PHP taint type vulnerability detection method based on heterogeneous graph neural network

Abstract

The invention discloses a PHP taint type vulnerability detection method based on a heterogeneous graph neural network, and belongs to the field of software security. The method comprises the following steps: performing annotation removal, variable naming standardization and character string standardization processing on a PHP source code through a code preprocessing module to generate a standardized code; based on a vulnerability sub-attribute graph extraction module, reversely tracking vulnerability sinks to a taint source, extracting a simplified vulnerability sub-attribute graph, and removing redundant nodes and edges; fusing BERT semantic features and node type features through a graph node embedding module to generate an initial embedding vector, and constructing a heterogeneous graph comprising an abstract syntax tree edge, a program flow graph edge and a control dependence graph edge; a heterogeneous graph neural network vulnerability detection module is adopted to perform independent feature aggregation on multiple types of edges, dynamic weighted fusion is performed in combination with an attention mechanism, and key nodes are screened through Top-k graph pooling; and finally, inputting the graph-level features into a classifier to realize vulnerability detection.

Description

Technical Field

[0001] The present invention belongs to the field of software security, and particularly relates to a PHP taint-type vulnerability detection method based on heterogeneous graph neural network. Background Art

[0002] PHP is a general-purpose scripting language for web development. Currently, PHP still dominates the market of web server-side programming languages. Its free and easy-to-expand features enable PHP-based projects to be quickly launched and iterated. However, from a security perspective, the design of this language has defects: lack of built-in security functions, unsound exception handling mechanisms, and functions with different function naming and parameter designs. In addition, PHP applications are usually deployed on web servers, directly responding to user interactions and requests, such as user clicks and inputs. Taint-type vulnerabilities are vulnerabilities caused when user input reaches critical functions without sufficient cleaning. The design defects of PHP and its characteristics of interacting with users make such vulnerabilities prone to occur. Attackers can use taint-type vulnerabilities to tamper with page content, implement phishing attacks, and damage server integrity, posing a serious threat to the information security and property security of users.

[0003] Traditional PHP taint - type vulnerability detection tools mainly rely on static analysis to locate potential risks in code, reducing manual analysis by experts to improve detection efficiency. Although traditional methods show high efficiency in large - scale code analysis, due to relying on rules predefined by experts, these methods still have certain limitations in practical applications and are prone to false positives and false negatives. In contrast, the static taint analysis method based on code property graphs can analyze code more precisely. However, when performing large - scale analysis, it still relies on rules formulated by experts to traverse the graph, which makes it insufficient in terms of automation and scalability. With the development of artificial intelligence, machine learning and deep learning technologies have been gradually applied to the field of software vulnerability detection. Data mining methods have improved the detection accuracy and reduced false positives by introducing machine learning models. However, the detection effect of these methods depends to a large extent on the relevance between the extracted features and taint - type vulnerabilities. NLP - based methods convert source code into a custom token sequence and automatically extract features through natural language models to classify whether the code has vulnerabilities. However, this method does not fully consider the structural characteristics of PHP code, resulting in a large loss of important semantic information in code representation. In contrast, graph neural networks can effectively capture and learn important semantic features from the graph structure of source code. However, since the proportion of statements related to vulnerabilities in functions is relatively small and there is a large amount of information unrelated to vulnerability patterns in the composite graph, this will hinder the accurate learning of vulnerability patterns. Therefore, existing deep - learning methods fail to analyze in combination with the characteristics of taint - type vulnerabilities, indicating that when dealing with complex code patterns, these methods are difficult to effectively capture the key path features of taint propagation in data flow and control flow, affecting the detection accuracy. Summary of the Invention

[0004] The object of the present invention is to develop a detection method applicable to large - scale PHP taint - type vulnerabilities. This method can deeply analyze and utilize the characteristics of taint - type vulnerabilities, only retaining the semantic and structural information related to taint - type vulnerabilities in the code property graph, thereby reducing the complexity of the code property graph. At the same time, this method can independently learn the structural information, control information, and dependency information carried by different types of edges, and weighted aggregate various edge information through an attention mechanism, thereby enhancing the model's ability to identify vulnerabilities and improving the classification performance.

