Open source software security vulnerability patch positioning method based on sorting

Abstract

The invention provides a sorting-based open source software security vulnerability patch positioning method. The method specifically comprises the following steps: collecting vulnerability and code submission data from a website; extracting vulnerability and code submission similarity characteristics of four dimensions including code lines, vulnerability identities, vulnerability repair positions and segmented word bags by using a data mining and statistical analysis method; training a bug field text semantic coding module based on a Bert model, and extracting bug semantic features and code submission semantic features by using the semantic coding module; splicing the semantic features of the vulnerability and the semantic features of the code submission to form all features of the vulnerability and the code submission; model training; and carrying out model fusion by using a majority voting thought. According to the method, features can be extracted from vulnerabilities and code submission, a vulnerability patch submission sorting model is established, code submission in an open source software warehouse is sorted according to the matching degree with the vulnerabilities, and the number of submission codes needing to be checked by patch labeling personnel is effectively reduced.

Description

technical field [0001] The patent of the present invention relates to the technical field of computer security, in particular to a sorting-based method for locating security loophole patches of open source software. Background technique [0002] The XGBoost model and the LightGBM model are both gradient boosting trees, which can extract the relationship between independent variables and dependent variables from various features. The principle is to achieve the effect of a strong classifier by fusing multiple weak classifiers. Each time, the residual of the real value and the current predicted value is used as the training target of the next weak classifier, and iterated continuously to make the final model fit the data. The difference is that the tree structure in the XGBoost model is grown by layers, while the tree structure in the LightGBM model is grown by leaves, and leaves with greater splitting benefits are found each time. [0003] The Convolutional Neural Network (C...

AI Technical Summary

Problems solved by technology

[0006] Currently locating vulnerability patches mainly locates vulnerability patches by manually checking code submissions one by one, which is very difficult and time-consuming

Currently there is a technology that uses feature engineering to locate vulnerability patches. However, this method only extracts the relationship between vulnerabilities and code submissions from the perspective of statistical analysis, ignoring the semantic content of vulnerability descriptions and code submissions; at the same time , this method only uses a single model for training and prediction, making the model less effective

Images