Kernel vulnerability detection method and device

Abstract

The present invention discloses a kernel vulnerability detection method and device, which includes: constructing an operating system kernel historical vulnerability set; extracting and constructing a historical vulnerability function semantic flow graph set based on the operating system kernel historical vulnerability set and a training information set; training a vulnerability clone detection model based on the historical vulnerability function semantic flow graph set to obtain a vulnerability clone detection optimization model; using the vulnerability clone detection optimization model, processing the target system information and the kernel historical vulnerability set to obtain a target system kernel vulnerability detection report. The method learns the semantic features of the vulnerability code through a clone detection framework of semantic learning, and then searches and mines based on existing kernel historical vulnerabilities to quickly locate the potential kernel vulnerability location.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and in particular relates to a kernel vulnerability detection method and device. Background Art

[0002] Kernel vulnerability detection is based on historical vulnerabilities in the operating system kernel. The kernel vulnerability detection framework searches and mines existing historical kernel vulnerabilities by learning vulnerability code features, and quickly locates the potential vulnerability locations of the operating system kernel. At present, the commonly used kernel vulnerability detection method uses deep neural networks for learning and feature recognition. The deep neural network structure has an expression ability that traditional models cannot match. A major feature of this type of network is that it requires a large amount of training data to ensure satisfactory training results and avoid overfitting, so as to ensure that the model can also perform well on new data. There is currently no public operating system clone vulnerability code dataset available for direct use. As an alternative, use a public non-operating system related public training set as an alternative. These clone groups can reflect the differences between versions of the same operating system code to a certain extent, and this method is relatively easy for this module to obtain a large amount of clone code in a relatively short period of time. However, this is different from actual development and its actual use effect cannot be guaranteed. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide a kernel vulnerability detection method and device, which adopts the "pre-training + fine-tuning" mode to process the training information set of the open source project, obtain the semantic features of the historical vulnerability code, and use the semantic features to search and mine the existing kernel historical vulnerabilities, so as to quickly locate the potential kernel vulnerability position of the target system.

[0004] In order to solve the above technical problems, a first aspect of an embodiment of the present invention discloses a kernel vulnerability detection method, the method comprising:

[0005] S1, build the historical vulnerability set of the operating system kernel;

[0006] S2, processing the operating system kernel historical vulnerability set and the training information set to obtain a historical vulnerability function semantic flow graph set;

[0007] S3, using the historical vulnerability function semantic flow graph set to train the vulnerability clone detection model to obtain a vulnerability clone detection optimization model;

[0008] S4, obtaining target system information;

[0009] S5, using the vulnerability clone detection optimization model, processing the target system information and the operating system kernel historical vulnerability set to obtain a target system kernel vulnerability detection report.

[0010] As an optional implementation manner, in the first aspect of the embodiment of the present invention, the step of constructing the operating system kernel historical vulnerability set includes:

[0011] S11, based on the source code git repository, determine the log information set;

[0012] S12, analyzing and processing the log information set to obtain a historical vulnerability patch set;

[0013] S13, processing the CVE vulnerability library and the historical vulnerability patch set to obtain the operating system kernel historical vulnerability set.

[0014] As an optional implementation manner, in the first aspect of the embodiment of the present invention, the analyzing and processing the log information set to obtain the historical vulnerability patch set includes:

[0015] S121, traverse the log information set to obtain all log information and the total number of log information N;

[0016] Initialize the number of log information to be processed n = 1;

[0017] S122, determining whether the number of log information processed is less than or equal to the total number of log information, and obtaining a log processing determination result;

[0018] When the processing log determination result is yes, execute S123 to S127;

[0019] When the processing log determination result is no, executing S128;

[0020] S123, obtaining the nth log information and obtaining pre-processed log information;

[0021] S124, parsing the pre-processed log information to obtain structured log information;

[0022] S125, processing the structured log information to obtain vulnerability type information;

[0023] S126, determining whether the vulnerability type information belongs to a vulnerability type set, and obtaining a vulnerability type determination result;

[0024] When the vulnerability type determination result is yes, execute S127;

[0025] When the vulnerability type determination result is no, the number of log information processing items is increased by 1, and S122 is executed;

[0026] S127, parsing the structured log information to obtain historical vulnerability patch information, and executing S122;

[0027] S128, all the historical vulnerability patch information is combined in order to obtain a historical vulnerability patch set.

[0028] As an optional implementation, in the first aspect of the embodiment of the present invention, the processing of the CVE vulnerability library and the historical vulnerability patch set to obtain the operating system kernel historical vulnerability set includes:

[0029] S131, obtaining the number of records a of the historical vulnerability patch set; and presetting the number of patch comparison records b of the historical vulnerability patch set=1:

[0030] S132, determining whether the number of patch comparisons is less than or equal to the number of records in the historical vulnerability patch set, and obtaining a determination result of the number of patch comparisons;

[0031] When the patch comparison number judgment result is yes, execute S133 to S136;

[0032] When the patch comparison number determination result is no, executing S137;

[0033] S133, obtaining the bth record of the historical vulnerability patch set to obtain the processing historical vulnerability patch information;

[0034] S134, parsing the processing history vulnerability patch information to obtain the processing history vulnerability CVE number;

[0035] S135, matching the CVE vulnerability database with the CVE number of the processed historical vulnerability to obtain historical vulnerability information;

[0036] S136, performing structured processing on the historical vulnerability information to obtain historical vulnerabilities of the operating system kernel;

[0037] The number of patch comparisons is increased by 1, and S132 is executed;

[0038] S137, combining all the operating system kernel historical vulnerabilities in order to obtain an operating system kernel historical vulnerability set.

