Method and device for constructing 0DAY vulnerability detection model based on AI large model

Abstract

The invention discloses a method and a device for constructing an 0DAY vulnerability detection model based on an AI large model, relates to the technical field of network security, and solves the problems that different analysis strategies are difficult to adopt aiming at codes of different levels, problem positioning and performance optimization are difficult to carry out in a targeted manner, the advantages of various models are difficult to combine, and the detection efficiency is high. And different analysis parameters are fully analyzed. By adding the adversarial sample into the vulnerability detection data set, the AI large model can learn more diversified vulnerability features in the training process, so that the generalization ability of the model is enhanced, and the model can better adapt to vulnerability detection tasks in different scenes. Through the AST abstract syntax tree replacement technology, the non-system code function in the data set can be quickly positioned and replaced, the dependence on the original code is reduced, and the vulnerability detection efficiency is improved. And different analysis strategies are adopted for different levels of codes, so that more targeted problem positioning is facilitated.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and specifically is a method and device for constructing a 0DAY vulnerability detection model based on an AI big model. Background Art

[0002] With the rapid development of information technology, the complexity and scale of software systems are increasing, and security vulnerabilities have become a major hidden danger in the field of network security. In particular, 0DAY vulnerabilities (Zero-Day Vulnerability) refer to vulnerabilities that have not been discovered or fixed by developers after the software is released. Such vulnerabilities are often exploited by hackers to attack, posing serious security threats. Traditional vulnerability detection methods often rely on static and dynamic analysis, but these methods often lack detection efficiency and accuracy when facing newly emerging 0DAY vulnerabilities. In recent years, the development of artificial intelligence technology has provided new ideas for vulnerability detection. Through machine learning and deep learning models, potential security risks can be automatically identified from a large amount of code. However, existing AI models still face many challenges in dealing with 0DAY vulnerabilities, including imbalanced data sets, scarce samples, and insufficient understanding of complex code logic. Therefore, a new method is needed to improve the effectiveness of AI models in 0DAY vulnerability detection.

[0003] Most 0DAY vulnerability detection solutions perform a unified analysis of the code. It is difficult to adopt different analysis strategies for different levels of code, to locate problems and optimize performance in a targeted manner, and to combine the advantages of multiple models to fully analyze different analysis parameters. Summary of the invention

[0004] The present invention aims to solve at least one of the technical problems existing in the prior art; to this end, the present invention proposes a 0DAY vulnerability detection model construction method and device based on an AI big model, which is used to solve the technical problems that it is difficult to adopt different analysis strategies for codes at different levels, it is difficult to locate problems and optimize performance in a targeted manner, and it is difficult to combine the advantages of multiple models to fully analyze different analysis parameters.

[0005] To solve the above problems, the first aspect of the present invention provides a method for constructing a 0DAY vulnerability detection model based on an AI large model, comprising the following steps: Collect normal running codes of various functions and implementations from open source projects, obtain known vulnerability instances and their contexts through public vulnerability databases, annotate the vulnerability locations, and form a vulnerability detection dataset with normal running codes; Through AST abstract syntax tree replacement technology, non-system code functions in the dataset are replaced with kernel APIs, and simulated vulnerability patterns are inserted into legitimate code; Filter the source code with 0DAY vulnerabilities in the legitimate code, generate adversarial samples containing "valid verification but vulnerabilities still exist" through GAN, and add them to the vulnerability detection dataset; According to the function and structure of the code, the dataset is divided into multiple levels, and the syntax features, execution path features, and inter-function relationship features of the code at each level are extracted; Use different dynamic analysis strategies and static analysis strategies for different levels of code, and analyze the corresponding dynamic analysis results and static analysis results; Based on the results of dynamic analysis and static analysis, as well as the grammatical features, execution path features, and inter-function relationship features of each level of code, the 0DAY vulnerability detection models of different levels of code are trained separately by combining the Transformer model and convolutional neural network algorithm.

[0006] Optionally, in an example of the above aspect, the non-system code functions in the data set are replaced with kernel APIs through AST abstract syntax tree replacement technology, and the simulated vulnerability pattern is inserted into the legitimate code, including the following steps: The source code is converted into a tree representation of the source code through the parser of the programming language; for example, Python's ast module converts the source code into AST, which is a tree representation of the source code; wherein, in the tree representation of the source code, each node represents a syntactic element, such as a variable, a function, a control structure, etc.

[0007] Traverse the tree representation of the source code, identify non-system functions based on function names, parameters, and return value features, identify non-system functions as function nodes that need to be replaced, and randomly select a number of non-system functions from them. Replace the non-system functions with non-system functions that have 0DAY vulnerabilities by randomly combining non-system functions, modifying input formats or contents, allowing more input conditions to trigger, and renaming variables, functions, and classes, and mark the vulnerability locations; identify non-system functions based on function names, parameters, and return value features, such as excluding function names that start with a specific prefix (such as "_").

[0008] Identify all non-system functions and their corresponding kernel APIs of function nodes that need to be replaced, and replace them with corresponding kernel API nodes. For example, replace a custom input validation function with a security API provided by the kernel. Convert the tree representation of the replaced source code back into executable code. Use existing tools, such as the astor library, to convert the modified AST back into executable code.

