Software vulnerability detection method and device, computer program product and electronic equipment

Abstract

The invention relates to the technical field of computers, and provides a software vulnerability detection method and device, a computer program product and electronic equipment. The method comprises the following steps: extracting attribute information of a target dependency file of to-be-detected software, and generating a unique dependency identifier of the to-be-detected software according to the attribute information of the target dependency file; matching the unique dependency identifier of the to-be-detected software with a unique vulnerability identifier in a vulnerability library, and determining candidate vulnerabilities according to vulnerabilities indicated by the successfully matched unique vulnerability identifier; and according to the influence degree of the candidate vulnerabilities on the to-be-detected software, determining a target vulnerability of the to-be-detected software from the candidate vulnerabilities, and generating a vulnerability detection report of the to-be-detected software based on the target vulnerability. According to the scheme, the software vulnerability detection efficiency and accuracy can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a software vulnerability detection method, a software vulnerability detection device, a computer program product, and an electronic device. Background Art

[0002] Software vulnerability detection can identify software security risks and better protect software assets.

[0003] There are two main vulnerability detection methods in related technologies: static application security testing and dynamic application security testing. However, these methods have insufficient support for dynamic type languages, high false positive rates, and are unable to intervene in vulnerability detection in the early stages of software development, so it is difficult to meet the needs of quickly discovering and repairing vulnerabilities.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the present disclosure is to provide a software vulnerability detection method and device, a computer program product and an electronic device, thereby improving the accuracy and detection efficiency of software vulnerability detection at least to a certain extent.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to a first aspect of the present disclosure, a software vulnerability detection method is provided, comprising: extracting attribute information of a target dependency of a software to be detected, generating a dependency unique identifier of the software to be detected according to the attribute information of the target dependency; matching the dependency unique identifier of the software to be detected with a vulnerability unique identifier in a vulnerability library, and determining a candidate vulnerability according to the vulnerability indicated by the successfully matched vulnerability unique identifier; determining a target vulnerability of the software to be detected from the candidate vulnerabilities according to the degree of influence of the candidate vulnerability on the software to be detected, and generating a vulnerability detection report of the software to be detected based on the target vulnerability.

[0008] Optionally, the method for determining the target dependency includes: matching the dependency indicated by the dependency reference information in the dependency file of the software to be detected with the code information of the software to be detected, the dependency reference information being used to indicate the dependency referenced in the software to be detected; and determining the successfully matched dependency as the target dependency.

[0009] Optionally, the method for determining the dependent files of the software to be detected includes: determining the target programming language used by the software to be detected; searching for the target format of the dependent files corresponding to the target programming language in a first mapping relationship, the first mapping relationship being used to indicate the mapping relationship between different programming languages ​​and their corresponding formats of dependent files; and determining the dependent files of the software to be detected based on the files of the target format in the software to be detected.

[0010] Optionally, the method for determining the degree of impact of the candidate vulnerability on the software to be detected includes: inputting the vulnerability information of the candidate vulnerability and the software information of the software to be detected into a pre-trained machine learning model, and obtaining the confidence of the candidate vulnerability according to the output of the machine learning model; and determining the confidence as the degree of impact of the candidate vulnerability on the software to be detected.

[0011] Optionally, the method for determining the pre-trained machine learning model includes: obtaining training data and sample labels, wherein the training data includes vulnerabilities and software, and the sample labels include the impact level of the vulnerabilities in the training data on the software; inputting the training data into the initial machine learning model to obtain the prediction result of the training data; obtaining the training loss based on the degree of difference between the prediction result of the training data and the sample label; and iteratively training the initial machine learning model based on the training loss until a preset condition is met to obtain the pre-trained machine learning model.

[0012] Optionally, determining a target vulnerability of the software to be detected from the candidate vulnerabilities according to the degree of influence of the candidate vulnerabilities on the software to be detected includes: determining a candidate vulnerability whose influence degree is greater than a preset value as the target vulnerability according to the degree of influence of the candidate vulnerabilities on the software to be detected.

[0013] Optionally, generating the vulnerability detection report of the software to be detected based on the target vulnerability includes: sorting the target vulnerabilities according to the descending order of the impact degree; and generating the vulnerability detection report of the software to be detected based on the sorting result.

[0014] According to a second aspect of the present disclosure, a software vulnerability detection device is provided, including a dependency extraction module configured to extract attribute information of a target dependency file of a software to be detected, and generate a dependency unique identifier of the software to be detected according to the attribute information of the target dependency file; a matching module configured to match the dependency unique identifier of the software to be detected with a vulnerability unique identifier in a vulnerability library, and determine a candidate vulnerability according to the vulnerability indicated by the successfully matched vulnerability unique identifier; and a vulnerability detection report generation module configured to determine a target vulnerability of the software to be detected from the candidate vulnerabilities according to the degree of influence of the candidate vulnerability on the software to be detected, and generate a vulnerability detection report for the software to be detected based on the target vulnerability.

[0015] According to a third aspect of the present disclosure, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the steps of the software vulnerability detection method as described in the first aspect.

[0016] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the software vulnerability detection method as described in the first aspect of the above embodiment is implemented.

[0017] According to a fifth aspect of an embodiment of the present disclosure, there is provided an electronic device, comprising: a processor; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the software vulnerability detection method as described in the first aspect of the above embodiment.

