Long function-oriented software supply chain vulnerability detection method

Abstract

The invention discloses a long function-oriented software supply chain vulnerability detection method, which comprises the following steps of: eliminating information irrelevant to vulnerabilities by applying a designed statement-level difference extraction algorithm on a pseudo-code level; secondly, utilizing a designed graph slicing algorithm to map pseudo code slices to a code attribute graph, identifying and positioning vulnerability-related statements and variable nodes thereof, tracing nodes which are semantically adjacent to variable nodes which are strongly correlated with vulnerabilities by tracking edges in an abstract syntax tree, and constructing a difference graph after slicing; afterwards, the difference graph is input into a graph matching neural network for training, so that the model can accurately judge the similarity of the difference sub-graph pairs between the vulnerabilities and the vulnerabilities after the vulnerabilities are repaired. Finally, whether the vulnerability exists or not is judged by comparing the distance between the to-be-detected function and the image obtained after the reference sample is sliced, the scale of the image is reduced, relevant information of the vulnerability is highlighted, and the time and hardware cost of model training are reduced while high detection accuracy is guaranteed.

Description

Technical Field

[0001] The present invention belongs to the technical field of binary-oriented Internet of Things supply chain vulnerability detection, and in particular relates to a software supply chain vulnerability detection method for long functions. Background Art

[0002] At present, most of the binary-oriented software supply chain vulnerability detection methods are based on binary code search. In the field of information security, "known vulnerabilities" usually refer to security vulnerabilities that have been discovered, recorded and widely known. Binary code search has been widely used in the detection of known vulnerabilities. Based on program analysis, it quantifies the similarity between all functions in the binary file and the functions to be detected, thereby determining whether the binary file contains known vulnerabilities. Although there have been many works devoted to the detection of binary software supply chain vulnerabilities based on binary code search, there are still the following challenges in this field: First, it is difficult to achieve cross-compilation environment support (different architectures, different compilers, different compiler versions and different compilation optimization options, etc.). Since IoT devices are widely deployed in various scenarios, and in order to meet diverse needs, a source code needs to be compiled through different compilation environments to obtain some binary files. Although these binary files have the same functions and similar semantics, their internal structures are different. Therefore, the design of vulnerability detection methods must fully consider their robustness to different compilation environments, and existing methods such as Asm2Vec, DeepBinDiff and PalmTree are only applicable to a single architecture. Binary vulnerability detection on the network does not support cross-compilation environment tasks; secondly, it is difficult to solve the problem of data scarcity. Training deep learning models usually requires a large amount of data. Most studies tend to focus on architectures with rich data sets and ignore those architectures with relatively scarce data sets (such as PowerPC). In addition, the time cost of manually labeling data sets for training models is extremely high. Therefore, data scarcity in the field of binary vulnerability detection is still an urgent problem to be solved; finally, there is the problem of vulnerability repair. After receiving a vulnerability report, third-party components usually release a repair patch. However, these patches make extremely small changes to the target binary file, and the difference between the binary file before and after the patch is difficult to detect. This tiny difference makes the existing detection method very easy to produce false positives, thus increasing the challenge of vulnerability detection.

[0003] The existing multi-model cross-architecture vulnerability detection solution PG-VulNet based on pseudocode and Graph Matching Networks (GMN) has the following main processes: Figure 1As shown in the figure, specifically: this method is based on the "plug-in" idea and trains a vulnerability detection model for each vulnerability with a CVE number. For each vulnerability, first, the source code before and after the vulnerability is repaired is compiled into a binary file dataset using different compilation environments, and then all binary files in the dataset are decompiled into a corresponding pseudocode set. The program attribute graph set is constructed by representing the syntax and semantic information of the pseudocode as a program attribute graph, that is, the abstract syntax tree, control flow graph and program dependency graph extracted from the pseudocode are merged; then, the different program attribute graphs representing the vulnerability in the program attribute graph set are combined into similar pairs, and the program attribute graphs representing the vulnerability and the repair status are combined into dissimilar pairs, and the paired data set is divided into a training set, a validation set and a test set. The training set is put into the graph matching neural network training, and the validation set is used to adjust the parameters to complete the model training. In the detection stage, based on the trained model, the sample most similar to other vulnerability samples is first selected from the training set as the benchmark sample, and then the maximum value of the distance between all vulnerability samples and the benchmark sample and the minimum value of the distance between all repair samples and the benchmark sample in the training set are calculated. In order to ensure the lowest false positive rate, a value slightly larger than the maximum value is selected as the threshold. During detection, the distance between the sample to be detected and the benchmark sample is calculated through the trained model. If the distance is less than the threshold, it is considered to be a vulnerability sample, and if the distance is greater than the threshold, it is considered to be a non-vulnerable sample.