[0009] In this embodiment, the functions in non-system code, such as user-mode programs, are replaced with kernel APIs through AST abstract syntax tree replacement technology; for example, kmalloc→vmalloc.

[0010] Optionally, in an example of the above aspect, screening source code for 0DAY vulnerabilities in legitimate code includes the following steps: Filter legitimate code that has vulnerabilities marked and source code that does not have 0DAY vulnerabilities marked; The vulnerability location of the code is converted into 0DAY vulnerability code by modifying the input format or content, allowing more input conditions to trigger, and renaming variables, functions, and classes, and 0DAY vulnerability is marked; Filter out the source code marked with 0DAY vulnerability.

[0011] Optionally, in an example of the above aspect, the screened source code is used to generate an adversarial sample containing "valid verification but the vulnerability still exists" through GAN, and added to the vulnerability detection dataset, including the following steps: For the source code marked with 0DAY vulnerabilities, insert the simulated vulnerability pattern at an appropriate location in the source code; Use the code with simulated vulnerability patterns inserted as the training set, and combine normal code and known vulnerability samples to form an adversarial training set; The GAN model generator is trained through the adversarial training set to create new samples that appear like real samples in front of the discriminator. The GAN model discriminator is trained to learn to distinguish between real samples and generated samples, and feedback is given to the generator to improve its output. Add the obtained new samples to the vulnerability detection dataset.

[0012] Optionally, in an example of the above aspect, according to the function and structure of the code, the data set is divided into multiple levels, and the syntax features, execution path features and inter-function relationship features of the code of each level are extracted, including the following steps: According to the function and structure of the code, the vulnerability detection data set is divided into multiple layers, including: application layer, service layer, data access layer and system layer; the application layer is user interaction logic and input processing code, the service layer is API call and business logic processing, the data access layer is database operation and data transmission, and the system layer is system call and underlying implementation; For each level of code, syntactic features are extracted through AST, execution path features are extracted through CFG control flow graph, and relationship features between functions are extracted through Call Graph function call graph.

[0013] Optionally, in an example of the above aspect, different dynamic analysis strategies and static analysis strategies are adopted for codes at different levels, including the following steps: For the application layer code in the vulnerability detection dataset, the dynamic analysis strategy includes: Use the Selenium tool to simulate user interactions, test the application's response to various common inputs, and use the OWASP ZAP fuzz testing tool to attack the application and identify potential security vulnerabilities; Obtain error information and security vulnerability data of application layer code under simulated user behavior; Static analysis strategies for application layer code include: Check code quality through SonarQube static code analysis tool, identify security vulnerabilities in the code and annotate zero-day vulnerabilities; Generate reports, including code quality scores and security vulnerability lists; For the service layer code in the vulnerability detection dataset, the dynamic analysis strategy includes: Perform load testing and security testing through RESTful or SOAP APIs, as well as the return results of regular requests, and monitor service requests and responses in real time; Collect API response time, error rate, and security vulnerability information; The static analysis strategy for the service layer code includes: Verify the consistency between service interface definition and implementation, and check the quality of service layer code through static analysis tools; Generate interface contract consistency report and code quality assessment report; For the code of the data access layer in the vulnerability detection dataset, the dynamic analysis strategy includes: Detect transaction processing performance by simulating concurrent database query operations, and identify potential performance anomalies or SQL injections by monitoring SQL query execution plans and performance; Record database query performance indicators and SQL injection anomalies; The static analysis strategy for the access layer code includes: Detect potential injection risks in SQL query construction through static code analysis tools and check the configuration of ORM object-relational mapping; Generate SQL injection risk assessment report and ORM usage review report; For the system-level code in the vulnerability detection dataset, the dynamic analysis strategy includes: Monitor the usage of system-level resources in real time, obtain CPU, memory and disk I / O usage data, system performance indicators, and conduct comprehensive penetration testing on the system to identify system-level code vulnerabilities; Collect system performance data and vulnerability information discovered by penetration testing; System-level code, static analysis strategy, including: Perform source code audit on underlying system components and generate configuration review reports and source code audit reports.

[0014] Analyze the corresponding dynamic analysis results and static analysis results.

[0015] Optionally, in an example of the above aspect, for different levels of code, a Transformer model and a convolutional neural network algorithm are combined to respectively train 0DAY vulnerability detection models for different levels of code, including the following steps: Obtain the dynamic analysis results and static analysis results of code extraction in the vulnerability detection dataset, as well as the syntax features, execution path features, and inter-function relationship features of each level of code; Add a fusion input layer before the input layer of the Transformer model and the convolutional neural network model, and add an analysis output layer after the output layer of the Transformer model and the convolutional neural network model; The fusion input layer inputs the dynamic analysis results and static analysis results of the corresponding layers, as well as the syntax features of the code, into the Transformer model, and inputs the execution path features and inter-function relationship features into the convolutional neural network model; Analyze the output layer to obtain the output results of the Transformer model and the output results of the convolutional neural network model for weighted fusion to obtain the final 0DAY vulnerability detection results; For codes at different levels, the vulnerability detection dataset is concentrated, the extracted data is input into the fusion input layer for model training, and the 0DAY vulnerability detection model of codes at different levels is obtained to detect 0DAY vulnerabilities in the code.

