JP2021108189A - Method for acquiring vulnerability feature, device, and electronic apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a method, an apparatus and an electronic device for acquiring a vulnerability feature, which acquires the vulnerability feature of a vulnerability online and improves the acquisition efficiency of the vulnerability feature.
SOLUTION: In a method of acquiring a vulnerability feature, a device for acquiring a vulnerability feature acquires a vulnerability patch information of a vulnerability, and then based on the vulnerability patch information, a code type vulnerability and a non-code type. S101 to determine the type of vulnerability including the vulnerability, and S102 to extract at least one vulnerability feature of the vulnerability based on the vulnerability analysis engine corresponding to the type of vulnerability. Then, S103 transmits at least one vulnerability feature of the vulnerability to the electronic device.
[Selection diagram] Fig. 2

Description

This application relates to a computer technology field, and specifically to an information security technology field.

In the field of information security, a vulnerability is a weakness or defect existing in a system, the sensitivity of the system to a specific threat attack or a dangerous event, or the possibility of an attacking threat action. Vulnerabilities arise from design flaws or coding mistakes in application software or operating systems, or from design flaws in services in the interaction processing process or unreasonable logical flows. It may have been created. These deficiencies, mistakes or irrational uses are consciously or unknowingly used to attack or control information systems in the assets or operations of an organization, steal important materials, tamper with user data, or other host computer systems. It may have a detrimental effect, such as being used as a stepping stone to invade the system. Vulnerability features are information for expressing vulnerabilities, and there are multiple vulnerability features for each vulnerability. In the case of Android (both registered trademarks) systems, how to use the vulnerability features of known vulnerabilities. Is very much in demand for system security analysis.

In the conventional technology, for a system known vulnerability, for example, a vulnerability scanned by a vulnerability scan is used when a person analyzes the vulnerability characteristics of an individual vulnerability and detects the individual vulnerability characteristics. The presence or absence of a vulnerability feature is detected by compiling the corresponding feature detection code based on the vulnerability feature and executing the feature detection code on the target machine to be detected. When a vulnerability that appears in the system is updated, the vulnerability feature acquisition efficiency is not high because the vulnerability feature is reanalyzed by a person and a subsequent detection process is executed.

The present application provides a method for acquiring a vulnerability feature, a device, and an electronic device, and can realize that the vulnerability feature can be acquired online and the efficiency of acquiring the vulnerability feature can be improved.

According to the first aspect, a method for acquiring a vulnerability feature is provided.
After acquiring the vulnerability patch information of the vulnerability, the type of the vulnerability is determined based on the vulnerability patch information, and the steps including the code type vulnerability and the non-code type vulnerability are included.
Steps to extract at least one vulnerability feature of the vulnerability based on the vulnerability analysis engine corresponding to the type of vulnerability, and
It includes a step of transmitting at least one vulnerability feature of the vulnerability to an electronic device.

According to the technique of the present application, after obtaining the vulnerability patch information of a vulnerability, it is determined based on the vulnerability patch information whether the vulnerability is a code type or a non-code type, and the vulnerability is vulnerable. At least one vulnerability feature of a vulnerability is extracted based on a vulnerability analysis engine corresponding to the type of vulnerability, and finally, at least one of the vulnerability features is transmitted to an electronic device. Different types of vulnerabilities correspond to different vulnerability analysis engines, and since the vulnerability analysis engine is pre-assembled based on different types of vulnerabilities, get the vulnerability characteristics of the vulnerabilities online. , It is possible to improve the acquisition efficiency of the vulnerability feature, it is not necessary to analyze and acquire the vulnerability feature by a person, and the maintenance cost of the system vulnerability database is reduced.

According to the second aspect, a device for acquiring vulnerability characteristics is provided.
The acquisition module used to acquire the vulnerability patch information of the vulnerability, and
Based on the vulnerability patch information, the type of the vulnerability is determined, and the confirmation module used for the type to include the code type vulnerability and the non-code type vulnerability, and the confirmation module.
An extraction module used to extract at least one vulnerability feature of the vulnerability based on the vulnerability analysis engine corresponding to the type of vulnerability.
Includes a transmission module used to transmit at least one vulnerability feature of the vulnerability to an electronic device.

According to the technique of the present application, after acquiring the vulnerability patch information of a vulnerability, the acquisition module determines whether the vulnerability is a code type or a non-code type based on the vulnerability patch information. And, the extraction module extracts at least one vulnerability feature of the vulnerability based on the vulnerability analysis engine corresponding to the type of vulnerability, and finally, the sending module extracts at least one vulnerability feature of the vulnerability. To the electronic device. Different types of vulnerabilities correspond to different vulnerability analysis engines, and since the vulnerability analysis engine is pre-assembled based on different types of vulnerabilities, get the vulnerability characteristics of the vulnerabilities online. , It is possible to improve the acquisition efficiency of the vulnerability feature, it is not necessary to analyze and acquire the vulnerability feature by a person, and the maintenance cost of the system vulnerability database is reduced.

According to the third aspect, the electronic device is provided.
Includes at least one processor and memory connected to communicate with at least one processor, of which
An instruction that can be executed by the at least one processor is stored in the memory, and when the instruction is executed by the at least one processor, the at least one processor is described in the first aspect. You will be able to carry out the method.

According to the fourth aspect, a non-temporary computer-readable storage medium in which computer instructions are stored is provided, and the computer instructions are for causing a computer to perform the method according to the first aspect.

According to a fifth aspect, a computer program is provided, the computer program is stored in a computer readable storage medium, and at least one processor of the electronic device can read the computer program from the computer readable storage medium. The at least one processor causes the electronic device to perform the method according to the first aspect by executing the computer program.

It should be understood that the content described in this section is not intended to mark the essential or important features of the embodiments of the present application and is not used to limit the scope of the present application. Other features of the present application are facilitated by the following specification.

The drawings are used to better understand the present solution and do not constitute a limitation to the present application.

It is the schematic of one application scene of this application. It is a flowchart of Example 1 of the acquisition method of the vulnerability feature which concerns on this application. It is a flowchart of Example 2 of the acquisition method of the vulnerability feature which concerns on this application. It is a flowchart of Example 3 of the acquisition method of the vulnerability feature which concerns on this application. It is a flowchart of Example 4 of the acquisition method of the vulnerability feature which concerns on this application. It is a structural schematic diagram of the acquisition device of the vulnerability feature which concerns on this application. It is a structural schematic diagram of the acquisition device of the vulnerability feature which concerns on this application. It is a structural schematic diagram of the acquisition device of the vulnerability feature which concerns on this application. It is a block diagram of the electronic device for realizing the acquisition method of the vulnerability feature of the Example of this application.