[0039] As an optional implementation, in the first aspect of the embodiment of the present invention, the processing of the operating system kernel historical vulnerability set and the training information set to obtain a historical vulnerability function semantic flow graph set includes:

[0040] S21, obtaining a training code set and a corresponding historical vulnerability CVE number set of a training information set;

[0041] S22, matching the operating system kernel historical vulnerability set based on the historical vulnerability CVE number set to obtain a historical vulnerability code set;

[0042] S23, cross-compiling the training code set and the historical vulnerability code set to obtain a training sample data set;

[0043] S24, disassembling the training sample data set to obtain a disassembled training data set;

[0044] S25, performing feature extraction on the disassembled training data set to obtain a training block feature information set and a structured block information set;

[0045] S26, combining the training block feature information set and the structured block information set to obtain a historical vulnerability function semantic flow graph set.

[0046] As an optional implementation, in the first aspect of the embodiment of the present invention, the use of the historical vulnerability function semantic flow graph to train the vulnerability clone detection model to obtain the vulnerability clone detection optimization model includes:

[0047] S31, obtaining a training parameter set;

[0048] S32, based on the training parameter set, matching processing is performed on the historical vulnerability function semantic flow graph set to determine a training data set;

[0049] S33, processing the training data set to obtain a training block feature information set and a training block structured information set;

[0050] S34, based on the training block feature information set, the vulnerability clone detection model is trained using the training block structured information set to obtain a vulnerability clone detection optimization model.

[0051] As an optional implementation manner, in the first aspect of the embodiment of the present invention, the vulnerability clone detection model is trained based on the training block feature information set using the training block structured information set to obtain the vulnerability clone detection optimization model, including:

[0052] S341, traversing the training block structured information set to obtain all training block structured information;

[0053] Set the number of training times to 1;

[0054] S342, using a vulnerability clone detection model, processing any piece of the training block structured information to obtain first vulnerability clone detection information;

[0055] S343, determining whether the training times value is greater than a preset training times threshold, and obtaining a training times determination result;

[0056] Increase the training times by 1;

[0057] When the result of the training times determination is yes, executing S344;

[0058] When the result of the training number determination is no, executing S349;

[0059] S344, parsing the first vulnerability clone detection information to obtain vulnerability type information;

[0060] S345, based on the vulnerability type information, matching the training block feature information set to obtain a training block label;

[0061] S346, using the first vulnerability clone detection information and the training block label, updating parameters of the vulnerability clone detection model;

[0062] S347, performing cosine processing on the first vulnerability clone detection information and the training block label to obtain prediction accuracy information;

[0063] S348, determining whether the prediction accuracy of the prediction accuracy information is greater than a preset accuracy threshold, and obtaining an accuracy determination result;

[0064] When the accuracy determination result is no, executing S343;

[0065] If the accuracy determination result is yes, execute S349;

[0066] S349, obtaining the vulnerability clone detection model after the parameters are updated, and obtaining the vulnerability clone detection optimization model.

[0067] A second aspect of an embodiment of the present invention discloses a kernel vulnerability detection device, the device comprising: a vulnerability set construction module, a data processing module, a model training module, a target data acquisition module and a vulnerability detection module;

[0068] The vulnerability set building module is used to build a historical vulnerability set of the operating system kernel;

[0069] The data processing module is used to process the operating system kernel historical vulnerability set and the training information set to obtain a historical vulnerability function semantic flow graph set;

[0070] The model training module is used to train the vulnerability clone detection model using the historical vulnerability function semantic flow graph set to obtain a vulnerability clone detection optimization model;

[0071] The target data acquisition module is used to acquire target system information;

[0072] The vulnerability detection module is used to process the target system information and the operating system kernel historical vulnerability set using the vulnerability clone detection optimization model to obtain a target system kernel vulnerability detection report.

[0073] A third aspect of an embodiment of the present invention discloses another kernel vulnerability detection device, the device comprising: a memory storing executable program code;

[0074] a processor coupled to the memory;

[0075] The processor calls the executable program code stored in the memory to execute part or all of the steps in the kernel vulnerability detection method disclosed in the first aspect of the embodiment of the present invention.

[0076] The fourth aspect of the present invention discloses a computer-readable storage medium, which stores computer instructions. When the computer instructions are called, they are used to execute some or all of the steps in the kernel vulnerability detection method disclosed in the first aspect of an embodiment of the present invention.

[0077] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0078] The present invention provides a kernel vulnerability detection method and device, which adopts a "pre-training + fine-tuning" mode to process the training information set of open source projects, obtain the semantic features of historical vulnerability codes, and use the semantic features to search and mine existing kernel historical vulnerabilities, quickly locate the kernel potential vulnerability position of the target system, and improve the kernel vulnerability detection efficiency and accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0080] Figure 1 It is a flowchart of a kernel vulnerability detection method disclosed in an embodiment of the present invention;

[0081] Figure 2 It is a structural schematic diagram of a kernel vulnerability detection device disclosed in an embodiment of the present invention;

[0082] Figure 3 It is a structural schematic diagram of another kernel vulnerability detection device disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0083] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0084] The terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, device, product or equipment that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or equipment.

