WO2025191784A1 - Program, processing device, and method - Google Patents

Abstract

A processing device according to the present disclosure comprises: a first specification unit that specifies a prescribed system call instruction or a prescribed function in a call flow which is included in target software and which includes the start and end point functions of the call flow and has a plurality of functions having a call relationship; a second specification unit that specifies an importance score corresponding to the type of the specified prescribed system call instruction or prescribed function on the basis of a correspondence relationship between a plurality of types of the system call instruction or the function and an importance score corresponding to each type; an assignment unit that assigns the specified importance score to each function included in the call flow; and an output unit that outputs call flow information relating to each function included in the call flow and the importance score assigned to each function.

Description

Program, processing device, and method

This disclosure relates to a program, a processing device, and a method.

Patent Document 1 discloses a technology that performs static analysis on binary code (i.e., the software being inspected), extracts the functions, system calls, and API calls that are called, as well as the argument values and conditions at the time of the calls, compares the extracted information with the contents of specifications, etc., and detects malicious code based on the comparison results.

JP 2009-98851 A

However, the technology disclosed in Patent Document 1 treats all call flows included in the software being inspected equally, which can lead to inefficient inspection processing. A "call flow" refers to a flow that includes multiple functions with a call relationship.

An object of the present disclosure is to provide a program, processing device, and method that can realize efficient inspection processing. It should be noted that this object is merely one of several objects that the embodiments disclosed in this specification aim to achieve. Other objects or objectives and novel features will become apparent from the description of this specification or the accompanying drawings.

The program disclosed herein causes a processing device to execute processing including: identifying a specific system call command or a specific function in a call flow that includes a start function and an end function of the call flow included in the target software and has multiple functions that have a call relationship; identifying an importance score corresponding to the identified type of specific system call command or function based on the correspondence between multiple types of system call commands or functions and the importance scores corresponding to each type; assigning the identified importance score to each function included in the call flow; and outputting call flow information related to each function included in the call flow and the importance scores assigned to each function.

The processing device disclosed herein comprises: a first identification unit that identifies a specific system call command or a specific function in a call flow that includes a start function and an end function of the call flow included in the target software and has multiple functions that have a call relationship; a second identification unit that identifies an importance score corresponding to the identified specific system call command or type of function based on the correspondence between multiple types of system call commands or functions and the importance scores corresponding to each type; an assignment unit that assigns the identified importance score to each function included in the call flow; and an output unit that outputs call flow information regarding each function included in the call flow and the importance scores assigned to each function.

The method disclosed herein includes identifying a specific system call command or a specific function in a call flow that includes a start function and an end function of the call flow included in the target software and has multiple functions that have a call relationship; identifying an importance score corresponding to the identified type of specific system call command or function based on the correspondence between multiple types of system call commands or functions and the importance scores corresponding to each type; assigning the identified importance score to each function included in the call flow; and outputting call flow information related to each function included in the call flow and the importance score assigned to each function.

This disclosure provides a program, processing device, and method that can achieve efficient inspection processing.

FIG. 1 is a block diagram illustrating an example of a processing device of the present disclosure. 10 is a flowchart illustrating an example of a processing operation of the processing device of the present disclosure. FIG. 2 is a diagram illustrating an example of a processing operation of the processing device of the present disclosure. FIG. 10 is a block diagram illustrating another example of a processing device according to the present disclosure. 10 is a flowchart illustrating another example of the processing operation of the processing device of the present disclosure. FIG. 10 is a diagram illustrating another example of the processing operation of the processing device of the present disclosure. FIG. 10 is a block diagram illustrating another example of a processing device according to the present disclosure. 10 is a flowchart illustrating another example of the processing operation of the processing device of the present disclosure. FIG. 10 is a diagram illustrating another example of the processing operation of the processing device of the present disclosure. FIG. 10 is a diagram illustrating another example of the processing operation of the processing device of the present disclosure. FIG. 10 is a diagram illustrating an example of call flow information. FIG. 10 is a diagram illustrating an example of call flow information. FIG. 10 is a diagram illustrating an example of call flow information. 1 is a block diagram illustrating an example of a software inspection device according to the present disclosure. 10 is a flowchart illustrating another example of the processing operation of the processing device of the present disclosure. FIG. 2 illustrates an example of the configuration of a processing device. FIG. 1 illustrates an example of the configuration of a software inspection device.

Embodiments will be described below with reference to the drawings. Note that in this disclosure, the drawings may relate to one or more embodiments. Furthermore, each element in the drawings may apply to one or more embodiments. Furthermore, in the embodiments, identical or equivalent elements are given the same reference numerals, and redundant explanations will be omitted.

First Embodiment
<Configuration example of processing device>
1 is a block diagram illustrating an example of a processing device according to the present disclosure. In FIG. 1 , a processing device 10 includes an identification unit (first identification unit) 11, an identification unit (second identification unit) 12, an assignment unit 13, and an output unit 14.

The identification unit 11 identifies a specific system call command or a specific function in a "call flow" included in the target software (e.g., software to be inspected). The "call flow" includes a start function and an end function of the call flow, and has multiple functions that have a call relationship.

For example, the identification unit 11 acquires "information related to the call flow." The "information related to the call flow" includes at least information related to the multiple functions and system call instructions included in the call flow, and information related to the call relationships between the multiple functions. The identification unit 11 may then identify a specific system call instruction or a specific function included in the call flow based on a list that holds information related to specific system call instructions and specific functions, and the information related to the call flow.

The identification unit 12 identifies an importance score corresponding to the type of predetermined system call instruction or function identified by the identification unit 11, based on the correspondence between multiple types of system call instructions or functions and the "importance scores" corresponding to each type. In the above correspondence, for example, a higher importance score may be associated with a system call instruction or function that has a greater impact on the system when exploited by a backdoor or the like. In this case, the importance score may also be referred to as a maliciousness score.

The assigning unit 13 assigns the importance score identified by the identifying unit 12 to each function included in the call flow. In other words, the assigning unit 13 propagates the importance score corresponding to the type of system call command or function included in the call flow to all functions included in the same call flow.