[0005] To achieve the above object, the technical solution adopted by the present invention is a PHP taint - type vulnerability detection method based on heterogeneous graph neural networks, including a code pre - processing module, a code property graph construction module, a vulnerability sub - property graph extraction module, a graph node embedding module, and a heterogeneous graph neural network vulnerability detection module.

[0006] The PHP taint - type vulnerability detection method based on heterogeneous graph neural networks includes the following steps:

[0007] Step 1: Input the PHP source code into the code preprocessing module. Perform operations such as comment removal, variable naming standardization, and string standardization to generate standardized code. The preprocessing module ensures the correctness of code parsing through syntax checking and eliminates the interference of coding style differences on detection.

[0008] Step 2: Input the preprocessed code into the code property graph construction module to generate a multi-level graph structure code property graph CPG that integrates the abstract syntax tree AST, control flow graph CFG, and program dependence graph PDG, capturing the syntax, control flow, and dependence information of the code, including data dependence information and control dependence information.

[0009] Step 3: Input the code property graph CPG into the vulnerability sub-property graph extraction module. Based on the principle of taint analysis, traverse backward from the vulnerability sink point to the taint source in the CPG to extract the vulnerability sub-property graph SPG. By removing redundant nodes and edges and retaining the key code elements related to the taint propagation path, the graph complexity is reduced.

[0010] Step 4: Input the sub-property graph SPG into the graph node embedding module to extract the code semantic features and type features of the nodes in the SPG and generate a heterogeneous graph. The semantic features are obtained through a pre-trained BERT model, and the type features are represented by One-Hot encoding. After fusion, an initial embedding vector of the node is formed.

[0011] Step 5: Input the heterogeneous graph into the heterogeneous graph neural network vulnerability detection module. In the heterogeneous graph neural network HGNN model in the module, through the independent feature aggregation and attention mechanism weighted fusion of multi-type edges AST, CFG, PDG, combined with the Top-k graph pooling layer to screen key nodes, enhancing the focusing ability on vulnerability features. Use mean pooling for the screened key nodes to generate a graph-level feature vector. Finally, input the graph-level feature vector into a fully connected classifier to output the vulnerability detection result, and optimize the model parameters through the cross-entropy loss function to achieve accurate classification of PHP taint-type vulnerabilities.

[0012] A further technical solution of the present invention is that Step 3 is specifically as follows:

[0013] Step 3.1: Identify sensitive function nodes related to vulnerabilities in the CPG (such as exit, shell_exec) as the initial sink points of the SPG.

[0014] Step 3.2: Traverse backward along the AST from the sink point to extract syntax-dependent nodes (such as variable assignment, function call) to generate a syntax sub-graph.

[0015] Step 3.3: Based on the forward traversal of the CFG, capture the statement nodes related to taint propagation in the control flow path to generate a control flow sub-graph.

[0016] Step 3.4: Integrate the data dependence edges and control dependence edges of the PDG to construct a complete taint propagation path;

[0017] Step 3.5: Merge the syntax subgraph, control flow subgraph and dependence edges to generate a refined SPG, and retain the key context of the vulnerability.

[0018] A further technical solution of the present invention is that step 4 is specifically as follows:

[0019] Step 4.1: Use the pre-trained BERT model to perform lexical analysis on the SPG nodes, extract the code semantic feature vectors, and capture the context dependence relationship;

[0020] Step 4.2: Use One-Hot encoding to represent the node types (such as AST_ASSIGN, CFG_FUNC_ENTRY) to generate type feature vectors;

[0021] Step 4.3: Concatenate the semantic feature vectors and type feature vectors, and map them to a unified embedding space through linear transformation to generate the initial node embedding vectors;

[0022] Step 4.4: Construct a heterogeneous graph structure according to the AST edges, CFG edges, and PDG edges, define three types of edge types and allocate independent adjacency matrices to form heterogeneous data that can be input into the HGNN.

