Software security vulnerability automatic detection and repair system

Abstract

The invention belongs to the technical field of software security processing, and provides a software security vulnerability automatic detection and repair system which comprises a vulnerability detection module, a vulnerability analysis module, a vulnerability repair module, a verification module and a database module. Through comprehensive vulnerability scanning and detection, the system can help to identify and repair potential security vulnerabilities in the software, so that the security of the software is remarkably improved, the risk of malicious attacks is reduced, meanwhile, the system realizes a full-automatic process from vulnerability detection to vulnerability repair, the requirement of manual intervention is reduced, and the system is suitable for popularization and application. The processing efficiency and the response speed are improved, the vulnerability analysis module carries out deep analysis on the detection result, it is ensured that the repairing scheme is high in pertinence and accuracy, and the found security problem can be effectively solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of software security processing, and specifically is a system for automatically detecting and repairing software security vulnerabilities, which can automatically, efficiently and comprehensively detect and repair software security vulnerabilities. Background Art

[0002] With the rapid development of information technology, software plays an increasingly important role in people's daily life and work. However, due to the complexity and diversity of software development, various security vulnerabilities inevitably exist in software systems. Once these vulnerabilities are exploited by malicious attackers, they may lead to serious consequences such as data leakage, system crash, service interruption, etc., causing huge losses to users and enterprises.

[0003] Existing software security vulnerability detection and repair methods mostly rely on manual participation, which is not only inefficient but also prone to missing some hidden vulnerabilities. At the same time, some existing vulnerability detection tools can only detect some vulnerabilities, which is not smart and comprehensive enough for vulnerability analysis and generation of repair solutions.

[0004] To this end, those skilled in the art have proposed a system for automatically detecting and repairing software security vulnerabilities to solve the problems raised by the background technology. Summary of the invention

[0005] In order to solve the above technical problems, the present invention provides a software security vulnerability automatic detection and repair system to solve the problem that the existing software security vulnerability detection and repair methods in the prior art mostly rely on manual participation, which is not only inefficient but also easy to miss certain hidden vulnerabilities.

[0006] In order to achieve the above objectives, the first aspect of the present application provides a software security vulnerability automatic detection and repair system, comprising:

[0007] Vulnerability detection module, used to conduct comprehensive vulnerability scanning and detection on target software to identify potential security vulnerabilities;

[0008] A vulnerability analysis module receives the detection results of the vulnerability detection module and analyzes the detection results, wherein the detection results include the type, severity and potential impact of the vulnerability;

[0009] The vulnerability repair module generates a corresponding repair plan for each detected vulnerability based on the results of the vulnerability analysis module and performs automatic repair operations;

[0010] Verification module, used to verify whether the repaired software still has vulnerabilities to ensure the effectiveness of the repair;

[0011] The database module updates the known security vulnerability information in real time for use by the vulnerability detection module and the vulnerability repair module.

[0012] Preferably, the vulnerability detection module performs comprehensive vulnerability scanning and detection on the target software, including the following steps:

[0013] S1. First, use the preset parameters and tools to perform a comprehensive vulnerability scan on the target software, including static code analysis, dynamic execution analysis, and network vulnerability scanning;

[0014] S2. Then, the vulnerability information of the vulnerability scan is detected and the vulnerability type is determined. The execution process can be expressed as:

[0015]

[0016] Among them, B is the binary file, and W is the vulnerability information;

[0017] S3. Then, the binary file B and the vulnerability information W are used as inputs. The state space of the program is explored in the symbolic execution process and detected using the defined detection strategy to check whether there is a program state that meets the vulnerability behavior pattern defined in the vulnerability detection strategy, thereby locating the vulnerability. At the same time, the search enhancement algorithm is referenced during the detection. The formula of the search enhancement algorithm is as follows:

[0018] X * =1-(t / t max ) 3 ;

[0019] Where t represents the number of iterations; t max is the maximum number of iterations.