Hereinafter, exemplary embodiments of the present application will be described with reference to the drawings. Although various details of the embodiments of the present application are included to contribute to understanding, these should be considered as merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications to the embodiments described herein are possible and do not deviate from the scope and purpose of the present application. Similarly, for clarity and brevity, the following descriptions omit well-known functions and structures.

In the examples of the present application, terms such as "exemplary" or "for example" are intended to be expressed as an example, an example or an explanation, and are described as "exemplary" or "for example" in the examples of the present application. Any of the examples or solutions given should not be construed as preferable or more advantageous than the other examples or solutions. To be precise, the use of terms such as "exemplary" or "for example" is intended to present the relevant concept in a concrete manner.

In the conventional technology, the method of acquiring the vulnerability characteristics requires that the vulnerability characteristics of the vulnerability be analyzed by a person, and when the vulnerability that appears in the system is updated, the vulnerability characteristics must be reanalyzed by a person. Therefore, the acquisition efficiency of the vulnerability feature is not high and the maintenance cost of the vulnerability database is high. In order to solve this problem, the present application provides methods, devices and electronic devices for acquiring vulnerability characteristics, and by pre-assembling different vulnerability analysis engines based on different types of vulnerabilities, different types of vulnerabilities In contrast, a different vulnerability analysis engine is used to analyze and extract the vulnerability characteristics, obtain the vulnerability patch information of the vulnerability, and then determine the type of the vulnerability based on the vulnerability patch information. , At least one vulnerability feature of the vulnerability is extracted based on the vulnerability analysis engine corresponding to the type of the vulnerability, and at least one of the vulnerability features of the vulnerability is transmitted to the electronic device in the electronic device. Used for vulnerability detection. Therefore, the vulnerability features of the vulnerability can be acquired online, the efficiency of acquiring the vulnerability features can be improved, and the maintenance cost of the system vulnerability database can be reduced. Hereinafter, the specific realization process of the method for acquiring the vulnerability feature of the embodiment of the present application will be described in detail with reference to the drawings.

First, some of the terms in the examples of the present application will be interpreted and explained so that those skilled in the art can understand them well.

1. A vulnerability feature is information for expressing a vulnerability, and if it is a code type vulnerability, the vulnerability feature is information on the difference between the source code of the vulnerability and the repair code of the vulnerability. If it is a non-code type vulnerability, the vulnerability feature is the change information between the source file of the vulnerability and the repair file of the vulnerability.

2. The execution entity is an application program (APP) or system software corresponding to when a code file is executed on an android system, and the application program is various application programs such as a social application program and a shopping application program. ..

3. A test target machine cluster is a test machine for testing vulnerability features built on multiple test target machines, based on different android system versions, different processor architecture platforms, and different security patch versions. Yes, each test target machine supports one android system version, one processor architecture platform and one security patch version.

FIG. 1 is a schematic view of one application scene of the present application, and as shown in FIG. 1, the vulnerability feature acquisition device according to the present application is a known vulnerability vulnerability feature or a known vulnerability vulnerability feature. And to acquire the execution entity corresponding to each vulnerability feature, the execution entity may be an application program (APP) or system software, and the application program in it is, for example, a social application program or Known vulnerabilities, such as in shopping application programs, are, for example, vulnerabilities in Android systems scanned by vulnerability scanning software, or vulnerabilities in announcements already published on the official Android website. Vulnerability feature acquisition The vulnerability feature of the vulnerability acquired by the device, or the vulnerability feature and the corresponding execution entity, can be used for vulnerability detection, and overall, the Java reflection mechanism, It is implemented in possible vulnerability feature drive modes, including decompilation (outdump). Specifically, when detecting individual vulnerability features using a conventional detection method, for example, the corresponding feature detection code is compiled based on the vulnerability features, and the feature detection code is detected in the electronic device. Executes with the corresponding execution entity (if there is no execution entity, it is gradually executed one by one across the execution entities in the electronic device) and detects whether or not the vulnerability feature exists, thereby vulnerable. Achieve the purpose of detection. The electronic device detected therein may be an electronic device that uses an Android software system, for example, a mobile phone, a pocket personal computer, an in-vehicle device, or the like. The device for acquiring the vulnerability characteristics according to the present application can acquire the vulnerability characteristics of the known vulnerabilities of the android system online, and when the vulnerabilities appearing in the android system are updated, the updated vulnerabilities are vulnerable. Since sexual features can be acquired in real time, the efficiency of acquiring vulnerable features is improved and the maintenance cost of the system vulnerability database is reduced. Hereinafter, the process of acquiring the vulnerability characteristics will be described in detail with reference to the drawings.

FIG. 2 is a flowchart of Example 1 of the method for acquiring a vulnerability feature according to the present application, and the execution subject in this embodiment may be a device for acquiring a vulnerability feature as shown in FIG. 1, and the vulnerability The device for acquiring sexual characteristics may be a hardware device or a software module, and as shown in FIG. 2, the method of this embodiment can include the following steps.

S101, After acquiring the vulnerability patch information of the vulnerability, the type of the vulnerability is determined based on the vulnerability patch information, and the type includes a code type vulnerability and a non-code type vulnerability.

Among them, the acquisition of the vulnerability patch information of the vulnerability can be obtained from the Android official website security announcement information. Specifically, the Android official website security announcement information includes vulnerabilities such as public vulnerabilities. Information such as the identifier, reference number, type, severity and updated version of the Android Open Source Project (AOSP) of the exposure (Common Vulnerabilities and Exposures, CVE) is included and is described below. Table 1 such as Table 1 is an example of the content of security announcement information, in which the reference number carries a link for vulnerability patch information, and the type is remote instruction or code execution vulnerability (remote command / code). execut, RCE), and the severity includes high, medium and low.