[0018] It can be seen from the above technical solutions that the software vulnerability detection method, software vulnerability detection device, and computer program product and electronic device implementing the software vulnerability detection method in the exemplary embodiments of the present disclosure have at least the following advantages and positive effects:

[0019] In the technical solutions provided by some embodiments of the present disclosure, a candidate vulnerability is obtained by matching the unique identifier of the target dependency of the software to be detected with the unique identifier of the vulnerability, and then a target vulnerability is obtained according to the degree of relevance between the candidate vulnerability and the software to be detected, so as to generate a vulnerability detection report of the software to be detected based on the target vulnerability. Compared with the related art, on the one hand, the present disclosure determines the candidate vulnerability by matching the unique identifier of the target dependency with the unique identifier of the vulnerability, which can reduce false positives and false negatives and improve the accuracy of vulnerability detection; on the other hand, the present disclosure can effectively screen the vulnerabilities in the vulnerability library by the degree of impact, save the time of manual intervention, and improve the efficiency of software vulnerability detection and repair.

[0020] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0022] Figure 1 A schematic diagram showing an exemplary system architecture to which embodiments of the present disclosure may be applied;

[0023] Figure 2 A schematic diagram showing a flow chart of a software vulnerability detection method in an exemplary embodiment of the present disclosure;

[0024] Figure 3 A schematic flow chart showing a method for determining target dependency in an exemplary embodiment of the present disclosure;

[0025] Figure 4 A flow chart showing a method for determining dependent files of software to be detected in an exemplary embodiment of the present disclosure;

[0026] Figure 5 A schematic diagram showing a flow chart of another software vulnerability detection method in an exemplary embodiment of the present disclosure;

[0027] Figure 6 A schematic diagram showing the composition of a software vulnerability detection device in an exemplary embodiment of the present disclosure;

[0028] Figure 7 A schematic structural diagram of an electronic device in an exemplary embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0029] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0030] The terms "a", "an", "the" and "said" are used in this specification to indicate the presence of one or more elements / components / etc.; the terms "including" and "having" are used to express an open-ended inclusion and mean that additional elements / components / etc. may exist in addition to the listed elements / components / etc.

[0031] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0032] With the rapid development of information technology, software systems have become increasingly complex. They usually rely on a large number of external libraries and frameworks to implement various functions. Although these third-party components have accelerated the development process, they have also introduced new security challenges. Attackers often exploit known vulnerabilities in these components to launch attacks, resulting in data leakage, service interruptions, and even more serious security incidents. Therefore, it is crucial for software developers and security experts to identify and manage security risks in these dependencies.

[0033] Traditional vulnerability detection methods, such as static application security testing (SAST) and dynamic application security testing (DAST), have achieved certain results in identifying software vulnerabilities. However, these methods often have limitations, such as insufficient support for dynamically typed languages, high false positive rates, and inability to intervene in the early stages of software development. In addition, with the popularization of continuous integration practices and the accelerated iteration speed of software, traditional vulnerability detection methods can no longer meet the needs of quickly discovering and fixing vulnerabilities.

[0034] In order to solve the above problems, the present invention provides a software vulnerability detection method and device, which can be applied to Figure 1 In the system architecture of the exemplary application environment shown.

[0035] like Figure 1 As shown, the system architecture 100 may include a terminal device 110 and a server 120. The terminal device 110 may be a terminal device such as a smart phone, a tablet computer, a desktop computer, a laptop computer, a smart wearable device, etc. The server 120 generally refers to a background system that provides software vulnerability detection related services in this exemplary embodiment, and may be a server or a cluster formed by multiple servers. The terminal 110 and the server 120 may be connected via a wired or wireless communication link to perform data exchange.

[0036] In an exemplary embodiment, the above-mentioned software vulnerability detection method can be performed by the terminal device 110. Accordingly, the software vulnerability detection device can be set in the terminal device 110 to implement the corresponding module functions. For example, the terminal device 110 can extract the attribute information of the target dependency of the software to be detected, generate the dependency unique identifier of the software to be detected according to the attribute information of the target dependency, and then obtain the vulnerability from the vulnerability library, and generate the vulnerability unique identifier corresponding to the obtained vulnerability, and match the vulnerability unique identifier with the dependency unique identifier, and obtain the candidate vulnerability from the matching results at all levels. Then calculate the correlation between each candidate vulnerability and the software to be detected, determine the target vulnerability from the candidate vulnerabilities according to the correlation, and then generate a vulnerability detection report for the software to be detected based on the target vulnerability.

[0037] In an exemplary embodiment, the above-mentioned software vulnerability detection method can be performed by the server 120. Accordingly, the software vulnerability detection device can be set in the server 120 to implement the corresponding module functions. For example, the terminal device 110 can send the software to be detected to the server, and the server 120 can extract the attribute information of the target dependency of the software to be detected, generate the dependency unique identifier of the software to be detected according to the attribute information of the target dependency, and then obtain the vulnerability from the vulnerability library, and generate the vulnerability unique identifier corresponding to the obtained vulnerability, match the vulnerability unique identifier and the dependency unique identifier, and obtain the candidate vulnerability at each level of matching results. Then calculate the correlation between each candidate vulnerability and the software to be detected, determine the target vulnerability from the candidate vulnerabilities according to the correlation, and then generate a vulnerability detection report of the software to be detected based on the target vulnerability, and send the generated vulnerability detection report of the software to be detected to the terminal device 110.