[0023] A further technical solution of the present invention is that step 5 is specifically as follows:

[0024] Step 5.1: Perform type-specific message passing on the AST edges, CFG edges, and PDG edges respectively, and aggregate the neighbor node information through the heterogeneous graph neural network;

[0025] Step 5.2: Introduce a cross-edge type attention mechanism, calculate the weights of different edge types, and dynamically adjust the information fusion ratio;

[0026] Step 5.3: Adopt a Top-k graph pooling layer to screen the key subgraphs based on the node importance scores, compress the graph scale and retain the vulnerability-sensitive features;

[0027] Step 5.4: Generate a global graph-level representation vector by mean pooling the multi-layer graph features for the final classification.

[0028] Step 5.5: Input the graph-level feature vector into the fully connected layer and map it to the binary classification space;

[0029] Step 5.6: Use the softmax function to calculate the vulnerability probability and output the detection result;

[0030] Step 5.7: Optimize the model parameters based on the cross-entropy loss function, and update the weights in combination with the gradient descent algorithm to improve the detection accuracy and generalization ability.

[0031] Due to the above technical solution, the technical effects achieved by the present invention are as follows:

[0032] This application proposes a method for reducing and modeling a code property graph based on a vulnerability sub-property graph. By reverse-tracking the taint source to the vulnerability sink, redundant nodes and edges in the code property graph are removed, and only the key code elements closely related to the taint propagation path are retained. The SPG significantly reduces the complexity of the graph structure, reduces the interference of irrelevant information on the model, and solves the problems of low detection efficiency and high false positive rate caused by redundant information in traditional CPG methods.

[0033] This application designs a node embedding method that fuses semantic and structural information. By combining the deep semantic features of the pre-trained BERT model and the node type features of One-Hot encoding, a unified high-dimensional embedding vector is generated through linear transformation. This method fully integrates the text semantics and syntactic structure information of the code, and solves the problem that traditional embedding methods (such as Node2Vec and Word2Vec) only rely on single features, resulting in insufficient vulnerability representation.

[0034] This application constructs a multi-modal vulnerability detection model based on a heterogeneous graph neural network (HGNN). By independently modeling the feature propagation paths of three types of edges, namely AST, CFG, and PDG, and introducing a cross-edge type attention mechanism to dynamically adjust the information aggregation weights, the HGNN can accurately capture the interaction relationships of control dependencies, data flows, and syntactic structures in the code. Compared with homogeneous graph models (such as GCN and GAT), this model solves the problem of key feature loss caused by edge type confusion in traditional methods. Brief Description of the Drawings

[0035] Figure 1 is the overall structural schematic diagram of the PHP taint-type vulnerability detection method based on the heterogeneous graph neural network of the present invention;

[0036] Figure 2 is the source code example diagram of the PHP taint-type vulnerability concerned by the present invention;

[0037] Figure 3 is Figure 2 the schematic diagram of the code property graph constructed from the source code in;

[0038] Figure 4 is the schematic diagram of the sub-property graph construction method proposed by the present invention. Detailed Description of the Invention

[0039] Next, in combination with the accompanying drawings in the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention.

[0040] To make the above objects, features, and advantages of the present invention more obvious and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0041] A PHP taint-type vulnerability detection method based on a heterogeneous graph neural network, as Figure 1 shown, specifically includes the following steps:

[0042] Step 1: Input the PHP source code into the code preprocessing module, perform comment removal, variable naming standardization, and string standardization processing to generate standardized code. The preprocessing module ensures the correctness of code parsing through syntax checking and eliminates the interference of coding style differences on detection.

[0043] Step 2: Input the preprocessed code into the code property graph construction module to generate a multi-level graph structure code property graph CPG that integrates the abstract syntax tree AST, control flow graph CFG, and program dependence graph PDG, capturing the syntax, control flow, and dependence information of the code, including data dependence information and control dependence information.