[0016] According to another aspect of the present disclosure, a 0DAY vulnerability detection model construction device based on an AI big model is provided, comprising: Dataset generation module: collects normal running codes of various functions and implementations from open source projects, obtains known vulnerability instances and their contexts through public vulnerability databases, annotates the vulnerability locations, and forms a vulnerability detection dataset with normal running codes; Dataset expansion module: Use AST abstract syntax tree replacement technology to replace non-system code functions in the dataset with kernel APIs, and insert simulated vulnerability patterns into legitimate code; filter source code with 0DAY vulnerabilities in legitimate code, and generate adversarial samples containing "valid verification but vulnerabilities still exist" through GAN from the filtered source code, and add them to the vulnerability detection dataset; Data analysis module: divides the data set into multiple levels according to the function and structure of the code, and extracts the syntax features, execution path features, and inter-function relationship features of the code at each level; adopts different dynamic analysis strategies and static analysis strategies for codes at different levels, and analyzes the corresponding dynamic analysis results and static analysis results; Vulnerability detection model building module: Based on the dynamic analysis results and static analysis results, as well as the syntax features, execution path features, and inter-function relationship features of each level of code, the Transformer model and convolutional neural network algorithm are combined to train 0DAY vulnerability detection models for different levels of code.

[0017] According to another aspect of the present disclosure, there is provided a computing device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the above-mentioned method for constructing a 0DAY vulnerability detection model based on an AI large model are implemented.

[0018] Compared with the prior art, the present invention has the following beneficial effects: By adding adversarial samples to the vulnerability detection dataset, the AI ​​large model can learn more diverse vulnerability features during the training process, thereby enhancing the generalization ability of the model and enabling it to better adapt to vulnerability detection tasks in different scenarios. Through the AST abstract syntax tree replacement technology, it is convenient to quickly locate and replace non-system code functions in the dataset, reducing the dependence on the original code, thereby improving the efficiency of vulnerability detection.

[0019] The present invention adopts different analysis strategies for different levels of code, which is convenient for more targeted problem location and performance optimization. Through the combination of dynamic analysis and static analysis, it is convenient to timely discover and repair vulnerabilities and defects in the code, which helps to improve the overall quality and security of the code and reduce the risk of system crashes and data leaks; according to the dynamic analysis results and static analysis results, as well as the grammatical features, execution path features and inter-function relationship features of each level of code, for different levels of code, combined with the Transformer model and convolutional neural network algorithm, the 0DAY vulnerability detection model of different levels of code is trained respectively. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 It is a schematic diagram of the process of the present invention; Figure 2 Schematic diagram of the system framework of the present invention. DETAILED DESCRIPTION

[0022] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Example 1

[0023] See also Figure 1 The first aspect of the present invention provides a method for constructing a 0DAY vulnerability detection model based on an AI big model, comprising the following steps: Collect normal running codes of various functions and implementations from open source projects, obtain known vulnerability instances and their contexts through public vulnerability databases (such as CVE), annotate the vulnerability locations, and form a vulnerability detection dataset with normal running codes; Through AST abstract syntax tree replacement technology, non-system code functions in the dataset are replaced with kernel APIs, and simulated vulnerability patterns are inserted into legitimate code; Filter the source code with 0DAY vulnerabilities in the legitimate code, generate adversarial samples containing "valid verification but vulnerabilities still exist" through GAN, and add them to the vulnerability detection dataset; According to the function and structure of the code, the dataset is divided into multiple levels, and the syntax features, execution path features, and inter-function relationship features of the code at each level are extracted; Use different dynamic analysis strategies and static analysis strategies for different levels of code, and analyze the corresponding dynamic analysis results and static analysis results; Based on the results of dynamic analysis and static analysis, as well as the grammatical features, execution path features, and inter-function relationship features of each level of code, the 0DAY vulnerability detection models of different levels of code are trained separately by combining the Transformer model and convolutional neural network algorithm.

[0024] Specifically, the non-system code functions in the dataset are replaced with kernel APIs through AST abstract syntax tree replacement technology, and simulated vulnerability patterns are inserted into legitimate code. Source code with 0DAY vulnerabilities in legitimate code is screened, and adversarial samples containing "valid verification but vulnerabilities still exist" are generated from the screened source code through GAN, and added to the vulnerability detection dataset. By adding adversarial samples to the vulnerability detection dataset, the AI ​​large model can learn more diverse vulnerability features during the training process, thereby enhancing the generalization ability of the model and enabling it to better adapt to vulnerability detection tasks in different scenarios.

[0025] Through the AST abstract syntax tree replacement technology, it is easy to quickly locate and replace non-system code functions in the data set, reducing the dependence on the original code and thus improving the efficiency of vulnerability detection.

[0026] Replacing non-system code functions with kernel APIs and inserting simulated vulnerability patterns into legitimate code facilitates simulating vulnerability scenarios that are closer to the real environment, which helps the AI ​​large model to learn and identify the characteristics of 0DAY vulnerabilities more accurately.

