Vulnerability detection method based on dual attention mechanism and code similarity

Abstract

The present invention proposes a vulnerability detection method based on a dual attention mechanism and code similarity, which belongs to the field of vulnerability detection technology. It includes: extracting the program dependency graph corresponding to the unknown function to be tested, expanding the abstract syntax tree corresponding to the statement to each node of the program dependency graph to form a composite graph; using the marked vulnerability statement as a slicing criterion, finding the slicing node in the program dependency graph as the root node, expanding the abstract syntax tree to form a slice composite graph; learning the syntax and semantic information within the statement, generating an initial embedding vector of the statement node composed of semantic and syntax feature vectors; learning the structural features of the source code, obtaining the slice composite graph and the vector representation of the composite graph, and calculating the similarity between the two; when the similarity exceeds a certain threshold, the target function is defined as a potential vulnerability function. This method solves the problem of vulnerability detection methods that lack vulnerability information that can effectively exploit known vulnerability codes while ignoring or even eliminating redundant irrelevant information in the code.

Description

Technical Field

[0001] The present invention relates to a vulnerability detection method based on a dual attention mechanism and code similarity, and belongs to the technical field of vulnerability detection. Background Art

[0002] Vulnerability testing is an integral part of cybersecurity. It can quickly identify security risks within systems, applications, or networks, helping to assess and mitigate risks that could lead to data breaches or service disruptions. Regular vulnerability testing can prevent hackers from exploiting unpatched security flaws.

[0003] The current mainstream detection methods are code similarity vulnerability detection based on machine learning and code similarity vulnerability detection based on twin neural networks.

[0004] However, these two detection methods have difficulty distinguishing between highly similar patch codes and vulnerability codes, and have difficulty identifying dissimilar vulnerability codes with the same vulnerability patterns. Therefore, a vulnerability detection method is needed that can effectively utilize the vulnerability information of known vulnerability codes while ignoring or even eliminating redundant irrelevant information in the code. Summary of the Invention

[0005] A brief overview of the present invention is provided below to provide a basic understanding of certain aspects of the present invention. It should be understood that this overview is not an exhaustive overview of the present invention. It is not intended to identify key or important aspects of the present invention, nor is it intended to limit the scope of the present invention. Its purpose is simply to present certain concepts in a simplified form as a prelude to the more detailed description discussed later.

[0006] In view of this, in order to solve the technical problems existing in the prior art, the present invention provides a vulnerability detection method based on a dual attention mechanism and code similarity.

[0007] Solution 1: Vulnerability detection method based on dual attention mechanism and code similarity, including:

[0008] Step 1: Extract the program dependency graph (PDG) corresponding to the unknown function to be tested, and expand the abstract syntax tree (AST) corresponding to the statement to each node of the program dependency graph (PDG) to form a composite graph (FCG) of the unknown function to be tested.

[0009] Step 2: Use the vulnerable statements marked in the known vulnerable function as the slicing criteria, find the slicing nodes in the program dependency graph (PDG), connect all the slicing nodes, and then use each slicing node as the root node to expand the abstract syntax tree (AST) corresponding to the root node to form a slicing composite graph (SCG) of the vulnerable function.

[0010] Step 3: Use the sentence node embedding network to learn the grammatical and semantic information in the sentence, and generate an initial sentence node embedding vector composed of a semantic feature vector and a grammatical feature vector;

[0011] Step 4: Based on the neural network model, the structural features of the source code are learned, the vector representation of the slice composite graph SCG of the vulnerable function and the composite graph FCG of the unknown function are obtained, and the similarity between the two is calculated;

[0012] Step 5: Set the similarity threshold. When the similarity exceeds a certain threshold, the objective function is defined as a potential vulnerability function.

[0013] The preferred method for obtaining semantic feature vectors is to use the fine-tuned CodeBERT model to learn the dependencies between tokens in the sentence, thereby obtaining the node v i The semantic vector representation of

[0014] Preferably, the method for obtaining the grammatical feature vector is:

[0015] After obtaining the initial code, the initial position code is input into a parameter-learnable network to obtain the final position code.