To obtain the vulnerability patch information for a vulnerability, first determine the corresponding reference number based on the vulnerability identifier, and then obtain the corresponding vulnerability patch information based on the reference number. After obtaining the vulnerability patch information for a vulnerability, it is possible to determine whether the vulnerability type is a code type or a non-code type. If the vulnerability patch information includes the source code of the vulnerability and the repair code of the vulnerability, it can be determined that the type of the vulnerability is the code type, but the vulnerability patch information of the vulnerability is the vulnerability. If the source file and the repair file of the vulnerability are included, the type of the vulnerability can be determined to be a non-code type.

As something that needs to be explained, if the security announcement information contains multiple vulnerabilities, it is possible to obtain vulnerability patch information for multiple vulnerabilities at once, and for each vulnerability, it is possible to obtain individual vulnerabilities. If each vulnerability feature is acquired and one vulnerability is updated in the security announcement information within a certain period of time, one vulnerability patch information for the vulnerability is acquired at a time, and then Subsequent steps are executed to acquire the vulnerability characteristics of the one vulnerability.

Optionally, the vulnerability patch information of the vulnerability in the security announcement information may be acquired periodically according to the period of the preset, and the period of the preset may be half a month, one month, three months, six months, or the like. If a vulnerability is updated, the security announcement information is tracked in real time to obtain the updated vulnerability patch information, and the subsequent steps are performed to obtain the updated vulnerability. You can get the vulnerability characteristics.

S102, At least one vulnerability feature of a vulnerability is extracted based on a vulnerability analysis engine corresponding to the type of vulnerability.

Specifically, vulnerabilities of different types correspond to different vulnerability analysis engines, vulnerabilities of code type correspond to code analysis engines, and codes of different languages correspond to different code analysis engines, such as C / C ++. It supports code analysis engine, Java code analysis engine, kernel code analysis engine, etc. Non-code type vulnerabilities address file analysis engines, such as configuration file analysis engines.

Specifically, when the vulnerability analysis engine corresponding to the type of vulnerability is the C / C ++ code analysis engine, the C / C ++ code analysis engine analyzes the vulnerability patch information of the vulnerability and determines the characteristics of the vulnerability. If the vulnerability analysis engine corresponding to the type of vulnerability is the Java code analysis engine, the Java code analysis engine analyzes the vulnerability patch information of the vulnerability and extracts the characteristics of the vulnerability. If the vulnerability analysis engine corresponding to the type of vulnerability is the kernel code analysis engine, the kernel code analysis engine analyzes the vulnerability patch information of the vulnerability and extracts the characteristics of the vulnerability. If the corresponding vulnerability analysis engine is a configuration file analysis engine, the configuration file analysis engine analyzes the vulnerability patch information of the vulnerability and extracts the characteristics of the vulnerability. Different vulnerability analysis engines have different processes for analyzing and extracting the vulnerability characteristics of a vulnerability.

If there is at least one vulnerable feature for each vulnerability and there are multiple vulnerabilities, one vulnerable feature set is combined by the vulnerable features of a plurality of vulnerabilities.

In the case of a code type vulnerability, the vulnerability feature may be, for example, an increase or decrease in a function symbol, a class, or a displayable member definition of a class, or an increase or decrease in a unique character string in a code file. It may be a change in the code execution flow (for example, a jump to the library function XX is added). In the case of a non-code type vulnerability, the vulnerability feature is, for example, one of adding a string feature, deleting a string feature, modifying a string feature, adding a file, and deleting a file. Of these, the addition or deletion of files may be the addition or deletion of libraries.

S103, At least one vulnerability feature of the vulnerability is transmitted to the electronic device.

Specifically, at least one vulnerability feature of a vulnerability is transmitted to an electronic device and used for vulnerability detection in the electronic device.

After acquiring the vulnerability patch information of the vulnerability by the method of acquiring the vulnerability feature according to this embodiment, it is determined whether the vulnerability is a code type or a non-code type based on the vulnerability patch information. Confirm and extract at least one vulnerability feature of the vulnerability based on the vulnerability analysis engine corresponding to the type of vulnerability, and finally send at least one vulnerability feature of the vulnerability to the electronic device. .. Different types of vulnerabilities correspond to different vulnerability analysis engines, and since the vulnerability analysis engine is pre-assembled based on different types of vulnerabilities, get the vulnerability characteristics of the vulnerabilities online. , It is possible to improve the acquisition efficiency of the vulnerability feature, it is not necessary to analyze and acquire the vulnerability feature by a person, and the maintenance cost of the system vulnerability database is reduced.

FIG. 3 is a flowchart of Example 2 of the method for acquiring a vulnerability feature according to the present application, and the execution subject in this embodiment may be a device for acquiring a vulnerability feature as shown in FIG. 1, and FIG. As shown in, the method of this embodiment is based on the method as shown in FIG. 2, and can further include before S103 and also in step S104.

S104, For each vulnerability feature in at least one vulnerability feature, the execution entity of the vulnerability feature is determined based on the source code of the vulnerability feature or the code file containing the source file, and the vulnerability is vulnerable. Obtain sexual characteristics and execution entities.

Specifically, the executing entity is the corresponding application program (APP) or system software when the code file is executed on an android system, and detects if the only vulnerable feature is sent to the electronic device. Sometimes it is necessary to try the execution of the execution entity, the detection is slow, after acquiring the vulnerability feature of the vulnerability by S102, and also to determine the execution entity of each vulnerability feature and for subsequent vulnerability detection. It should be used for determining the corresponding execution entity for each vulnerability, thus improving the efficiency of vulnerability detection. Vulnerability Vulnerability The source code or source file of a vulnerability can be obtained based on the patch information, the source code corresponds to the code type vulnerability, and the source file corresponds to the non-code type vulnerability. What needs to be explained is that when there are a plurality of vulnerable features of one vulnerability, the execution entities of the plurality of vulnerable features may be the same or different.

Correspondingly, S103 may be specifically S103', and transmits at least one vulnerability feature of the vulnerability and the corresponding execution entity to the electronic device.

After acquiring the vulnerability patch information of the vulnerability by the method of acquiring the vulnerability feature according to this embodiment, it is determined whether the vulnerability is a code type or a non-code type based on the vulnerability patch information. Establish and extract at least one vulnerability feature of the vulnerability based on the vulnerability analysis engine corresponding to the type of vulnerability, and then, for each extracted vulnerability feature, the vulnerability feature The execution entity of the vulnerability feature is determined based on the code file in which the source code or the source file is, and finally, at least one vulnerability feature of the vulnerability and the corresponding execution entity are transmitted to the electronic device. Vulnerabilities of different types correspond to different vulnerability analysis engines, and since the vulnerability analysis engine is pre-assembled based on the different types of vulnerabilities, the vulnerability characteristics of the vulnerabilities and the corresponding execution entities. Can be acquired online, the efficiency of acquiring vulnerability features can be improved, there is no need to analyze and acquire vulnerability features by humans, and the maintenance cost of the system vulnerability database is reduced.