[0020] Preferably, the operation steps for analyzing the detection results are as follows: firstly, the outliers configured in the detection results are set, and then the outlier running data after configuration is detected by using a Gaussian mixture model algorithm, and the formula of the Gaussian mixture model algorithm is as follows:

[0021]

[0022] Where x represents the number of test results; π i represents the Gaussian mixture model weight; u i represents the mean of the i-th Gaussian component;

[0023] The maximum likelihood estimation method of the Gaussian mixture model algorithm can help the outlier detection algorithm find the abnormal result target of the outlier operation after configuration. Its function formula is:

[0024] L(λx)=P(xλ)=ΠP(x i |λ)

[0025] At the same time, when analyzing the detection results, in addition to using the Gaussian mixture model algorithm, the isolation forest algorithm can also be introduced to identify outliers. The isolation forest is an efficient anomaly detection algorithm that isolates observations by randomly selecting features and cutoff values. The path length of the decision tree constructed in the isolation forest algorithm uses the following formula: Where L is the path length from the root node to the leaf node, d is the depth of the decision tree, and N i is the number of samples of the i-th node. At the same time, the calculation of the anomaly score in the isolation forest algorithm uses the following formula: Where h(x) is the average path length of sample x in the isolation forest, μ and σ are the average path length and standard deviation of all samples, respectively.

[0026] Preferably, the vulnerability repair module includes a repair strategy generation unit and an automatic repair execution unit. The repair strategy generation unit is used to automatically generate repair suggestions according to the vulnerability type and context environment; the automatic repair execution unit automatically modifies the source code or configuration file according to the repair suggestion and implements the repair operation. At the same time, in the vulnerability repair module, in addition to automatically generating repair suggestions and executing repair operations, a genetic algorithm can also be introduced to optimize the repair strategy. The genetic algorithm formula adopts Where Fitness(solution) is the fitness of the solution, Error(solution) is the error rate of the solution, MaxError is the maximum error rate among all solutions, and the probability of selecting an operation in the genetic algorithm can be expressed as follows: Where P(select) is the probability of selecting an action.

[0027] Preferably, the verification module includes a regression test unit and a vulnerability retest unit. The regression test unit is used to perform a comprehensive regression test on the repaired software to ensure that the repair operation does not introduce new errors. The vulnerability retest unit is used to rerun the vulnerability detection process to verify whether the identified vulnerabilities have been successfully repaired. In the verification module, in addition to performing comprehensive regression testing and vulnerability retesting, code coverage analysis can also be introduced to ensure the comprehensiveness of the test. Code coverage is implemented using the following algorithm: Among them, Coverage is the code coverage, which represents the ratio of the number of executed code lines to the total number of code lines.

[0028] Preferably, the database module includes a vulnerability information library and an update mechanism. The vulnerability information library is used to store known security vulnerability information and its repair solutions. The update mechanism is used to obtain the latest vulnerability information from an external security intelligence source in real time and update the vulnerability information library. In the database module, in addition to storing known security vulnerability information and its repair solutions, a machine learning model can also be introduced to predict new security vulnerabilities. The machine learning model predicts new security vulnerabilities using the following algorithm: PredictedVulnerability = MLModel (features), wherein PredictedVulnerability is the security vulnerability predicted by the machine learning model, and features is the feature used to train the model. At the same time, in the machine learning model, a decision function of a support vector machine (SVM) is also used, specifically: Where f(x) is the decision function of SVM, α i is the Lagrange multiplier, y i is the label of the i-th training sample, K(x,x i ) is the kernel function, b is the bias term, and the activation function of the neural network is also used, specifically, Where a is the output of the activation function, z is the weighted sum of the inputs, and σ is the sigmoid function.

[0029] Preferably, in terms of the automatic detection and repair system for software security vulnerabilities, in addition to providing a system for automatically, efficiently and comprehensively detecting and repairing software security vulnerabilities, a user interface (UI) can also be introduced. The user interface adopts the following formula: UIFeedback = SystemStatus + Progress + Recommendations, where UIFeedback is the feedback provided by the user interface, SystemStatus is the system status, Progress is the task progress, and Recommendations is the system suggestion. At the same time, the user task completion time can be calculated using the following formula: TaskTime is the total time it takes for the user to complete the task. i ) is the time required to complete the i-th task;

[0030] At the same time, user satisfaction scores can also be added, using the following formula: Where UserSatisfaction is the user satisfaction score, and Rating(feedback) is the score of the i-th user feedback.