[0016] Perform subtree masking: mask the sibling nodes and parent nodes of the current node;

[0017] Get the vector representation of each subtree, weight and aggregate the vector representations of all subtrees, and get the vector representation of the abstract syntax tree AST corresponding to the statement.

[0018] Preferably, the method for generating the initial embedding vector of a sentence node composed of a semantic feature vector and a grammatical feature vector is: connecting the semantic feature vector and the grammatical feature vector, inputting them into the linear layer of the fully connected network, and obtaining the initial embedding vector of the node.

[0019] Preferably, the method for learning the structural features of source code based on the neural network model is:

[0020]

[0021]

[0022] in, and Represents the node v obtained by the model after l-1 and l layers respectively i The hidden vector representation of Represents node v j The hidden vector representation of v j Indicates v i Neighbors, that is, in the composite graph g G There is a line from vj to v i f represents the propagation function of the model, which is used to collect information about neighboring nodes to update the state of the current node; z represents the output function, which is used to calculate the final output feature vector of the node.

[0023] Preferably, the method for obtaining the vector representation of the slice composite graph SCG of the vulnerability function is: calculating the data dependency weight, control dependency weight and comprehensive weight of the node, and obtaining the node through the data dependency weight, control dependency weight and comprehensive weight. The weight of the slice composite graph g is obtained based on the node weight and node representation matrix SCG The final vector representation of .

[0024] Preferably, the method for obtaining the vector representation of the unknown function composite graph FCG is: for g FCG Each node Will g SCG The final vector representation z s and g FCG Each node The output vector Concatenate them and input them into the linear layer to calculate g FCG Each node The attention score is g FCG Each node Assign weights; calculate the final vector representation g FCG ,formula:

[0025]

[0026]

[0027]

[0028] z f =AVG(MLP(σ(W F *O F )))

[0029] in, Representation node The weight of Linear represents the fully connected layer, W F Indicates g FCG The weight matrix of the node set, n f Indicates g FCG The number of nodes declared in z f Indicates g FCG The final vector representation.

[0030] Preferably, the method for calculating the vector similarity between the slice composite graph SCG vector representation of the vulnerability function and the composite graph FCG of the unknown function is:

[0031]

[0032] Among them, g FCG Represents the function composite graph FCG, g SCG Represents the slice composite graph SCG, z s The final vector representation of the slice composite graph, z f The final vector representation representing the function composition graph.

[0033] Solution 2: An electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the steps of the vulnerability detection method based on the dual attention mechanism and code similarity described in Solution 1.

[0034] Solution 3: A computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the vulnerability detection method based on the dual attention mechanism and code similarity described in Solution 1.

[0035] The beneficial effects of the present invention are as follows: Based on the slice composite graph (SCG), the present invention describes the core statements related to the vulnerability and their control dependencies and data dependencies, while retaining the vulnerability information while eliminating as much interference information as possible that is not related to the vulnerability. The present invention includes a dual attention mechanism of tree attention and mutual attention, which can help the model pay more attention to the core syntax and semantic information during the node embedding process to distinguish between vulnerability code and patch code, thereby completing the vulnerability detection task based on similarity. This effectively solves the technical problem of vulnerability detection methods that lack vulnerability information that can effectively exploit known vulnerability codes while ignoring or even eliminating redundant irrelevant information in the code. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0037] Figure 1 Flowchart of the vulnerability detection method based on dual attention mechanism and code similarity. DETAILED DESCRIPTION

[0038] To make the technical solutions and advantages of the embodiments of the present invention more clearly understood, exemplary embodiments of the present invention are further described in detail below with reference to the accompanying drawings. It should be noted that the embodiments described are only a portion of the embodiments of the present invention, and are not an exhaustive list of all embodiments. It should be noted that the embodiments of the present invention and the features thereof may be combined with each other unless they conflict.

[0039] Example 1: Reference Figure 1 This embodiment describes a vulnerability detection method based on a dual attention mechanism and code similarity, including:

[0040] Step 1: Extract the program dependency graph (PDG) corresponding to the unknown function, expand the abstract syntax tree (AST) corresponding to the statement to each node of the program dependency graph (PDG) to form a composite graph (FCG) of the unknown function.