[0038] It should be understood that Figure 1 The number of terminal devices and servers in the example is only illustrative. Any number of terminal devices and servers may be provided as required. For example, the server 120 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0039] However, it is easy for those skilled in the art to understand that the above application scenarios are only used as examples and are not limited to this in the present exemplary embodiment.

[0040] Figure 2 A flowchart of a software vulnerability detection method in an exemplary embodiment of the present disclosure is shown. Figure 2 , the method comprising:

[0041] Step S210, extracting the attribute information of the target dependency of the software to be detected, and generating the dependency unique identifier of the software to be detected according to the attribute information of the target dependency;

[0042] Step S220, matching the dependency unique identifier of the software to be detected with the vulnerability unique identifier in the vulnerability library, and determining candidate vulnerabilities according to the vulnerabilities indicated by the successfully matched vulnerability unique identifiers;

[0043] Step S230 , determining a target vulnerability of the software to be detected from the candidate vulnerabilities according to the degree of influence of the candidate vulnerabilities on the software to be detected, and generating a vulnerability detection report of the software to be detected based on the target vulnerability.

[0044] exist Figure 2In the technical solution provided by the illustrated embodiment, a candidate vulnerability is obtained by matching the unique identifier of the target dependency of the software to be detected with the unique identifier of the vulnerability, and then a target vulnerability is obtained according to the degree of correlation between the candidate vulnerability and the software to be detected, so as to generate a vulnerability detection report of the software to be detected based on the target vulnerability. Compared with the related art, on the one hand, the present disclosure determines the candidate vulnerability by matching the unique identifier of the target dependency with the unique identifier of the vulnerability, which can reduce false positives and false negatives and improve the accuracy of vulnerability detection; on the other hand, the present disclosure can effectively screen the vulnerabilities in the vulnerability library through matching and correlation, saving the time of manual intervention and improving the efficiency of software vulnerability detection and repair.

[0045] Next, first, a specific implementation method of "step S210, extracting the target dependency attribute information of the software to be detected, and generating the dependency unique identifier of the software to be detected according to the target dependency attribute information" is described in detail.

[0046] For example, software dependencies include external components, libraries, or resources that are required for the normal operation of a software module or application. These dependencies can be code libraries, frameworks, system services, or external resources, which together constitute the software's infrastructure to ensure the normal operation and functionality of the software.

[0047] In an exemplary implementation, the target dependency may include the dependency actually used in the software to be tested. Based on this, for example, Figure 3 A flowchart of a method for determining target dependency in an exemplary embodiment of the present disclosure is shown. Figure 3 , the method may include steps S310 to S320. Wherein:

[0048] In step S310, the dependency indicated by the dependency reference information in the dependency file of the software to be detected is matched with the code information of the software to be detected.

[0049] In an exemplary embodiment, the dependency reference information is used to indicate the dependencies referenced in the software to be detected. In other words, there is a dependency file in the file package of the detection software, and the dependency file is specifically used to record the relevant information of the dependencies referenced by the software to be detected during the development process, that is, the dependency file includes the component name, version, supplier and other information referenced by the software to be detected.

[0050] For example, Figure 4 A flowchart of a method for determining dependent files of software to be detected in an exemplary embodiment of the present disclosure is shown. Figure 4 , the method may include steps S410 to S430.

[0051] In step S410, the target programming language used by the software to be detected is determined.

[0052] For example, different software to be tested may be written in different programming languages, such as Python, C, C++, JAVA, etc.

[0053] In an exemplary embodiment, different programming languages ​​can be classified by a programming language analyzer to obtain a target programming language used by the software to be detected. The programming language analyzer can classify different types of programming languages ​​according to the characteristics of different types of programming languages. Therefore, the language characteristics of the software to be detected can be extracted, and the language characteristics of the software to be detected can be input into the programming language analyzer to obtain the target programming language used by the software to be detected.

[0054] In another exemplary embodiment, the target programming language used by the software to be tested may also be manually confirmed.

[0055] In step S420, the target format of the dependent file corresponding to the target programming language is searched in the first mapping relationship.

[0056] In an exemplary implementation, the first mapping relationship is used to indicate a mapping relationship between different programming languages ​​and the formats of their corresponding dependent files.

[0057] For example, for each programming language, the dependent files in the software developed using the programming language can have a fixed file format, such as the dependent files of the software corresponding to each type of programming language have a fixed suffix format, and the suffix format can be used to distinguish the dependent files in the software from other function code files. A mapping relationship between different programming languages ​​and the formats of the corresponding dependent files can be generated in advance, such as the first mapping relationship can record the formats of the dependent files corresponding to different programming languages.

[0058] After determining the target programming language used by the software to be detected, the format of the dependent file corresponding to the target programming language can be searched in the first mapping relationship to obtain the target format.

[0059] In step S430, dependent files of the software to be detected are determined according to the files in the target format in the software to be detected.

[0060] As mentioned above, the format of the dependent files in the software to be detected is different from the format of the software entity function code file of the software to be detected, so the files of the target format can be searched in the file package of the software to be detected, thereby determining the dependent files of the software to be detected from the file package of the software to be detected.