The output unit 14 outputs information regarding each function included in the call flow and the importance score assigned to each function (hereinafter, sometimes referred to as "call flow information"). The output unit 14 may also output the above-mentioned target software along with the call flow information.

<Example of processing device operation>
FIG. 2 is a flowchart illustrating an example of a processing operation of the processing device of the present disclosure.

The identification unit 11 identifies a specific system call command or a specific function in the "call flow" (step S11). For example, the identification unit 11 acquires "information related to the call flow." Then, the identification unit 11 identifies the specific system call command or specific function included in the call flow based on a list that holds information related to the specific system call command and the specific function, and the information related to the call flow.

Figure 3 is a diagram illustrating an example of the processing operation of the processing device of the present disclosure. For example, the above list holds "execve" as the specified system call command. The call flow shown in Figure 3 includes the system call command "execve," functions "func2," "func1," and "do_com." In this case, the identification unit 11 identifies the system call command "execve" as the specified system call command in the call flow. Note that the binary in Figure 3 represents the target software described above.

The identification unit 12 identifies the importance score corresponding to the identified type of specified system call instruction or specified function based on the "correspondence" (step S12). In the example of Figure 3, the system call instruction "execve" is associated with an importance score of "10" in the list above. In this case, the identification unit 12 identifies the score "10" as the importance score corresponding to the identified type of specified system call instruction. For example, an importance score of "10" may be the most important, and an importance score of "0" may be the least important.

The assigning unit 13 assigns the importance score identified by the identifying unit 12 to each function included in the call flow (step S13). As described above, in the example of Figure 3, the call flow includes the system call command "execve", the functions "func2", "func1", and "do_com". Therefore, in the example of Figure 3, an importance score of "10" is assigned to each of the functions "func2", "func1", and "do_com". Note that the assigning unit 13 does not need to assign an importance score to the function "func1", which is an internal function that is not exported.

The output unit 14 outputs call flow information regarding each function included in the call flow and the importance score assigned to each function (step S14). This call flow information is referred to as "policy" in Figure 3.

As described above, according to the first embodiment, the identification unit 11 in the processing device 10 identifies a specific system call instruction or a specific function in a call flow. The identification unit 12 identifies an importance score corresponding to the type of specific system call instruction or specific function identified by the identification unit 11 based on the correspondence between multiple types of system call instructions or functions and the importance scores corresponding to each type. The assignment unit 13 assigns the importance score identified by the identification unit 12 to each function included in the call flow. The output unit 14 outputs call flow information related to each function included in the call flow and the importance score assigned to each function.

This configuration of the processing device 10 makes it possible to obtain call flow information regarding each function included in a call flow and the importance score assigned to each function. By using this call flow information during software inspection processing, resources can be preferentially allocated to inspection processing of functions assigned importance scores indicating higher importance and call flows that include such functions, thereby improving the efficiency of software inspection processing.

Second Embodiment
<Configuration example of processing device>
4 is a block diagram illustrating another example of a processing device according to the present disclosure. In FIG. 4, a processing device 20 includes an identification unit (first identification unit) 21, an identification unit (second identification unit) 22, an assignment unit 23, and an output unit 24.

Similar to the identification unit 11, the identification unit 21 identifies a specific system call command or a specific function in a "call flow" included in the target software (e.g., software to be inspected). The target software includes multiple call flows, namely, a first call flow and a second call flow. The identification unit 21 identifies a specific system call command or a specific function in each of the first call flow and the second call flow.

For example, the identification unit 21 acquires "information related to the call flow." The "information related to the call flow" includes at least information related to the multiple functions and system call instructions included in the first call flow, and information related to the call relationships between the multiple functions. The "information related to the call flow" includes at least information related to the multiple functions and system call instructions included in the second call flow, and information related to the call relationships between the multiple functions. The identification unit 21 may then identify a specific system call instruction or a specific function included in the first call flow based on a list that holds information related to specific system call instructions and specific functions, and the information related to the call flow. The identification unit 21 may also identify a specific system call instruction or a specific function included in the second call flow based on a list that holds information related to specific system call instructions and specific functions, and the information related to the call flow.

Similar to identification unit 12, identification unit 22 identifies an importance score corresponding to the type of predetermined system call instruction or predetermined function identified by identification unit 21 based on the correspondence between multiple types of system call instructions or functions and the "importance scores" corresponding to each type. Specifically, identification unit 22 identifies an importance score corresponding to the type of predetermined system call instruction or predetermined function identified in the first call flow, and an importance score corresponding to the type of predetermined system call instruction or predetermined function identified in the second call flow. Hereinafter, the importance score corresponding to the type of predetermined system call instruction or predetermined function identified in the first call flow may be referred to as the "first importance score." Furthermore, the importance score corresponding to the type of predetermined system call instruction or predetermined function identified in the second call flow may be referred to as the "second importance score."

The assigning unit 23 assigns a first importance score to each function included in the first call flow. The assigning unit 23 also assigns a second importance score to each function included in the second call flow. In other words, the assigning unit 23 propagates the importance score corresponding to the type of system call command or function included in the call flow to all functions included in the same call flow.

Here, if the first call flow and the second call flow include a common function, the assignment unit 23 selects the importance score corresponding to the highest importance as the importance score of the common function.

The output unit 24 outputs call flow information regarding each function included in the first call flow and the importance score assigned to each function, and each function included in the second call flow and the importance score assigned to each function. The output unit 24 may also output the above-mentioned target software along with the call flow information.

<Example of processing device operation>
FIG. 5 is a flowchart showing another example of the processing operation of the processing device of the present disclosure.

The identification unit 21 identifies a specific system call command or a specific function in each call flow included in the target software (step S21).

FIG. 6 is a diagram illustrating another example of the processing operation of the processing device of the present disclosure. For example, the above list holds "execve" and "syscall A" as predetermined system call instructions. The first call flow shown in FIG. 6 includes the system call instruction "execve", the function "func2", the function "func1", and the function "do_com". The second call flow shown in FIG. 6 includes the system call instruction "syscall A", the function "func4", the function "func3", and the function "do_com". In this case, the identification unit 21 identifies the system call instruction "execve" as the predetermined system call instruction in the first call flow. The identification unit 21 also identifies the system call instruction "syscall A" as the predetermined system call instruction in the second call flow.