[0041] Step 2: Use the vulnerable statements marked in the known vulnerable function as the slicing criteria, find the slicing nodes in the program dependency graph (PDG), connect all the slicing nodes, and then use each slicing node as the root node to expand the abstract syntax tree (AST) corresponding to the root node to form a slicing composite graph (SCG) of the vulnerable function.

[0042] Step 3: Use the sentence node embedding network to learn the grammatical and semantic information in the sentence, and generate an initial sentence node embedding vector composed of a semantic feature vector and a grammatical feature vector;

[0043] Extract grammatical feature vectors using the CodeBERT model: Use the fine-tuned CodeBERT model to learn the dependencies between tokens in a sentence. Specifically, split the code sentence into a token sequence, feed it into the CodeBERT model in the form of text, and use the vector representation of the last hidden layer output as the node v i The semantic vector representation of i se ;

[0044] Use the tree-type attention mechanism to extract grammatical feature vectors:

[0045] Obtaining the initial code. The specific performance of obtaining the initial code is: using two measures: position coding and subtree masking;

[0046] Positional encoding: This includes layer-order encoding, parent encoding, and depth encoding. Specifically, layer-order encoding numbers the current node based on the layer-order traversal of the abstract syntax tree (AST); parent encoding records the number of the current node's parent; and depth encoding records the depth of the current node. After obtaining the initial positional encoding, it is input into a parameter-learnable network to obtain the final positional encoding.

[0047] Subtree masking: masks the sibling nodes and parent nodes of the current node. When calculating the value of the tree-type attention mechanism, the masked sibling nodes and parent nodes of the current node are not included. The structural information of the abstract syntax tree (AST) is fully utilized to extract the subtree of the syntax tree, and parallel computing is implemented to improve computing efficiency.

[0048] The multi-head attention mechanism is used to obtain the vector representation of each subtree, and then the vector representations of all subtrees are weighted and aggregated through the soft attention mechanism to obtain the final vector representation of the abstract syntax tree AST.

[0049] The specific calculation formula of the tree-type attention mechanism is:

[0050] Q i =B i W Q ,K i =T i W K ,V i =T i W V

[0051]

[0052]

[0053]

[0054] Among them, Q, K, V represent the query vector, target vector and value vector in the tree-type attention mechanism respectively; T i =

[0055] [t i,1 ,t i,2 ,…,t i,m ]∈R m×d Represents the current statement node v i The corresponding syntax tree T i The node embedding matrix of T i The number of tree nodes contained in B; d represents the vector dimension of the node; i =[b i,1 ,b i,2 ,…,b i,n ]∈R n×d Indicates T i The embedding matrix of the corresponding subtree root node, n is T i The number of neutron tree root nodes; W Q , W K , W V represents the learnable weight matrix; M i Indicates T i The corresponding subtree mask, S i=[s i,1 ,s i,2 ,…,s i,n ]∈R n×d Represents the vector matrix of all subtrees obtained, where s i,j Represents node v i The embedding vector of the jth subtree; u represents a learnable random initialization vector, a i,j Indicates s i,j The corresponding attention score, Represents a statement node v i The final grammatical feature vector;

[0056] Since the semantic feature vector and the grammatical feature vector do not belong to the same semantic space, this embodiment connects the two vectors and feeds them into the linear layer of the fully connected network to finally obtain the initial embedding vector of the node; the parameters in the linear layer can be trained simultaneously with the graph neural network model in step 4. Formally, for the composite graph g G Among them, G∈{FCG,SCG}, any node v i , there is a corresponding x i Represents its feature vector, which is calculated by the linear layer through the semantic feature vector and the grammatical feature vector, that is, W l and b l are the learnable parameters in the linear layer, and They are node v i The corresponding semantic feature vector and grammatical feature vector.

[0057] Step 4: Based on the graph neural network model, learn the structural features of the source code, obtain the vector representation of the slice composite graph SCG of the vulnerable function and the composite graph FCG of the unknown function, and calculate the similarity between the two.