[0027] According to the function and structure of the code, the data set is divided into multiple levels, and the syntax features, execution path features, and inter-function relationship features of the code at each level are extracted; different dynamic analysis strategies and static analysis strategies are used for codes at different levels, and the corresponding dynamic analysis results and static analysis results are analyzed; Dataset layering helps break down complex code systems into more manageable parts. Each layer has its own specific scope and responsibilities, making it easier to locate and understand the code. By extracting syntax features, execution path features, and inter-function relationship features, it is easier to understand the behavior and logic of the code more comprehensively. Focusing on the runtime behavior of the code through dynamic analysis can reveal problems and performance bottlenecks in the actual execution of the code. Static analysis checks the syntax, semantics, and structure of the code without running the code, which helps to discover potential defects and security issues. Combining the two can achieve a comprehensive analysis of the code and improve the accuracy of the analysis.

[0028] Different analysis strategies are used for different levels of code to facilitate more targeted problem location and performance optimization. Through the combination of dynamic analysis and static analysis, vulnerabilities and defects in the code can be discovered and fixed in a timely manner, which helps to improve the overall quality and security of the code and reduce the risk of system crashes and data leaks.

[0029] Based on the results of dynamic analysis and static analysis, as well as the grammatical features, execution path features, and inter-function relationship features of each level of code, the 0DAY vulnerability detection models of different levels of code are trained separately by combining the Transformer model and convolutional neural network algorithm.

[0030] The Transformer model is good at handling global dependencies and long-distance dependencies, and has a stronger ability to capture complex logic and function call relationships in the code. It can effectively analyze the relationship characteristics between functions, thereby more accurately identifying potential 0DAY vulnerabilities. The CNN model performs well in local feature extraction, and is particularly suitable for extracting grammatical features and execution path features of the code. Through convolution operations, CNN can capture subtle changes in the code, which may be clues to 0DAY vulnerabilities.

[0031] The model is trained for different levels of code, so that the model can focus more on the code features of a specific level, thereby improving the generalization ability of the model. When new code appears, the model can adapt faster and detect vulnerabilities accurately. Combining dynamic analysis results with static analysis results and multiple features of the code for training, the model can learn a richer code representation. This representation method helps the model better understand and analyze the code and improve the accuracy of vulnerability detection.

[0032] The Transformer model has the ability to perform parallel computations and process information at multiple locations simultaneously, thereby speeding up training. This is particularly important for training large-scale code datasets. The CNN model efficiently extracts local features through convolution operations, reduces unnecessary computation, and improves training efficiency. By combining the outputs of the Transformer model and the CNN model, the complementarity between the models can be achieved, further improving the accuracy of vulnerability detection. During the training process, the model can be optimized and adjusted in a targeted manner according to the characteristics of different levels of code and the needs of vulnerability detection to improve the performance and accuracy of the model.

[0033] In one embodiment of the present invention, the non-system code functions in the data set are replaced with kernel APIs through AST abstract syntax tree replacement technology, and the simulated vulnerability pattern is inserted into the legitimate code, including the following steps: The source code is converted into a tree representation of the source code through the parser of the programming language; for example, Python's ast module converts the source code into AST, which is a tree representation of the source code; wherein, in the tree representation of the source code, each node represents a syntactic element, such as a variable, a function, a control structure, etc.

[0034] Traverse the tree representation of the source code, identify non-system functions based on function names, parameters, and return value features, identify non-system functions as function nodes that need to be replaced, and randomly select a number of non-system functions from them. Replace the non-system functions with non-system functions that have 0DAY vulnerabilities by randomly combining non-system functions, modifying input formats or contents, allowing more input conditions to trigger, and renaming variables, functions, and classes, and mark the vulnerability locations; identify non-system functions based on function names, parameters, and return value features, such as excluding function names that start with a specific prefix (such as "_").

[0035] Identify all non-system functions and their corresponding kernel APIs of function nodes that need to be replaced, and replace them with corresponding kernel API nodes. For example, replace a custom input validation function with a security API provided by the kernel. Convert the tree representation of the replaced source code back into executable code. Use existing tools, such as the astor library, to convert the modified AST back into executable code.

[0036] In this embodiment, the functions in non-system code, such as user-mode programs, are replaced with kernel APIs through AST abstract syntax tree replacement technology; for example, kmalloc→vmalloc.

[0037] In one embodiment of the present invention, screening source code for 0DAY vulnerabilities in legitimate code includes the following steps: Filter legitimate code that has vulnerabilities marked and source code that does not have 0DAY vulnerabilities marked; The vulnerability location of the code is converted into 0DAY vulnerability code by modifying the input format or content, allowing more input conditions to trigger, and renaming variables, functions, and classes, and 0DAY vulnerability is marked; Filter out the source code marked with 0DAY vulnerability.

[0038] In one embodiment of the present invention, the screened source code is used to generate an adversarial sample containing "valid verification but vulnerabilities still exist" through GAN, and added to the vulnerability detection dataset, including the following steps: For the source code marked with 0DAY vulnerabilities, insert the simulated vulnerability pattern at an appropriate location in the source code; Use the code with simulated vulnerability patterns inserted as the training set, and combine normal code and known vulnerability samples to form an adversarial training set; The GAN model generator is trained through the adversarial training set to create new samples that appear like real samples in front of the discriminator. The GAN model discriminator is trained to learn to distinguish between real samples and generated samples, and feedback is given to the generator to improve its output. Add the obtained new samples to the vulnerability detection dataset.

