RULE DESCRIPTION LANGUAGE FOR SOFTWARE VULNERABILITY DETECTION

摘要

According to an embodiment of the present invention, a method for detecting a security weakness of a software comprises the steps of: parsing a source code of a target software; generating a flow graph including a data flow and a control flow after parsing the source code; writing and storing a pattern of a security weakness with an independent rule description language by generating the flow graph; and searching the flow graph based on a preset standard to detect the security weakness by analyzing the pattern of the security weakness in the specification written by the rule description language.