[0085] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0086] The present invention discloses a kernel vulnerability detection method and device, which uses the semantic features to search and mine the existing kernel historical vulnerabilities, quickly locate the kernel potential vulnerability position of the target system, and improve the kernel vulnerability detection efficiency and accuracy. The following are detailed descriptions.

[0087] Embodiment 1

[0088] See also Figure 1 , Figure 1 : is a flowchart of a kernel vulnerability detection method disclosed in an embodiment of the present invention. Figure 1 The kernel vulnerability detection method described is applied to a network security detection system, such as a local server or cloud server for network security detection management, and the embodiments of the present invention are not limited thereto. Figure 1 As shown, the kernel vulnerability detection method may include the following operations:

[0089] S1, historical vulnerability set of operating system kernel;

[0090] S2, processing the operating system kernel historical vulnerability set and the training information set to obtain a historical vulnerability function semantic flow graph set;

[0091] It should be noted that the training information set refers to a public training set related to a non-operating system; the public training set can, to a certain extent, reflect the differences between different versions of the same operating system code, and this method is relatively easy for this module to obtain a large number of cloned codes in a relatively short period of time;

[0092] S3, using the historical vulnerability function semantic flow graph set to train the vulnerability clone detection model to obtain a vulnerability clone detection optimization model;

[0093] S4, obtaining target system information;

[0094] S5, using the vulnerability clone detection optimization model, processing the target system information and the operating system kernel historical vulnerability set to obtain a target system kernel vulnerability detection report.

[0095] It can be seen that the kernel vulnerability detection method described in the embodiment of the present invention is implemented, and the semantic features are used to search and mine existing kernel historical vulnerabilities, so as to quickly locate the potential kernel vulnerability positions of the target system, thereby improving the efficiency and accuracy of kernel vulnerability detection.

[0096] In an optional embodiment, the step of constructing the operating system kernel historical vulnerability set in the above step S1 includes:

[0097] S11, based on the source code git repository, determine the log information set;

[0098] It should be noted that the source code git repository refers to a version control unified code library created using the distributed version control tool git, which is used to record the file / directory status; the source code git repository contains temporary storage area information, branch information and history record information:

[0099] It should be noted that the git log command is used to process the historical record information to obtain a log information set;

[0100] S12, analyzing and processing the log information set to obtain a historical vulnerability patch set;

[0101] S13, processing the CVE vulnerability library and the historical vulnerability patch set to obtain the operating system kernel historical vulnerability set.

[0102] It can be seen that the kernel vulnerability detection method described in the embodiment of the present invention is implemented, and the semantic features are used to search and mine existing kernel historical vulnerabilities, so as to quickly locate the potential kernel vulnerability positions of the target system, thereby improving the efficiency and accuracy of kernel vulnerability detection.

[0103] In another optional embodiment, the step S12 of analyzing and processing the log information set to obtain a historical vulnerability patch set includes:

[0104] S121, traverse the log information set to obtain all log information and the total number of log information N;

[0105] Initialize the number of log information to be processed n = 1;

[0106] S122, determining whether the number of log information processed is less than or equal to the total number of log information, and obtaining a log processing determination result;

[0107] When the processing log determination result is yes, execute S123 to S127;

[0108] When the processing log determination result is no, executing S128;

[0109] S123, obtaining the nth log information and obtaining pre-processed log information;

[0110] It should be noted that the pre-processed log information includes but is not limited to log identification information, system type information, updated data information and operation time information;

[0111] It should be noted that the updated data information includes but is not limited to system fault information, system fault type and fault time information;

[0112] S124, parsing the pre-processed log information to obtain structured log information;

[0113] It should be noted that the pre-processing log information is parsed to extract log identification information, system type information, updated data information and operation time information;

[0114] It should be noted that the updated data information is parsed to extract system fault information, system fault type and fault time information;

[0115] It should be noted that the log identification information, the system type information, the operation time information, the system fault information, the system fault type and the fault time information are structured and encapsulated to obtain structured log information;

[0116] S125, processing the structured log information to obtain vulnerability type information;

[0117] It should be noted that the structured log information is parsed to extract the system fault information, the system fault type and the fault time information;

[0118] It should be noted that the system fault information and the system fault type are analyzed to obtain vulnerability type information;

[0119] S126, determining whether the vulnerability type information belongs to a vulnerability type set, and obtaining a vulnerability type determination result;

[0120] When the vulnerability type determination result is yes, execute S127;

[0121] When the vulnerability type determination result is no, the number of log information processing items is increased by 1, and S122 is executed;

[0122] S127, parsing the structured log information to obtain historical vulnerability patch information, and executing S122;

[0123] It should be noted that the historical vulnerability patch information includes information such as the operating system kernel historical vulnerability code, the operating system kernel historical vulnerability number, the operating system kernel historical vulnerability location, and the operating system kernel historical vulnerability type;

[0124] S128, all the historical vulnerability patch information is combined in order to obtain a historical vulnerability patch set.