The identification unit 22 identifies an importance score corresponding to the identified type of specified system call instruction or specified function based on the "correspondence" (step S22). In the example of Figure 6, the above correspondence associates the system call instruction "execve" with an importance score of "10", and the system call instruction "syscall A" with an importance score of "8". In this case, the identification unit 22 identifies the score "10" as the importance score corresponding to the type of system call instruction "execve" identified for the first call flow. Furthermore, the identification unit 22 identifies the score "8" as the importance score corresponding to the type of system call instruction "syscall A" identified for the second call flow.

The assigning unit 23 assigns the importance score identified for each call flow to each function included in each call flow (step S23). As described above, in the example of FIG. 6, the first call flow includes the system call command "execve", the functions "func2", "func1", and "do_com". Therefore, in the example of FIG. 6, an importance score of "10" is assigned to each of the functions "func2", "func1", and "do_com". Also, in the example of FIG. 6, the second call flow includes the system call command "syscall A", the functions "func4", "func3", and "do_com". Therefore, in the example of FIG. 6, an importance score of "8" is assigned to each of the functions "func4", "func3", and "do_com". Note that the assigning unit 23 does not need to assign importance scores to the functions "func1" and "func3", which are internal functions that are not exported.

The assignment unit 23 determines whether there are any common functions included in multiple call flows (step S24).

If there is a common function included in multiple call flows (step S24 YES), the assigning unit 23 selects the importance score corresponding to the highest importance as the importance score of the common function (step S25). In the example of Figure 6, the function "do_com" is a common function, and the importance score "10" and the importance score "8" have been assigned to the function "do_com". Therefore, the assigning unit 23 selects the importance score "10" from the importance score "10" and the importance score "8" as the importance score of the function "do_com".

The output unit 24 outputs call flow information regarding each function included in each call flow and the importance score assigned to each function (step S26). Note that if there are no common functions included in multiple call flows (step S24 NO), the processing proceeds to step S26.

As described above, according to the second embodiment, the identification unit 21 in the processing device 20 identifies a predetermined system call command or a predetermined function in each of the first call flow and the second call flow. The identification unit 22 identifies an importance score corresponding to the predetermined system call command or the type of predetermined function identified in the first call flow, and an importance score corresponding to the predetermined system call command or the type of predetermined function identified in the second call flow. The assignment unit 23 assigns a first importance score to each function included in the first call flow. The assignment unit 23 also assigns a second importance score to each function included in the second call flow. The output unit 24 outputs call flow information related to each function included in the first call flow and the importance scores assigned to each function, and each function included in the second call flow and the importance scores assigned to each function.

This configuration of the processing device 20 makes it possible to obtain call flow information regarding each function included in each call flow and the importance score assigned to each function, even if the target software contains multiple call flows.

Third Embodiment
<Configuration example of processing device>
7 is a block diagram illustrating another example of a processing device according to the present disclosure. In FIG. 7, a processing device 30 includes an identification unit (first identification unit) 31, an identification unit (second identification unit) 32, an assignment unit 33, and an output unit 34.

Similar to the identification unit 21, the identification unit 31 identifies a specific system call command or a specific function in each of the first call flow and the second call flow.

The identification unit 32 identifies an importance score and a category corresponding to the type of specified system call instruction or specified function identified by the identification unit 31 based on the "correspondence relationship." Here, the "correspondence relationship" associates multiple types of system call instructions or functions with "importance scores" and "categories" corresponding to each type. Specifically, the identification unit 32 identifies a first importance score and a first category corresponding to the type of specified system call instruction or specified function identified in the first call flow. Furthermore, the identification unit 32 identifies a second importance score and a second category corresponding to the type of specified system call instruction or specified function identified in the second call flow.

Here, the categories may be defined in terms of the functionality performed by the functions, such as "writing to a file" or "creating a process." Alternatively, the categories may be defined for each security function, such as "integrity," "confidentiality," or "availability." Alternatively, the categories may be categories of vulnerabilities that may arise due to the functions, and may be defined, for example, by a Common Weakness Enumeration (CWE).

The assigning unit 33 assigns a first importance score and a first category to each function included in the first call flow. Furthermore, the assigning unit 23 assigns a second importance score and a second category to each function included in the second call flow.

Here, when the first call flow and the second call flow include a common function and the first category and the second category are the same, the assigning unit 33 selects the importance score of the common function that corresponds to the highest importance out of the first importance score and the second importance score. In other words, when the first call flow and the second call flow include a common function and the first category and the second category are the same, the assigning unit 33 assigns the score of the common function that corresponds to the higher importance out of the first importance score and the second importance score.

If the first category and the second category are different, the output unit 34 outputs call flow information regarding each function included in the first call flow and the importance score assigned to each function, i.e., the policy of the first category. Also, if the first category and the second category are different, the output unit 34 outputs call flow information regarding each function included in the second call flow and the importance score assigned to each function, i.e., the policy of the second category.

If the first category and the second category are the same, the output unit 34 outputs call flow information regarding each function included in the first call flow and the second call flow and the importance score assigned to each function, i.e., the policy of the first category (= second category).

The output unit 34 may also output the above-mentioned target software along with the call flow information.

<Example of processing device operation>
FIG. 8 is a flowchart showing another example of the processing operation of the processing device of the present disclosure.

The identification unit 31 identifies a specific system call command or a specific function in each call flow included in the target software (step S31).

FIG. 9 is a diagram illustrating another example of the processing operation of the processing device of the present disclosure. For example, the above list holds "execve" and "syscall A" as predetermined system call instructions. The first call flow shown in FIG. 9 includes the system call instruction "execve", the function "func2", the function "func1", and the function "do_com". The second call flow shown in FIG. 9 includes the system call instruction "syscall A", the function "func4", the function "func3", and the function "do_com". In this case, the identification unit 31 identifies the system call instruction "execve" as the predetermined system call instruction in the first call flow. The identification unit 31 also identifies the system call instruction "syscall A" as the predetermined system call instruction in the second call flow.