[0004] Although the above methods have effectively dealt with problems such as cross-compilation environment, data scarcity, and vulnerability repair to a certain extent, the methods represented by a series of solutions, such as converting binary code into pseudocode in reverse, using semantic graph structures such as program property graphs to represent pseudocode semantics, and then combining graph neural networks to learn semantic information, all have a challenge that has not been fully considered in the past: the application scenario limitations brought by long functions. This limitation constitutes a new problem that needs to be solved under the current technical framework. Long functions often contain more complex and multi-level logical structures. They are usually composed of a large number of lines of code. There are not only close data flow dependencies between these lines of code, but also complex control flow dependencies. Data flow dependency refers to whether the value of a variable in a statement (or expression) directly depends on the value or state of a variable in another statement (or expression). In terms of data flow, variables in long functions often undergo multiple assignments, operations, and transfers. Their values ​​flow between different code segments and affect each other, forming an intricate data network. Control flow dependency refers to whether the value of a variable or the execution of a statement depends on the state of another statement or variable. In terms of control flow, long functions usually contain multiple conditional branches, loop structures, and function calls. These control structures are nested and intertwined, and together determine the execution path of the program. A small change in a condition may lead to a huge change in the execution path of the entire function. In long functions, control dependencies may become more complex. Therefore, the semantic graphs extracted from long functions are often large in scale and complex in hierarchy. The connections between nodes (representing variables, statements, etc.) may be very dense, and there will be a large number of edge connections between nodes that are far apart in the graph. For graph neural networks, in such graphs, calculations between long distances (i.e., parts of the code that are far apart) may become difficult due to the vanishing gradient problem, which makes it difficult for the model to capture long-range dependencies. The lack of such long-range dependencies will limit the model's ability to understand and capture complex structures and semantics in long code snippets, making it difficult to effectively represent and learn vulnerability features in the code. On the other hand, for downstream graph neural networks that complete vulnerability detection tasks by learning code features, the depth of the model determines the perceptual field of view of the neural network. When graph neural networks process graph structure data, as the number of network layers increases, node features may tend to be consistent. This phenomenon is called oversmoothing. The oversmoothing problem will reduce the distinguishability of node features, thus limiting the depth of the graph neural network and affecting the performance of the model in distinguishing samples with different features. In addition, the code that causes the vulnerability usually only occupies a small part of the entire function, which means that in the graph representation of the function, the cause of the vulnerability may only be traced back to a small subgraph or a single path.For vulnerability detection, the importance of these subgraphs or paths far exceeds other areas on the graph. Therefore, how to delineate the areas related to vulnerabilities in the code property graph is also crucial to improving the accuracy of vulnerability detection, especially for long function scenarios. Summary of the invention

[0005] In view of this, the present invention provides a software supply chain vulnerability detection method for long functions, which effectively addresses the challenges of software supply chain vulnerability detection in long function scenarios with complex logic and close dependence on data flow and control flow.

[0006] The present invention provides a method for detecting software supply chain vulnerabilities in long functions, comprising the following steps:

[0007] Step 1: construct an abstract syntax tree, a control flow graph, and a program dependency graph based on the pseudocode of the software binary file. Finally, based on the nodes of the abstract syntax tree, add the edges in the control flow graph and the program dependency graph as additional relationships to the nodes of the abstract syntax tree to obtain a code attribute graph. All code attribute graphs constitute a code attribute graph set.