[0044] Step 3: Input the code property graph CPG into the vulnerability sub-property graph extraction module. Based on the principle of taint analysis, traverse the vulnerability sink backwards to the taint source in the CPG, extract the vulnerability sub-property graph SPG, and reduce the graph complexity by removing redundant nodes and edges and retaining the key code elements related to the taint propagation path.

[0045] Step 3.1: Identify sensitive function nodes related to vulnerabilities in the CPG (such as exit, shell_exec) as the initial sink of the SPG.

[0046] Step 3.2: Traverse backwards along the AST from the sink to extract syntax-dependent nodes (such as variable assignments, function calls) to generate a syntax sub-graph.

[0047] Step 3.3: Based on the forward traversal of the CFG, capture the statement nodes related to taint propagation in the control flow path to generate a control flow sub-graph.

[0048] Step 3.4: Integrate the data dependence edges and control dependence edges of the PDG to construct a complete taint propagation path.

[0049] Step 3.5: Merge the syntax subgraph, control flow subgraph, and dependency edges to generate a streamlined SPG, and retain the key context of the vulnerability.

[0050] Step 4: Input the sub-property graph SPG into the graph node embedding module to extract the code semantic features and type features of the nodes in the SPG, and generate a heterogeneous graph. The semantic features are obtained through a pre-trained BERT model, and the type features are represented by one-hot encoding. After fusion, an initial node embedding vector is formed:

[0051] Step 4.1: Use the pre-trained BERT model to perform lexical analysis on the SPG nodes, extract the code semantic feature vectors, and capture the context dependencies;

[0052] Step 4.2: Represent the node types (such as AST_ASSIGN, CFG_FUNC_ENTRY) using one-hot encoding to generate type feature vectors;

[0053] Step 4.3: Concatenate the semantic feature vectors and type feature vectors, and map them to a unified embedding space through linear transformation to generate the initial node embedding vectors;

[0054] Step 4.4: Construct a heterogeneous graph structure based on AST edges, CFG edges, and PDG edges, define three types of edge types, and assign independent adjacency matrices to form heterogeneous data that can be input into HGNN.

[0055] Step 5: Input the heterogeneous graph into the heterogeneous graph neural network vulnerability detection module. In the module, the heterogeneous graph neural network HGNN model aggregates the independent features of multiple types of edges AST, CFG, and PDG through weighted fusion with the attention mechanism, combines the Top-k graph pooling layer to screen key nodes, and enhances the focusing ability on vulnerability features. Mean pooling is used for the selected key nodes to generate a graph-level feature vector. Finally, the graph-level feature vector is input into a fully connected classifier to output the vulnerability detection result, and the model parameters are optimized through the cross-entropy loss function to achieve accurate classification of PHP taint-type vulnerabilities:

[0056] Step 5.1: Perform type-specific message passing on AST edges, CFG edges, and PDG edges respectively, and aggregate the neighbor node information through the heterogeneous graph neural network;

[0057] Step 5.2: Introduce a cross-edge type attention mechanism to calculate the weights of different edge types and dynamically adjust the information fusion ratio;

[0058] Step 5.3: Use the Top-k graph pooling layer to screen the key subgraphs based on the node importance scores, compress the graph scale, and retain the vulnerability-sensitive features;

[0059] Step 5.4: Generate a global graph-level representation vector through mean pooling of multi-layer graph features for final classification.

[0060] Step 5.5: Input the graph-level feature vector into the fully connected layer and map it to the binary classification space;

[0061] Step 5.6: Use the softmax function to calculate the vulnerability probability and output the detection result;

[0062] Step 5.7: Optimize the model parameters based on the cross-entropy loss function, update the weights in combination with the gradient descent algorithm, and improve the detection accuracy and generalization ability.

