Software vulnerability analysis method and device

1. A software vulnerability analysis method in an analysis device, comprising:

searching a code clone corresponding to a used source code from any analysis target source code;

detecting a security sink and sensitive data of the security sink on the basis of patch information in the searched code clone after the searching;

acquiring a source code which is from a user input point to the security sink by backwardly tracing the sensitive data detected in the analysis target source code after the detecting; and

verifying whether the searched code clone is a vulnerability in the analysis target source code by performing a concolic testing on the basis of a path from the user input point to the security sink after the acquiring a source code;

wherein the searching a code clone comprises:

normalizing each of the analysis target source code and an original source code of the analysis target source code;

tokenizing the normalized analysis target source code and the normalized original source code into source code lines, respectively;

constructing multiple unit source codes by grouping the tokenized analysis target source code by a predetermined number of lines of source codes in sequence after the tokenizing; and

determining a predetermined unit source code including the tokenized original source code among the multiple unit source codes as a unit source code including the code clone after the constructing multiple unit source codes.

2. The software vulnerability analysis method of claim 1 , wherein the determining is performed using a bloom filter.

3. The software vulnerability analysis method of claim 1 , wherein the searching is performed by comparing the analysis target source code with an original source code of the analysis target source code.

4. The software vulnerability analysis method of claim 1 , wherein the searching is performed using the patch information.

5. The software vulnerability analysis method of claim 1 , wherein the acquiring a source code is performed by backwardly tracing the detected sensitive data on the basis of a code structure graph.

6. The software vulnerability analysis method of claim 1 , wherein the verifying comprises:

acquiring a result of the concolic testing by inputting any initial value to the input point; and

determining whether the result of the concolic testing acquired in the acquiring a result of the concolic testing satisfies a predefined security requirement to operate a statement of the analysis target source code as a significant operation command.

7. The software vulnerability analysis method of claim 6 , wherein the security requirement is relevant to at least one of predetermined function parameters, memory access, and integer arithmetic.

8. A software vulnerability analysis device comprising: a memory in which a program for conducting vulnerability analysis on any analysis target source code is stored; and a processor configured to execute the program, wherein when the program is executed, the processor searches a code clone corresponding to a used source code from the analysis target source code, detects a security sink and sensitive data of the security sink on the basis of patch information in the searched code clone, acquires a source code which is from a user input point to the security sink by backwardly tracing the sensitive data detected in the analysis target source code, and verifies whether the searched code clone is a vulnerability in the analysis target source code by performing a concolic testing on the basis of a path from the user input point to the security sink; wherein the processor searches the code clone by normalizing each of the analysis target source code and an original source code of the analysis target source code, tokenizing the normalized analysis target source code and the normalized original source code into source code lines, respectively, constructing multiple unit source codes by grouping the tokenized analysis target source code by a predetermined number of lines of source codes in sequence after the tokenizing; and determining a predetermined unit source code including the tokenized original source code among the multiple unit source codes as a unit source code including the code clone after the constructing multiple unit source codes.

9. The software vulnerability analysis device of claim 8 , wherein the processor searches the code clone using a bloom filter.

10. The software vulnerability analysis device of claim 8 , further comprising:

a display device,

wherein the processor displays a result of verifying whether the searched code clone is a vulnerability on the display device.