[0008] Step 2: Subgraph pairs obtained by slicing the code attribute graphs with vulnerabilities in pairs constitute similar subgraph pairs, and subgraph pairs obtained by slicing the code attribute graphs with vulnerabilities in pairs and the code attribute graphs after the vulnerabilities are fixed in pairs constitute dissimilar subgraph pairs. The sets of similar subgraph pairs and dissimilar subgraph pairs are divided into training sets, test sets, and validation sets according to a certain ratio.

[0009] Step 3: Use the training set generated in step 2 to train a graph matching neural network with an attention mechanism as the current vulnerability detection model. At the same time, use the validation set as the basis for adjusting the model parameters (i.e., parameter adjustment), and finally complete the model training. The graph matching neural network includes an encoder, a propagator, and an aggregator. The encoder uses a multi-layer perceptron to map the nodes of the two feature graphs to initial vectors; the propagator is used to aggregate the information of neighbor nodes in the same graph, and use the cross-graph matching information of the nodes between the two graphs to update the node features. After multi-layer propagation, the node representation of each graph is obtained; the aggregator aggregates the node features into a graph feature vector;

[0010] Step 4. Based on the trained vulnerability detection model, select the benchmark samples required in the detection process from the training set, and then determine the threshold required in the detection process based on the benchmark samples and all other samples in the training set. During the detection, the pseudocode obtained by the binary file to be detected in the manner of step 1 is recorded as the pseudocode to be detected, and the code attribute graph is recorded as the code attribute graph to be detected. Then, the code attribute graph to be detected and the code attribute graph corresponding to the benchmark sample are obtained by the manner of step 2 to obtain a subgraph pair. Finally, the subgraph pair is input into the trained software supply chain vulnerability detection model to calculate the distance between the code attribute graph to be detected and the benchmark sample. If the distance is less than the threshold, it means that the sample to be detected contains a vulnerability, otherwise it does not.

[0011] Furthermore, the code property graph in step 1 is constructed as follows: first, a code analysis tool is used to extract the abstract syntax tree, control flow graph and program dependency graph of the pseudocode respectively; next, the code property graph is obtained by taking the abstract syntax tree as the basic structure and adding the edges of the control flow graph and the program dependency graph as additional relationships to the nodes of the abstract syntax tree; the control flow graph represents the control flow relationship between the basic blocks of the program, and the program dependency graph represents the data dependency and control dependency relationship between the variables in the code.

[0012] Furthermore, the graph slicing method in step 2 is: pseudocode pairs are formed by two pseudocodes (P i , P j ), by comparing with the pseudo code (P i , P j ) respectively correspond to the code attribute graphs to form a code attribute graph pair (G i , G j ); According to the pseudo code (P i , P j ) to its corresponding code attribute graph pair (G i , G j ) to slice the graph and obtain the subgraph pair (G i’ , G j’ ).

[0013] Furthermore, the graph slicing method is:

[0014] Step 2.1. Rename all variables in the variable declaration part of the pseudocode in alphabetical order, and then use the new names to replace the corresponding variable names in the pseudocode; calculate P i and P j The difference between i In and not in P j The statements in are saved to the set S i , denoted as S i = {stmt i1 , stmt i2 , ..., stmtim}, will be in P j In and not in P i The statements in are saved to the set S j , denoted as S j = {stmt j1 , stmt j2 , ..., stmt jm};

[0015] Step 2.2: For the code attribute graph pair (G i , G j ) in each code attribute graph locates the code attribute graph that corresponds to statement S i or statement S j The variable nodes corresponding to the variables in the code attribute graph constitute a node set L belonging to the graph;

[0016] Step 2.3: Based on the node set L and the code attribute graph set G, construct a difference graph diffG, and the corresponding difference graph diffG constitutes a difference subgraph pair (G i’ , G j’ ).