[0031] The second aspect of the present application provides a processor configured to execute the above-mentioned software security vulnerability automatic detection and repair system. In terms of the processor, in addition to being configured to execute the software security vulnerability automatic detection and repair system, parallel processing technology can also be introduced to increase the processing speed. The acceleration ratio of parallel processing can be expressed as follows: Speedup is the speedup ratio of parallel processing, Time sequential is the time of sequential execution, Time parallel is the time of parallel execution. During parallel processing, Amdahl's law is followed, which is S is the speedup ratio, p is the proportion of code that can be parallelized, n is the number of processors for parallel processing, and parallel efficiency ParallelEfficiency is the parallel efficiency, and n is the number of processors for parallel processing.

[0032] Preferably, in terms of the processor configuration, in addition to executing the software security vulnerability automatic detection and repair system, the security sandbox technology can also be introduced to isolate potential malicious code. The security sandbox technology can limit the execution environment of the program to prevent malicious behavior from affecting the system. The security score of the sandbox environment can be calculated using the following formula:

[0033] SafetyScore is the safety score of the sandbox environment, which represents the ratio of the number of safe operations to the total number of operations. The probability of malicious behavior detection is calculated using the following formula: P (malicious) is the probability of detecting malicious behavior, which represents the ratio of the number of malicious behaviors detected to the total number of behaviors.

[0034] The third aspect of the present application provides a machine-readable storage medium, on which instructions are stored. When the instructions are executed by a processor, the processor is configured to execute the above-mentioned software security vulnerability automatic detection and repair system. In terms of the machine-readable storage medium, in addition to storing instructions, a configuration file for optimizing system performance can also be stored. The configuration file can include algorithm parameters and system setting information. The objective function of parameter optimization is used in the configuration file process, Objective (parameters) = Error (model (parameters)).

[0035] Where Objective(parameters) is the objective function to be optimized.

[0036] Error(model(parameters)) is the error rate of the model under given parameters. The gradient descent of parameter adjustment uses the following formula, θ new =θ old-ηΔ θ Objective(θ), where θ new is the new parameter value, θ old is the old parameter value, η is the learning efficiency, Δ θ Objective(θ) is the gradient of the objective function with respect to the parameter θ.

[0037] Compared with the prior art, the present invention has the following beneficial effects:

[0038] Through comprehensive vulnerability scanning and detection, the system of the present invention can help identify and repair potential security vulnerabilities in the software, thereby significantly improving the security of the software and reducing the risk of malicious attacks. At the same time, the system realizes a fully automated process from vulnerability detection to repair, reducing the need for manual intervention, improving processing efficiency and response speed, and the vulnerability analysis module conducts in-depth analysis of the detection results to ensure that the repair plan is highly targeted and accurate, and can effectively solve the discovered security problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is a framework diagram of the software security vulnerability automatic detection and repair system of the present invention.

[0040] Figure 2 This is a framework diagram of a vulnerability detection module of the present invention.

[0041] Figure 3 This is a framework diagram of the vulnerability analysis module in the present invention.

[0042] Figure 4 This is a framework diagram of the vulnerability repair module in the present invention.

[0043] Figure 5 This is a framework diagram of the verification module in the present invention.