FIG. 4 is a flowchart of Example 3 of the method for acquiring a vulnerability feature according to the present application, and the execution subject in this embodiment may be a device for acquiring a vulnerability feature as shown in FIG. 1, and FIG. As shown in, the method of this embodiment can include the following steps.

S201, After acquiring the vulnerability patch information of the vulnerability, the type of the vulnerability is determined based on the vulnerability patch information, and the type includes a code type vulnerability and a non-code type vulnerability.

Among them, the acquisition of the vulnerability patch information of the vulnerability can be acquired from the Android official website security announcement information, and the specific acquisition process can be referred to the description of S101, which will not be explained repeatedly here. To do so. If the vulnerability patch information of the vulnerability includes the source code of the vulnerability and the repair code of the vulnerability, it can be determined that the type of the vulnerability is the code type. At this time, S202 is executed to execute the vulnerability. If the vulnerability patch information includes a vulnerability source file and a vulnerability repair file, it can be determined that the vulnerability type is a non-code type, and S203 is executed at this time.

S202, At least one vulnerability feature of a vulnerability is extracted based on a vulnerability analysis engine corresponding to a code type vulnerability.

Among them, code type vulnerabilities correspond to code analysis engines, and codes in different languages correspond to different code analysis engines such as C / C ++ code analysis engine, Java code analysis engine, and kernel code analysis engine.

As one feasible embodiment, S202 may be a step (not shown) of executing the following operations by a vulnerability analysis engine corresponding to a code type vulnerability.

S2021, vulnerable source code and vulnerable repair code are subjected to grammatical analysis of the corresponding coding language, and at least one difference information between the vulnerable source code and the vulnerable repair code is performed based on the grammatical analysis result. The difference information may be, for example, an increase or decrease in the function symbol, class or displayable member definition of the class, or an increase or decrease in a unique character string in the code file, and code execution. It may be a flow change (for example, a jump to the library function XX is added).

S2022, the vulnerability feature of the vulnerability is determined based on at least one difference information, and one difference information corresponds to one vulnerability feature, that is, after the difference information is determined, one difference information is one. Established as a vulnerability feature.

The vulnerability patch information of one of the following vulnerabilities is given as an example.
――― a / src / android, SkAandroidFrameworkUtils. cpp
+++ b src / android, SkAandroidFrameworkUtils. cpp
@@ -17,7 + 17,9 @@
# Include "effects / GrDisableColorXP.h"
# Endif // SK_SUPPORT_GPU
-# Ifdef SK_BUILD_FOR_ANDROID
＋ # ifdef SK_BUILD_FOR_ANDROID_FRAMWORK
＋
＋ # include <log / log. h>
# If SK_SUPPORT_GPU
Boolean SkAndroidFrameworkUtils :: clipWithStencil (skcanvas * canvas) {
@@ -52,5 +54,9 @@
}
# End if // SK_SUPPORT_GPU
-End if // SK_BUILD_FOR_ANDROID
+ Voice SKAndroidFrameworkUtils :: safe8Netlog (const char * bugNumer)
{
+ Android_errorwritelog (0x534e4554, bugNumer);
＋}
＋
＋ # end if // SK_BUILD_FOR_ANDROID_FRAMEWORK

In the above vulnerability patch information, the code that precedes the code with "-" is the source code of the vulnerability, and the code that precedes the code with "+" is the repair code of the vulnerability. , Of which "-end if // SK_BUILD_FOR_ANDROID"
+ Voice SKAndroidFrameworkUtils :: safe8Netlog (const char * bugNumer)
{
+ Based on "Android_errorwritelog (0x534e4554, bugNumer)"
It can be analyzed that the method "void SKAndroidFrameworkUtils :: safe8Netlog (const char * blogNumer)" has been added to the corresponding class realization, and the method "void SKAndroidFrameworkUtiles :: safnet It is a vulnerability feature.

In this embodiment, the vulnerability analysis engine corresponding to the vulnerability of the code type performs the grammatical analysis of the corresponding coding language for the source code of the vulnerabilities and the repair code of the vulnerabilities, and is vulnerable based on the results of the grammatical analysis. Obtain the vulnerability feature of a code type vulnerability online by determining at least one difference information between the sex source code and the vulnerability repair code, and determining one difference information as one vulnerability feature. It is possible to improve the acquisition efficiency of vulnerability features.

S203, At least one vulnerability feature of a vulnerability is extracted based on a vulnerability analysis engine corresponding to a non-code type vulnerability.

Non-code type vulnerabilities address file analysis engines, such as configuration file analysis engines. As one feasible embodiment, S203 may be a step (not shown) of executing the following operations by a vulnerability analysis engine corresponding to a non-code type vulnerability.

S2031, at least one change information between the vulnerability source file and the vulnerability repair file is confirmed, and the change information is the addition of the character string feature, the deletion of the character string feature, the correction of the character string feature, and the file. It includes any one of addition and deletion of files, of which the addition or deletion of files may be the addition or deletion of libraries.

S2032, the code file containing the source file of the vulnerability is determined, and the code file containing the source file of the vulnerability is searched for whether or not any change information is unique with at least one change information.

S2033, the unique change information is determined as the vulnerability feature of the vulnerability.

In this embodiment, a vulnerability analysis engine for non-code type vulnerabilities determines change information between a vulnerability source file and a vulnerability repair file, and a code file containing the vulnerability source file. Then, it searches whether or not each change information has uniqueness, and determines the unique change information as the vulnerability feature of the vulnerability. As a result, it is possible to acquire the vulnerability features of non-code type vulnerabilities online, and improve the efficiency of acquiring the vulnerability features.

S204, for each vulnerability feature in at least one of the vulnerability features, the source code of the vulnerability feature or the execution entity of the vulnerability feature is determined based on the code file in which the source file exists, and the execution entity of the vulnerability feature is determined. Obtain the vulnerability feature and execution entity.

