Analysis -, from which other types of code analysis tasks can be derived.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
