摘要
小程序模板在开发过程中被广泛使用,但其固有的安全漏洞导致大量模板小程序面临安全风险.由于小程序模板代码闭源且使用情况不透明,现有方法难以对小程序模板固有漏洞以及衍生的小程序漏洞进行挖掘.为此,本文提出了一种面向小程序模板的融合多阶段聚类分析和模板行为分析的漏洞挖掘方法.该方法通过提取代码特征汇总相同模板开发的小程序,采用基于图匹配的启发式方法来识别相似的程序行为,即模板行为,以此构建小程序模板过程间控制流图,从而快速定位并系统性评估模板开发行为导致的小程序漏洞及其扩散现象.基于该方法本文实现了一个面向小程序模板的漏洞挖掘工具MTVMiner,从小程序集中提取出11489套小程序模板过程间控制流图,准确率达93.35%,并将其用于密钥泄漏漏洞检测,检出690套存在密钥泄漏漏洞的模板,影响超2万个小程序.
Mini-program templates are widely used in the development,but their inherent vulnerabilities expose a large number of mini-programs to security risks.Due to the closed-source nature of mini-program template code and the lack of transparency in their usage,existing methods struggle to detect both the inherent vulnerabilities in the templates and the derived vulnerabilities in mini-programs.To address this,this paper proposes a vulnerability mining method for mini-program templates,which combines multi-stage clustering analysis and template behavior analysis.This method extracts code features to group mini-programs developed by same template,and uses a graph-matching-based heuristic approach to identify similar program behaviors,i.e.,template behaviors for constructing an inter-procedural control flow graph of mini-program templates.By analyzing inter-procedural control flow graph of templates,this method can quickly locate and systematically evaluates mini-program vulnerabilities and their spread caused by template development.Based on this method,we have implemented a vulnerability mining tool called MTVMiner for mini-program template,which extracts 11489 inter-process control flow graphs from collection of mini-programs with an accuracy rate of 93.35%.MTVMiner has been used for key leakage vulnerability detection,identifying 690 templates with key leakage vulnerabilities,affecting over 20000 mini-programs.
作者
杨雲腾
史一哲
杨哲慜
YANG Yunteng;SHI Yizhe;YANG Zhemin(System and Security Laboratory,School of Computer Science,Fudan University,Shanghai 200433,China)
出处
《小型微型计算机系统》
北大核心
2026年第2期443-450,共8页
Journal of Chinese Computer Systems
基金
国家自然科学基金项目(62172104)资助.
关键词
小程序模板
图匹配
数据流分析
漏洞检测
MiniApp template
graph matching
data flow analysis
vulnerability detection