[0125] It can be seen that the kernel vulnerability detection method described in the embodiment of the present invention is implemented, and the semantic features are used to search and mine existing kernel historical vulnerabilities, so as to quickly locate the potential kernel vulnerability positions of the target system, thereby improving the efficiency and accuracy of kernel vulnerability detection.

[0126] In another optional embodiment, the CVE vulnerability library and the historical vulnerability patch set are processed in the above step S13 to obtain the operating system kernel historical vulnerability set, including:

[0127] S131, obtaining the number a of records of the historical vulnerability patch set; presetting the number b of patch comparisons of the historical vulnerability patch set=1;

[0128] S132, determining whether the number of patch comparisons is less than or equal to the number of records in the historical vulnerability patch set, and obtaining a determination result of the number of patch comparisons;

[0129] When the patch comparison number judgment result is yes, execute S133 to S136;

[0130] When the patch comparison number determination result is no, executing S137;

[0131] S133, obtaining the bth record of the historical vulnerability patch set to obtain the processing historical vulnerability patch information;

[0132] It should be noted that the historical vulnerability patch information includes vulnerability type information, CVE number information and vulnerability name;

[0133] S134, parsing the processing history vulnerability patch information to obtain the processing history vulnerability CVE number;

[0134] It should be noted that the parsing process means extracting the CVE number information of the processing history vulnerability patch information to obtain the processing history vulnerability CVE number;

[0135] S135, matching the CVE vulnerability database with the CVE number of the processed historical vulnerability to obtain historical vulnerability information;

[0136] S136, performing structured processing on the historical vulnerability information to obtain historical vulnerabilities of the operating system kernel;

[0137] It should be noted that the structured processing means extracting the vulnerability type, CVE number, vulnerability name, vulnerability code and vulnerability location of the historical vulnerability information and encapsulating them in an agreed format;

[0138] The number of patch comparisons is increased by 1, and S132 is executed;

[0139] S137, combining all the operating system kernel historical vulnerabilities in order to obtain an operating system kernel historical vulnerability set.

[0140] It can be seen that the kernel vulnerability detection method described in the embodiment of the present invention is implemented, and the semantic features are used to search and mine existing kernel historical vulnerabilities, so as to quickly locate the potential kernel vulnerability positions of the target system, thereby improving the efficiency and accuracy of kernel vulnerability detection.

[0141] In another optional embodiment, the operating system kernel historical vulnerability set and the training information set are processed in the above step S2 to obtain a historical vulnerability function semantic flow graph set, including:

[0142] S21, obtaining a training code set and a corresponding historical vulnerability CVE number set of a training information set;

[0143] It should be noted that the open source projects shown in Table 1 are selected to construct the training information set, and the open source projects include but are not limited to Coreutils6.5, Coreutils6.7, BusyBox1.21.0, OpenSSL1.0.1u, OpenSSL1.0.1f programs, respectively under x86, x64, arm32, arm64, MIPS32, MIPS64 and other architectures, using GCC4.9, GCC5.5 and O0, O1, O2, O3 optimization levels; the specific training sample construction is shown in Table 1;

[0144] Table 1 Pre-training sample construction options

[0145]

[0146] S22, matching the operating system kernel historical vulnerability set based on the historical vulnerability CVE number set to obtain a historical vulnerability code set;

[0147] It should be noted that the historical vulnerability code set includes several historical vulnerability codes;

[0148] S23, cross-compiling the training code set and the historical vulnerability code set to obtain a training sample data set;

[0149] It should be noted that the cross-compilation means using different compilation environments to compile the training code set and the historical vulnerability code set, and cross-compiling under different compilation configurations to obtain 240 binary files and more than 700,000 functions, as shown in Table 2;

[0150] Table 2 Statistics of pre-training sample size

[0151] program Number of files Number of functions Number of basic blocks Coreutils 96 14237 S71K BusyBox 48 183075 2949K OpenSSL 96 538228 5325K

[0152] S24, disassembling the training sample data set to obtain a disassembled training data set;

[0153] It should be noted that IDA Pro is used to disassemble the training sample data set;

[0154] S25, performing feature extraction on the disassembled training data set to obtain a training block feature information set and a structured block information set;

[0155] It should be noted that IDA Python is used to extract features from the disassembled training data set, including basic block feature information and structural feature information;

[0156] It should be noted that by observing a large number of binary code disassembly files and referring to the known basic block features, a more reasonable classification method is shown in Table 3. However, this classification method still has the following problems: on the one hand, the granularity of the internal function call is too coarse, which easily leads to the neglect of many behavioral details implied by the function; on the other hand, the timing relationship between the code lines inside the basic block is ignored, and the basic blocks corresponding to different timing relationships may have completely different meanings, which will cause a large error in the understanding of the function semantics;

[0157] Table 43 Basic block feature selection

[0158] Group Example Stack push Arithmetic add Logical xor Compare test External call call ds:socket Internal call call sub:xxx Conditional jump jle Unconditional jump jmp Generic move

