Software vulnerability classification method and system

Abstract

The invention provides a software vulnerability classification method and system. Skip-is used in the classification method. The classification method comprises the following steps: training and generating vulnerability word vectors by using a Skip-gram language model; mapping words in each vulnerability text into a space with a limited dimension, to represent semantic information, thereby reducing the sparsity of the word vector; then, fully using the advantages of feature extraction and semantic information representation of the convolutional neural network and the recurrent neural network;constructing a C-GRU neural network model, using a convolutional neural network to extract local features of text vectors, using a GRU to extract global features related to text contexts, and fusing the features extracted by the two complementary models. According to the method, the technical defects that an automatic vulnerability classification method based on a machine learning algorithm is poor in effect of processing high-dimensional and sparse problems, text features and representation semantic information cannot be well extracted, and specific vulnerability information is ignored are overcome, and the software classification accuracy is improved.

Description

technical field [0001] The invention relates to the field of software loophole detection, in particular to a software loophole classification method and system. Background technique [0002] With the rapid development of information technology, the application of the Internet and computers has penetrated into various industries. From energy, transportation, production, military, medical care to people's daily life, they are inseparable from the support of the Internet. While information technology brings us great convenience, it also brings huge risks and hidden dangers. In recent years, frequent computer security incidents, such as information systems being attacked and causing confidential information leakage, private data loss and other major loss security incidents, have brought huge losses to major enterprises, organizations and individuals, and caused computer The cause of the security incident is that the loopholes of the system are exploited by malicious attacks. T...

AI Technical Summary

Problems solved by technology

[0004] However, due to the large number and types of software vulnerabilities, the description information of each vulnerability is relatively small, so that each vulnerability presents a high-dimensional and sparse feature in the generated word vector space

These automatic vulnerability classification methods based on machine learning algorithms are not very effective in dealing with high-dimensional and sparse problems, and cannot extract text features and represent semantic information well, while ignoring specific vulnerability information, which makes software vulnerability classification difficult. Not very accurate

Images