[0039] In one embodiment of the present invention, according to the function and structure of the code, the data set is divided into multiple levels, and the syntax features, execution path features and inter-function relationship features of the code of each level are extracted, including the following steps: According to the function and structure of the code, the vulnerability detection data set is divided into multiple layers, including: application layer, service layer, data access layer and system layer; the application layer is user interaction logic and input processing code, the service layer is API call and business logic processing, the data access layer is database operation and data transmission, and the system layer is system call and underlying implementation; For each level of code, syntactic features are extracted through AST, execution path features are extracted through CFG control flow graph, and relationship features between functions are extracted through Call Graph function call graph.

[0040] In one embodiment of the present invention, different dynamic analysis strategies and static analysis strategies are used for different levels of code, including the following steps: For the application layer code in the vulnerability detection dataset, the dynamic analysis strategy includes: Use the Selenium tool to simulate user interactions, test the application's response to various common inputs, and use the OWASP ZAP fuzz testing tool to attack the application and identify potential security vulnerabilities; Obtain error information and security vulnerability data of application layer code under simulated user behavior; Static analysis strategies for application layer code include: Check code quality through SonarQube static code analysis tool, identify security vulnerabilities in the code and annotate zero-day vulnerabilities; Generate reports, including code quality scores and security vulnerability lists; For the service layer code in the vulnerability detection dataset, the dynamic analysis strategy includes: Perform load testing and security testing through RESTful or SOAP APIs, as well as the return results of regular requests, and monitor service requests and responses in real time; Collect API response time, error rate, and security vulnerability information; The static analysis strategy for the service layer code includes: Verify the consistency between service interface definition and implementation, and check the quality of service layer code through static analysis tools; Generate interface contract consistency report and code quality assessment report; For the code of the data access layer in the vulnerability detection dataset, the dynamic analysis strategy includes: Detect transaction processing performance by simulating concurrent database query operations, and identify potential performance anomalies or SQL injections by monitoring SQL query execution plans and performance; Record database query performance indicators and SQL injection anomalies; The static analysis strategy for the access layer code includes: Detect potential injection risks in SQL query construction through static code analysis tools and check the configuration of ORM object-relational mapping; Generate SQL injection risk assessment report and ORM usage review report; For the system-level code in the vulnerability detection dataset, the dynamic analysis strategy includes: Monitor the usage of system-level resources in real time, obtain CPU, memory and disk I / O usage data, system performance indicators, and conduct comprehensive penetration testing on the system to identify system-level code vulnerabilities; Collect system performance data and vulnerability information discovered by penetration testing; System-level code, static analysis strategy, including: Perform source code audit on underlying system components and generate configuration review reports and source code audit reports.

[0041] In one embodiment of the present invention, analyzing the corresponding dynamic analysis results and static analysis results includes the following steps: For the application layer code in the vulnerability detection dataset, extract the error information of dynamic analysis and the error ratio and security vulnerability quantity data in the security vulnerability data; By calculating the dynamic analysis evaluation value V1 = a1*error ratio + a2*(security vulnerability quantity data / 100), a1 and a2 are corresponding weights, and the extracted data and the dynamic analysis evaluation value are taken together as the dynamic analysis result; Extract code quality scores and security vulnerability lists from static analysis results of application layer codes; By calculating the static analysis evaluation value E1 = b1*(the number of 0DAY vulnerabilities marked as security vulnerabilities / the total number of security vulnerabilities)+b2*[(100-code quality score) / 100], b1 and b2 are the corresponding weights, and the extracted data and the static analysis evaluation value are taken together as the static analysis result; For the service layer code in the vulnerability detection dataset, extract the API response time and error rate of dynamic analysis, as well as the number of security vulnerabilities and the number of 0DAY vulnerabilities annotated by security vulnerabilities; By calculating the dynamic analysis evaluation value V2 = a3*(API response time / 100+error rate)+a4*(number of 0DAY vulnerabilities marked as security vulnerabilities / total number of security vulnerabilities), a3 and a4 are corresponding weights, and the extracted data and dynamic analysis evaluation value are taken together as the dynamic analysis result; Extract the code quality score and security vulnerability list from the static analysis results of the service layer code; By calculating the static analysis evaluation value E2 = b3*(number of interface contract consistency standards / total number of interface contract tests)+b4*[(100-code quality score) / 100], b3 and b4 are corresponding weights, and the extracted data and static analysis evaluation value are taken together as the static analysis result; For the data access layer code in the vulnerability detection dataset, extract the database query response time and error rate for dynamic analysis, as well as the number of SQL injection anomalies; By calculating the dynamic analysis evaluation value V3 = a5*(database query response time / 100+error rate)+a6*(number of SQL injection anomalies / total number of security vulnerabilities), a5 and a6 are corresponding weights, and the extracted data and the dynamic analysis evaluation value are taken together as the dynamic analysis result; Extract the number of potential SQL injection points from the static analysis results of the data access layer code and the list of potential vulnerabilities in the ORM configuration; By calculating the static analysis evaluation value E3 = b5*(number of potential SQL injection points / 100)+b6*[number of potential vulnerabilities in ORM configuration / 100], b5 and b6 are corresponding weights, the extracted data and the static analysis evaluation value are taken together as the static analysis result; For the system-level code in the vulnerability detection dataset, extract the abnormal times of CPU, memory and disk I / O usage data for dynamic analysis and the vulnerability data detected by penetration testing; By calculating the dynamic analysis evaluation value V4 = a7* (the proportion of 0DAY vulnerabilities marked in the vulnerabilities detected by the penetration test) + a8* (the number of abnormal CPU, memory and disk I / O usage data / 100), a7 and a8 are the corresponding weights, and the extracted data and the dynamic analysis evaluation value are taken together as the dynamic analysis result; Extract the number of vulnerabilities and security risk factors of underlying system components from the static analysis results of system-level code, as well as the number of non-compliant codes in source code audits; By calculating the static analysis evaluation value E4=b7*(the percentage of non-compliant code in the source code audit)+b8*[the number of vulnerabilities in the underlying system components / the sum of the number of vulnerabilities in the underlying system components and the number of security risk factors], b7 and b8 are the corresponding weights, and the extracted data and the static analysis evaluation value are taken together as the static analysis results.