Among them, as one feasible embodiment, the step of determining the execution entity of the vulnerability feature based on the source code of the vulnerability feature or the code file in which the source file is located is specifically.
S2041, the step of determining the source code of the vulnerability feature or the code file containing the source file,
S2042, compilation of code file A step of searching for an execution entity of a code file from a configuration file and determining an execution entity of a vulnerability feature based on the execution entity of the code file may be included (both not shown).

Of these, each version of the system corresponds to one compile configuration file, and since the compile configuration file remembers the mapping relationship between the code file and the corresponding execution entity, the code from the compile configuration file of the code file The execution entity of the file can be found, and the execution entity of the vulnerability feature can be determined based on the execution entity of the code file. Determining the execution entity of a vulnerability feature can facilitate subsequent vulnerability detection. Specifically, when detecting individual vulnerability features, the corresponding feature detection code is compiled based on the vulnerability features, and the feature detection code is executed by the corresponding execution entity in the detected electronic device to execute the vulnerability. By detecting whether or not a feature exists, the purpose of vulnerability detection can be achieved and the efficiency of detection can be improved.

Based on the example shown in any one of FIGS. 2 to 4, it is also possible to further verify the acquired vulnerability features and improve the accuracy of acquiring the vulnerability features, which is shown in FIG. Taking such a method as an example, FIG. 5 is a flowchart of Example 4 of the method for acquiring a vulnerability feature according to the present application. As shown in FIG. 5, the method of this example is described after S204 and as follows. Steps can be included.

S205, At least one vulnerability feature of the vulnerability is tested and verified by a pre-built test target machine cluster, and the vulnerability feature that passes the verification is obtained, and the test target machine cluster is a test target in which the vulnerability is repaired. Includes machines and test target machines for which vulnerabilities have not been repaired.

Of these, test target machine clusters are multiple test target machines built on different android system versions, different processor architecture platforms, and different security patch versions, and test target machine clusters are test targets for which vulnerabilities have been fixed. The machine and the test target machine where the vulnerability has not been repaired must be included. In the test target machine where the vulnerability has been repaired, the vulnerability feature is not detected, and in the test target machine where the vulnerability has not been repaired, the test target machine has not been repaired. Vulnerability features are detected, thereby ensuring the accuracy of the acquired vulnerability features, and the test target machine may be jointly built by a virtual machine (Gen8motion virtual machine) and a real machine. Among them, the Gen8motion virtual machine is an android emulator and provides an Android virtual environment. Since the test target machine cluster is built on different android system versions, different processor architecture platforms and different security patch versions, one android system version, one processor architecture platform and one processor architecture platform for each test target machine. It supports security patch versions, which ensures completeness and accuracy of verification.

S206, the vulnerability feature that has passed the verification is determined as the vulnerability feature of the vulnerability.

The acquired vulnerabilities are tested and verified on a pre-built test target machine cluster, and the vulnerabilities and execution entities that pass the verification are the vulnerabilities of the final vulnerability, thereby ensuring the accuracy of the vulnerability acquisition. Can be improved and the false positive rate of vulnerability features can be reduced.

When selectively obtaining the verification-failed vulnerability feature in S205, the method of this embodiment can further include step S207 to display the verification-failed vulnerability feature.

The verification-failed vulnerability feature is displayed to the user, the user (that is, the developer) analyzes the cause of the verification-failed vulnerability feature, and the cause of the verification-failed vulnerability feature is executed. It can include any one of undiscovered entity, undiscovered vulnerability feature in the corresponding execution entity, undiscovered difference in vulnerability feature in the control version of the corresponding execution entity, and lack of execution permission. After the user analyzes the cause, the cause of the vulnerable feature that failed the verification can be entered. Furthermore, the method of this embodiment can further include the following steps.

S208, Receives the cause of the validation-failed vulnerability feature entered by the user, and adds or modifies the vulnerability analysis engine based on the cause of the validation-failed vulnerability feature. .. It assists in the acquisition of accurate vulnerability features, improves the accuracy of vulnerability acquisition, and reduces the false detection rate of vulnerability features.

By the method of acquiring the vulnerability feature according to this example, the acquired vulnerability feature is tested and verified on a pre-built test target machine cluster, and the vulnerability feature and the execution entity that pass the verification are the final vulnerability. Add or modify the vulnerability analysis engine based on the cause of the user-entered validation-failed vulnerability feature, which is a feature and execution entity and has failed validation. By doing so, it is possible to assist the acquisition of accurate vulnerability features, improve the accuracy of vulnerability acquisition, and reduce the false detection rate of vulnerability features.

FIG. 6 is a schematic view of the structure of the vulnerability feature acquisition device according to the present application. As shown in FIG. 6, the vulnerability feature acquisition device 100 of the present embodiment includes the acquisition module 11, the confirmation module 12, and the extraction. The module 13 and the transmission module 14 can be included, of which the acquisition module 11 is used to acquire the vulnerability patch information of the vulnerability, and the confirmation module 12 is based on the vulnerability patch information. It is used to determine the type of vulnerability, and the type includes code type and non-code type vulnerabilities, and the extraction module 13 becomes a vulnerability analysis engine corresponding to the type of vulnerability. It is used to extract at least one vulnerability feature of a vulnerability based on it, and the transmission module 14 is used to transmit at least one vulnerability feature of the vulnerability to an electronic device. Is.

In addition, the deterministic module 12 also refers to the source code of the vulnerability feature or the execution entity of the vulnerability feature based on the code file in which the source file is located, for each vulnerability feature in at least one of the vulnerability features. Is used to determine.

Correspondingly, the transmission module 14 is used to transmit at least one vulnerability feature of the vulnerability and the corresponding execution entity to the electronic device.

Optionally, the vulnerability patch information includes the source code of the vulnerability and the repair code of the vulnerability, and the extraction module 12 is provided by the vulnerability analysis engine corresponding to the type of the vulnerability.
Perform grammatical analysis of the corresponding coding language for the source code of the vulnerability and the repair code of the vulnerability.
Determine at least one difference information between the vulnerability source code and the vulnerability repair code based on the grammatical analysis results, determine the vulnerability characteristics of the vulnerability based on at least one difference information, and determine one difference information. Is used to perform an operation that corresponds to one vulnerable feature.

