Function-level code vulnerability detection method based on slice attribute graph representation learning

Abstract

The invention discloses a function-level code vulnerability detection method based on slice attribute graph representation learning, and the method comprises the steps: firstly introducing a new slice criterion, proposing the concept of a slice attribute graph, and generating a slice attribute graph of a code based on the slice criterion and a program slice technology; extracting graph structure information, node attribute information and code context information which have a dependency relationship with the vulnerability candidate key points; then, performing representation learning on the slice attribute graph by utilizing a relation graph convolutional neural network and combining a dual attention mechanism based on nodes and sub-graphs so as to learn a more comprehensive and accurate vulnerability mode; and finally, fusing the vulnerability identification results of the slice attribute graphs to realize function-level vulnerability detection, and determining a set of vulnerability candidate statements and grammatical elements associated with vulnerabilities. More vulnerability candidate key points can be covered, structures, attributes and context information related to vulnerabilities are fully learned and expressed, and the vulnerability detection accuracy is improved.

Description

technical field [0001] The invention relates to a loophole detection method, in particular to a function-level code loophole detection method based on slice attribute graph representation learning. Background technique [0002] Software vulnerability detection is an important and challenging problem in information security. Traditional detection methods and detection tools depend to a large extent on the reviewers' understanding of security issues and the accumulation of long-term experience, and rely on known vulnerability patterns, making it difficult to detect previously undiscovered vulnerabilities. In addition to the classic method, the method of applying machine learning as a supplementary vulnerability detection method has also made great progress. Although the vulnerability detection method based on machine learning avoids the problem that commonly used detection tools rely on experts to manually write detection rules, it still needs to manually extract vulnerabiliti...

AI Technical Summary

Problems solved by technology

Although the code composite graph established with AST as the backbone is suitable for encoding complex program structure semantics, the graph structure is too complex and large when the function scale is large, which affects the learning efficiency of the model, and there are a large number of nodes and nodes that are not related to vulnerabilities in the graph. The edge will interfere with the model learning vulnerability mode, resulting in a high false positive rate of the model

In addition, the program analysis used by this method is limited to the intra-procedural analysis, and no inter-procedural analysis is performed, so there may be false negatives for cross-file or cross-function call vulnerabilities

Images