A software defect automatic detection method based on an open source code library

Abstract

The invention discloses a software defect automatic detection method based on an open source code library. The software defect automatic detection method comprises a bidirectional LSTM framework related to a source code feature extraction technology, a word vector representation method in natural language processing and a deep learning technology. The detection method is based on a code change record in a large-scale open source code warehouse Github. Through acquiring a large number of defect codes in the code changing process and using a static code analysis technology, data stream characteristics of defect code fragments are extracted, a code defect detection model is designed by the aid of a bidirectional LSTM framework in deep learning, technical support is provided for code defect static detection, defect detection on target files is achieved, and accurate vulnerability positions are reported on the premise of low missing report rate.

Description

technical field [0001] The invention relates to the field of code auditing, in particular to an automatic detection method for software defects based on an open source code base. Background technique [0002] Software vulnerabilities and system vulnerabilities are the core threats to network security. Therefore, vulnerability detection technology has always been a core research topic of network security. According to the standard of whether to execute the target program during the detection process, software security vulnerability detection technology is divided into dynamic detection technology and static detection technology. Among them, the dynamic detection technology injects test data during the running of the program to observe whether the program is running normally and whether the output conforms to the intention of the program, so as to achieve the purpose of finding program loopholes. Dynamic testing only focuses on the external performance of the program running....

AI Technical Summary

Problems solved by technology

[0006] Aiming at the problem that the existing code defect static detection technology relies on manually defined patterns and has a high rate of false positives, the present invention proposes an automatic software defect detection method based on an open-source code base, which realizes defect detection on target files and prevents false negatives from occurring during false positives. The ability to report the exact location of a vulnerability in a low-rate premise

Images