[0159] In order to solve the problem that the granularity of internal function calls is too coarse, which easily causes many behavioral details implied by the function to be ignored, this embodiment observes a large number of binary disassembly files and screens the standard library functions of the C language, and selects 18 classes with higher usage frequency, thereby further subdividing the library function calls. These 18 classes are file input / output class (fstream.h), mathematical function class (math.h), miscellaneous function and memory allocation class (stdlib.h), exception handling class (exception), STL linear list container class (list), STL mapping container class (map), STL queue container class (queue), STL collection class (set), STL stack container class (stack), STL dynamic array container class (vector), localization function class (locale.h), string processing class (string.h), time function class (time.h), wide character processing class (wchar.h), complex number processing class (complex.h), character processing class (ctype.h), floating point number processing class (float.h), input / output class (stdio.h);

[0160] S26, combining the training block feature information set and the structured block information set to obtain a historical vulnerability function semantic flow graph set;

[0161] It should be noted that the combination of the training block feature information set and the structured block information set to obtain a historical vulnerability function semantic flow graph set includes:

[0162] S261, traversing the training block feature information set to obtain all training block feature information;

[0163] It should be noted that the training block feature information set includes several pieces of training block feature information;

[0164] It should be noted that the training block characteristic information includes information type and training block characteristic information;

[0165] S262, parsing any of the training block feature information to obtain information type and training block feature information;

[0166] S263, traversing the structured block information set to obtain all structured block information;

[0167] It should be noted that the structured block information set includes several pieces of structured block information;

[0168] It should be noted that the structured block information includes information type and structured block information;

[0169] S264, parsing any of the structured block information to obtain information type and structured block information;

[0170] S265, combining the information type, the training block feature information, and the structured block information to obtain a historical vulnerability function semantic flow graph;

[0171] S266, all of the historical vulnerability function semantic flow graphs are combined in order to obtain a set of historical vulnerability function semantic flow graphs.

[0172] It can be seen that the kernel vulnerability detection method described in the embodiment of the present invention is implemented, and the semantic features are used to search and mine existing kernel historical vulnerabilities, so as to quickly locate the potential kernel vulnerability positions of the target system, thereby improving the efficiency and accuracy of kernel vulnerability detection.

[0173] In an optional embodiment, in the above step S3, the use of the historical vulnerability function semantic flow graph to train the vulnerability clone detection model to obtain the vulnerability clone detection optimization model includes:

[0174] S31, obtaining a training parameter set;

[0175] S32, based on the training parameter set, matching processing is performed on the historical vulnerability function semantic flow graph set to determine a training data set;

[0176] S33, processing the training data set to obtain a training block feature information set and a training block structured information set;

[0177] S34, based on the training block feature information set, using the training block structured information set to train the vulnerability clone detection model to obtain a vulnerability clone detection optimization model;

[0178] It should be noted that, for the training block structured information set, it is evenly divided into a training set, a validation set and a test set, and N groups of clone pairs and N groups of non-clone pairs are randomly selected each time, and are marked with 1 and -1 (1 represents a clone pair, and -1 represents a non-clone pair), and a data set is generated in a 1:1 ratio, which can ensure the balance of the data and prevent overfitting. The vulnerability clone detection model is trained using the training data set to obtain a vulnerability clone detection pre-training model;

[0179] For fine-tuning sample construction, the vulnerability clone detection pre-training model is used to select the 16 main categories in Table 4 and multiple consecutive versions of operating system codes. The relevant vulnerability codes are located and extracted according to the submission logs. These vulnerability codes are cross-compiled under different architectures and different compilation configurations to obtain the corresponding binary clone groups. A certain number of clone pairs and non-clone pairs are randomly selected each time, and the model parameters are fine-tuned based on the pre-training model to obtain the vulnerability clone detection optimization model.

[0180] Table 4 Main categories of CWE

[0181] category CWE Number Buffer Overflow CWE-120 Uncontrolled Format String CWE-134 Integer Overflow CWE-190 Null Pointer Dereference CWE-476 Memory Leak CWE-401 Null Termination Errors CWE-170 Concurrency Errors CWE-362 Double Free CWE-415 Access Freed Memory CWE-416 Insecure Randomness CWE-330 OS Command Injection CWE-78 Insecure Temporary File CWE-377 Rellance on Untrusted Inputs CWE-807 Poor Code Quality CWE-398 Dead Code CWE-561 Use of Obsolete Functions CWE-477 Risky Cryptography CWE-327 Unused Bariable CWE-563

[0182] It should be noted that this embodiment selects 18 classes with high frequency of use by observing a large number of binary disassembly files and screening the standard library functions of C language, thereby further subdividing the library function calls. These 18 classes are file input / output class (fstream.h), mathematical function class (math.h), miscellaneous function and memory allocation class (stdlib.h), exception handling class (exception), STL linear list container class (list), STL mapping container class (map), STL queue container class (queue), STL collection class (set), STL stack container class (stack), STL dynamic array container class (vector), localization function class (locale.h), string processing class (string.h), time function class (time.h), wide character processing class (wchar.h), complex number processing class (complex.h), character processing class (ctype.h), floating point number processing class (float.h), input / output class (stdio.h);

[0183] It should be noted that this embodiment uses a semantic flow graph to represent the structured information between the basic blocks of the function. At the same time, taking into account that the degree of influence of data dependency, control dependency, etc. on the semantics of the function may be different, a weighted semantic flow graph is designed, using 0 and 1 to indicate that the edges between the basic blocks belong to data dependency and control dependency, respectively. At the same time, parameters α and β are added to the network model to represent their respective weights. During the training process, the values ​​of the parameters are continuously adjusted to more accurately characterize the semantics of the function.