[0044] Figure 6 This is a framework diagram of the database module in the present invention. DETAILED DESCRIPTION

[0045] The following embodiments of the present invention are described in further detail in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0046] like Figure 1-6 As shown:

[0047] Embodiment: The present invention provides a software security vulnerability automatic detection and repair system, including a vulnerability detection module, a vulnerability analysis module, a vulnerability repair module, a verification module and a database module, wherein the vulnerability detection module, the vulnerability analysis module, the vulnerability repair module, the verification module and the database module are electrically connected in sequence:

[0048] Vulnerability detection module, used to conduct comprehensive vulnerability scanning and detection on target software to identify potential security vulnerabilities;

[0049] The vulnerability analysis module receives the detection results of the vulnerability detection module and analyzes the detection results, which include the type, severity and potential impact of the vulnerability;

[0050] The vulnerability repair module generates a corresponding repair plan for each detected vulnerability based on the results of the vulnerability analysis module and performs automatic repair operations;

[0051] Verification module, used to verify whether the repaired software still has vulnerabilities to ensure the effectiveness of the repair;

[0052] The database module updates the known security vulnerability information in real time for use by the vulnerability detection module and the vulnerability repair module.

[0053] From the above, it can be seen that the present invention can help identify and repair potential security vulnerabilities in the software through comprehensive vulnerability scanning and detection, thereby significantly improving the security of the software and reducing the risk of malicious attacks. At the same time, the system realizes a fully automated process from vulnerability detection to repair, reducing the need for manual intervention, improving processing efficiency and response speed, and the vulnerability analysis module conducts in-depth analysis of the detection results to ensure that the repair plan is highly targeted and accurate, and can effectively solve the discovered security problems.

[0054] In one embodiment of the present invention, the vulnerability detection module performs comprehensive vulnerability scanning and detection on the target software, including the following steps:

[0055] S1. First, use the preset parameters and tools to perform a comprehensive vulnerability scan on the target software, including static code analysis, dynamic execution analysis, and network vulnerability scanning;

[0056] S2. Then, the vulnerability information of the vulnerability scan is detected and the vulnerability type is determined. The execution process can be expressed as:

[0057]

[0058] Among them, B is the binary file, and W is the vulnerability information;

[0059] S3. Then take the binary file B and the vulnerability information W as input, explore the state space of the program in the symbolic execution process and use the defined detection strategy to detect it, check whether there is a program state that meets the vulnerability behavior pattern defined in the vulnerability detection strategy, so as to locate the vulnerability, and at the same time reference the search enhancement algorithm during detection. The formula of the search enhancement algorithm is as follows:

[0060] X * =1-(t / tmax ) 3 ;

[0061] Where t represents the number of iterations; t max is the maximum number of iterations.

[0062] From the above, we can see that by combining static code analysis and dynamic execution analysis, multiple dimensions of the software can be covered, thereby more comprehensively identifying potential security vulnerabilities; network vulnerability scanning can quickly discover vulnerabilities at the network level, complementing code analysis to improve overall detection efficiency. At the same time, the use of search enhancement algorithms during symbolic execution can more effectively explore the program state space and improve the accuracy of vulnerability location. By defining detection strategies and detecting program states that conform to vulnerability behavior patterns, vulnerabilities can be accurately located, providing strong support for subsequent analysis and repair.

[0063] In one embodiment of the present invention, the operation steps for analyzing the detection results are as follows: first, the outliers configured in the detection results are set, and then the outlier running data after the configuration is detected by using a Gaussian mixture model algorithm. The formula of the Gaussian mixture model algorithm is as follows:

[0064]

[0065] Where x represents the number of test results; π i represents the Gaussian mixture model weight; u i represents the mean of the i-th Gaussian component;

[0066] The maximum likelihood estimation method of the Gaussian mixture model algorithm can help the outlier detection algorithm find the abnormal result target of the outlier operation after configuration. Its function formula is:

[0067] L(λx)=P(xλ)=ΠP(x i |λ);

[0068] At the same time, when analyzing the detection results, in addition to using the Gaussian mixture model algorithm, the isolation forest algorithm can also be introduced to identify outliers. The isolation forest is an efficient anomaly detection algorithm that isolates observations by randomly selecting features and cutoff values. The path length of the decision tree constructed in the isolation forest algorithm uses the following formula: Where L is the path length from the root node to the leaf node, d is the depth of the decision tree, and N i is the number of samples of the i-th node. At the same time, the calculation of the anomaly score in the isolation forest algorithm uses the following formula: Where h(x) is the average path length of sample x in the isolation forest, μ and σ are the average path length and standard deviation of all samples, respectively.

