Source code vulnerability detection method, detector and training method and system thereof

Abstract

The invention discloses a source code vulnerability detection method, a detector and a training method and system thereof. The method comprises the steps of generating an abstract syntax tree based on each function in a source code, traversing all the abstract syntax trees, searching the code elements capable of being matched with the same vulnerability syntax feature, calling the code elements as the candidate vulnerability elements, and determining all the candidate vulnerability elements; based on a program slicing technology, identifying the code statements in semantic association with each candidate vulnerability element in the source code to determin the corresponding candidate vulnerability code segments, and adding the vulnerability labels to the candidate vulnerability code segments; and inputting the vector data corresponding to each candidate vulnerability code segment into a neural network model, and training the neural network model based on the label of each candidate vulnerability code segment to obtain a vulnerability detector. Based on the deep neural network, the vulnerability syntax features are extracted through a universal framework, the method is not limited to the vulnerability types and is high in expandability.

Description

technical field [0001] The present invention relates to the field of loophole detection, and more specifically, to a source code loophole detection method, a detector, and a training method and system thereof. Background technique [0002] At present, most of the security problems come from unreasonable compilation of source codes. Although developers' code security awareness is improving, security problems in software are still becoming more and more prominent. According to the report of the National Vulnerability Database (NVD) in the United States, more than 13,400 vulnerabilities were recorded globally in 2017, more than twice the number of vulnerability records in 2016, and this number is still rising. Therefore, vulnerability is a problem that cannot be underestimated in software systems, and the solution to this problem is to use effective vulnerability detection technology to discover and repair vulnerabilities. [0003] Static vulnerability detection based on sourc...

AI Technical Summary

Problems solved by technology

[0007] Aiming at the defects of the prior art, the purpose of the present invention is to solve the technical problems of the existing vulnerability detection technology, such as large manual participation, coarse granularity, and few types of vulnerabilities involved.

Images