[0061] Through the above steps S410 to S430, the software to be detected in different programming languages ​​can be uniformly processed to improve the versatility of the software vulnerability detection method in the present disclosure. At the same time, the dependent files of the software to be detected in different programming languages ​​can be automatically determined to help improve the efficiency of software vulnerability detection.

[0062] In an exemplary embodiment, although some dependencies are recorded in the dependency file, they are not actually used, that is, there are dependencies that are only referenced but not actually used, for example, some external libraries or modules are introduced in the software to be detected, but the functions of these libraries or modules are not actually used in the code. Based on this, the reference information in the dependency file of the software to be detected can be matched with the code information of the software to be detected, and the dependencies actually used in the software to be detected can be determined according to the matching results, so as to obtain the target dependency.

[0063] For example, the dependency content corresponding to the dependency indicated by the reference information in the dependency file of the software to be detected can be matched with the relevant code of the software to be detected. For example, the function identifier of the key function in each dependency in the dependency file of the software to be detected can be matched with the code in the software to be detected that has the same function as the dependency, so as to find out whether the function identifier exists in the code of the software to be detected. If it exists, it is determined that the match is successful, otherwise it is determined that the match fails. For example, if a dependency in the dependency file is a user identity authentication module, and there is a key function in the user identity authentication module, and its function name is A, then it can be found in the identity authentication code of the software to be detected whether there is a function named A. If it exists, it is determined that the match is successful, otherwise it is determined that the match fails.

[0064] In step S320, the successfully matched dependency is determined as the target dependency.

[0065] For example, if a match is found in step S310, it means that the dependency indicated by the dependency reference information is indeed used in the software to be detected, so the dependency can be determined as the target dependency. In this way, vulnerability detection can be performed on the software to be detected according to the target dependency in subsequent steps.

[0066] Through the above steps S310 to S320, the dependencies actually used by the software to be detected can be filtered out from the dependency file, so that in the subsequent steps, software vulnerability detection can be performed based on the dependencies actually used by the software to be detected, which can improve the accuracy of software vulnerability detection.

[0067] After obtaining the target dependency, a unique identifier of the target can be generated. For example, attribute information of the target dependency can be extracted, such as the organization, manufacturer, product name, version number, etc. of the target dependency.

[0068] In an exemplary embodiment, the unique identifier of the target dependency may include the target dependency CPE (Common Platform Enumeration). CPE is an open, standardized framework for describing and identifying configurations on software and hardware platforms. It provides a structured way to uniquely identify IT assets, including operating systems, applications, databases, and other software components, as well as the hardware on which they run. The purpose of CPE is to provide a common language that allows different organizations and tools to consistently communicate information about IT assets, especially in the security field, for accurately describing vulnerability and configuration management related data.

[0069] For example, the dependency CPE of the software to be detected may be generated based on the extracted attribute information of the target dependency, such as the organization to which the target dependency belongs, the product name, the version number, and other information.

[0070] The specific implementation method of "step S220, matching the dependency unique identifier of the software to be detected with the vulnerability unique identifier in the vulnerability library, and determining the candidate vulnerability according to the vulnerability indicated by the successfully matched vulnerability unique identifier" is described in detail below.

[0071] For example, a vulnerability unique identifier corresponding to a vulnerability in the vulnerability library may be generated according to vulnerability attribute information in the vulnerability library, wherein the vulnerability unique identifier may also include a vulnerability CPE.

[0072] Exemplarily, the dependent CPEs of the software to be detected may be matched with the vulnerability CPEs corresponding to the vulnerabilities in the vulnerability library respectively. If the match is successful, the vulnerability indicated by the vulnerability CPE is determined as a candidate vulnerability.

[0073] The specific implementation method of "step S230, determining a target vulnerability of the software to be detected from the candidate vulnerabilities according to the degree of influence of the candidate vulnerabilities on the software to be detected, and generating a vulnerability detection report of the software to be detected based on the target vulnerability" is described in detail below.

[0074] In an exemplary embodiment, a method for determining the degree of impact of the candidate vulnerability on the software to be detected includes: inputting vulnerability information of the candidate vulnerability and software information of the software to be detected into a pre-trained machine learning model, and obtaining the confidence of the candidate vulnerability based on the output of the machine learning model; and determining the confidence as the degree of impact of the candidate vulnerability on the software to be detected.

[0075] Among them, the vulnerability information of the candidate vulnerability may include vulnerability type, vulnerability impact scope, vulnerability repair difficulty, vulnerability attack complexity, vulnerability permission requirements, etc., and the software information of the software to be tested may include information such as the software functions of the software to be tested.

[0076] Exemplarily, a method for determining a pre-trained machine learning model includes: obtaining training data and sample labels, wherein the training data includes vulnerabilities and software, and the sample labels include correlations between the vulnerabilities in the training data and the software; inputting the training data into an initial machine learning model to obtain prediction results of the training data; obtaining training losses based on the degree of difference between the prediction results of the training data and the sample labels; and iteratively training the initial machine learning model based on the training losses until preset conditions are met to obtain the pre-trained machine learning model.