[0184] It can be seen that the kernel vulnerability detection method described in the embodiment of the present invention is implemented, and the semantic features are used to search and mine existing kernel historical vulnerabilities, so as to quickly locate the potential kernel vulnerability positions of the target system, thereby improving the efficiency and accuracy of kernel vulnerability detection.

[0185] In another optional embodiment, in the above step S34, based on the training block feature information set, the vulnerability clone detection model is trained using the training block structured information set to obtain the vulnerability clone detection optimization model, including:

[0186] S341, traversing the training block structured information set to obtain all training block structured information;

[0187] Set the number of training times to 1;

[0188] S342, using a vulnerability clone detection model, processing any piece of the training block structured information to obtain first vulnerability clone detection information;

[0189] S343, determining whether the training times value is greater than a preset training times threshold, and obtaining a training times determination result;

[0190] It should be noted that the training times threshold is set to 500;

[0191] Increase the training times by 1;

[0192] When the result of the training times determination is yes, executing S344;

[0193] When the result of the training number determination is no, executing S349;

[0194] S344, parsing the first vulnerability clone detection information to obtain vulnerability type information;

[0195] S345, based on the vulnerability type information, matching the training block feature information set to obtain a training block label;

[0196] S346, using the first vulnerability clone detection information and the training block label, updating parameters of the vulnerability clone detection model;

[0197] S347, performing cosine processing on the first vulnerability clone detection information and the training block label to obtain prediction accuracy information;

[0198] S348, determining whether the prediction accuracy of the prediction accuracy information is greater than a preset accuracy threshold, and obtaining an accuracy determination result;

[0199] It should be noted that the accuracy threshold is set to 1;

[0200] When the accuracy determination result is no, executing S343;

[0201] If the accuracy determination result is yes, execute S349;

[0202] S349, obtaining the vulnerability clone detection model after the parameters are updated, and obtaining the vulnerability clone detection optimization model.

[0203] It can be seen that implementing the kernel vulnerability detection method described in the embodiment of the present invention is conducive to improving the efficiency of outbound order processing and improving the efficiency of goods outbound, thereby improving the intelligence level of outbound order management and improving the efficiency of warehousing and logistics work.

[0204] In another optional embodiment, in the above step S5, the vulnerability clone detection model adopts an improved LSTM (long short-term memory) network structure, including: a data input layer, a first LSTM layer, a memory processing layer, a second LSTM layer and a result output layer;

[0205] The output end of the data input layer is connected to the input end of the first LSTM layer; the output end of the first LSTM layer is connected to the input end of the calculation processing layer; the output end of the calculation processing layer is connected to the input end of the second LSTM layer; the output end of the second LSTM layer is connected to the input end of the result output layer;

[0206] The data input layer is used to receive the target project information and the operating system kernel historical vulnerability set, and send the target project information to the first LSTM layer;

[0207] The first LSTM layer is used to process the target project information to obtain first processing result information, and send the first processing result information to the memory processing layer;

[0208] The memory processing layer is used to process the first processing result information to obtain second processing result information, and send the second processing result information to the second LSTM layer;

[0209] It should be noted that the memory processing layer, as the middle layer of the vulnerability clone detection model, can attach the state of the memory processing layer to the feature state, so that each feature can obtain different degrees of time series fitting, thereby improving the superiority of parameter adjustment and structure optimization of the vulnerability clone detection model;

[0210] It should be noted that the second processing result information includes target engineering feature vector information and operating system kernel historical vulnerability feature vector information;

[0211] The second LSTM layer is used to perform cosine processing on the second processing result information to obtain vulnerability detection result information;

[0212] The result output layer is used to output and process the vulnerability detection result information to obtain a target project kernel vulnerability detection report.

[0213] It can be seen that implementing the kernel vulnerability detection method described in the embodiment of the present invention is conducive to improving the efficiency of outbound order processing and improving the efficiency of goods outbound, thereby improving the intelligence level of outbound order management and improving the efficiency of warehousing and logistics work.

[0214] In another optional embodiment, in the above step S5, the use of the vulnerability clone detection optimization model to process the target system information and the operating system kernel historical vulnerability set to obtain a target system kernel vulnerability detection report includes:

[0215] S51, obtaining target system information;

[0216] S52, using a vulnerability clone detection optimization model to process the target system information to obtain a first feature vector of a basic block;

[0217] S53, calculating and processing the first eigenvector of the basic block to obtain a second eigenvector of the basic block;

[0218] The calculation processing expression is:

[0219] A′=α·A+β·A

[0220] Wherein, A′ represents the second eigenvector of the basic block; A represents the first eigenvector of the basic block; α represents the edge data dependency weight between basic blocks; β represents the edge control dependency weight between basic blocks;

[0221] S54, traversing the operating system kernel historical vulnerability set to obtain all historical target vulnerability information;

[0222] S55, using the vulnerability clone detection optimization model, processing any of the historical target vulnerability information to obtain a historical target vulnerability feature vector;

[0223] S56, performing cosine processing on the second feature vector of the basic block and the historical target vulnerability feature vector to obtain a target system kernel vulnerability detection result;

[0224] It should be noted that when the cosine value of the angle between the second feature vector of the basic block and the feature vector of the historical vulnerability is 1, it can be determined that the basic block and the historical target vulnerability are a clone pair (the closer the cosine value of the angle between the two vectors is to 1, the more similar the functions are);

[0225] S57, combining the target system kernel vulnerability detection results in order to obtain a target system kernel vulnerability detection report.