[0058] For the composite graph g G Any node v i , h i and o i Represents the corresponding hidden vector representation and output vector representation. In order to update the state of the current node according to the situation of the neighbors, the graph neural network model is expressed by the following formula:

[0059]

[0060]

[0061] in, and Represents the node v obtained by the model after l-1 and l layers respectively i The hidden vector representation of Represents node v j The hidden vector representation of v j Indicates v i neighbors, that is, in the composite graph g G There is a line from v j to v i f represents the propagation function of the model, which is used to collect information about neighboring nodes to update the state of the current node; z represents the output function, which is used to calculate the final output feature vector of the node;

[0062] The mutual attention mechanism is used to obtain the vector representation of the slice composite graph SCG of the vulnerable function and the composite graph FCG of the unknown function, and then the similarity between the two is calculated.

[0063] The method for obtaining the vector representation of the slice composite graph (SCG) of the vulnerable function is as follows: for the slice composite graph (SCG) of the vulnerable function, the weight is directly calculated using its own graph structure to highlight the vulnerability information it contains; specifically, the data dependency weight, control dependency weight, and comprehensive weight of the node are calculated;

[0064] Data-dependent weights: using g SCG Vulnerable nodes As the root node, and set the root node weight to α r ; If there is a node in the slice composite graph SCG of the vulnerability function Furthermore, assuming that this node is connected to the vulnerable node through at least k data dependency edges Connect, then, the node The data dependency weight is α i =α r ·(L α ) k , where L α ∈(0,1) is a hyperparameter representing the data-dependent weight decay rate.

[0065] Control dependency weight: still use vulnerable nodes As the root node, and set the root node weight to β r ; Assume that the node Connected to the root node by at least k control dependency edges, the control dependency weight is β i =β r ·(L β ) k , where L β ∈(0,1) is a hyperparameter that represents the decay rate of the control dependency weight;

[0066] The comprehensive weight is: Assume that the node With the root node There are at least k edges connecting them (data-dependent edges or control-dependent edges), then The comprehensive weight is γ i =γ r ·(L γ ) k , where L r ∈(0,1) is a hyperparameter representing the decay rate of the comprehensive weight.

[0067] Through the data dependence weight α i , control dependency weight β i and the comprehensive weight γ i , get the node The weight is calculated as follows:

[0068]

[0069]

[0070] in, Representation node The weight of , Softmax is the softmax function; W S Represents the weight matrix of the node set, n s Indicates g SCG The number of nodes declared in .

[0071] Combining the weight and node representation matrix, we get g SCG The final vector representation is calculated as follows:

[0072] σ(·)=MaxPool(Relu(Conv(·)))

[0073] z s =AVG(MLP(σ(W S *O S )))

[0074] where σ(·) is defined as a one-dimensional convolutional layer with maximum pooling, MaxPool represents the maximum pooling operation, Relu represents the activation function, Conv represents the one-dimensional convolution operation, AVG represents the average pooling operation, MLP represents the multi-layer perceptron, and W S Represents the weight matrix of the previous step, O S Represents the output feature vector set of the node, z s Indicates g SCG Final vector representation.

[0075] The method of obtaining the vector representation of the unknown function composite graph FCG is: for the unknown function composite graph FCG, use the known vulnerability information in the slice composite graph SCG of the vulnerability function and the mutual attention mechanism to assign weights; specifically: for g FCG Each node Will gSCG The final vector representation z s and g FCG Each node The output vector Concatenate them and input them into the linear layer to calculate g FCG Each node The attention score is g FCG Each node Assign weights; calculate the final vector representation g FCG formula:

[0076]

[0077]

[0078] z f =AVG(MLP(σ(W F *O F )))

[0079] in, Representation node The weight of Linear represents the fully connected layer, W F Indicates g FCG The weight matrix of the node set, n f Indicates g FCG The number of nodes declared in z f Indicates g FCG The final vector representation.

[0080] Using z s and z f Calculate g FCG and g SCG The similarity between them is calculated as follows:

[0081]

[0082] Among them, g FCG Represents the function composite graph, g SCG represents a slice composite graph, z s The final vector representation of the slice composite graph, z f The final vector representation representing the function composition graph.

[0083] Step 5: Set the similarity threshold. When the similarity exceeds a certain threshold, the objective function is defined as a potential vulnerability function.