[0077] For example, different vulnerabilities and software can be obtained, and the impact levels of different vulnerabilities on different software can be manually annotated to obtain training data and sample labels. Then, the vulnerability information corresponding to the vulnerabilities in the training data and the software information corresponding to the software in the training data are extracted, and the extracted vulnerability information and software information are input into the initial machine learning model. The initial machine learning model is used to predict the impact level of the vulnerabilities in the training data on the software to obtain the prediction results, and the prediction results are compared with the sample labels to obtain the degree of difference between the prediction results and the sample labels. The degree of difference is determined as the training loss, and then in the iterative training process, the initial machine learning model is allowed to converge in the direction of continuously reducing the training loss until the preset number of iterations is reached or the training loss is less than the preset value, and the training is terminated to obtain the pre-trained machine learning model.

[0078] In an exemplary embodiment, the machine learning module may include any machine learning model capable of prediction, such as a convolutional neural network model or a support vector machine model, and this exemplary embodiment does not impose any characteristic limitation on this.

[0079] Exemplarily, the software information of the software to be detected and the vulnerability information of each candidate vulnerability can be input into a pre-trained machine learning model. The pre-trained machine learning model can output the impact probability of the candidate vulnerability on the software to be detected. The impact probability can be used to measure the confidence of the candidate vulnerability, thereby using the impact probability as the degree of impact of the candidate vulnerability on the software to be detected.

[0080] In an exemplary embodiment, according to the degree of influence of the candidate vulnerability on the software to be detected, determining the target vulnerability of the software to be detected from the candidate vulnerabilities includes: according to the degree of influence of the candidate vulnerability on the software to be detected, determining the candidate vulnerability whose influence degree is greater than a preset value as the target vulnerability.

[0081] For example, a preset value may be set, and then candidate vulnerabilities with a correlation greater than the preset value may be determined as target vulnerabilities. The preset value is used to select vulnerabilities with a high correlation with the software to be detected from the candidate vulnerabilities, so the preset value may be set larger, because the impact is determined by probability, and the maximum probability value is 1, so the preset value may range from greater than or equal to 0.6 to less than 1. The specific value of the preset value may be customized according to the needs, and this exemplary embodiment does not limit the characteristics of this.

[0082] In an exemplary embodiment, the above-mentioned generating the vulnerability detection report of the software to be detected based on the target vulnerability includes: sorting the target vulnerabilities according to the descending order of the impact degree; and generating the vulnerability detection report of the software to be detected based on the sorting result.

[0083] For example, the target vulnerabilities can be sorted in order from high to low according to the degree of impact, and then the sorting results can be written into the vulnerability detection report. In this way, the user can determine the importance of different target vulnerabilities based on the sorting results in the vulnerability detection report, and thus repair and optimize the vulnerabilities according to different degrees of importance.

[0084] For example, Figure 5 A flowchart showing another software vulnerability detection method in an exemplary embodiment of the present disclosure is shown. Figure 5 , the method may include steps S501 to S513. Wherein:

[0085] In step S501, the software to be detected is obtained; in step S502, the programming language type used by the software to be detected is obtained through a programming language analyzer; in step S503, the dependent files are determined from the software to be detected according to the dependent file format corresponding to the programming language type; in step S504, it is determined whether the dependencies in the dependent files are actually used, if not, go to step S505, otherwise, go to step S506; in step S505, ignore and do not process; in step S506, extract the dependency attributes to generate a unique dependency identifier; in step S507, extract the vulnerability attributes in the vulnerability library Generate a vulnerability unique identifier; in step S508, compare the dependency unique identifier and the vulnerability unique identifier to generate a first data set; in step S509, use a machine learning model to perform confidence scoring on each vulnerability unique identifier in the first data set; in step S510, determine whether the confidence score is greater than a set threshold, if not, go to step S511, otherwise go to step S512; in step S511, ignore and do not process; in step S512, record and generate a second data set; in step S513, process the vulnerability information contained in the second data set to obtain a vulnerability detection result.

[0086] For example, different programming languages ​​can be classified according to a programming language analyzer to obtain the type of programming language used by the software to be detected. Among them, the programming language analyzer can also be a pre-trained programming language classifier obtained by training any machine learning model. Then, according to the first mapping relationship stored in advance, the dependency file format corresponding to the type of programming language used by the software to be detected is found to obtain the target file format. Then, the file of the target file format is searched in the software package of the software to be detected to obtain the dependency file of the software to be detected. Usually, the dependency file contains the component name, version, supplier and other information referenced by the software. Then, the dependency file word segmenter can be used to filter out the dependencies that are actually used in the software to be detected, thereby ignoring the dependencies that are only referenced but not used. And extract the key information of the filtered dependencies, that is, the dependency attribute information, such as the organization, manufacturer, product name and version number of the above-mentioned dependencies. Based on the attribute information of the filtered dependencies, the dependency CPE of the software to be detected is generated, and then the vulnerability is obtained from the vulnerability database, and the vulnerability CPE is generated. The vulnerability CPE contains relevant information of the vulnerability, such as the organization / manufacturer, product name, version number, etc. to which the vulnerability belongs.