The identification unit 32 identifies the importance score and category corresponding to the identified type of specified system call instruction or specified function based on the "correspondence" (step S32). In the example of Figure 9, the above correspondence associates the system call instruction "execve" with an importance score of "10" and category "A," and the system call instruction "syscall A" with an importance score of "8" and category "B." In this case, the identification unit 32 identifies the score "10" and category "A" as the importance score and category corresponding to the type of system call instruction "execve" identified for the first call flow. The identification unit 32 also identifies the score "8" and category "B" as the importance score and category corresponding to the type of system call instruction "syscall A" identified for the second call flow.

The assignment unit 33 assigns the importance score identified for each call flow to each function included in each call flow (step S33). As described above, in the example of Figure 9, the first call flow includes the system call command "execve", the functions "func2", "func1", and "do_com". Therefore, in the example of Figure 9, the functions "func2", "func1", and "do_com" are each assigned an importance score of "10" and a category of "A". Also, in the example of Figure 9, the second call flow includes the system call command "syscall A", the functions "func4", "func3", and "do_com". Therefore, in the example of Figure 9, the functions "func4", "func3", and "do_com" are each assigned an importance score of "8" and a category of "B". Note that the assignment unit 33 does not need to assign importance scores and categories to the functions "func1" and "func3", which are internal functions that are not exported.

The assignment unit 33 determines whether there are any common functions included in multiple call flows of the same category (step S34).

If there is a common function included in multiple call flows of the same category (step S34 YES), the assigning unit 33 selects the importance score corresponding to the highest importance as the importance score of the common function (step S35). In the example of Figure 9, the function "do_com" is a common function of the first call flow and the second call flow, but the category of the first call flow is different from the category of the second call flow. If the category of the first call flow is "A" and the category of the second call flow is also "A", the assigning unit 33 selects the importance score "10" as the importance score of the function "do_com" from the importance score "10" and the importance score "8".

The output unit 34 outputs call flow information regarding each function included in each call flow and the importance score assigned to each function (step S26). Here, for multiple call flows that are in different categories, the output unit 34 outputs call flow information (policy) for each call flow. Furthermore, for multiple call flows that include a common function and are in the same category, the output unit 34 outputs call flow information (policy) common to the multiple call flows.

As described above, according to the third embodiment, the assigning unit 33 in the processing device 30 assigns the importance score and category identified by the identifying unit 32 to each function included in the call flow. The output unit 34 outputs call flow information related to each function included in the call flow and the importance score and category assigned to each function.

This configuration of the processing device 30 makes it possible to obtain call flow information regarding each function included in the call flow and the importance score and category assigned to each function. By using this call flow information during software inspection processing, resources can be preferentially allocated to inspection processing of call flows in the desired category, thereby improving the efficiency of software inspection processing.

<Modification of the third embodiment>
FIG. 10 is a diagram illustrating another example of the processing operation of the processing device of the present disclosure. As shown in FIG. 10, the call flow may span multiple binaries (in FIG. 10, a main binary and a sub-binary (library (lib))). In this case, the output unit 34 may output call flow information (policy) on a binary basis (library basis). FIGS. 11A, 11B, and 11C are diagrams illustrating examples of call flow information. FIG. 11A shows call flow information after analysis of library C. FIG. 11B shows call flow information after analysis of library B. FIG. 11C shows call flow information after analysis of library A. As shown in FIG. 11C, the importance score of "10" is selected as the importance score for the library A function "do_com" from the importance scores of "10" and "8."

Fourth Embodiment
<Configuration example of software inspection device>
12 is a block diagram showing an example of a software inspection device according to the present disclosure. In FIG. 12 , the software inspection device 50 includes an identification unit (first identification unit) 51, an identification unit (second identification unit) 52, an assignment unit 53, an output unit 54, and an inspection processing unit 55. The identification unit 51, the identification unit 52, the assignment unit 53, and the output unit 54 may have the same functions as the identification unit 11, the identification unit 12, the assignment unit 13, and the output unit 14. Alternatively, the identification unit 51, the identification unit 52, the assignment unit 53, and the output unit 54 may have the same functions as the identification unit 21, the identification unit 22, the assignment unit 23, and the output unit 24. Alternatively, the identification unit 51, the identification unit 52, the assignment unit 53, and the output unit 54 may have the same functions as the identification unit 31, the identification unit 32, the assignment unit 33, and the output unit 34. Here, the description will be given by taking as an example that the identification unit 51, the identification unit 52, the assignment unit 53, and the output unit 54 have the same functions as the identification unit 31, the identification unit 32, the assignment unit 33, and the output unit 34.

The inspection processing unit 55 sets a portion of the target software as the inspection range based on the specified inspection range specification parameters, and performs an inspection of the target software within the set inspection range. For example, the inspection processing unit 55 performs "process flow analysis" as the inspection process for the target software.

The above inspection range specification parameters may be score thresholds, categories, or a combination of score thresholds and categories.

For example, if a score threshold of "9" is set as the inspection range specification parameter, the inspection processing unit 55 will inspect the target software with functions having an importance score value of 9 or greater as the inspection range. In other words, based on the call flow information, the inspection processing unit 55 may inspect functions of the multiple functions included in the call flow of the target software whose importance indicated by an importance score is higher than a predetermined level.

Furthermore, for example, if category "A" is set as the inspection range specification parameter, the inspection processing unit 55 inspects the target software with functions in category "A" as the inspection range.

Furthermore, for example, if a score threshold of "9" and a category of "A" are set as the inspection range specification parameters, the inspection processing unit 55 will inspect the target software with the inspection range set to functions in category "A" with an importance score value of 9 or greater.

For example, the inspection processing unit 55 receives a "call flow function list" corresponding to each call flow, and call flow information regarding each function included in each call flow and the importance score and category assigned to each function. The inspection processing unit 55 then performs data flow analysis and control flow analysis on the call flows (i.e., functions) in the inspection range specified by the inspection range specification parameters, thereby identifying conditional branches in the call flows in the inspection range that are likely to trigger a backdoor. The inspection processing unit 55 then outputs inspection results that include information regarding the identified conditional branches, etc.