[0042] In one embodiment of the present invention, for different levels of code, the Transformer model and the convolutional neural network algorithm are combined to train the 0DAY vulnerability detection model of different levels of code respectively, including the following steps: Obtain the dynamic analysis results and static analysis results of code extraction in the vulnerability detection dataset, as well as the syntax features, execution path features, and inter-function relationship features of each level of code; Add a fusion input layer before the input layer of the Transformer model and the convolutional neural network model, and add an analysis output layer after the output layer of the Transformer model and the convolutional neural network model; The fusion input layer inputs the dynamic analysis results and static analysis results of the corresponding layers, as well as the syntax features of the code, into the Transformer model, and inputs the execution path features and inter-function relationship features into the convolutional neural network model; Analyze the output layer to obtain the output results of the Transformer model and the output results of the convolutional neural network model for weighted fusion to obtain the final 0DAY vulnerability detection results; For codes at different levels, the vulnerability detection dataset is concentrated, the extracted data is input into the fusion input layer for model training, and the 0DAY vulnerability detection model of codes at different levels is obtained to detect 0DAY vulnerabilities in the code. Example 2

[0043] See also Figure 2 According to an embodiment of the present application, a 0DAY vulnerability detection model construction device based on an AI large model is also provided, including: Dataset generation module: collects normal running codes of various functions and implementations from open source projects, obtains known vulnerability instances and their contexts through public vulnerability databases, annotates the vulnerability locations, and forms a vulnerability detection dataset with normal running codes; Dataset expansion module: Use AST abstract syntax tree replacement technology to replace non-system code functions in the dataset with kernel APIs, and insert simulated vulnerability patterns into legitimate code; filter source code with 0DAY vulnerabilities in legitimate code, and generate adversarial samples containing "valid verification but vulnerabilities still exist" through GAN from the filtered source code, and add them to the vulnerability detection dataset; Data analysis module: divides the data set into multiple levels according to the function and structure of the code, and extracts the syntax features, execution path features, and inter-function relationship features of the code at each level; adopts different dynamic analysis strategies and static analysis strategies for codes at different levels, and analyzes the corresponding dynamic analysis results and static analysis results; Vulnerability detection model building module: Based on the dynamic analysis results and static analysis results, as well as the syntax features, execution path features, and inter-function relationship features of each level of code, the Transformer model and convolutional neural network algorithm are combined to train 0DAY vulnerability detection models for different levels of code. Example 3

[0044] According to an embodiment of the present application, a computing device is also provided, including: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the above-mentioned method for constructing a 0DAY vulnerability detection model based on an AI large model are implemented.

[0045] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A method for constructing a 0DAY vulnerability detection model based on an AI big model, characterized in that: The following steps are involved: Collect normal running codes of various functions and implementations from open source projects, obtain known vulnerability instances and their contexts through public vulnerability databases, annotate the vulnerability locations, and form a vulnerability detection dataset with normal running codes; Through AST abstract syntax tree replacement technology, non-system code functions in the dataset are replaced with kernel APIs, and simulated vulnerability patterns are inserted into legitimate code; Filter the source code with 0DAY vulnerabilities in the legitimate code, generate adversarial samples containing "valid verification but vulnerabilities still exist" through GAN, and add them to the vulnerability detection dataset; According to the function and structure of the code, the data set is divided into multiple levels, and the syntax features, execution path features, and inter-function relationship features of the code at each level are extracted; Use different dynamic analysis strategies and static analysis strategies for different levels of code, and analyze the corresponding dynamic analysis results and static analysis results; Based on the results of dynamic analysis and static analysis, as well as the grammatical features, execution path features, and inter-function relationship features of each level of code, the 0DAY vulnerability detection models of different levels of code are trained separately by combining the Transformer model and convolutional neural network algorithm.

2. According to the method for constructing a 0DAY vulnerability detection model based on an AI large model according to claim 1, it is characterized in that: Through the AST abstract syntax tree replacement technology, the non-system code functions in the dataset are replaced with kernel APIs, and the simulated vulnerability patterns are inserted into the legitimate code, including the following steps: The source code is converted into a tree representation of the source code by a parser of the programming language; in the tree representation of the source code, each node represents a syntax element; Traverse the tree representation of the source code, identify non-system functions according to the function name, parameter and return value characteristics, identify the non-system functions as function nodes that need to be replaced, and randomly select a number of non-system functions from them. Replace the non-system functions with non-system functions with 0DAY vulnerabilities by randomly combining the non-system functions, modifying the input format or content, allowing more input conditions to trigger, and renaming variables, functions and classes, and mark the vulnerability locations; Determine all non-system functions of function nodes that need to be replaced and their corresponding kernel APIs, and replace them with corresponding kernel API nodes; The tree representation of the replaced source code is converted back into executable code.