Optionally, the vulnerability patch information includes the vulnerability source file and the vulnerability repair file, and the extraction module 12 contains.
With a vulnerability analysis engine that corresponds to the type of vulnerability
Establish at least one change information between the vulnerability source file and the vulnerability repair file, and the change information includes adding string features, removing string features, modifying string features, adding files, and so on. Including any one of the file deletions
Determine the code file that contains the source file of the vulnerability, and search the code file that contains the source file of the vulnerability to see if any change information is unique with at least one change information.
It is used to perform operations that determine unique change information as a vulnerability feature of a vulnerability.

Further, the confirmation module 12 is
Determine the source code of the vulnerability feature or the code file that contains the source file,
Compile code file This is used to find the execution entity of the code file in the configuration file and determine the execution entity of the vulnerability feature based on the execution entity of the code file.

The apparatus of this embodiment can be used to carry out the technical solution of the embodiment of the method as shown in FIG. 2 or FIG. 3 or FIG. Therefore, I will not repeat it here.

FIG. 7 is a schematic structural diagram of the vulnerability feature acquisition device according to the present application. As shown in FIG. 7, the vulnerability feature acquisition device 200 of the present embodiment is based on the device as shown in FIG. In addition, verification module 15 can be included, of which
The verification module 15 is used to test-verify at least one of the vulnerability features of the vulnerability by a pre-built test target machine cluster to obtain a test target machine cluster that has passed the verification. Includes test target machines with repaired vulnerabilities and test target machines without repaired vulnerabilities.
The confirmation module 14 is also used to determine the vulnerability feature that has passed the verification as the vulnerability feature of the vulnerability.

Optionally, the test target machine cluster is built on different android system versions, different processor architecture platforms and different security patch versions.

The device of this embodiment can be used to carry out the technical solution of the embodiment of the method as shown in FIG. 5, and since its realization principle and technical effect are similar, it is repeated here. I will not explain it.

FIG. 8 is a schematic structural diagram of the vulnerability feature acquisition device according to the present application. As shown in FIG. 8, the vulnerability feature acquisition device 300 of the present embodiment is based on the device as shown in FIG. Further, a display module 16 can be included, and the display module 16 is used to display the verification-failed vulnerability feature when the verification-failed vulnerability feature is obtained.

Further, a receiving module 17 and a processing module 18 can be included, of which the receiving module 18 is used to receive the cause of the failed validation feature input by the user and process. Module 19 is used to add or modify a vulnerability analysis engine based on the cause of the failure feature of the vulnerability.

The device of this embodiment can be used to carry out the technical solution of the embodiment of the method as shown in FIG. 5, and since its realization principle and technical effect are similar, it is repeated here. I will not explain it.

According to the embodiments of the present application, the present application further provides electronic devices and readable storage media.

As shown in FIG. 9, FIG. 9 is a block diagram of an electronic device for realizing a method of acquiring a vulnerability feature according to an embodiment of the present application. Electronic devices are intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbench, personal digital assistants, servers, blade servers, large computers, and other suitable computers. .. Electronic devices can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smart phones, wearable devices and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely exemplary and limit the realization of the present application as described and / or as required by the text. Not intended.

As shown in FIG. 9, the electronic device includes one or more processors 801 and memory 802, and an interface for connecting each component, and the interface includes a high-speed interface and a low-speed interface. The individual components are connected to each other using different buses and can be installed on the public mainboard or otherwise installed as needed. The processor can process instructions executed within an electronic device, either in memory or for displaying GUI graphics information on an external input / output device (such as a display device coupled to an interface). It even includes instructions stored in memory. In other embodiments, it may be used with a plurality of processors and / or a plurality of buses and a plurality of memories, if necessary. Similarly, it may be connected to a plurality of electronic devices and each device may partially provide necessary operations (for example, a server array, a set of blade servers, or a multiprocessor system). In FIG. 9, one processor 801 is taken as an example.

The memory 802 is a non-temporary computer-readable storage medium according to the present application. Among them, the memory stores instructions that can be executed by at least one processor, and the at least one processor executes the method for acquiring the vulnerability feature according to the present application. The non-temporary computer-readable storage medium of the present application stores computer instructions, and the computer instructions are for causing a computer to execute a method for acquiring a vulnerability feature according to the present application.

The memory 802 is a non-temporary computer-readable storage medium, and is a program instruction / module (for example, acquisition module 11, confirmation module 12, extraction as shown in FIG. 6) corresponding to the acquisition method of the vulnerability feature in the embodiment of the present application. It may be used to store non-temporary software programs such as module 13 and transmit module 14), non-temporary computer-executable programs and modules. Processor 801 executes various functional applications and data processing of the server by executing non-temporary software programs, instructions and modules stored in memory 802, ie, vulnerable in the embodiments of the above method. The method of acquiring sexual characteristics will be realized.

The memory 802 can include a program storage area and a data storage area, of which the program storage area can store the operating system, the application program required for at least one function, and the data storage area is in the vehicle. Update of electronic control unit Data that is newly created by using electronic devices can be stored. Memory 802 can also include fast random access memory and also includes non-temporary memory such as at least one magnetic disk storage device, flash memory device, or other non-temporary solid-state storage device. You can also do it. In some embodiments, the memory 802 can selectively include memories that are remotely located relative to the processor 801 and those remote memories provide a method of acquiring vulnerability features via the network. Can be connected to electronic devices for Examples of the above networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The electronic device of the method of acquiring the vulnerability feature can further include an input device 803 and an output device 804. The processor 801 and the memory 802, the input device 803, and the output device 804 may be connected by a bus or other method, and FIG. 9 shows an example of a method in which the processor 801 is connected by a bus.

The input device 803 can receive the input numerical or character information and generate the input of the key signal related to the user setting and function control of the electronic device, and can generate the input of the touch screen, the key pad, the mouse, the track pad, and the like. Input devices such as touchpads, indicator rods, one or more mouse buttons, trackballs, control handles and the like. The output device 804 can include a display device, an auxiliary lighting device (LED or the like), a tactile feedback device (vibration motor or the like), or the like. The display device can include, but is not limited to, a liquid crystal display (LCD), a light emitting diode (LED) display, or a plasma display. In some embodiments, the display device may be a touch screen.