[0069] From the above, we can see that by setting the Gaussian mixture model algorithm, we can effectively process complex test result data and improve the accuracy of abnormal result detection. At the same time, by setting the outliers configured in the test results and using the maximum likelihood estimation method of the Gaussian mixture model, we can more accurately identify abnormal result targets. By introducing a negative feedback mechanism, the test result analysis process has the ability to self-optimize and can continuously adjust according to the feedback results to improve the detection effect. Through automated and intelligent analysis methods, the need for manual intervention is reduced and the overall intelligence level of the system is improved.

[0070] In one embodiment of the present invention, the vulnerability repair module includes a repair strategy generation unit and an automatic repair execution unit. The repair strategy generation unit is used to automatically generate repair suggestions according to the vulnerability type and context environment; the automatic repair execution unit automatically modifies the source code or configuration file according to the repair suggestion and implements the repair operation. At the same time, in the vulnerability repair module, in addition to automatically generating repair suggestions and executing repair operations, a genetic algorithm can also be introduced to optimize the repair strategy. The genetic algorithm formula adopts Where Fitness(solution) is the fitness of the solution, Error(solution) is the error rate of the solution, MaxError is the maximum error rate among all solutions, and the probability of selecting an operation in the genetic algorithm can be expressed as follows: Where P(select) is the probability of selecting an action.

[0071] In one embodiment of the present invention, the verification module includes a regression test unit and a vulnerability retest unit. The regression test unit is used to perform a comprehensive regression test on the repaired software to ensure that the repair operation does not introduce new errors. The vulnerability retest unit is used to rerun the vulnerability detection process to verify whether the identified vulnerabilities have been successfully repaired. In the verification module, in addition to performing comprehensive regression testing and vulnerability retesting, code coverage analysis can also be introduced to ensure the comprehensiveness of the test. The code coverage is implemented using the following algorithm: Among them, Coverage is the code coverage, which represents the ratio of the number of executed code lines to the total number of code lines.

[0072] From the above, we can see that by retesting the repaired software through the verification module, it is ensured that the vulnerability has been effectively repaired, which improves the reliability and stability of the repair work.

[0073] In one embodiment of the present invention, the database module includes a vulnerability information library and an update mechanism. The vulnerability information library is used to store known security vulnerability information and its repair solutions. The update mechanism is used to obtain the latest vulnerability information from an external security intelligence source in real time and update the vulnerability information library. In the database module, in addition to storing known security vulnerability information and its repair solutions, a machine learning model can also be introduced to predict new security vulnerabilities. The machine learning model predicts new security vulnerabilities using the following algorithm: PredictedVulnerability = MLModel (features), wherein PredictedVuln erability is the security vulnerability predicted by the machine learning model, and features is the feature used to train the model. At the same time, in the machine learning model, a decision function of a support vector machine (SVM) is also used, specifically: Where f(x) is the decision function of SVM, α i is the Lagrange multiplier, y i is the label of the i-th training sample, K(x,x i ) is the kernel function, b is the bias term, and the activation function of the neural network is also used, specifically, Where a is the output of the activation function, z is the weighted sum of the inputs, and σ is the sigmoid function.

[0074] From the above, we can see that the database module updates the known security vulnerability information in real time, allowing the system to continuously track the latest security threats, provide the latest data support for vulnerability detection and repair, and enhance the long-term protection capabilities of the software.

[0075] In one embodiment of the present invention, in terms of the automatic detection and repair system for software security vulnerabilities, in addition to providing a system for automatically, efficiently and comprehensively detecting and repairing software security vulnerabilities, a user interface (UI) can also be introduced. The user interface adopts the following formula: UIFeedback = SystemStatus + Progress + Recommendations, where UIFeedback is the feedback provided by the user interface, SystemStatus is the system status, Progress is the task progress, and Recommendations is the system suggestion. At the same time, the user task completion time can be calculated using the following formula: TaskTime is the total time it takes for the user to complete the task. i ) is the time required to complete the i-th task;

[0076] At the same time, user satisfaction scores can also be added, using the following formula: Where UserSatisfaction is the user satisfaction score, and Rating(feedback) is the score of the i-th user feedback.

