Data-driven intelligent memory leak detection method and system

Abstract

The invention discloses a data-driven intelligent memory leak detection method and system. The method comprises the following steps: collecting vulnerability data; constructing an inter-program value flow graph IVFG, and extracting vulnerability features; training a vulnerability detection model by using a multi-relational graph convolutional network COMPGCN; and preprocessing a to-be-detected file, detecting whether memory leak exists or not by using the detection model, and reporting a vulnerability function with the memory leak and the suspicious vulnerability statement. According to the invention. unique code grammar and semantic information of the memory leak vulnerability can be better utilized, the relation between vulnerability codes and sensitive objects such as calling contexts and global variables is fully mined, codes with potential memory leak are judged, suspicious vulnerability statements are output, and the targetness is higher; the defects of memory leak detection by a traditional static or dynamic method can be overcome to a certain extent, and compared with a current popular vulnerability detection method based on deep learning, the method has the advantages that suspicious statements with memory leak can be output, so that the practical application field is wider, the precision is higher, and the positioning is more accurate.

Description

technical field [0001] The invention belongs to the field of software security, in particular to a data-driven intelligent detection method and system for memory leaks. Background technique [0002] As a common software vulnerability, memory leaks will seriously reduce the performance of computer software, and even cause the software to crash when it is running. With the expansion of the scale and complexity of software projects, memory leaks widely exist in many large-scale projects, threatening software security. How to accurately and efficiently detect potential memory leaks in software has become a very challenging task. In the previous work, static analysis or dynamic detection was often used. Static analysis mainly analyzes the memory allocation point and the different paths starting from the memory allocation point, and finds the memory release point corresponding to the memory allocation point in the corresponding path to verify whether Correct memory deallocation e...

AI Technical Summary

Problems solved by technology

However, manually formulated vulnerability characteristics cannot cover all situations, and the vulnerability data is obtained by inserting some special cases of memory leaks, which may not be effective when faced with memory leaks in some real software

There are also some works that use deep learning methods to detect memory-related vulnerabilities. For example, the document "GRAPHSPY: Fused Program Semantic-Level Embedding via Graph Neural Networks for Dead Store Detection" extracts program semantics from aspects such as program structure and execution order, and Use a variety of popular graph neural network models to identify unnecessary memory operations in programs, but do not use some vulnerability characteristics closely related to memory to model memory vulnerabilities, making the method less targeted and less scalable

Images