The systems and various technical embodiments described herein are realized by digital electronic circuits, integrated circuit systems, application specific ASICs (ASICs), computer hardware, firmware, software, and / or combinations thereof. May be done. The various embodiments thereof may include embodiments implemented in one or more computer programs, the one or more computer programs being executed and / or in a programmable system including at least one programmable processor. It can be interpreted that the programmable processor may be a purpose-built or general purpose programmable processor, receiving data or instructions from a storage system, at least one input device, or at least one output device. Then, data or instructions can be transmitted to the storage system, the at least one input device, or the at least one output device.

These computer programs (also called programs, software, software applications, or code) include programmable processor machine instructions that allow these computer programs to be advanced processes and / or object-oriented programming languages and / or assembly language / machines. It can be implemented using language. For example, the terms "machine-readable medium" and "computer-readable medium" as used herein refer to any computer program product, device, and / or device for providing machine instructions and / or data to a programmable processor. It refers to a magnetic disk, an optical disk, a memory, a programmable logic device (PLD), etc.) and includes a machine-readable medium that receives a machine command as a machine-readable signal. The term "machine readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

According to an embodiment of the present application, a computer program is further provided, the computer program is stored in a computer-readable storage medium, and at least one processor of an electronic device can read the computer program from the computer-readable storage medium, and at least one. One processor causes an electronic device to perform the method described in the above embodiment by executing a computer program.

To provide interaction with the user, the systems and techniques described herein can be implemented on a computer, which is a display device (CRT (cathode tube) or LCD (liquid crystal) for displaying information to the user. There is a display) monitor, etc.), and a keyboard or pointing device (mouse, trackball, etc.), and the user can provide input to the computer through the keyboard or the pointing device. Other types of devices can be used to provide interaction with the user, for example, the feedback provided to the user may be any form of sensory feedback (visual feedback, auditory feedback, or tactile feedback, etc.) ), And the input from the user can be received in any form (including sound input, voice input or tactile input).

The systems and technologies described herein are for computer systems that include background components (such as acting as a data server), for computer systems that include middleware components (such as application servers), or for computer systems that include front-end components. (A user, such as a user computer with a graphical user interface or a network browser, can use the graphical user interface or the network browser to provide instructions with embodiments and techniques according to the systems and techniques described herein. ) Or any combination of such background components, middleware components, or front-end components may be implemented in a computer system. The components of the system can be interconnected in any form or through digital data communication of the medium (such as a communication network). Communication networks typically include local area networks (LANs), wide area networks (WANs), and the Internet.

The computer system can include a client terminal and a server. Client terminals and servers are generally far apart from each other and provide traction through communication networks. The relationship between the client terminal and the server is built up by executing on the corresponding computer and by computer programs that have a relationship of the client terminal and the server with each other.

According to the technical solution of the embodiment of the present application, after obtaining the vulnerability patch information of the vulnerability, whether the vulnerability is a code type or a non-code type is determined based on the vulnerability patch information. Determine and extract at least one vulnerability feature of the vulnerability based on the vulnerability analysis engine corresponding to the type of vulnerability, and finally, for each extracted vulnerability feature, the vulnerability feature By determining the execution entity of the vulnerability feature based on the source code or the code file in which the source file is located, the vulnerability feature and the execution entity of the vulnerability are obtained. Different types of vulnerabilities correspond to different vulnerability analysis engines, and since the vulnerability analysis engine is pre-assembled based on different types of vulnerabilities, get the vulnerability characteristics of the vulnerabilities online. , It is possible to improve the acquisition efficiency of the vulnerability feature, it is not necessary to analyze and acquire the vulnerability feature by a person, and the maintenance cost of the system vulnerability database is reduced.

It should be understood that the various forms of flow shown above can be used to rearrange, increase, or delete steps. For example, each step described in the present application may be performed in parallel, in sequence, or in order, as long as the desired results of the technical solutions disclosed in the present application are achieved. The text is not limited here, as it may be executed in a disorderly manner.

The specific embodiments described above do not constitute a limitation on the scope of protection of the present application. Those skilled in the art should understand that various modifications, combinations, subcombinations and alternatives based on design requirements and other factors are possible. All modifications, equivalent replacements or improvements made within the spirit or principles of the present application should be included in the scope of protection of the present application.

Claims (22)

