Fine-grained source code vulnerability detection method based on graph neural network

Abstract

The invention discloses a fine-grained source code vulnerability detection method based on a graph neural network, which comprises the following steps: A, for all source codes of software, extractinga code attribute graph of a function in the source codes, and performing vectorization representation on the code attribute graph, the vectorization representation comprising vectorization representation of node attributes and graph structures; B, extracting code features by using a graph attention network, and processing all statements to obtain a final data set; and C, training a vulnerability detection model, and determining a final model through the effect on the test set. The source code vulnerability detection method provided by the invention has the advantages that the automation degreeis higher; dependence on domain expert knowledge is reduced, code auditing cost is greatly saved, code auditing efficiency is improved, grammar and semantic information in source codes are better reserved, meanwhile, vectorized representation of statements can be learned purposefully through a graph attention network, and vulnerability detection of a finer-grained statement level is achieved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a fine-grained source code vulnerability detection method based on a graph neural network. Background technique [0002] As an indispensable part of the information society, software is playing an increasingly important role. It is not only inseparable from personal daily life but also closely related to the development of society. However, software is a double-edged sword. While it provides convenient services for individuals and society, potential loopholes in software may also cause great losses to individuals and society. Vulnerabilities in software are often inevitable. On the one hand, it is difficult to avoid problems in the process of software design, development, and deployment. On the other hand, due to commercial benefits, the software development cycle cannot be too long, which further increases the There is a risk of software vulnerabilities. In order to r...

AI Technical Summary

Problems solved by technology

[0004] In view of the above-mentioned defects of the prior art, the technical problem to be solved by the present invention is to provide a fine-grained source code vulnerability detection method based on a graph neural network, using a code attribute graph as an intermediate representation of source code, and using a graph attention network to learn The vector representation of the sentence, finally combined with the deep neural network to realize the fine-grained vulnerability detection at the sentence level, solves the problems of the existing vulnerability detection methods, such as high false negative rate, heavy reliance on domain expert knowledge, excessive detection granularity, and lack of suitable intermediate representation in the source code

Images