[0226] It can be seen that implementing the kernel vulnerability detection method described in the embodiment of the present invention is conducive to improving the efficiency of outbound order processing and improving the efficiency of goods outbound, thereby improving the intelligence level of outbound order management and improving the efficiency of warehousing and logistics work.

[0227] Embodiment 2

[0228] See also Figure 2 , Figure 2 : is a schematic diagram of the structure of a kernel vulnerability detection device disclosed in an embodiment of the present invention. Figure 2 The described device can be applied to a network security detection system, such as a local server or a cloud server for network security detection management, and the embodiments of the present invention are not limited thereto. Figure 2 As shown, the device includes: a vulnerability set construction module 201, a data processing module 202, a model training module 203, a target data acquisition module 204 and a vulnerability detection module 205;

[0229] The vulnerability set building module 201 is used to build a historical vulnerability set of the operating system kernel;

[0230] The data processing module 202 is used to process the operating system kernel historical vulnerability set and the training information set to obtain a historical vulnerability function semantic flow graph set;

[0231] The model training module 203 is used to train the vulnerability clone detection model using the historical vulnerability function semantic flow graph set to obtain a vulnerability clone detection optimization model;

[0232] The target data acquisition module 204 is used to acquire target system information;

[0233] The vulnerability detection module 205 is used to process the target system information and the operating system kernel historical vulnerability set by using the vulnerability clone detection optimization model to obtain a target system kernel vulnerability detection report.

[0234] Embodiment 3

[0235] See also Figure 3 , Figure 3 : is a schematic diagram of the structure of a kernel vulnerability detection device disclosed in an embodiment of the present invention. Figure 3 The described device can be applied to a network security detection system, such as a local server or a cloud server for network security detection management, and the embodiments of the present invention are not limited thereto. Figure 3 As shown, the device may include:

[0236] A memory 301 storing executable program codes;

[0237] a processor 302 coupled to the memory 301;

[0238] The processor 302 calls the executable program code stored in the memory 301 to execute the steps in the kernel vulnerability detection method described in the first embodiment.

[0239] Embodiment 4

[0240] An embodiment of the present invention discloses a computer-readable storage medium storing a computer program for electronic data exchange, wherein the computer program enables a computer to execute the steps of the kernel vulnerability detection method described in the first embodiment.

[0241] The device embodiments described above are only illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, i.e., they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

[0242] Through the specific description of the above embodiments, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the above technical solution can be essentially or partly contributed to the prior art in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable rewritable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, a magnetic disk storage, a magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0243] Finally, it should be noted that the kernel vulnerability detection method and device disclosed in the embodiments of the present invention disclose only the preferred embodiments of the present invention, which are only used to illustrate the technical solution of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments can still be modified, or some of the technical features therein can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A kernel vulnerability detection method, characterized in that: The method comprises: S1, build the historical vulnerability set of the operating system kernel; S2, processing the operating system kernel historical vulnerability set and the training information set to obtain a historical vulnerability function semantic flow graph set; S3, using the historical vulnerability function semantic flow graph set to train the vulnerability clone detection model to obtain a vulnerability clone detection optimization model; S4, obtaining target system information; S5, using the vulnerability clone detection optimization model, processing the target system information and the operating system kernel historical vulnerability set to obtain a target system kernel vulnerability detection report; The step of constructing the operating system kernel historical vulnerability set includes: S11, based on the source code git repository, determine the log information set; S12, analyzing and processing the log information set to obtain a historical vulnerability patch set; S13, processing the CVE vulnerability library and the historical vulnerability patch set to obtain an operating system kernel historical vulnerability set; The step of analyzing and processing the log information set to obtain a historical vulnerability patch set includes: S121, traverse the log information set to obtain all log information and the total number of log information N; Initialize the number of log information to be processed n = 1; S122, determining whether the number of log information processed is less than or equal to the total number of log information, and obtaining a log processing determination result; When the processing log determination result is yes, execute S123 to S127; When the processing log determination result is no, executing S128; S123, obtaining the nth log information and obtaining pre-processed log information; S124, parsing the pre-processed log information to obtain structured log information; S125, processing the structured log information to obtain vulnerability type information; S126, determining whether the vulnerability type information belongs to a vulnerability type set, and obtaining a vulnerability type determination result; When the vulnerability type determination result is yes, execute S127; When the vulnerability type determination result is no, the number of log information processing items is increased by 1, and S122 is executed; S127, parsing the structured log information to obtain historical vulnerability patch information, and executing S122; S128, all the historical vulnerability patch information is combined in order to obtain a historical vulnerability patch set; The processing of the CVE vulnerability library and the historical vulnerability patch set to obtain the operating system kernel historical vulnerability set includes: S131, obtaining the number a of records of the historical vulnerability patch set; presetting the number b of patch comparisons of the historical vulnerability patch set=1; S132, determining whether the number of patch comparisons is less than or equal to the number of historical vulnerability patch set records, and obtaining a determination result of the number of patch comparisons; When the patch comparison number judgment result is yes, execute S133 to S136; When the patch comparison number determination result is no, executing S137; S133, obtaining the bth record of the historical vulnerability patch set to obtain the processing historical vulnerability patch information; S134, parsing the processing history vulnerability patch information to obtain the processing history vulnerability CVE number; S135, matching the CVE vulnerability database with the CVE number of the processed historical vulnerability to obtain historical vulnerability information; S136, performing structured processing on the historical vulnerability information to obtain historical vulnerabilities of the operating system kernel; The number of patch comparisons is increased by 1, and S132 is executed; S137, combining all the operating system kernel historical vulnerabilities in order to obtain an operating system kernel historical vulnerability set; The process of using the vulnerability clone detection optimization model to process the target system information and the operating system kernel historical vulnerability set to obtain a target system kernel vulnerability detection report includes: S51, obtaining target system information; S52, using a vulnerability clone detection optimization model to process the target system information to obtain a first feature vector of a basic block; S53, calculating and processing the first eigenvector of the basic block to obtain a second eigenvector of the basic block; The calculation processing expression is: A'=α·A+β·A Wherein, A' represents the second eigenvector of the basic block; A represents the first eigenvector of the basic block; α represents the edge data dependency weight between basic blocks; β represents the edge control dependency weight between basic blocks; S54, traversing the operating system kernel historical vulnerability set to obtain all historical target vulnerability information; S55, using the vulnerability clone detection optimization model, processing any of the historical target vulnerability information to obtain a historical target vulnerability feature vector; S56, performing cosine processing on the second feature vector of the basic block and the historical target vulnerability feature vector to obtain a target system kernel vulnerability detection result; S57, combining the target system kernel vulnerability detection results in order to obtain a target system kernel vulnerability detection report.