<Example of software inspection device operation>
FIG. 13 is a flowchart showing another example of the processing operation of the processing device of the present disclosure.

The identification unit 51 identifies a specific system call command or a specific function in each call flow included in the target software (step S41).

The identification unit 52 identifies the importance score and category corresponding to the identified specific system call instruction or type of specific function based on the "correspondence" (step S42).

The assigning unit 53 assigns the importance score identified for each call flow to each function included in each call flow (step S43).

The assignment unit 53 determines whether there are any common functions included in multiple call flows of the same category (step S44).

If there is a common function included in multiple call flows of the same category (step S44 YES), the assignment unit 53 selects the importance score corresponding to the highest importance as the importance score of the common function (step S45).

The output unit 54 outputs call flow information regarding each function included in each call flow and the importance score assigned to each function, as well as the target software (step S46).

The inspection processing unit 55 sets a portion of the target software as the inspection range based on the specified inspection range specification parameters, and performs an inspection of the target software within the set inspection range (step S47).

As described above, according to the fourth embodiment, the inspection processing unit 55 in the software inspection device 50 sets a portion of the target software as the inspection range based on the specified inspection range designation parameters, and performs inspection of the target software within the set inspection range.

This software inspection device 50 configuration allows resources to be preferentially allocated to inspection processing within the inspection range, thereby improving the efficiency of software inspection processing.

<Other Embodiments>
<1> FIG. 14 is a diagram illustrating an example of the configuration of a processing device. In FIG. 14, the processing device 100 includes a processor 101 and a memory 102. The processor 101 may be, for example, a microprocessor, a micro processing unit (MPU), or a central processing unit (CPU). The processor 101 may include multiple processors. The memory 102 is configured by a combination of volatile memory and non-volatile memory. The memory 102 may include storage located away from the processor 101. In this case, the processor 101 may access the memory 102 via an I (Input)/O (Output) interface (not shown).

The processing devices 10, 20, and 30 of the first to third embodiments can each have the configuration shown in FIG. 14. The identification units 11, 21, and 31, the identification units 12, 22, and 32, the assignment units 13, 23, and 33, and the output units 14, 24, and 34 of the processing devices 10, 20, and 30 of the first to third embodiments may be realized by the processor 101 reading and executing a program stored in the memory 102. In other words, the processing devices 10, 20, and 30 of the first to third embodiments can be realized by software. The program can be stored using various types of non-transitory computer-readable medium and supplied to the processing devices 10, 20, and 30. Examples of non-transitory computer-readable medium include magnetic recording media (e.g., flexible disks, magnetic tapes, and hard disk drives) and magneto-optical recording media (e.g., magneto-optical disks). Further examples of non-transitory computer-readable media include CD-ROM (Read Only Memory), CD-R, and CD-R/W. Further examples of non-transitory computer-readable media include semiconductor memory. Semiconductor memory includes, for example, mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, and RAM (Random Access Memory). The program may also be supplied to the processing devices 10, 20, and 30 by various types of transitory computer-readable medium. Examples of transitory computer-readable medium include electrical signals, optical signals, and electromagnetic waves. The transitory computer-readable medium may supply the program to the processing devices 10, 20, and 30 via wired communication paths such as electrical wires and optical fibers, or wireless communication paths.

Alternatively, the identification units 11, 21, 31, identification units 12, 22, 32, assignment units 13, 23, 33, and output units 14, 24, 34 of the processing devices 10, 20, 30 of the first to third embodiments may each be realized by dedicated hardware. Furthermore, some or all of the components of each device may be realized by general-purpose or dedicated circuits, processors, etc., or a combination of these. These may be configured by a single chip, or by multiple chips connected via a bus. Some or all of the components of each device may be realized by a combination of the above-mentioned circuits, etc., and programs. Furthermore, processors that can be used include CPUs (Central Processing Units), GPUs (Graphics Processing Units), FPGAs (Field-Programmable Gate Arrays), quantum processors (quantum computer control chips), etc.

Furthermore, when some or all of the components of the processing devices 10, 20, 30 of the first to third embodiments are realized by multiple information processing devices, circuits, etc., the multiple information processing devices, circuits, etc. may be centrally located or distributed. For example, the information processing devices, circuits, etc. may be realized as a client-server system, cloud computing system, etc., in which each is connected via a communications network. Furthermore, the functions of the processing devices 10, 20, 30 of the first to third embodiments may be provided in a SaaS (Software as a Service) format.

<2> Figure 15 is a diagram showing an example configuration of a software inspection device. In Figure 15, the software inspection device 200 has a processor 201 and a memory 202. The processor 201 may be, for example, a microprocessor, an MPU (Micro Processing Unit), or a CPU (Central Processing Unit). The processor 201 may include multiple processors. The memory 202 is composed of a combination of volatile memory and non-volatile memory. The memory 202 may include storage located away from the processor 201. In this case, the processor 201 may access the memory 202 via an I (Input)/O (Output) interface not shown.

The software inspection device 50 of the fourth embodiment may have the configuration shown in FIG. 15. The identification unit 51, identification unit 52, assignment unit 53, output unit 54, and inspection processing unit 55 of the software inspection device 50 of the fourth embodiment may be realized by the processor 201 reading and executing a program stored in the memory 202. In other words, the software inspection device 50 of the fourth embodiment can be realized by software. The program can be stored using various types of non-transitory computer-readable medium and supplied to the software inspection device 50. Examples of non-transitory computer-readable medium include magnetic recording media (e.g., flexible disks, magnetic tapes, hard disk drives) and magneto-optical recording media (e.g., magneto-optical disks). Further examples of non-transitory computer-readable media include CD-ROMs (Read Only Memory), CD-Rs, and CD-R/Ws. Further examples of non-transitory computer-readable media include semiconductor memories. Semiconductor memories include, for example, mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, and RAM (Random Access Memory). The program may also be supplied to the software inspection device 50 by various types of transitory computer-readable medium. Examples of transitory computer-readable medium include electrical signals, optical signals, and electromagnetic waves. The transitory computer-readable medium may supply the program to the software inspection device 50 via a wired communication path such as an electrical wire or optical fiber, or a wireless communication path.