3. According to the method for constructing a 0DAY vulnerability detection model based on an AI large model according to claim 1, it is characterized in that: Screening legitimate code for source code with 0DAY vulnerabilities includes the following steps: Filter legitimate code that has vulnerabilities marked and source code that does not have 0DAY vulnerabilities marked; The vulnerability location of the code is converted into 0DAY vulnerability code by modifying the input format or content, allowing more input conditions to trigger, and renaming variables, functions, and classes, and 0DAY vulnerability is marked; Filter out the source code marked with 0DAY vulnerability.

4. According to the method for constructing a 0DAY vulnerability detection model based on an AI big model according to claim 1, it is characterized in that: The screened source code is used to generate adversarial samples containing "valid verification but vulnerabilities still exist" through GAN, and added to the vulnerability detection dataset, including the following steps: For the source code marked with 0DAY vulnerabilities, insert the simulated vulnerability pattern at an appropriate location in the source code; Use the code with simulated vulnerability patterns inserted as the training set, and combine normal code and known vulnerability samples to form an adversarial training set; The GAN model generator is trained through the adversarial training set to create new samples that appear like real samples in front of the discriminator. The GAN model discriminator is trained to learn to distinguish between real samples and generated samples, and feedback is given to the generator to improve its output. Add the obtained new samples to the vulnerability detection dataset.

5. According to the method for constructing a 0DAY vulnerability detection model based on an AI big model according to claim 1, it is characterized in that: According to the function and structure of the code, the dataset is divided into multiple levels, and the syntax features, execution path features, and inter-function relationship features of the code at each level are extracted, including the following steps: According to the function and structure of the code, the vulnerability detection data set is divided into multiple layers, including: application layer, service layer, data access layer and system layer; the application layer is user interaction logic and input processing code, the service layer is API call and business logic processing, the data access layer is database operation and data transmission, and the system layer is system call and underlying implementation; For each level of code, syntactic features are extracted through AST, execution path features are extracted through CFG control flow graph, and relationship features between functions are extracted through Call Graph function call graph.

6. According to the method for constructing a 0DAY vulnerability detection model based on an AI big model according to claim 1, it is characterized in that: Different dynamic analysis strategies and static analysis strategies are used for different levels of code, including the following steps: For the application layer code in the vulnerability detection dataset, the dynamic analysis strategy includes: Use the Selenium tool to simulate user interactions, test the application's response to various common inputs, and use the OWASP ZAP fuzz testing tool to attack the application and identify potential security vulnerabilities; Obtain error information and security vulnerability data of application layer code under simulated user behavior; Static analysis strategies for application layer code include: Check code quality through SonarQube static code analysis tool, identify security vulnerabilities in the code and annotate zero-day vulnerabilities; Generate reports, including code quality scores and security vulnerability lists; For the service layer code in the vulnerability detection dataset, the dynamic analysis strategy includes: Perform load testing and security testing through RESTful or SOAP APIs, as well as the return results of regular requests, and monitor service requests and responses in real time; Collect API response time, error rate, and security vulnerability information; The static analysis strategy for the service layer code includes: Verify the consistency between service interface definition and implementation, and check the quality of service layer code through static analysis tools; Generate interface contract consistency report and code quality assessment report; For the code of the data access layer in the vulnerability detection dataset, the dynamic analysis strategy includes: Detect transaction processing performance by simulating concurrent database query operations, and identify potential performance anomalies or SQL injections by monitoring SQL query execution plans and performance; Record database query performance indicators and SQL injection anomalies; The static analysis strategy for the access layer code includes: Detect potential injection risks in SQL query construction through static code analysis tools and check the configuration of ORM object-relational mapping; Generate SQL injection risk assessment report and ORM usage review report; For the system-level code in the vulnerability detection dataset, the dynamic analysis strategy includes: Monitor the usage of system-level resources in real time, obtain CPU, memory and disk I / O usage data, system performance indicators, and conduct comprehensive penetration testing on the system to identify system-level code vulnerabilities; Collect system performance data and vulnerability information discovered by penetration testing; System-level code, static analysis strategy, including: Perform source code audit on underlying system components and generate configuration review reports and source code audit reports.