[0087] Compare the dependency CPE of the software to be detected with the vulnerability CPE. When the dependency attribute and the vulnerability attribute have a matching relationship, the vulnerability is added to the first data set. In other words, the first data set contains the potential vulnerabilities of the software to be detected. Then, each vulnerability CPE in the first data set is given a confidence score through the machine learning model. This score is used to estimate how likely this vulnerability is to be related to the project of the software to be detected. If the confidence score of a vulnerability CPE is very high, it means that this vulnerability will indeed affect the project of the software to be detected, and more attention needs to be paid to this vulnerability; if the confidence score is very low, it means that this vulnerability has little to do with the project of the software to be detected, or it will not have a real impact on the software to be detected. Based on this, the vulnerability CPE with a confidence score exceeding a certain threshold can be selected from the first data set according to this confidence score to generate a second data set. The second data set contains the vulnerabilities that are most likely to affect the software to be detected, that is, the above-mentioned target vulnerabilities.

[0088] Through the vulnerability information in the second data set, a vulnerability report is formed by sorting the confidence scores from high to low. Through this report, users can repair and optimize the vulnerabilities according to their importance.

[0089] The present disclosure can classify the dependencies in the dependency files of software in different programming languages ​​according to the programming language analyzer and the dependency file analyzer, filter and ignore the dependencies that are only referenced but not actually used, and only analyze the dependencies that are actually used. Different programming languages ​​can be processed, with strong versatility, and by filtering the dependencies, more attention can be paid to the analysis of the dependencies actually used, thereby improving the efficiency of vulnerability detection. Secondly, based on the extracted dependency attributes and vulnerability attributes, false positives and false negatives can be reduced by matching the dependency CPE and the vulnerability CPE, thereby improving the accuracy of vulnerability detection. At the same time, by automatically scoring the vulnerabilities through the machine learning model, it is possible to reduce unnecessary inspections based on accurate dependency analysis and vulnerability scoring, and reduce the consumption of computing resources and human resources. In addition, through confidence scoring and threshold setting, a quantifiable risk management tool is provided for the software, and users can perform vulnerability detection management on the software or software projects through customization.

[0090] In other words, the method disclosed in the present invention can deeply understand software dependencies, accurately identify potential security vulnerabilities, and provide timely feedback. It should not only be able to handle static code analysis, but also be able to adapt to dynamically changing runtime environments. It has high accuracy and efficiency, can adapt to the fast-paced software development cycle, and reduces the reliance on manual intervention in software vulnerability detection.

[0091] In addition, it should be noted that the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0092] Furthermore, an exemplary embodiment of the present disclosure also provides a software vulnerability detection device. Figure 6 As shown, the software vulnerability detection device 600 includes the following program modules: a dependency extraction module 610, configured to extract the attribute information of the target dependency file of the software to be detected, and generate the dependency unique identifier of the software to be detected according to the attribute information of the target dependency file; a matching module 620, configured to match the dependency unique identifier of the software to be detected with the vulnerability unique identifier in the vulnerability library, and determine the candidate vulnerability according to the vulnerability indicated by the successfully matched vulnerability unique identifier; a vulnerability detection report generation module 630, configured to determine the target vulnerability of the software to be detected from the candidate vulnerabilities according to the degree of influence of the candidate vulnerability on the software to be detected, and generate a vulnerability detection report of the software to be detected based on the target vulnerability.

[0093] In an exemplary embodiment, the method for determining the target dependency includes: matching the dependency indicated by the dependency reference information in the dependency file of the software to be detected with the code information of the software to be detected, wherein the dependency reference information is used to indicate the dependency referenced in the software to be detected; and determining the successfully matched dependency as the target dependency.

[0094] In an exemplary embodiment, the method for determining the dependent files of the software to be detected includes: determining the target programming language used by the software to be detected; searching for the target format of the dependent files corresponding to the target programming language in a first mapping relationship, wherein the first mapping relationship is used to indicate the mapping relationship between different programming languages ​​and their corresponding formats of dependent files; and determining the dependent files of the software to be detected based on the files of the target format in the software to be detected.

[0095] In an exemplary embodiment, a method for determining the degree of impact of the candidate vulnerability on the software to be detected includes: inputting vulnerability information of the candidate vulnerability and software information of the software to be detected into a pre-trained machine learning model, and obtaining the confidence of the candidate vulnerability based on the output of the machine learning model; and determining the confidence as the degree of impact of the candidate vulnerability on the software to be detected.

[0096] In an exemplary embodiment, the method for determining the pre-trained machine learning model includes: obtaining training data and sample labels, wherein the training data includes vulnerabilities and software, and the sample labels include the impact level of the vulnerabilities in the training data on the software; inputting the training data into the initial machine learning model to obtain the prediction result of the training data; obtaining the training loss based on the degree of difference between the prediction result of the training data and the sample label; and iteratively training the initial machine learning model based on the training loss until a preset condition is met to obtain the pre-trained machine learning model.

[0097] In an exemplary embodiment, determining a target vulnerability of the software to be detected from the candidate vulnerabilities according to the degree of influence of the candidate vulnerabilities on the software to be detected includes: according to the degree of influence of the candidate vulnerabilities on the software to be detected, determining a candidate vulnerability whose influence degree is greater than a preset value as the target vulnerability.

[0098] In an exemplary embodiment, generating the vulnerability detection report of the software to be detected based on the target vulnerability includes: sorting the target vulnerabilities in descending order of the impact degree; and generating the vulnerability detection report of the software to be detected based on the sorting result.