Alternatively, the identification unit 51, identification unit 52, assignment unit 53, output unit 54, and inspection processing unit 55 of the software inspection device 50 of the fourth embodiment may each be realized by dedicated hardware. Furthermore, some or all of the components of each device may be realized by general-purpose or dedicated circuits, processors, etc., or a combination of these. These may be configured by a single chip, or by multiple chips connected via a bus. Some or all of the components of each device may be realized by a combination of the above-mentioned circuits, etc., and programs. Furthermore, processors that can be used include CPUs (Central Processing Units), GPUs (Graphics Processing Units), FPGAs (Field-Programmable Gate Arrays), quantum processors (quantum computer control chips), etc.

Furthermore, when some or all of the components of the software inspection device 50 of the fourth embodiment are realized by multiple information processing devices, circuits, etc., the multiple information processing devices, circuits, etc. may be centrally located or distributed. For example, the information processing devices, circuits, etc. may be realized as a client-server system, cloud computing system, etc., in a form in which each is connected via a communications network. Furthermore, the functions of the software inspection device 50 of the fourth embodiment may be provided in the form of SaaS (Software as a Service).

The present invention has been described above with reference to the embodiments, but the present invention is not limited to the above. Various modifications to the configuration and details of the present invention that are understandable to those skilled in the art can be made within the scope of the invention. Furthermore, each embodiment can be combined with other embodiments as appropriate.

Each drawing is merely an example for describing one or more embodiments. Each drawing does not relate to only one particular embodiment, but may also relate to one or more other embodiments. As will be understood by those skilled in the art, various features or steps described with reference to any one drawing can be combined with features or steps shown in one or more other drawings to create, for example, an embodiment not explicitly shown or described. Not all features or steps shown in any one drawing are necessarily required to describe an exemplary embodiment, and some features or steps may be omitted. The order of steps described in any drawing may be changed as appropriate.

A part or all of the above-described embodiments can be described as, but not limited to, the following supplementary notes.
(Appendix 1)
Identifying a predetermined system call command or a predetermined function in a call flow that includes a start function and an end function of the call flow included in the target software and has a plurality of functions that have a call relationship;
Identifying an importance score corresponding to the specified type of system call instruction or function based on a correspondence relationship between a plurality of types of system call instructions or functions and an importance score corresponding to each type;
assigning the identified importance score to each function in the call flow;
outputting call flow information relating to each function included in the call flow and the importance score assigned to each function;
A program for causing a processing device to execute a process, including:
(Appendix 2)
the subject software includes a first call flow and a second call flow;
identifying the predetermined system call instruction or the predetermined function includes identifying the predetermined system call instruction or the predetermined function in each of the first call flow and the second call flow;
identifying the importance score includes identifying a first importance score corresponding to a predetermined system call instruction or a predetermined type of function identified in the first call flow, and a second importance score corresponding to a predetermined system call instruction or a predetermined type of function identified in the second call flow,
assigning the importance scores includes assigning the first importance score to each function included in the first call flow and assigning the second importance score to each function included in the second call flow.
Attachment 1. The program described in claim 1.
(Appendix 3)
assigning the importance score includes, when a common function included in both the first call flow and the second call flow exists, assigning the common function a score corresponding to a higher importance out of the first importance score and the second importance score.
The program described in Appendix 2.
(Appendix 4)
the correspondence relationship associates the plurality of types with importance scores and categories corresponding to each type;
assigning the importance score includes assigning the identified importance score and category to each function included in the call flow.
Attachment 1. The program described in claim 1.
(Appendix 5)
the subject software includes a first call flow and a second call flow;
Identifying the predetermined system call instruction or the predetermined function includes identifying the predetermined system call instruction or the predetermined function in each of the first call flow and the second call flow;
identifying the importance score includes identifying a first importance score and a first category corresponding to a predetermined system call instruction or a predetermined type of function identified in the first call flow, and a second importance score and a second category corresponding to a predetermined system call instruction or a predetermined type of function identified in the second call flow,
assigning the importance scores includes assigning the first importance score and the first category to each function included in the first call flow, and assigning the second importance score and the second category to each function included in the second call flow.
Attachment 4: The program described in claim 4.
(Appendix 6)
assigning the importance score includes, when a common function included in both the first call flow and the second call flow exists and the first category and the second category are the same, assigning the common function a score corresponding to a higher importance out of the first importance score and the second importance score.
Attachment 5. The program according to claim 5.
(Appendix 7)
the outputting includes outputting the target software and the call flow information.
7. The program according to any one of appendices 1 to 6.
(Appendix 8)
the processing includes determining, based on the call flow information, a function having an importance score higher than a predetermined level among a plurality of functions included in the call flow of the target software as a target for inspection processing;
8. The program according to claim 7.
(Appendix 9)
a first identification unit that identifies a predetermined system call command or a predetermined function in a call flow that includes a start function and an end function of the call flow included in the target software and has a plurality of functions that have a call relationship;
a second identification unit that identifies an importance score corresponding to the identified type of predetermined system call instruction or function based on a correspondence relationship between a plurality of types of system call instruction or function and an importance score corresponding to each type;
an assigning unit that assigns the identified importance score to each function included in the call flow;