[0063] The following combines Figure 1 to illustrate the code preprocessing module used in step 2 of the present invention:

[0064] As Figure 1 shown in the code preprocessing, before modeling the source code, the present invention processes the source code text. First, delete the comments in the text, remove unnecessary comments and blank lines, and unify the indentation style, because the existence of vulnerabilities is not affected by these markers. Then replace user-defined functions and variables with common identifiers (such as VAR0, FUN0), but retain all PHP built-in functions (such as query, exec, echo), which are related to the vulnerabilities under study and are usually taint sources or sinks. Since the echo function in PHP supports multiple forms, in order to unify the form after modeling as much as possible, the output strings of all echo functions also need to be converted to a fixed concatenation format (as shown in the third line of the example). Finally, replace all printable strings and fixed-format concatenated strings with null values, but at the same time retain all escape characters in the strings, because in many cases, the use of double quotes and single quotes is crucial for triggering potential security vulnerabilities.

[0065] The following combines Figure 2 and Figure 3 to illustrate the code property graph construction module used in step 2 of the present invention:

[0066] The code property graph (CPG) is a comprehensive representation constructed based on the abstract syntax tree (AST), control flow graph (CFG), and program dependence graph (PDG). It combines the syntax structure, control flow information, and data dependence relationships of the code, providing a complete understanding of the code semantics for vulnerability analysis. The present invention uses php-ast to parse the PHP source code ( Figure 2 shown), and also uses the phpjoern tool to construct the AST ( Figure 3 shown by the black arrows), and all nodes in the subsequent generated graph are derived from the AST. Subsequently, the TChecker tool is used to generate the CFG and PDG. The combination of AST, CFG, and PDG forms the CPG ( Figure 3 shown by the colored arrows).

[0067] The following combines Figure 2 , 3 , and 4 to illustrate the vulnerability sub-property graph extraction module used in the present invention:

[0068] For example, Figure 2 In the PHP taint-type vulnerability example graph, the vulnerability appears on line 5 of the code: The user input in $tainted["t"] is not properly filtered before being output by the exit function. Therefore, an attacker can construct specific input content to inject malicious scripts into the page and induce the victim to perform operations controlled by the attacker. It can be found from the example that taint-type vulnerabilities have common characteristics: The root cause of the vulnerability often lies in the fact that the input data is not fully verified or filtered, resulting in malicious data being able to enter through the input end of the program and being further transmitted, flowing to sensitive functions, and ultimately causing abnormal program behavior or unauthorized operations.

[0069] Figure 3 Shows Figure 2 the code property graph of the PHP source code in. In the AST, <?php?>(where <?php is the start tag and?> is the end tag) is regarded as the top-level function and serves as the root node of the entire AST tree. Each statement in the code is parsed into sub-nodes of the AST and organized according to the hierarchical structure of the syntax. For example, a variable assignment statement is modeled as an ASSIGN node (represented by = in the figure), a function call is mapped to a CALL node, and a conditional judgment corresponds to an IF node. Most of the execution paths in the CFG are linear, and the only branches are generated by IF statements. The control flow finally converges to the exit node, clearly describing the execution path of the code. The program dependence graph PDG combines data dependence and control dependence information. Data dependence edges are used to trace the definition and use relationships of variables, while control dependence edges depict the execution constraints between different statements in the program. The PDG can more comprehensively capture the data flow and control flow inside the program and provide an accurate variable propagation path model for taint analysis.

[0070] Figure 4 Shows the SPG generation process. The SPG is a sub-graph extracted from the CPG, and the definition of the SPG is as follows: SPG = {Node, E ast , E cfg , E pdg} where Node is the node in the sub-graph, and E ast , E cfg , E pdg are the edges in three different types of graphs, namely AST, CFG, and PDG, respectively. The SPG generation process is divided into three steps:

[0071] 1) Traverse all nodes in AST and match them with the convergence points of taint vulnerabilities to obtain the nodes N of all sensitive functions sink ∈S sink It is worth mentioning that there may be multiple N sink , which is normal, will be for each N sink SPG is established. For each N sink First perform forward traversal and find N sink AST root node A of the statement N , traverse A backward N , all traversed nodes N i Add to set N, which includes N sink . All edges A used during traversal E Add them to set E ast .