[0017] Furthermore, in step 2.3, the difference graph diffG is constructed according to the node set L and the code attribute graph set G as follows:

[0018] The input is the node set L, the code attribute graph set G, and the upper limit T of the number of nodes in the difference graph diffG to be generated. nodes , the output is the generated graph diffG, V diff and E diff Respectively represent the node set and edge set of diffG; initially, V diff Initialize to L, and set E diff Initialized to an empty set; for each node l in L, first find the parent node l of l through the function findParent() parent , and then use the function getSubtree() to obtain the l parent All nodes in the subtree with the node as the root are denoted as V subtree ; Traverse V subtree Each node in V determines whether it exists in the set V. diff For the case not in V diff The nodes in the set V are added to diff If V diff The number of nodes in exceeds the threshold T nodes Then end the V subtree Otherwise, continue to traverse; get the node set V corresponding to diffG diff ;

[0019] According to V diff Construct the edge set E of diffG diff , for V diff Any node in G, if it exists on an edge in G and the other node connected by the edge is also in V diff Then merge the edge into E diff In; by the final V diff and E diff Construct diffG and complete the construction of diffG.

[0020] Furthermore, the method for selecting the benchmark sample in step 4 is: select the diffG graph pairs obtained by processing each of the code attribute graphs representing the vulnerability status in the training set through the graph slicing algorithm, use the trained software supply chain vulnerability detection model to calculate the distance between them, and select the benchmark sample based on the principle of minimizing the sum of distances, that is, after calculating the difference subgraph pairs between this sample and all other positive samples in the training set, the sum of the distances between the difference subgraph pairs calculated by the model is the smallest.

[0021] Furthermore, the threshold value in step 4 is determined as follows: according to the graph slicing algorithm, the diffG graph pairs consisting of the code attribute graphs representing all vulnerabilities in the training set and the benchmark samples are obtained, and the distance between the diffG graph pairs is calculated using the trained software supply chain vulnerability detection model, and the maximum value of the distance is recorded as max; according to the graph slicing algorithm, the diffG graph pairs consisting of the code attribute graphs representing all repaired functions in the training set and the benchmark samples are obtained, and the distance between the diffG graph pairs is calculated using the trained software supply chain vulnerability detection model, and the minimum value of the distance is recorded as min; the value is taken in the (max, min) interval to test its accuracy on the training set, and the threshold corresponding to the highest accuracy is the determined threshold. If there are multiple thresholds with the same accuracy, the present invention further selects the threshold that makes the false positive rate of the training set the lowest.

[0022] Furthermore, the step size of the value taken in the (max, min) interval is set to 0.001.

[0023] Beneficial effects:

[0024] The designed statement-level difference extraction algorithm is used at the pseudocode level to remove information irrelevant to the vulnerability; the designed graph slicing algorithm is then used to map the pseudocode slices to the code attribute graph, identify and locate the vulnerability-related statements and their variable nodes, and trace the edges in the abstract syntax tree to the semantically adjacent nodes of the variable nodes that are strongly related to the vulnerability, and construct the sliced ​​difference graph. After that, the difference graph is input into the graph matching neural network training, so that the model can accurately determine the similarity of the difference subgraph pairs between the vulnerability and the repaired one, and between the vulnerability and the vulnerability. Finally, by comparing the distance between the function to be tested and the graph after slicing the benchmark sample, it is determined whether it has a vulnerability, which reduces the scale of the graph and highlights the vulnerability-related information, while ensuring high detection accuracy and reducing the time and hardware cost of model training. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a flowchart of the existing multi-model cross-architecture vulnerability detection solution based on pseudocode and graph matching network.

[0026] Figure 2 A schematic diagram of a flow chart of a software supply chain vulnerability detection method for long functions provided by the present invention.

[0027] Figure 3 A flowchart of a graph slicing algorithm for a software supply chain vulnerability detection method for long functions provided by the present invention. DETAILED DESCRIPTION

[0028] The present invention is described in detail with reference to the following embodiments.

[0029] The present invention provides a software supply chain vulnerability detection method for long functions, the processing flow is as follows: Figure 2 As shown, the specific steps include:

[0030] Step 1. Decompile the binary file to be detected into pseudocode, build an abstract syntax tree based on the pseudocode, establish a control flow graph and a program dependency graph based on the abstract syntax tree, and finally use the nodes of the abstract syntax tree as the basic structure, add the edges in the control flow graph and the program dependency graph as additional relationships to the nodes of the abstract syntax tree to obtain a code attribute graph, and all code attribute graphs constitute a code attribute graph set G.