an output unit that outputs call flow information regarding each function included in the call flow and an importance score assigned to each function;
A processing device comprising:
(Appendix 10)
the subject software includes a first call flow and a second call flow;
the first identification unit identifies a predetermined system call command or a predetermined function in each of the first call flow and the second call flow;
the second identification unit identifies a first importance score corresponding to the type of a predetermined system call instruction or a predetermined function identified in the first call flow, and a second importance score corresponding to the type of a predetermined system call instruction or a predetermined function identified in the second call flow,
the assigning unit assigns the first importance score to each function included in the first call flow, and assigns the second importance score to each function included in the second call flow;
10. The processing device of claim 9.
(Appendix 11)
When a common function included in both the first call flow and the second call flow exists, the assigning unit assigns a score corresponding to a higher importance between the first importance score and the second importance score to the common function.
11. The processing device of claim 10.
(Appendix 12)
the correspondence relationship associates the plurality of types with importance scores and categories corresponding to each type;
the assigning unit assigns the identified importance score and category to each function included in the call flow.
10. The processing device of claim 9.
(Appendix 13)
the subject software includes a first call flow and a second call flow;
the first identification unit identifies a predetermined system call command or a predetermined function in each of the first call flow and the second call flow;
the second identification unit identifies a first importance score and a first category corresponding to the type of the predetermined system call instruction or the predetermined function identified in the first call flow, and a second importance score and a second category corresponding to the type of the predetermined system call instruction or the predetermined function identified in the second call flow,
the assigning unit assigns the first importance score and the first category to each function included in the first call flow, and assigns the second importance score and the second category to each function included in the second call flow.
13. The processing device of claim 12.
(Appendix 14)
the assigning unit assigns, to the common function, a score corresponding to a higher importance between the first importance score and the second importance score, when a common function included in both the first call flow and the second call flow exists and the first category and the second category are the same.
14. The processing device of claim 13.
(Appendix 15)
the output unit outputs the target software and the call flow information.
15. The processing device of any one of appendices 9 to 14.
(Appendix 16)
a processing device according to claim 15; and
an inspection processing unit that, based on the call flow information, selects functions of importance indicated by importance scores higher than a predetermined level among a plurality of functions included in the call flow of the target software as inspection processing targets;
A software inspection device comprising:
(Appendix 17)
Identifying a predetermined system call command or a predetermined function in a call flow that includes a start function and an end function of the call flow included in the target software and has a plurality of functions that have a call relationship;
Identifying an importance score corresponding to the specified type of system call instruction or function based on a correspondence relationship between a plurality of types of system call instructions or functions and an importance score corresponding to each type;
assigning the identified importance score to each function in the call flow;
outputting call flow information relating to each function included in the call flow and the importance score assigned to each function;
A method comprising:
(Appendix 18)
the subject software includes a first call flow and a second call flow;
identifying the predetermined system call instruction or the predetermined function includes identifying the predetermined system call instruction or the predetermined function in each of the first call flow and the second call flow;
identifying the importance score includes identifying a first importance score corresponding to a predetermined system call instruction or a predetermined type of function identified in the first call flow, and a second importance score corresponding to a predetermined system call instruction or a predetermined type of function identified in the second call flow,
assigning the importance scores includes assigning the first importance score to each function included in the first call flow and assigning the second importance score to each function included in the second call flow.
18. The method of claim 17.
(Appendix 19)
assigning the importance score includes, when a common function included in both the first call flow and the second call flow exists, assigning the common function a score corresponding to a higher importance among the first importance score and the second importance score.
19. The method of claim 18.
(Appendix 20)
the correspondence relationship associates the plurality of types with importance scores and categories corresponding to each type;
assigning the importance score includes assigning the identified importance score and category to each function included in the call flow.
18. The method of claim 17.
(Appendix 21)
the subject software includes a first call flow and a second call flow;
Identifying the predetermined system call instruction or the predetermined function includes identifying the predetermined system call instruction or the predetermined function in each of the first call flow and the second call flow;
identifying the importance score includes identifying a first importance score and a first category corresponding to a predetermined system call instruction or a predetermined type of function identified in the first call flow, and a second importance score and a second category corresponding to a predetermined system call instruction or a predetermined type of function identified in the second call flow,
assigning the importance scores includes assigning the first importance score and the first category to each function included in the first call flow, and assigning the second importance score and the second category to each function included in the second call flow.
21. The method of claim 20.
(Appendix 22)
assigning the importance score includes, when a common function included in both the first call flow and the second call flow exists and the first category and the second category are the same, assigning the common function a score corresponding to a higher importance out of the first importance score and the second importance score.
22. The method of claim 21.
(Appendix 23)
the outputting includes outputting the target software and the call flow information.
23. The method of any one of claims 17 to 22.
(Appendix 24)
the method includes determining, based on the call flow information, functions of a plurality of functions included in the call flow of the target software, the functions having importance indicated by importance scores higher than a predetermined level, as targets of inspection processing;
24. The method of claim 23.