[0072] 2) A obtained in step 1) N As a starting point, forward traverse on CFG, so that a set of AST root nodes S is obtained new and a set of edges C E . E Add to E cfg . Then traverse each A backward along the AST new ∈S new , all traversed nodes N i Add to set N. For each A new ∈S new As the starting point of step 2) recursively execute until there is a tainted source node N source ∈N, stop the recursion.

[0073] 3) All data dependency edges P in PDG d and control dependency edge P c Add to SPG, that is

[0074] Finally, the union of all structural information and dependency sets in the program constitutes the proposed SPG.

[0075] The following combination Figure 1 The graph node embedding module used in the present invention is described as follows:

[0076] like Figure 1 As shown in the graph node embedding, in order to effectively embed the semantics and type information of the nodes in SPG, the present invention generates the initial embedding vector v of the node i .

[0077] First, for N iPerform lexical analysis on the code statements in ∈N, and use the pre-trained Bert model to generate vectors of lexical tokens Thus, the semantic information of the nodes can be obtained. For the type information of the nodes, the One-Hot encoding method is used to represent the type of each node, and the type feature vector is obtained Due to the semantic feature vector and the type feature vector are in different semantic spaces, that is, their meanings and scopes are different, and they cannot be directly added or concatenated. Therefore, these two vectors are concatenated together and input into the linear layer, and finally the initial embedding vector of the node is obtained, as follows: Among them, W l and b l are parameters that can be learned in the linear layer, v i is the initial embedding vector of the node, and || represents the concatenation operation. It is used to input the graph g SPG ={V, E, T V , T E} is defined as a heterogeneous graph with labeled edges, where V represents the set of nodes, E represents the set of edges, T V is the set of node types, and T E is the set of edge types. Each node N i ∈N in the SPG corresponds to an initial embedding vector v i ∈V. The node type T SPG of g V has only one v. For each edge e SPG ∈E in g j , a type T j ∈T E is assigned at the beginning of its construction. The edge type T SPG of g V contains three types, namely E ast representing the code structure, E cfg representing the control relationship, and E pdg representing the dependency relationship.

[0078] Next, the heterogeneous graph neural network vulnerability detection module used in the present invention will be described in conjunction with Figure 1 :

[0079] As Figure 1 shown in the detection model, the present invention uses HGNN to perform representation learning on g SPG (V, E, T V , T E ) to learn the hidden state of each node in each layer. In g SPGAmong them, V has only one type, but E has three types. Node v needs to perform message aggregation with the neighbors of each type of edge separately. Its message aggregation formula can be expressed as: Where N v (e) represents the adjacent node of node v that is connected and of type t, and h u (l) is the vector representation of node u at the l-th layer, and α vu is the attention weight of neighbor node u to node v, and this weight is calculated by the following formula: Where W is the projection matrix, α is the attention vector, and ∥ represents the vector concatenation operation. The same node performs message aggregation with the neighbors of three types of edges respectively to generate three vectors. By introducing a new attention mechanism layer, the aggregated information generated by each type of edge is combined into a final node representation. The final aggregation formula is as follows: Where is the i-th vector generated by node v in the l-th layer, and h v (l + 1) is the hidden state of node v at the l + 1-th layer, and W a is the weight matrix for learning the final aggregated representation, and σ is the non-linear activation function ReLU.

[0080] The present invention uses the Top-k pooling model as the graph pooling layer to learn the hierarchical structure of the nodes in the graph and further extract the node features closely related to the graph-level feature representation. Therefore, this process will reduce the dimension of the output feature vector, reduce the computational burden of the subsequent neural network layer, and alleviate the overfitting problem of the model to a certain extent. The model evaluates the importance of each node by calculating the projection score of the feature vector of each node on a global reference vector. This global reference vector can be automatically learned. Then, the model sorts the nodes according to the scores and selects the top k nodes with the highest scores, where k ∈ (0, 1) is the pooling ratio. Finally, the vectors of these k nodes are averaged and input into the fully connected layer for classification.