[0031] The method of decompiling binary files into pseudocode is implemented by a batch decompilation python script written based on the IDA reverse tool. Pseudocode is closer to high-level programming language than intermediate representation. Although it cannot be directly recompiled and is very different from the real source code in form, it restores the logic and semantics of the original program as much as possible. This process converts binary files of different platforms, different architectures, and different compilers into the same intermediate representation that is independent of architecture, greatly reducing cross-architecture interference.

[0032] The code property graph is constructed as follows: first, the code analysis tool joern is used to extract the abstract syntax tree, control flow graph, and program dependency graph of the pseudocode. Next, the code property graph is obtained by adding the edges of the control flow graph and the program dependency graph as additional relationships to the nodes of the abstract syntax tree based on the abstract syntax tree. The control flow graph represents the control flow relationship between the basic blocks of the program, and the program dependency graph represents the data dependency and control dependency relationship between the variables in the code.

[0033] Step 2: Pseudocode pairs are formed by two pseudocodes. i , P j ), by comparing with the pseudo code (P i , P j ) respectively correspond to the code attribute graphs to form a code attribute graph pair (G i , G j ); for pseudo code pair (P i , P j ) and its corresponding code attribute graph pair (G i , G j ) to slice the graph and obtain the subgraph pair (G i’ , G j’ ).

[0034] In order to solve the problem of large graph size caused by long functions, that is, to reduce the number of nodes and edges in the graph and retain the contextual semantic information of variables related to the vulnerability behavior, the present invention constructs a graph slicing algorithm to slice the given pseudocode pair (P i , P j ) and its corresponding code attribute graph pair (G i , G j ) is sliced ​​to obtain the difference subgraph pair (G i’ , G j’ ), the process of the graph slicing algorithm is as follows Figure 3 As shown, the following steps are included:

[0035] Step 2.1. Although the process of decompiling to generate pseudocode is committed to restoring the structure and logic of the source code, the loss of information, such as the loss of the original variable name, usually results in the variables being assigned temporary or common names, which will cause variables with the same meaning in the pseudocode to have different names. Therefore, first rename the variables in the pseudocode. Specifically: first parse the pseudocode and record the order in which each variable first appears, and generate a new name for each variable. The name consists of a combination of the letter combination "var" and an increasing number, such as var1, var2, var3,... In this way, the new name of the variable is ensured to be unique in the current pseudocode. After that, traverse the entire pseudocode and replace each old variable name with the corresponding new variable name. After completing the name replacement of all pseudocodes in the pseudocode set, calculate P based on the Gestalt matching algorithm. i and P j The difference between i In and not in P j The statements in are saved to the set S i , denoted as S i = {stmt i1 , stmt i2 , ..., stmt im}, will be in P j In and not in P i The statements in are saved to the set S j , denoted as S j = {stmt j1 , stmt j2 , ..., stmt jm};

[0036] Step 2.2: For the code attribute graph pair (G i , G j ) in each code attribute graph, locate the one that matches the statement set S i Or a set of statements S j The variable nodes corresponding to the variables in all statements in the code attribute graph constitute the node set L belonging to the graph.

[0037] From the construction process of the above code attribute graph, we can know that the code attribute graph and the nodes of the abstract syntax tree that constitute the code attribute graph are the same, and the variable node is the leaf node with the attribute of Identifier in the abstract syntax tree. In order to facilitate retrieval and improve positioning efficiency, the positioning process is converted into searching for the variable node corresponding to the variable in the statement in the abstract syntax tree, that is, the leaf node with the attribute of Identifier. The specific process is: First, for S i and S jFor each statement stmt in the abstract syntax tree, determine its corresponding node, that is, the node with the attribute statement, and record these node sets as Then, search for V stmt The attributes in each subtree with each node as the root are Identifier leaf nodes.

[0038] Since in the tree structure if the node v i is node v j ancestor node, then v j The leaf node set is v i A subset of the leaf node set of v i and v j The task of finding a leaf node can be simplified to finding v i The leaf node task of V stmt The ancestor-descendant relationship between the midpoints narrows the search range of the leaf nodes. stmt Obtaining the leaf node set L further improves the efficiency.