[0084] Adjusting parameters to train graph neural network models: using label information and g FCG and g SCGThe similarity between them is calculated, the contrast loss function is calculated, and the network parameters are adjusted according to the loss back propagation until the contrast loss drops to the predetermined target range, and the training ends.

[0085] Use the contrast loss function to train the model, and the calculation formula is:

[0086] D=1-Sim(g FCG ,g SCG )

[0087]

[0088] Among them, D represents the distance between two sample features, N P Represents the number of sample pairs, y represents the label of whether the two samples are similar, y = 1 means the two samples are similar, y = 0 means the two samples are not similar, margin is a defined hyperparameter, which is the threshold of D (when y = 0, if D ≥ margin, it means that the training is successful and the loss is equal to 0).

[0089] To train and evaluate the model, we obtain a dataset consisting of unknown functions to be tested and known vulnerable functions. The dataset is divided into a training dataset and a test dataset. The ratio of the split is 8:2, with 8 training datasets and 2 test datasets. The model is trained using the data in the training dataset and tested using the test dataset.

[0090] After the model is trained, the target function is input into the graph neural network model. The graph neural network uses the method in step 4 to calculate the similarity between the target function and the known vulnerability function. When the similarity exceeds a certain threshold, the target function is defined as a potential vulnerability function.

[0091] This invention can play an important role in many fields. Application areas include security auditing, continuous integration / continuous deployment, complex software vulnerability analysis, vulnerability fix tracking, and many other aspects. The following lists some known and potential application areas and their application methods.

[0092] 1. Security Audit: This invention can be used for automated auditing, helping security experts quickly identify potential risks in code. For example, by comparing known vulnerabilities in open source software, similar vulnerability patterns can be detected in closed-source commercial software.

[0093] 2. Continuous Integration / Continuous Deployment: In a continuous integration / continuous deployment environment, the present invention can be used as a step to automatically check whether newly submitted code has known vulnerabilities. This helps reduce the introduction of new vulnerabilities due to code changes.

[0094] 3. Large-Scale Software Vulnerability Analysis: In large-scale software repositories, this method can help researchers identify potential threats that may be similar to known vulnerabilities without understanding the internal structure of the code. This is particularly useful for analyzing very large and complex software.

[0095] 4. Vulnerability fix tracking: After a vulnerability is discovered and fixed, researchers can use this invention to track other software versions that may be affected by the same vulnerability so that they can be fixed in a timely manner.

[0096] Example 2: The computer device of the present invention may include a processor and memory, such as a single-chip microcomputer including a central processing unit. Furthermore, the processor is configured to execute a computer program stored in the memory to implement the steps of the vulnerability detection method based on the dual attention mechanism and code similarity.

[0097] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0098] The memory may primarily include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function (such as a sound playback function or an image playback function); and the data storage area may store data generated based on the use of the mobile phone (such as audio data, a phone book, etc.). Furthermore, the memory may include high-speed random access memory and non-volatile memory, such as a hard disk, internal memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other volatile solid-state storage device.

[0099] Embodiment 3: Computer readable storage medium embodiment.

[0100] The computer-readable storage medium of the present invention can be any form of storage medium that can be read by a processor of a computer device, including but not limited to non-volatile memory, volatile memory, ferroelectric memory, etc. The computer-readable storage medium stores a computer program. When the processor of the computer device reads and executes the computer program stored in the memory, the steps of the vulnerability detection method based on the dual attention mechanism and code similarity can be implemented.

[0101] The computer program includes computer program code, which may be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal, and software distribution medium. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0102] Although the present invention has been described with respect to a limited number of embodiments, it will be apparent to those skilled in the art, having benefit of the foregoing description, that other embodiments are contemplated within the scope of the invention thus described. Furthermore, it should be noted that the language used in this specification has been selected primarily for readability and didactic purposes, rather than for the purpose of explaining or limiting the subject matter of the present invention. Consequently, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is intended to be illustrative rather than restrictive of the scope of the invention, which is defined by the appended claims.