[0081] The embodiments described above are only used to describe the preferred embodiments of the present invention and do not limit the scope of the present invention. Without departing from the design spirit of the present invention, various deformations and improvements made by those of ordinary skill in the art to the technical solutions of the present invention shall fall within the protection scope determined by the claims of the present invention.

Claims

1. A PHP taint-type vulnerability detection method based on heterogeneous graph neural network, characterized in that, It includes a code preprocessing module, a code property graph construction module, a vulnerability sub-property graph extraction module, a graph node embedding module, and a heterogeneous graph neural network vulnerability detection module. The specific steps are as follows: Step S1: Input the PHP source code into the code preprocessing module for comment removal, variable naming normalization, and string standardization to generate standardized code. The code preprocessing module ensures the correctness of code parsing through syntax checking and eliminates the interference of coding style differences on detection; Step S2: Input the preprocessed code into the code property graph construction module to generate a multi-level graph structure code property graph CPG that integrates the abstract syntax tree AST, control flow graph CFG, and program dependence graph PDG, capturing the syntax, control flow, and dependence information of the code; Step S3: Input the code property graph CPG into the vulnerability sub-property graph extraction module. Based on the principle of taint analysis, traverse backward from the vulnerability sink point to the taint source in the CPG to extract the vulnerability sub-property graph SPG. By removing redundant nodes and edges and retaining the key code elements related to the taint propagation path, the graph complexity is reduced; Step S4: Input the sub-property graph SPG into the graph node embedding module to extract the code semantic features and type features of the nodes in the SPG and generate a heterogeneous graph. The semantic features are obtained through the pre-trained BERT model, and the type features are represented by One-Hot encoding. After fusion, the initial embedding vector of the node is formed; Step S5: Input the heterogeneous graph into the heterogeneous graph neural network vulnerability detection module. The heterogeneous graph neural network HGNN model in the module performs independent feature aggregation and attention mechanism weighted fusion through multi-type edges AST, CFG, PDG, combines with the Top-k graph pooling layer to screen key nodes, and enhances the focusing ability on vulnerability features; use mean pooling for the selected key nodes to generate a graph-level feature vector. Finally, input the graph-level feature vector into a fully connected classifier to output the vulnerability detection result, and optimize the model parameters through the cross-entropy loss function to achieve accurate classification of PHP taint-type vulnerabilities.

2. The PHP taint-type vulnerability detection method based on the heterogeneous graph neural network according to claim 1, wherein: The dependence information in Step S2 includes data dependence information and control dependence information.

3. The PHP taint vulnerability detection method based on heterogeneous graph neural network according to claim 2, characterized in that: Step 3 is specifically as follows: Step 3.1: Identify the sensitive function nodes related to vulnerabilities in the CPG as the initial sink points of the SPG; Step 3.2: Traverse backward along the AST from the sink point to extract syntax-dependent nodes to generate a syntax subgraph; Step 3.3: Based on forward traversal of the CFG, capture the statement nodes related to taint propagation in the control flow path to generate a control flow subgraph; Step 3.4: Integrate the data dependence edges and control dependence edges of the PDG to construct a complete taint propagation path; Step 3.5: Merge the syntax subgraph, control flow subgraph, and dependence edges to generate a refined SPG, retaining the key context of the vulnerability.