After obtaining the vulnerability patch information of the vulnerability, the type of the vulnerability is determined based on the vulnerability patch information, and the steps including the code type vulnerability and the non-code type vulnerability are included.
Steps to extract at least one vulnerability feature of the vulnerability based on the vulnerability analysis engine corresponding to the type of vulnerability, and
A step of transmitting at least one vulnerability feature of the vulnerability to an electronic device,
How to get the vulnerability features, including. The method of acquiring the vulnerability feature is further described.
For each vulnerability feature in at least one of the vulnerability features, the step includes determining the execution entity of the vulnerability feature based on the source code of the vulnerability feature or the code file in which the source file is located.
The step of transmitting at least one vulnerability feature of the vulnerability to an electronic device is
Including the step of transmitting at least one vulnerability feature of the vulnerability and the corresponding executing entity to the electronic device.
The method for acquiring the vulnerability feature according to claim 1. The vulnerability patch information of the vulnerability includes the source code of the vulnerability and the repair code of the vulnerability, and at least one of the vulnerabilities is based on the vulnerability analysis engine corresponding to the type of the vulnerability. The step of extracting the feature is
By the vulnerability analysis engine corresponding to the above type of vulnerability
Perform grammatical analysis of the corresponding coding language for the source code of the vulnerability and the repair code of the vulnerability.
Based on the grammatical analysis result, at least one difference information between the source code of the vulnerability and the repair code of the vulnerability is determined, and the vulnerability characteristic of the vulnerability is determined based on the at least one difference information. Including the step of performing an operation such that one difference information corresponds to one vulnerability feature,
The method for acquiring the vulnerability feature according to claim 1. The vulnerability patch information of the vulnerability includes the source file of the vulnerability and the repair file of the vulnerability, and at least one of the vulnerabilities is based on the vulnerability analysis engine corresponding to the type of the vulnerability. The step of extracting the feature is
By the vulnerability analysis engine corresponding to the above type of vulnerability
The change information of at least one of the source file of the vulnerability and the repair file of the vulnerability is confirmed, and the change information includes addition of a character string feature, deletion of a character string feature, modification of a character string feature, addition of a file, and so on. Including any one of the file deletions
The code file containing the source file of the vulnerability is determined, and the code file containing the source file of the vulnerability is searched for whether or not any change information is unique with at least one change information.
Including the step of performing an operation that determines the unique change information as the vulnerability feature of the vulnerability.
The method for acquiring the vulnerability feature according to claim 1. The step of determining the execution entity of a vulnerability feature based on the source code of the vulnerability feature or the code file in which the source file is located is
Steps to determine the source code or code file containing the source code for the vulnerability feature,
A step of searching for the execution entity of the code file from the compilation configuration file of the code file and determining the execution entity of the vulnerability feature based on the execution entity of the code file.
2. The method for acquiring a vulnerability feature according to claim 2. The method of acquiring the vulnerability feature is further described.
At least one of the vulnerability characteristics of the vulnerability is tested and verified by a pre-built test target machine cluster, and the vulnerability characteristics that pass the verification are obtained, and the test target machine cluster is a test target in which the vulnerability is repaired. Steps that include the machine and the test target machine for which the vulnerability has not been repaired,
The step of determining the vulnerability feature that passed the verification as the vulnerability feature of the vulnerability, and
The method for acquiring a vulnerability feature according to any one of claims 1 to 5, including. The test target machine cluster was built on different android system versions, different processor architecture platforms and different security patch versions.
The method for acquiring the vulnerability feature according to claim 6. The method of acquiring the vulnerability feature is further described.
When a verification-failed vulnerability feature is obtained, the step of displaying the verification-failed vulnerability feature is included.
The method for acquiring the vulnerability feature according to claim 6. The method of acquiring the vulnerability feature is further described.
The step of receiving the cause of the vulnerability feature of the verification failure entered by the user, and
Steps to add a vulnerability analysis engine or modify the vulnerability analysis engine based on the cause of the above-mentioned failed verification vulnerability feature, and
8. The method for acquiring a vulnerability feature according to claim 8. The acquisition module used to acquire the vulnerability patch information of the vulnerability, and
A verifier module that is used to determine the type of the vulnerability based on the vulnerability patch information, and the type includes a code type vulnerability and a non-code type vulnerability.
An extraction module used to extract at least one vulnerability feature of the vulnerability based on the vulnerability analysis engine corresponding to the type of vulnerability.
A transmission module used to transmit at least one vulnerability feature of the vulnerability to an electronic device.
A device for acquiring vulnerability characteristics, including. The confirmation module also
For each vulnerability feature in at least one of the vulnerability features, the source code of the vulnerability feature or the source file is used to determine the execution entity of the vulnerability feature based on the code file.
The transmission module
Used to send at least one vulnerability feature of the vulnerability and the corresponding executing entity to an electronic device.
The device for acquiring a vulnerability feature according to claim 10. The vulnerability patch information of the vulnerability includes the source code of the vulnerability and the repair code of the vulnerability.
By the vulnerability analysis engine corresponding to the above type of vulnerability
Perform grammatical analysis of the corresponding coding language for the source code of the vulnerability and the repair code of the vulnerability.
Based on the grammatical analysis result, at least one difference information between the source code of the vulnerability and the repair code of the vulnerability is determined, and the vulnerability characteristic of the vulnerability is determined based on the at least one difference information. One variance information is used to perform an operation that corresponds to one vulnerable feature,
The device for acquiring a vulnerability feature according to claim 10. The vulnerability patch information of the vulnerability includes the source file of the vulnerability and the repair file of the vulnerability.
By the vulnerability analysis engine corresponding to the above type of vulnerability
The change information of at least one of the source file of the vulnerability and the repair file of the vulnerability is confirmed, and the change information includes addition of a character string feature, deletion of a character string feature, modification of a character string feature, addition of a file, and so on. Including any one of the file deletions
The code file containing the source file of the vulnerability is determined, and the code file containing the source file of the vulnerability is searched for whether or not any change information is unique with at least one change information.
Used to perform an operation that establishes unique change information as a vulnerability feature of the vulnerability.
The device for acquiring a vulnerability feature according to claim 10. The confirmation module is
Determine the source code or code file containing the source code of the above-mentioned vulnerability feature,
It is used to find the execution entity of the code file from the compilation configuration file of the code file and determine the execution entity of the vulnerability feature based on the execution entity of the code file.
The device for acquiring a vulnerability feature according to claim 11. The vulnerability feature acquisition device also
At least one of the vulnerability features is tested and validated by a pre-built test target machine cluster, and is used to obtain a valid vulnerability feature, and the test target machine cluster is repaired. Includes a verification module that contains a test target machine that has been tested and a test target machine that has not been repaired for vulnerabilities.
The determination module is also used to determine the pass-verification vulnerability feature as the vulnerability feature of the vulnerability.
The device for acquiring a vulnerability feature according to any one of claims 10 to 14. The test target machine cluster was built on different android system versions, different processor architecture platforms and different security patch versions.
The device for acquiring a vulnerability feature according to claim 15. The vulnerability feature acquisition device further
Includes a display module used to display the failed validation feature when a failed validation feature is obtained.
The device for acquiring a vulnerability feature according to claim 15. The vulnerability feature acquisition device further
The receiving module used to receive the cause of the failed validation feature entered by the user, and the receiving module.
A processing module used to add a vulnerability analysis engine or modify the vulnerability analysis engine based on the cause of the failure feature of the above-mentioned verification failure.
The device for acquiring a vulnerability feature according to claim 17. Includes at least one processor and memory connected to communicate with at least one processor, of which
An instruction that can be executed by the at least one processor is stored in the memory, and when the instruction is executed by the at least one processor, the at least one processor can be any of claims 1 to 9. You will be able to execute the method for acquiring vulnerability features described in Section 1.
Electronics. A non-temporary computer-readable storage medium in which computer instructions are stored, the computer instructions for causing a computer to execute the method for acquiring a vulnerability feature according to any one of claims 1 to 9. Is a readable storage medium. How to get the vulnerability characteristics
After acquiring the vulnerability patch information of the vulnerability, the step of determining the type of the vulnerability based on the vulnerability patch information, and
Steps to extract at least one vulnerability feature of the vulnerability based on the vulnerability analysis engine corresponding to the type of vulnerability, and
A step of transmitting at least one vulnerability feature of the vulnerability to an electronic device,
How to get the vulnerability features, including. A computer program that, when executed by a processor, causes a computer to execute the method for acquiring a vulnerability feature according to any one of claims 1 to 9.

Images