[0039] Step 2.3: Based on the node set L and the code attribute graph set G, a difference graph diffG is constructed from the bottom up, and the corresponding difference graph diffG constitutes a difference subgraph pair (G i’ , G j’ ).

[0040]

[0041]

[0042] The processing process of the above algorithm is as follows: the input is the node set L, the code attribute graph set G and the upper limit T of the number of nodes in the difference graph diffG to be generated nodes , the output is the generated graph diffG, V diff and E diff Respectively represent the node set and edge set of diffG; initially, V diff Initialize to L, and set E diff Initialized to an empty set; for each node l in L, first find the parent node l of l through the function findParent() parent , and then use the function getSubtree() to obtain the l parent All nodes in the subtree with the node as the root are denoted as V subtree ; Traverse V subtree Each node in V determines whether it exists in the set V. diff For the case not in V diff The nodes in the set V are added to diff If Vdiff The number of nodes in exceeds the threshold T nodes Then end the V subtree Otherwise, continue to traverse; finally, we get the node set V corresponding to diffG diff , according to V diff Construct the edge set E of diffG diff , for V diff Any node in G, if it exists on an edge of the code attribute graph in G, and the other node linked by this edge is also in V diff Then merge the edge into E diff In; by the final V diff and E diff diffG is formed, and the construction of diffG is completed. subtree All nodes in V already exist diff The traversal is terminated directly when the time is right, which can ensure that the present invention can not only solve the problem of long functions, but also be applicable to application scenarios of non-long functions.

[0043] Step 3. The training set contains similar subgraph pairs and dissimilar subgraph pairs, wherein the similar subgraph pairs are composed of the subgraph pairs obtained by slicing the code attribute graphs with vulnerabilities (positive samples) in step 2, and the dissimilar subgraph pairs are composed of the subgraph pairs obtained by slicing the code attribute graphs with vulnerabilities and the code attribute graphs after the vulnerabilities are fixed (negative samples) in step 2.

[0044] Step 4: Use a graph matching neural network with an attention mechanism to build a software supply chain vulnerability detection model, which is used to calculate the similarity score between given graph pairs. The software supply chain vulnerability detection model includes an encoder, a propagator, and an aggregator. The encoder uses a multi-layer perceptron to map the nodes of two feature graphs to initial vectors; the propagator is used to aggregate the information of neighbor nodes in the same graph, and use the cross-graph matching information of nodes between two graphs to update the node features. After multi-layer propagation, the node representation of each graph is obtained; the aggregator aggregates the node features into a graph feature vector. The training sample data set is used to complete the training of the software supply chain vulnerability detection model, so that the model has the ability to distinguish between vulnerabilities and repair states and determine whether the vulnerability difference graphs are similar.

[0045] Step 5: Based on the trained vulnerability detection model, select the benchmark samples required in the detection process from the training set, and then determine the threshold required in the detection process based on the benchmark samples and all other samples in the training set. During the detection, the pseudocode obtained by the binary file to be detected in step 1 is recorded as the pseudocode to be detected, and the code attribute graph is recorded as the code attribute graph to be detected. Then, the code attribute graph to be detected and the code attribute graph corresponding to the benchmark sample are obtained by step 2 to obtain a subgraph pair. Finally, the subgraph pair is input into the software supply chain vulnerability detection model trained in step 4 to calculate the distance between the code attribute graph to be detected and the benchmark sample. If the distance is less than the threshold, it means that the sample to be detected contains a vulnerability, otherwise it does not contain it.

[0046] Among them, the method of selecting benchmark samples is: select all code attribute graphs (positive samples) representing the vulnerability status in the training set, and obtain difference subgraph pairs by processing them with the graph slicing algorithm. Use the trained software supply chain vulnerability detection model to calculate the distance between them, and select the benchmark sample according to the principle of minimum sum of distances, that is, after calculating the difference subgraph pairs between this sample and all other positive samples in the training set, the sum of the distances between the difference subgraph pairs calculated by the model is the smallest.