10 Processing device 11 Identification unit (first identification unit)
12 Specific Section (Second Specific Section)
13 Assignment unit 14 Output unit 20 Processing device 21 Identification unit (first identification unit)
22 Specific Section (Second Specific Section)
23 Assignment unit 24 Output unit 30 Processing device 31 Identification unit (first identification unit)
32 Specific Section (Second Specific Section)
33 Assignment unit 34 Output unit 50 Software inspection device 51 Identification unit (first identification unit)
52 Specific Section (Second Specific Section)
53 Assignment unit 54 Output unit 55 Inspection processing unit

Claims (24)

Identifying a predetermined system call command or a predetermined function in a call flow that includes a start function and an end function of the call flow included in the target software and has a plurality of functions that have a call relationship;
Identifying an importance score corresponding to the specified type of system call instruction or function based on a correspondence relationship between a plurality of types of system call instructions or functions and an importance score corresponding to each type;
assigning the identified importance score to each function in the call flow;
outputting call flow information relating to each function included in the call flow and the importance score assigned to each function;
A program for causing a processing device to execute a process, including: the subject software includes a first call flow and a second call flow;
identifying the predetermined system call instruction or the predetermined function includes identifying the predetermined system call instruction or the predetermined function in each of the first call flow and the second call flow;
identifying the importance score includes identifying a first importance score corresponding to a predetermined system call instruction or a predetermined type of function identified in the first call flow, and a second importance score corresponding to a predetermined system call instruction or a predetermined type of function identified in the second call flow,
assigning the importance scores includes assigning the first importance score to each function included in the first call flow and assigning the second importance score to each function included in the second call flow.
The program according to claim 1. assigning the importance score includes, when a common function included in both the first call flow and the second call flow exists, assigning the common function a score corresponding to a higher importance out of the first importance score and the second importance score.
The program according to claim 2. the correspondence relationship associates the plurality of types with importance scores and categories corresponding to each type;
assigning the importance score includes assigning the identified importance score and category to each function included in the call flow.
The program according to claim 1. the subject software includes a first call flow and a second call flow;
Identifying the predetermined system call instruction or the predetermined function includes identifying the predetermined system call instruction or the predetermined function in each of the first call flow and the second call flow;
identifying the importance score includes identifying a first importance score and a first category corresponding to a predetermined system call instruction or a predetermined type of function identified in the first call flow, and a second importance score and a second category corresponding to a predetermined system call instruction or a predetermined type of function identified in the second call flow,
assigning the importance scores includes assigning the first importance score and the first category to each function included in the first call flow, and assigning the second importance score and the second category to each function included in the second call flow.
The program according to claim 4. assigning the importance score includes, when a common function included in both the first call flow and the second call flow exists and the first category and the second category are the same, assigning the common function a score corresponding to a higher importance out of the first importance score and the second importance score.
The program according to claim 5. the outputting includes outputting the target software and the call flow information.
The program according to any one of claims 1 to 6. the processing includes determining, based on the call flow information, a function having an importance score higher than a predetermined level among a plurality of functions included in the call flow of the target software as a target for inspection processing;
The program according to claim 7. a first identification unit that identifies a predetermined system call command or a predetermined function in a call flow that includes a start function and an end function of the call flow included in the target software and has a plurality of functions that have a call relationship;
a second identification unit that identifies an importance score corresponding to the identified type of predetermined system call instruction or function based on a correspondence relationship between a plurality of types of system call instruction or function and an importance score corresponding to each type;
an assigning unit that assigns the identified importance score to each function included in the call flow;
an output unit that outputs call flow information regarding each function included in the call flow and an importance score assigned to each function;
A processing device comprising: the subject software includes a first call flow and a second call flow;
the first identification unit identifies a predetermined system call command or a predetermined function in each of the first call flow and the second call flow;
the second identification unit identifies a first importance score corresponding to the type of a predetermined system call instruction or a predetermined function identified in the first call flow, and a second importance score corresponding to the type of a predetermined system call instruction or a predetermined function identified in the second call flow,
the assigning unit assigns the first importance score to each function included in the first call flow, and assigns the second importance score to each function included in the second call flow;
The processing device according to claim 9. When a common function included in both the first call flow and the second call flow exists, the assigning unit assigns a score corresponding to a higher importance between the first importance score and the second importance score to the common function.
The processing device of claim 10. the correspondence relationship associates the plurality of types with importance scores and categories corresponding to each type;
the assigning unit assigns the identified importance score and category to each function included in the call flow.
The processing device according to claim 9. the subject software includes a first call flow and a second call flow;
the first identification unit identifies a predetermined system call command or a predetermined function in each of the first call flow and the second call flow;
the second identification unit identifies a first importance score and a first category corresponding to the type of the predetermined system call instruction or the predetermined function identified in the first call flow, and a second importance score and a second category corresponding to the type of the predetermined system call instruction or the predetermined function identified in the second call flow,
the assigning unit assigns the first importance score and the first category to each function included in the first call flow, and assigns the second importance score and the second category to each function included in the second call flow.
The processing device of claim 12. the assigning unit assigns, to the common function, a score corresponding to a higher importance between the first importance score and the second importance score, when a common function included in both the first call flow and the second call flow exists and the first category and the second category are the same.
The processing device of claim 13. the output unit outputs the target software and the call flow information.
The processing device according to any one of claims 9 to 14. a processing device according to claim 15;
an inspection processing unit that, based on the call flow information, selects functions of importance indicated by importance scores higher than a predetermined level among a plurality of functions included in the call flow of the target software as inspection processing targets;
A software inspection device comprising: Identifying a predetermined system call command or a predetermined function in a call flow that includes a start function and an end function of the call flow included in the target software and has a plurality of functions that have a call relationship;
Identifying an importance score corresponding to the specified type of system call instruction or function based on a correspondence relationship between a plurality of types of system call instructions or functions and an importance score corresponding to each type;
assigning the identified importance score to each function in the call flow;
outputting call flow information relating to each function included in the call flow and the importance score assigned to each function;
A method comprising: the subject software includes a first call flow and a second call flow;
identifying the predetermined system call instruction or the predetermined function includes identifying the predetermined system call instruction or the predetermined function in each of the first call flow and the second call flow;
identifying the importance score includes identifying a first importance score corresponding to a predetermined system call instruction or a predetermined type of function identified in the first call flow, and a second importance score corresponding to a predetermined system call instruction or a predetermined type of function identified in the second call flow,
assigning the importance scores includes assigning the first importance score to each function included in the first call flow and assigning the second importance score to each function included in the second call flow.
18. The method of claim 17. assigning the importance score includes, when a common function included in both the first call flow and the second call flow exists, assigning the common function a score corresponding to a higher importance out of the first importance score and the second importance score.
20. The method of claim 18. the correspondence relationship associates the plurality of types with importance scores and categories corresponding to each type;
assigning the importance score includes assigning the identified importance score and category to each function included in the call flow.
18. The method of claim 17. the subject software includes a first call flow and a second call flow;
Identifying the predetermined system call instruction or the predetermined function includes identifying the predetermined system call instruction or the predetermined function in each of the first call flow and the second call flow;
identifying the importance score includes identifying a first importance score and a first category corresponding to a predetermined system call instruction or a predetermined type of function identified in the first call flow, and a second importance score and a second category corresponding to a predetermined system call instruction or a predetermined type of function identified in the second call flow,
assigning the importance scores includes assigning the first importance score and the first category to each function included in the first call flow, and assigning the second importance score and the second category to each function included in the second call flow.
21. The method of claim 20. assigning the importance score includes, when a common function included in both the first call flow and the second call flow exists and the first category and the second category are the same, assigning the common function a score corresponding to a higher importance out of the first importance score and the second importance score.
22. The method of claim 21. the outputting includes outputting the target software and the call flow information.
23. The method of any one of claims 17 to 22. the method includes determining, based on the call flow information, functions of a plurality of functions included in the call flow of the target software, the functions having an importance indicated by an importance score higher than a predetermined level, as targets of inspection processing;
24. The method of claim 23.