A Cross Language Code Security Audit Framework Based on Normalized Representation

作     者：Yong Chen Chao Xu Jing Selena He Sheng Xiao 

作者机构：School of Information EngineeringNanjing Audit UniversityNanjing211815China Department of Computer ScienceKennesaw State UniversityKennesaw30144-5588USA Information Science and Engineering DepartmentHunan First Normal UniversityChangsha410205China 

出 版 物：《Journal of Quantum Computing》 (量子计算杂志（英文）)

年 卷 期：2022年第4卷第2期

页      面：75-84页

学科分类：08[工学] 0812[工学-计算机科学与技术（可授工学、理学学位）] 

基　　金：This work was supported by the Universities Natural Science Research Project of Jiangsu Province under Grant 20KJB520026 the Natural Science Foundation of Jiangsu Province under Grant BK20180821. 

主　　题：Code security audit normalization cross language security vulnerabilities 

摘      要：With the rapid development of information technology,audit objects and audit itself are more and more inseparable from software.As an important means of software security audit,code security audit will become an important aspect of future audit that cannot be ignored.However,the existing code security audit ismainly based on source code,which is difficult to meet the audit needs of more and more programming languages and binary commercial software.Based on the idea of normalized transformation,this paper constructs a cross language code security audit framework(CLCSA).CLCSA first uses compile/decompile technology to convert different highlevel programming languages and binary codes into normalized representation,and then usesmachine learning technology to build a cross language code security audit model based on normalized representation to evaluate code security and find out possible code security vulnerabilities.Finally,for the discovered vulnerabilities,the heuristic search strategy will be used to find the best repair scheme from the existing normalized representation sample library for automatic repair,which can improve the effectiveness of code security audit.CLCSA realizes the normalized code security audit of different types and levels of code,which provides a strong support for improving the breadth and depth of code security audit.