[0047] The threshold is determined as follows: according to the graph slicing algorithm, all the difference subgraph pairs between the positive samples and the benchmark samples in the training set are obtained, their distances are calculated by the trained model, and the maximum value of all distances is obtained, which is recorded as max; according to the graph slicing algorithm, all the difference subgraph pairs between the negative samples and the benchmark samples in the training set are obtained, their distances are calculated by the trained model, and the minimum value of all distances is obtained, which is recorded as min; for example, a step size of 0.001 is set in the (max, min) interval, and all possible thresholds in this interval are used to test their accuracy on the training set, and the threshold when the accuracy reaches the maximum is selected as the final threshold.

[0048] If there are multiple thresholds with the same accuracy, the present invention further selects the threshold that minimizes the false positive rate of the training set. This selection strategy is particularly important in real-world software supply chain scenarios because most functions do not actually contain vulnerabilities. By selecting the threshold with the lowest false positive rate, it is possible to minimize the situation where normal, non-vulnerable functions are mistakenly identified as having vulnerabilities, thereby improving the overall security analysis efficiency and accuracy. Such a strategy helps reduce unnecessary repair and audit work.

[0049] In summary, the above are only preferred embodiments of the present invention and are not intended to limit the protection scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A software supply chain vulnerability detection method for long functions, characterized in that: The following steps are involved: Step 1: construct an abstract syntax tree, a control flow graph, and a program dependency graph based on the pseudocode of the software binary file. Finally, based on the nodes of the abstract syntax tree, add the edges in the control flow graph and the program dependency graph as additional relationships to the nodes of the abstract syntax tree to obtain a code attribute graph. All code attribute graphs constitute a code attribute graph set. Step 2: Subgraph pairs obtained by slicing the code attribute graphs with vulnerabilities in pairs constitute similar subgraph pairs, and subgraph pairs obtained by slicing the code attribute graphs with vulnerabilities in pairs and the code attribute graphs after the vulnerabilities are fixed in pairs constitute dissimilar subgraph pairs. The sets of similar subgraph pairs and dissimilar subgraph pairs are divided into training sets, test sets, and validation sets according to a certain ratio. Step 3: Use the training set generated in step 2 to train a graph matching neural network with an attention mechanism as the current vulnerability detection model. At the same time, use the validation set as the basis for adjusting the model parameters (i.e., parameter adjustment), and finally complete the model training. The graph matching neural network includes an encoder, a propagator, and an aggregator. The encoder uses a multi-layer perceptron to map the nodes of the two feature graphs to initial vectors; the propagator is used to aggregate the information of neighbor nodes in the same graph, and use the cross-graph matching information of the nodes between the two graphs to update the node features. After multi-layer propagation, the node representation of each graph is obtained; the aggregator aggregates the node features into a graph feature vector; Step 4. Based on the trained vulnerability detection model, select the benchmark samples required in the detection process from the training set, and then determine the threshold required in the detection process based on the benchmark samples and all other samples in the training set. During the detection, the pseudocode obtained by the binary file to be detected in the manner of step 1 is recorded as the pseudocode to be detected, and the code attribute graph is recorded as the code attribute graph to be detected. Then, the code attribute graph to be detected and the code attribute graph corresponding to the benchmark sample are obtained by the manner of step 2 to obtain a subgraph pair. Finally, the subgraph pair is input into the trained software supply chain vulnerability detection model to calculate the distance between the code attribute graph to be detected and the benchmark sample. If the distance is less than the threshold, it means that the sample to be detected contains a vulnerability, otherwise it does not.

2. The software supply chain vulnerability detection method according to claim 1, characterized in that: The code property graph in step 1 is constructed as follows: first, the code analysis tool is used to extract the abstract syntax tree, control flow graph and program dependency graph of the pseudocode respectively; next, the code property graph is obtained by taking the abstract syntax tree as the basic structure and adding the edges of the control flow graph and the program dependency graph as additional relationships to the nodes of the abstract syntax tree; the control flow graph represents the control flow relationship between the basic blocks of the program, and the program dependency graph represents the data dependency and control dependency relationship between the variables in the code.