[0099] The specific details of each part of the above-mentioned device have been described in detail in the implementation method of the method part. The undisclosed details can be found in the implementation method of the method part, so they will not be repeated here.

[0100] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the exemplary embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0101] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0102] The exemplary embodiments of the present disclosure also provide a computer program product, which includes a computer program, and when the computer program is executed by a processor, the software vulnerability detection method described above is implemented.

[0103] In one embodiment, the computer program product may be a tangible product containing a computer program, such as a computer-readable storage medium storing a computer program. The readable storage medium may be a storage medium based on electrical, magnetic, optical, electromagnetic, infrared, or other signals, including but not limited to: random access memory (RAM), read-only memory (ROM), magnetic tape, floppy disk, flash memory (Flash), mechanical hard disk (HDD), solid-state drive (SSD), and the like. Exemplarily, the computer program product may be implemented as a non-volatile storage medium storing a computer program, such as a read-only memory, a NAND flash memory, and the like.

[0104] In one embodiment, the computer program product may be an intangible product including a computer program. Exemplarily, the computer program product may be implemented as a virtual digital product, such as a digital file storing an executable file, an installation package, etc. of the computer program.

[0105] The code of the computer program can be written in one or more programming languages. Programming languages ​​such as C language, Java, C++, Python, etc. The program code can be executed entirely on the user computing device, or partially on the user computing device, or as a separate software package, or partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, such as a local area network (LAN), a wide area network (WAN), etc., or can be connected to an external computing device (e.g., an Internet connection provided by an operator).

[0106] Computer programs can be carried or transmitted through electrical, magnetic, optical, electromagnetic, infrared and other signals. Electronic devices can convert signals carrying computer programs into digital signals, and then run computer programs. When a computer program runs on an electronic device, its code is used to enable the electronic device to execute (more specifically, the processor of the electronic device can execute) the method steps of various exemplary embodiments of the present disclosure, such as the above-mentioned software vulnerability detection method, which includes the following steps: extracting the attribute information of the target dependency of the software to be detected, and generating the dependency unique identifier of the software to be detected according to the attribute information of the target dependency; matching the dependency unique identifier of the software to be detected with the vulnerability unique identifier in the vulnerability library, and determining the candidate vulnerability according to the vulnerability indicated by the vulnerability unique identifier that successfully matches; determining the target vulnerability of the software to be detected from the candidate vulnerability according to the degree of influence of the candidate vulnerability on the software to be detected, and generating a vulnerability detection report of the software to be detected based on the target vulnerability.

[0107] By executing the above method steps through a computer program, on the one hand, candidate vulnerabilities can be determined based on the matching of the unique identifier of the target dependency and the unique identifier of the vulnerability, which can reduce false positives and false negatives and improve the accuracy of vulnerability detection; on the other hand, the vulnerabilities in the vulnerability library can be effectively screened through the degree of impact, saving time for manual intervention and improving the efficiency of software vulnerability detection and repair.

[0108] The exemplary embodiments of the present disclosure also provide an electronic device, such as the terminal device 110 or the server 120 described above. The electronic device may include a processor and a memory. The memory stores executable instructions of the processor, such as a computer program. The processor executes the method steps of various exemplary embodiments of the present disclosure by executing the executable instructions. In addition, the electronic device may also include a display for displaying a graphical user interface.

[0109] Reference below Figure 7 , the electronic device is exemplarily described in the form of a general-purpose computing device. It should be understood that Figure 7 The electronic device 700 shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0110] like Figure 7 As shown, the electronic device 700 may include: a processor 710 , a memory 720 , a bus 730 , an I / O (input / output) interface 740 , a network adapter 750 , and a display 760 .

[0111] The memory 720 may include a volatile memory, such as a RAM 721, a cache unit 722, and may also include a non-volatile memory, such as a ROM 723. The memory 720 may also include one or more program modules 724, such program modules 724 include but are not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or a combination thereof may include the implementation of a network environment. For example, the program module 724 may include each module in the above-mentioned device.

[0112] The processor 710 may include one or more processing units. For example, the processor 710 may include an AP (Application Processor), a modem processor, a GPU (Graphics Processing Unit), an ISP (Image Signal Processor), a controller, an encoder, a decoder, a DSP (Digital Signal Processor), a baseband processor and / or an NPU (Neural-Network Processing Unit), etc.

[0113] The processor 710 can be used to execute executable instructions stored in the memory 720, such as the above-mentioned software vulnerability detection method, which includes the following steps: extracting the attribute information of the target dependency of the software to be detected, and generating the dependency unique identifier of the software to be detected according to the attribute information of the target dependency; matching the dependency unique identifier of the software to be detected with the vulnerability unique identifier in the vulnerability library, and determining a candidate vulnerability according to the vulnerability indicated by the successfully matched vulnerability unique identifier; determining the target vulnerability of the software to be detected from the candidate vulnerabilities according to the degree of influence of the candidate vulnerability on the software to be detected, and generating a vulnerability detection report for the software to be detected based on the target vulnerability.

[0114] By implementing the above method through a computer program, on the one hand, candidate vulnerabilities can be determined based on the matching of the unique identifier of the target dependency and the unique identifier of the vulnerability, which can reduce false positives and negatives and improve the accuracy of vulnerability detection; on the other hand, the vulnerabilities in the vulnerability library can be effectively screened through the degree of impact, saving time for manual intervention and improving the efficiency of software vulnerability detection and repair.