2. The kernel vulnerability detection method according to claim 1, characterized in that: The processing of the operating system kernel historical vulnerability set and the training information set to obtain a historical vulnerability function semantic flow graph set includes: S21, obtaining a training code set and a corresponding historical vulnerability CVE number set of a training information set; S22, matching the operating system kernel historical vulnerability set based on the historical vulnerability CVE number set to obtain a historical vulnerability code set; S23, cross-compiling the training code set and the historical vulnerability code set to obtain a training sample data set; S24, disassembling the training sample data set to obtain a disassembled training data set; S25, performing feature extraction on the disassembled training data set to obtain a training block feature information set and a structured block information set; S26, combining the training block feature information set and the structured block information set to obtain a historical vulnerability function semantic flow graph set.

3. The kernel vulnerability detection method according to claim 2, characterized in that: The combining of the training block feature information set and the structured block information set to obtain a historical vulnerability function semantic flow graph set includes: S261, traversing the training block feature information set to obtain all training block feature information; S262, parsing any of the training block feature information to obtain information type and training block feature information; S263, traversing the structured block information set to obtain all structured block information; S264, parsing any of the structured block information to obtain information type and structured block information; S265, combining the information type, the training block feature information, and the structured block information to obtain a historical vulnerability function semantic flow graph; S266, all of the historical vulnerability function semantic flow graphs are combined in order to obtain a set of historical vulnerability function semantic flow graphs.

4. The kernel vulnerability detection method according to claim 1, characterized in that: The method of using the historical vulnerability function semantic flow graph to train the vulnerability clone detection model to obtain the vulnerability clone detection optimization model includes: S31, obtaining a training parameter set; S32, based on the training parameter set, matching processing is performed on the historical vulnerability function semantic flow graph set to determine a training data set; S33, processing the training data set to obtain a training block feature information set and a training block structured information set; S34, based on the training block feature information set, the vulnerability clone detection model is trained using the training block structured information set to obtain a vulnerability clone detection optimization model.

5. The kernel vulnerability detection method according to claim 4, characterized in that: The method of training the vulnerability clone detection model based on the training block feature information set and using the training block structured information set to obtain the vulnerability clone detection optimization model includes: S341, traversing the training block structured information set to obtain all training block structured information; Set the number of training times to 1; S342, using a vulnerability clone detection model, processing any of the training block structured information to obtain first vulnerability clone detection information; S343, determining whether the training times value is greater than a preset training times threshold, and obtaining a training times determination result; Increase the training times by 1; When the result of the training times determination is yes, executing S344; When the result of the training number determination is no, executing S349; S344, parsing the first vulnerability clone detection information to obtain vulnerability type information; S345, based on the vulnerability type information, matching the training block feature information set to obtain a training block label; S346, using the first vulnerability clone detection information and the training block label, updating parameters of the vulnerability clone detection model; S347, performing cosine processing on the first vulnerability clone detection information and the training block label to obtain prediction accuracy information; S348, determining whether the prediction accuracy of the prediction accuracy information is greater than a preset accuracy threshold, and obtaining an accuracy determination result; When the accuracy determination result is no, executing S343; If the accuracy determination result is yes, execute S349; S349, obtaining the vulnerability clone detection model after the parameters are updated, and obtaining the vulnerability clone detection optimization model.

6. A kernel vulnerability detection device, characterized in that: The device comprises: A memory storing executable program code; a processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the kernel vulnerability detection method according to any one of claims 1 to 5.

7. A computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and when the computer instructions are called, they are used to execute the kernel vulnerability detection method according to any one of claims 1 to 4.

Images