[0077] The performance indicators of the existing method (i.e., manually checking whether the software has security vulnerabilities) and the automatic detection and repair system for software security vulnerabilities provided in this embodiment are compared, and the comparison results are shown in Table 1:

[0078] Table 1- Performance index comparison results

[0079] Existing methods This method Detection accuracy 69.2％ 93.5％ Real-time detection Unable to monitor in real time Automated real-time monitoring Detection effect Some detection vulnerabilities Comprehensive vulnerability detection Human involvement requirements Reliance on human involvement No manual work required Safety hazard missed detection rate 34.8％ 3.2％

[0080] It can be seen from Table 1 that compared with the existing methods, the software security vulnerability automatic detection and repair system provided in this embodiment has better results in detection accuracy, detection real-time, detection effect, manual participation requirements and security hazard missed detection rate. This method can provide a system for software to automatically, efficiently and comprehensively detect and repair software security vulnerabilities.

[0081] The embodiment of the present application also provides a processor configured to execute the above-mentioned software security vulnerability automatic detection and repair system.

[0082] The processor contains a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the above-mentioned software security vulnerability automatic detection and repair system can be implemented by adjusting kernel parameters. In terms of the processor, in addition to being configured to execute the software security vulnerability automatic detection and repair system, parallel processing technology can also be introduced to increase the processing speed. The acceleration ratio of parallel processing can be expressed as follows: Speedup is the speedup ratio of parallel processing, Time sequential is the time of sequential execution, Time parallel is the time of parallel execution. During parallel processing, Amdahl's law is followed, which is S is the speedup ratio, p is the proportion of code that can be parallelized, n is the number of processors for parallel processing, and parallel efficiency ParallelEfficiency is the parallel efficiency, and n is the number of processors for parallel processing.

[0083] Preferably, in terms of processor configuration, in addition to executing the software security vulnerability automatic detection and repair system, the security sandbox technology can also be introduced to isolate potential malicious code. The security sandbox technology can limit the execution environment of the program to prevent malicious behavior from affecting the system. The security score of the sandbox environment can be calculated using the following formula:

[0084] SafetyScore is the safety score of the sandbox environment, which represents the ratio of the number of safe operations to the total number of operations. The probability of malicious behavior detection is calculated using the following formula: P(malicious) is the probability of detecting malicious behavior, which represents the ratio of the number of malicious behaviors detected to the total number of behaviors.

[0085] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory forms such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0086] The embodiment of the present application provides a machine-readable storage medium, on which instructions are stored. When the instructions are executed by a processor, the processor is configured to execute the above-mentioned software security vulnerability automatic detection and repair system. In terms of the machine-readable storage medium, in addition to storing instructions, a configuration file for optimizing system performance can also be stored. The configuration file can include algorithm parameters and system setting information. The objective function of parameter optimization is used in the configuration file process, Objective (parameters) = Error (model (parameters)).

[0087] Where Objective(parameters) is the objective function to be optimized.

[0088] Error(model(parameters)) is the error rate of the model under given parameters. The gradient descent of parameter adjustment uses the following formula, θ new =θ old -ηΔ θ Objective(θ), where θ new is the new parameter value, θ old is the old parameter value, η is the learning efficiency, Δ θ Objective(θ) is the gradient of the objective function with respect to the parameter θ.

[0089] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0090] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0091] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0092] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0093] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0094] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0095] Computer readable media include permanent and non-permanent, removable and non-removable media, and can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0096] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0097] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A software security vulnerability automatic detection and repair system, characterized in that: include: Vulnerability detection module, used to conduct comprehensive vulnerability scanning and detection on target software to identify potential security vulnerabilities; A vulnerability analysis module receives the detection results of the vulnerability detection module and analyzes the detection results, wherein the detection results include the type, severity and potential impact of the vulnerability; The vulnerability repair module generates a corresponding repair plan for each detected vulnerability based on the results of the vulnerability analysis module and performs automatic repair operations; Verification module, used to verify whether the repaired software still has vulnerabilities to ensure the effectiveness of the repair; The database module updates the known security vulnerability information in real time for use by the vulnerability detection module and the vulnerability repair module.