7. According to claim 6, a method for constructing a 0DAY vulnerability detection model based on an AI large model is characterized in that: Analyzing the corresponding dynamic analysis results and static analysis results includes the following steps: For the application layer code in the vulnerability detection dataset, extract the error information of dynamic analysis and the error ratio and security vulnerability quantity data in the security vulnerability data; By calculating the dynamic analysis evaluation value V1 = a1*error ratio + a2*(security vulnerability quantity data / 100), a1 and a2 are corresponding weights, and the extracted data and the dynamic analysis evaluation value are taken together as the dynamic analysis result; Extract code quality scores and security vulnerability lists from static analysis results of application layer codes; By calculating the static analysis evaluation value E1 = b1*(the number of 0DAY vulnerabilities marked as security vulnerabilities / the total number of security vulnerabilities)+b2*[(100-code quality score) / 100], b1 and b2 are the corresponding weights, and the extracted data and the static analysis evaluation value are taken together as the static analysis result; For the service layer code in the vulnerability detection dataset, extract the API response time and error rate of dynamic analysis, as well as the number of security vulnerabilities and the number of 0DAY vulnerabilities annotated by security vulnerabilities; By calculating the dynamic analysis evaluation value V2 = a3*(API response time / 100+error rate)+a4*(number of 0DAY vulnerabilities marked as security vulnerabilities / total number of security vulnerabilities), a3 and a4 are corresponding weights, and the extracted data and dynamic analysis evaluation value are taken together as the dynamic analysis result; Extract the code quality score and security vulnerability list from the static analysis results of the service layer code; By calculating the static analysis evaluation value E2 = b3*(number of interface contract consistency standards / total number of interface contract tests)+b4*[(100-code quality score) / 100], b3 and b4 are corresponding weights, and the extracted data and static analysis evaluation value are taken together as the static analysis result; For the data access layer code in the vulnerability detection dataset, extract the database query response time and error rate for dynamic analysis, as well as the number of SQL injection anomalies; By calculating the dynamic analysis evaluation value V3 = a5*(database query response time / 100+error rate)+a6*(number of SQL injection anomalies / total number of security vulnerabilities), a5 and a6 are corresponding weights, and the extracted data and the dynamic analysis evaluation value are taken together as the dynamic analysis result; Extract the number of potential SQL injection points from the static analysis results of the data access layer code and the list of potential vulnerabilities in the ORM configuration; By calculating the static analysis evaluation value E3 = b5*(number of potential SQL injection points / 100)+b6*[number of potential vulnerabilities in ORM configuration / 100], b5 and b6 are corresponding weights, the extracted data and the static analysis evaluation value are taken together as the static analysis result; For the system-level code in the vulnerability detection dataset, extract the abnormal times of CPU, memory and disk I / O usage data for dynamic analysis and the vulnerability data detected by penetration testing; By calculating the dynamic analysis evaluation value V4 = a7* (the proportion of 0DAY vulnerabilities marked in the vulnerabilities detected by the penetration test) + a8* (the number of abnormal CPU, memory and disk I / O usage data / 100), a7 and a8 are the corresponding weights, and the extracted data and the dynamic analysis evaluation value are taken together as the dynamic analysis result; Extract the number of vulnerabilities and security risk factors of underlying system components from the static analysis results of system-level code, as well as the number of non-compliant codes in source code audits; By calculating the static analysis evaluation value E4=b7*(the percentage of non-compliant code in the source code audit)+b8*[the number of vulnerabilities in the underlying system components / the sum of the number of vulnerabilities in the underlying system components and the number of security risk factors], b7 and b8 are the corresponding weights, and the extracted data and the static analysis evaluation value are taken together as the static analysis results.

8. According to the method for constructing a 0DAY vulnerability detection model based on an AI big model according to claim 1, it is characterized in that: For different levels of code, the Transformer model and convolutional neural network algorithm are combined to train the 0DAY vulnerability detection model for different levels of code, including the following steps: Obtain the dynamic analysis results and static analysis results of code extraction in the vulnerability detection dataset, as well as the syntax features, execution path features, and inter-function relationship features of each level of code; Add a fusion input layer before the input layer of the Transformer model and the convolutional neural network model, and add an analysis output layer after the output layer of the Transformer model and the convolutional neural network model; The fusion input layer inputs the dynamic analysis results and static analysis results of the corresponding layers, as well as the syntax features of the code, into the Transformer model, and inputs the execution path features and inter-function relationship features into the convolutional neural network model; Analyze the output layer to obtain the output results of the Transformer model and the output results of the convolutional neural network model for weighted fusion to obtain the final 0DAY vulnerability detection results; For codes at different levels, the vulnerability detection dataset is concentrated, the extracted data is input into the fusion input layer for model training, and the 0DAY vulnerability detection model of codes at different levels is obtained to detect 0DAY vulnerabilities in the code.

9. A 0DAY vulnerability detection model construction device based on AI big model, characterized in that: include: Dataset generation module: collects normal running codes of various functions and implementations from open source projects, obtains known vulnerability instances and their contexts through public vulnerability databases, annotates the vulnerability locations, and forms a vulnerability detection dataset with normal running codes; Dataset expansion module: Use AST abstract syntax tree replacement technology to replace non-system code functions in the dataset with kernel APIs, and insert simulated vulnerability patterns into legitimate code; filter source code with 0DAY vulnerabilities in legitimate code, and generate adversarial samples containing "valid verification but vulnerabilities still exist" through GAN from the filtered source code, and add them to the vulnerability detection dataset; Data analysis module: divides the data set into multiple levels according to the function and structure of the code, and extracts the syntax features, execution path features, and inter-function relationship features of the code at each level; Use different dynamic analysis strategies and static analysis strategies for different levels of code, and analyze the corresponding dynamic analysis results and static analysis results; Vulnerability detection model building module: Based on the dynamic analysis results and static analysis results, as well as the syntax features, execution path features, and inter-function relationship features of each level of code, the Transformer model and convolutional neural network algorithm are combined to train 0DAY vulnerability detection models for different levels of code.

10. A computing device comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of a method for constructing a 0DAY vulnerability detection model based on an AI large model as described in any one of claims 1 to 8 are implemented.

Images