Claims

1. A vulnerability detection method based on dual attention mechanism and code similarity, characterized by: include: Step 1: Extract the program dependency graph (PDG) corresponding to the unknown function to be tested, and expand the abstract syntax tree (AST) corresponding to the statement to each node of the program dependency graph (PDG) to form a composite graph (FCG) of the unknown function to be tested. Step 2: Use the vulnerable statements marked in the known vulnerable function as the slicing criteria, find the slicing nodes in the program dependency graph (PDG), connect all the slicing nodes, and then use each slicing node as the root node to expand the abstract syntax tree (AST) corresponding to the root node to form a slicing composite graph (SCG) of the vulnerable function. Step 3: Use the sentence node embedding network to learn the grammatical and semantic information in the sentence, and generate an initial sentence node embedding vector composed of a semantic feature vector and a grammatical feature vector; Step 4: Based on the neural network model, the structural features of the source code are learned, the vector representation of the slice composite graph SCG of the vulnerable function and the composite graph FCG of the unknown function are obtained, and the similarity between the two is calculated; Step 5: Set a similarity threshold. When the similarity exceeds a certain threshold, the objective function is defined as a potential vulnerability function. The method to obtain semantic feature vectors is to use the fine-tuned CodeBERT model to learn the dependency between tokens in the sentence and obtain the node The semantic vector representation of ; The method to obtain the grammatical feature vector is: After obtaining the initial code, the initial position code is input into a parameter-learnable network to obtain the final position code. Perform subtree masking: mask the sibling nodes and parent nodes of the current node; Get the vector representation of each subtree, weight and aggregate the vector representations of all subtrees, and get the vector representation of the abstract syntax tree (AST) corresponding to the statement; The method for generating the initial embedding vector of a sentence node composed of a semantic feature vector and a grammatical feature vector is as follows: the semantic feature vector and the grammatical feature vector are concatenated and input into the linear layer of the fully connected network to obtain the initial embedding vector of the node; For composite graphs in, , any node , there is a corresponding represents its eigenvector, It is calculated by the linear layer through the semantic feature vector and the grammatical feature vector, that is, ; and are the learnable parameters in the linear layer, and Node The corresponding semantic feature vector and grammatical feature vector.

2. The vulnerability detection method based on dual attention mechanism and code similarity according to claim 1 is characterized in that: The method of learning the structural features of source code based on the neural network model is: ； ； in, and Respectively and The nodes obtained by the model after the layer The hidden vector representation of Representation node The hidden vector representation of ; express neighbors, that is, in the composite graph There is a line from arrive edge; Represents the propagation function of the model, which is used to collect information from neighboring nodes to update the state of the current node; Represents the output function, which is used to calculate the final output feature vector of the node.

3. The vulnerability detection method based on dual attention mechanism and code similarity according to claim 1 is characterized in that: The method to obtain the SCG vector representation of the slice composite graph of the vulnerability function is: calculate the data dependency weight, control dependency weight and comprehensive weight of the node, and obtain the node through the data dependency weight, control dependency weight and comprehensive weight. The weight of the node is used to obtain the slice composite graph based on the node weight and node representation matrix The final vector representation of .

4. The vulnerability detection method based on dual attention mechanism and code similarity according to claim 1 is characterized in that: The method to obtain the vector representation of the composite graph FCG of the unknown function to be tested is: Each node ,Will The final vector representation of and Each node The output vector Concatenate them and input them into the linear layer to calculate Each node The attention score is Each node Assign weights; Calculate the final vector representation ,formula: ； ； ； ； in, Representation node The weight of represents the fully connected layer, express The weight matrix of the node set, express Declare the number of nodes in express The final vector representation.

5. The vulnerability detection method based on dual attention mechanism and code similarity according to claim 1 is characterized in that: The method for calculating the similarity between the vector representation of the slice composite graph SCG of the vulnerability function and the vector representation of the composite graph FCG of the unknown function is: ； in, represents the function composite graph, represents a sliced ​​composite graph, represents the final vector representation of the slice composite graph, The final vector representation representing the function composition graph.

6. An electronic device, characterized in that: The invention comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the vulnerability detection method based on the dual attention mechanism and code similarity according to any one of claims 1 to 5 are implemented.

7. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor, the vulnerability detection method based on the dual attention mechanism and code similarity described in any one of claims 1 to 5 is implemented.

Images