Method and system for classifying software vulnerabilities

Abstract

The invention provides a method and system for classifying software loopholes. The classification method uses the Skip-gram language model to train and generate vulnerability word vectors, and maps the words in each vulnerability text to a limited-dimensional space to represent semantic information, reducing the sparsity of the word vectors, and then Making full use of the advantages of convolutional neural network and cyclic neural network to extract features and represent semantic information, a C-GRU neural network model is constructed, using convolutional neural network to extract local features of text vectors, and using GRU to extract global features related to text context , to fuse the features extracted by the two complementary models. The present invention overcomes the technical defect that the machine learning algorithm-based automatic classification method for loopholes is not very effective in dealing with high-dimensional and sparse problems, and cannot extract text features and representational semantic information well, while ignoring specific loophole information. Improved software classification accuracy.

Description

technical field [0001] The invention relates to the field of software loophole detection, in particular to a software loophole classification method and system. Background technique [0002] With the rapid development of information technology, the application of the Internet and computers has penetrated into various industries. From energy, transportation, production, military, medical care to people's daily life, they are inseparable from the support of the Internet. While information technology brings us great convenience, it also brings huge risks and hidden dangers. In recent years, frequent computer security incidents, such as information systems being attacked and causing confidential information leakage, private data loss and other major loss security incidents, have brought huge losses to major enterprises, organizations and individuals, and caused computer The cause of the security incident is that the loopholes of the system are exploited by malicious attacks. T...

AI Technical Summary

Problems solved by technology

[0004] However, due to the large number and types of software vulnerabilities, the description information of each vulnerability is relatively small, so that each vulnerability presents a high-dimensional and sparse feature in the generated word vector space

These automatic vulnerability classification methods based on machine learning algorithms are not very effective in dealing with high-dimensional and sparse problems, and cannot extract text features and represent semantic information well, while ignoring specific vulnerability information, which makes software vulnerability classification difficult. Not very accurate

Images