2. A software security vulnerability automatic detection and repair system as claimed in claim 1, characterized in that: The vulnerability detection module performs comprehensive vulnerability scanning and detection on the target software, including the following steps: S1. First, use the preset parameters and tools to perform a comprehensive vulnerability scan on the target software, including static code analysis, dynamic execution analysis, and network vulnerability scanning; S2. Then, the vulnerability information of the vulnerability scan is detected and the vulnerability type is determined. The execution process can be expressed as: Among them, B is the binary file, and W is the vulnerability information; S3. Then, the binary file B and the vulnerability information W are used as inputs. The state space of the program is explored in the symbolic execution process and detected using the defined detection strategy to check whether there is a program state that meets the vulnerability behavior pattern defined in the vulnerability detection strategy, thereby locating the vulnerability. At the same time, the search enhancement algorithm is referenced during the detection. The formula of the search enhancement algorithm is as follows: X * =1-(t / t max ) 3 ; Where t represents the number of iterations; t max is the maximum number of iterations.

3. The software security vulnerability automatic detection and repair system as claimed in claim 1, characterized in that: The operation steps for analyzing the detection results are as follows: first, the outliers configured in the detection results are set, and then the outlier running data after the configuration is detected by using a Gaussian mixture model algorithm. The formula of the Gaussian mixture model algorithm is as follows: Where x represents the number of test results; π i represents the Gaussian mixture model weight; u i represents the mean of the i-th Gaussian component; The maximum likelihood estimation method of the Gaussian mixture model algorithm can help the outlier detection algorithm find the abnormal result target of the outlier operation after configuration. Its function formula is: L(λx)=P(xλ)=ΠP(x i |l); At the same time, when analyzing the detection results, in addition to using the Gaussian mixture model algorithm, the isolation forest algorithm can also be introduced to identify outliers. The isolation forest is an efficient anomaly detection algorithm that isolates observations by randomly selecting features and cutoff values. The path length of the decision tree constructed in the isolation forest algorithm uses the following formula: Where L is the path length from the root node to the leaf node, d is the depth of the decision tree, and N i is the number of samples of the i-th node. At the same time, the calculation of the anomaly score in the isolation forest algorithm uses the following formula: Where h(x) is the average path length of sample x in the isolation forest, μ and σ are the average path length and standard deviation of all samples, respectively.

4. The software security vulnerability automatic detection and repair system as claimed in claim 1, characterized in that: The vulnerability repair module includes a repair strategy generation unit and an automatic repair execution unit. The repair strategy generation unit is used to automatically generate repair suggestions according to the vulnerability type and context environment; The automatic repair execution unit automatically modifies the source code or configuration file according to the repair suggestion and implements the repair operation. At the same time, in the vulnerability repair module, in addition to automatically generating repair suggestions and executing repair operations, a genetic algorithm can also be introduced to optimize the repair strategy. The genetic algorithm formula adopts Where Fitness(solution) is the fitness of the solution, Error(solution) is the error rate of the solution, MaxError is the maximum error rate among all solutions, and the probability of selecting an operation in the genetic algorithm can be expressed as follows: Where P(select) is the probability of selecting an action.

5. The software security vulnerability automatic detection and repair system as claimed in claim 1, characterized in that: The verification module includes a regression test unit and a vulnerability retest unit. The regression test unit is used to perform a comprehensive regression test on the repaired software to ensure that the repair operation does not introduce new errors. The vulnerability retest unit is used to rerun the vulnerability detection process to verify whether the identified vulnerabilities have been successfully repaired. In the verification module, in addition to comprehensive regression testing and vulnerability retesting, code coverage analysis can also be introduced to ensure the comprehensiveness of the test. Code coverage is implemented using the following algorithm Among them, Coverage is the code coverage, which represents the ratio of the number of executed code lines to the total number of code lines.