[0115] The bus 730 is used to realize the connection between different components of the electronic device 700, and may include a data bus, an address bus, and a control bus.

[0116] The electronic device 700 can communicate with one or more external devices 800 (eg, a keyboard, a mouse, an external controller, etc.) through the I / O interface 740 .

[0117] The electronic device 700 can communicate with one or more networks through the network adapter 750. For example, the network adapter 750 can provide mobile communication solutions such as 3G / 4G / 5G, or wireless communication solutions such as wireless LAN, Bluetooth, near field communication, etc. The network adapter 750 can communicate with other modules of the electronic device 700 through the bus 730.

[0118] The electronic device 700 may display a graphical user interface through the display 760 , such as an interface for displaying a generated vulnerability detection report.

[0119] although Figure 7 Not shown, other hardware and / or software modules may also be provided in the electronic device 700, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0120] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present disclosure, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0121] As can be seen from the above, the technical solution of the present disclosure can be implemented as a method, an apparatus, a system, a computer program product, a storage medium, an electronic device, etc. Those skilled in the art can understand that various aspects of the present disclosure can be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation combining hardware and software, such as being respectively referred to as a "circuit", "module" or "system".

[0122] It should be understood that the present disclosure is not limited to the specific method steps or structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from the scope thereof. Those skilled in the art will easily think of other embodiments based on the specific embodiments provided by the present disclosure. Therefore, the specific embodiments provided by the present disclosure are only exemplary, and the scope and spirit of the present disclosure are indicated by the claims, and any variations, uses or adaptive changes of the present disclosure should be covered, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the technical field that are not disclosed in the present disclosure.

Claims

1. A software vulnerability detection method, characterized in that: include: Extracting the target dependency attribute information of the software to be detected, and generating the dependency unique identifier of the software to be detected according to the target dependency attribute information; Matching the dependency unique identifier of the software to be detected with the vulnerability unique identifier in the vulnerability library, and determining candidate vulnerabilities according to the vulnerabilities indicated by the successfully matched vulnerability unique identifiers; According to the degree of influence of the candidate vulnerabilities on the software to be detected, a target vulnerability of the software to be detected is determined from the candidate vulnerabilities, and a vulnerability detection report of the software to be detected is generated based on the target vulnerability.

2. The method according to claim 1, characterized in that The target dependency is determined by: Matching the dependency indicated by the dependency reference information in the dependency file of the software to be detected with the code information of the software to be detected, wherein the dependency reference information is used to indicate the dependency referenced in the software to be detected; The successfully matched dependency is determined as the target dependency.

3. The method according to claim 2, characterized in that The method for determining the dependent files of the software to be detected includes: Determine the target programming language used by the software to be detected; Searching for a target format of a dependent file corresponding to the target programming language in a first mapping relationship, wherein the first mapping relationship is used to indicate a mapping relationship between different programming languages ​​and their corresponding formats of dependent files; Determine dependent files of the software to be detected based on the files in the target format in the software to be detected.

4. The method according to claim 1, characterized in that: The method for determining the degree of influence of the candidate vulnerability on the software to be detected includes: Inputting vulnerability information of the candidate vulnerability and software information of the software to be detected into a pre-trained machine learning model, and obtaining the confidence of the candidate vulnerability according to the output of the machine learning model; The confidence level is determined as the degree of influence of the candidate vulnerability on the software to be detected.

5. The method according to claim 4, characterized in that The method for determining the pre-trained machine learning model includes: Acquire training data and sample labels, wherein the training data includes vulnerabilities and software, and the sample labels include the impact level of the vulnerabilities in the training data on the software; Inputting the training data into an initial machine learning model to obtain a prediction result of the training data; Obtaining a training loss according to the difference between the prediction result of the training data and the sample label; The initial machine learning model is iteratively trained based on the training loss until a preset condition is met, thereby obtaining the pre-trained machine learning model.

6. The method according to claim 1, characterized in that Determining a target vulnerability of the software to be detected from the candidate vulnerabilities according to the degree of influence of the candidate vulnerabilities on the software to be detected includes: According to the degree of influence of the candidate vulnerability on the software to be detected, the candidate vulnerability whose influence degree is greater than a preset value is determined as the target vulnerability.

7. The method according to claim 1, characterized in that Generating the vulnerability detection report of the software to be detected based on the target vulnerability includes: sorting the target vulnerabilities according to the descending order of the impact degree; A vulnerability detection report of the software to be detected is generated based on the sorting result.

8. A software vulnerability detection device, characterized in that: include: A dependency extraction module is configured to extract attribute information of a target dependency file of the software to be detected, and generate a dependency unique identifier of the software to be detected according to the attribute information of the target dependency file; A matching module is configured to match the dependency unique identifier of the software to be detected with the vulnerability unique identifier in the vulnerability library, and determine a candidate vulnerability according to the vulnerability indicated by the successfully matched vulnerability unique identifier; The vulnerability detection report generating module is configured to determine the target vulnerability of the software to be detected from the candidate vulnerabilities according to the degree of influence of the candidate vulnerabilities on the software to be detected, and generate a vulnerability detection report of the software to be detected based on the target vulnerability.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement the method according to any one of claims 1 to 7.

Images