3. The software supply chain vulnerability detection method according to claim 1, characterized in that: The method of slicing the graph in step 2 is: pseudocode pairs are formed by two pseudocodes (P i , P j ), by comparing with the pseudo code (P i , P j ) respectively correspond to the code attribute graphs to form a code attribute graph pair (G i , G j ); According to the pseudo code (P i , P j ) to its corresponding code attribute graph pair (G i , G j ) to slice the graph and obtain the subgraph pair (G i’ , G j’ ).

4. The software supply chain vulnerability detection method according to claim 3 is characterized in that: The way to slice the graph is as follows: Step 2.

1. Rename all variables in the variable declaration part of the pseudocode in alphabetical order, and then use the new names to replace the corresponding variable names in the pseudocode; calculate P i and P j The difference between i In and not in P j The statements in are saved to the set S i , denoted as S i ={stmt i1 , stmt i2 , ..., stmt im }, will be in P j In and not in P i The statements in are saved to the set S j , denoted as S j ={stmt j1 , stmt j2 , ..., stmt jm }; Step 2.2: For the code attribute graph pair (G i , G j ) in each code attribute graph locates the code attribute graph that corresponds to statement S i or statement S j The variable nodes corresponding to the variables in the code attribute graph constitute a node set L belonging to the graph; Step 2.3: Based on the node set L and the code attribute graph set G, construct a difference graph diffG, and the corresponding difference graph diffG constitutes a difference subgraph pair (G i’ , G j’ ).

5. The software supply chain vulnerability detection method according to claim 4, characterized in that: In step 2.3, the method of constructing the difference graph diffG according to the node set L and the code attribute graph set G is as follows: The input is the node set L, the code attribute graph set G, and the upper limit T of the number of nodes in the difference graph diffG to be generated. nodes , the output is the generated graph diffG, V diff and E diff Respectively represent the node set and edge set of diffG; initially, V diff Initialize to L, and set E diff Initialized to an empty set; for each node l in L, first find the parent node l of l through the function findParent() parent , and then use the function getSubtree() to obtain the l parent All nodes in the subtree with the node as the root are denoted as V subtree ; Traverse V subtree Each node in V determines whether it exists in the set V. diff For the case not in V diff The nodes in the set V are added to diff If V diff The number of nodes in exceeds the threshold T nodes Then end the V subtree Otherwise, continue to traverse; get the node set V corresponding to diffG diff ; According to V diff Construct the edge set E of diffG diff , for V diff Any node in G, if it exists on an edge in G and the other node connected by the edge is also in V diff Then merge the edge into E diff In; by the final V diff and E diff Construct diffG and complete the construction of diffG.

6. The software supply chain vulnerability detection method according to claim 1, characterized in that: The method for selecting the benchmark sample in step 4 is: select the diffG graph pairs obtained by processing each pair of all code attribute graphs representing the vulnerability status in the training set through the graph slicing algorithm, use the trained software supply chain vulnerability detection model to calculate the distance between them, and select the benchmark sample based on the principle of minimizing the sum of distances, that is, after calculating the difference subgraph pairs between this sample and all other positive samples in the training set, the sum of the distances between the difference subgraph pairs calculated by the model is the smallest.

7. The software supply chain vulnerability detection method according to claim 1, characterized in that: The threshold value in step 4 is determined as follows: according to the graph slicing algorithm, the diffG graph pairs consisting of the code attribute graphs representing all vulnerabilities in the training set and the benchmark samples are obtained, and the distance between the diffG graph pairs is calculated using the trained software supply chain vulnerability detection model, and the maximum value of the distance is recorded as max; according to the graph slicing algorithm, the diffG graph pairs consisting of the code attribute graphs representing all repaired functions in the training set and the benchmark samples are obtained, and the distance between the diffG graph pairs is calculated using the trained software supply chain vulnerability detection model, and the minimum value of the distance is recorded as min; the value is taken in the (max, min) interval to test its accuracy on the training set, and the threshold corresponding to the highest accuracy is the determined threshold. If there are multiple thresholds with the same accuracy, the present invention further selects the threshold that makes the false positive rate of the training set the lowest.

8. The software supply chain vulnerability detection method according to claim 7, characterized in that: The step size of the value in the (max, min) interval is set to 0.001.

Images