6. The software security vulnerability automatic detection and repair system as claimed in claim 1, characterized in that: The database module includes a vulnerability information library and an update mechanism. The vulnerability information library is used to store known security vulnerability information and its repair solutions. The update mechanism is used to obtain the latest vulnerability information from an external security intelligence source in real time and update the vulnerability information library. In the database module, in addition to storing known security vulnerability information and its repair solutions, a machine learning model can also be introduced to predict new security vulnerabilities. The machine learning model predicts new security vulnerabilities using the following algorithm: PredictedVulnerability=MLModel(features), where PredictedVu lnerability is the security vulnerability predicted by the machine learning model, and features is the feature used to train the model. At the same time, in the machine learning model, a decision function of a support vector machine (SVM) is also used, specifically: Where f(x) is the decision function of SVM, α i is the Lagrange multiplier, y i is the label of the i-th training sample, K(x,x i ) is the kernel function, b is the bias term, and the activation function of the neural network is also used, specifically, Where a is the output of the activation function, z is the weighted sum of the inputs, and σ is the sigmoid function.

7. The software security vulnerability automatic detection and repair system as claimed in claim 1, characterized in that: In terms of the automatic detection and repair system for software security vulnerabilities, in addition to providing a system that automatically, efficiently and comprehensively detects and repairs software security vulnerabilities, a user interface (UI) can also be introduced. The user interface uses the following formula: UIFeedback = SystemStatus + Progress + Recommendations, where UIFeedback is the feedback provided by the user interface, SystemStatus is the system status, Progress is the task progress, and Recommendations is the system suggestion. At the same time, the user task completion time can be calculated using the following formula TaskTime is the total time it takes for the user to complete the task. i ) is the time required to complete the i-th task; At the same time, user satisfaction scores can also be added, using the following formula: Where UserSatisfaction is the user satisfaction score, and Rating(feedback) is the score of the i-th user feedback.

8. A processor, characterized in that: The system is configured to execute the software security vulnerability automatic detection and repair system according to any one of claims 1 to 6. In terms of the processor, in addition to being configured to execute the software security vulnerability automatic detection and repair system, parallel processing technology can also be introduced to increase the processing speed. The acceleration ratio of parallel processing can be expressed as follows: Speedup is the speedup ratio of parallel processing, Time sequential is the time of sequential execution, Time parallel is the time for parallel execution. During parallel processing, Amdahl's law is followed, which is S is the speedup ratio, p is the proportion of code that can be parallelized, n is the number of processors for parallel processing, and parallel efficiency ParallelEfficiency is the parallel efficiency, and n is the number of processors for parallel processing.

9. A processor as claimed in claim 8, characterized in that: In terms of the processor configuration, in addition to executing the software security vulnerability automatic detection and repair system, the security sandbox technology can also be introduced to isolate potential malicious code. The security sandbox technology can limit the execution environment of the program to prevent malicious behavior from affecting the system. The security score of the sandbox environment can be calculated using the following formula: SafetyScore is the safety score of the sandbox environment, which represents the ratio of the number of safe operations to the total number of operations. The probability of malicious behavior detection is calculated using the following formula: P(malicious) is the probability of detecting malicious behavior, which represents the ratio of the number of malicious behaviors detected to the total number of behaviors.

10. A machine-readable storage medium having instructions stored thereon, which, when executed by a processor, causes the processor to be configured to execute the software security vulnerability automatic detection and repair system according to any one of claims 1 to 7, characterized in that: In terms of machine-readable storage media, in addition to storing instructions, configuration files for optimizing system performance can also be stored. The configuration files can include algorithm parameters and system setting information. The objective function of parameter optimization is used in the configuration file process. Objective (parameters) = Error (model (parameters)). Where Objective(parameters) is the objective function to be optimized. Error(model(parameters)) is the error rate of the model under given parameters. The gradient descent of parameter adjustment uses the following formula, θ new =θ old -ηΔ θ Objective(θ), where θ new is the new parameter value, θ old is the old parameter value, η is the learning efficiency, Δ θ Objective(θ) is the gradient of the objective function with respect to the parameter θ.

Images