4. The PHP taint vulnerability detection method based on the heterogeneous graph neural network according to claim 3, wherein: SPG generation process: The definition of SPG is as follows: SPG = {Node, E ast , E cfg , E pdg} where Node is the node in the subgraph, and E ast , E cfg , E pdg are the edges in three different types of graphs, namely AST, CFG, and PDG, respectively. 1) Traverse all nodes in the AST, match them with the convergence points of taint-type vulnerabilities, and obtain the nodes N of all sensitive functions sink ∈S sink ; For each N sink First, perform a forward traversal to find the AST root node A of the statement where N sink is located N , then perform a backward traversal of A N , and add all the traversed nodes N i to the set N, including N sink , and add all the used edges A E to the set E ast ; 2) Starting from A N as the starting point, perform a forward traversal on the CFG to obtain a set S of root nodes of a group of ASTs new and a set of edges C E . Add C E to E cfg . Then, perform a backward traversal along the AST for each A new ∈ S new . Add all the traversed nodes N i to the set N. Recursively execute taking each A new ∈ S new as the starting point of step 2) until there is a tainted source node N source ∈ N, and stop the recursion; 3) Add all the data dependency edges P in the PDG d and the control dependency edges P c to the SPG, that is All the structural information in the program and the union of the dependency relation sets constitute the SPG.

5. The PHP taint vulnerability detection method based on heterogeneous graph neural network according to claim 1, characterized in that: Step 4 is specifically as follows: Step 4.1: Use the pre-trained BERT model to perform lexical analysis on the SPG nodes to extract code semantic feature vectors and capture context dependence relationships; Step 4.2: Represent the node types using One-Hot encoding to generate type feature vectors; Step 4.3: Concatenate the semantic feature vector and the type feature vector, and map them to a unified embedding space through a linear transformation to generate the initial node embedding vector; Step 4.4: Construct a heterogeneous graph structure based on AST edges, CFG edges, and PDG edges, define three types of edge types and assign independent adjacency matrices to form heterogeneous data that can be input into the HGNN.

6. The PHP taint type vulnerability detection method based on the heterogeneous graph neural network according to claim 5, characterized in that: Method for the graph node embedding module to embed the semantic and type information of nodes in the SPG: For N i Perform lexical analysis on the code statements in N, and use the pre-trained Bert model to generate vectors of lexical tokens Obtain the semantic information of the nodes; for the type information of the nodes, use the One-Hot encoding method to represent the type of each node and obtain the type feature vector The semantic feature vector And the type feature vector Concatenate the two vectors and input them into the linear layer to obtain the initial embedding vector of the nodes, as follows: Among them, W l and b l are parameters that can be learned in the linear layer, v i is the initial embedding vector of the node, and || represents the concatenation operation.

7. The PHP taint vulnerability detection method based on heterogeneous graph neural network according to claim 6, wherein: The graph g input into the heterogeneous graph neural network in step 4.4 SPG ={V, E, T V , T E} is defined as a heterogeneous graph with labeled edges, where V represents the set of nodes, E represents the set of edges, and T V is the set of node types, and T E is the set of edge types. For each node N i ∈N in the SPG, there corresponds an initial embedding vector v i ∈V, and the node type T SPG of g V has only one v. For each edge e SPG ∈E in g j a type T j ∈T E is assigned at the beginning of construction, and the edge type T SPG of g V contains three types, namely E ast representing the code structure, E cfg representing the control relationship, and E pdg .

8. The PHP taint vulnerability detection method based on the heterogeneous graph neural network according to claim 7, characterized in that: Step 5 is as follows: Step 5.1: Perform type-specific message passing on AST edges, CFG edges, and PDG edges respectively, and aggregate neighbor node information through a heterogeneous graph neural network; Step 5.2: Introduce a cross-edge type attention mechanism to calculate the weights of different edge types and dynamically adjust the information fusion ratio; Step 5.3: Adopt a Top-k graph pooling layer to screen key subgraphs based on node importance scores, compress the graph scale and retain vulnerability-sensitive features; Step 5.4: Generate a global graph-level representation vector for final classification by mean pooling multi-layer graph features; Step 5.5: Input the graph-level feature vector into a fully connected layer and map it to a binary classification space; Step 5.6: Use the softmax function to calculate the vulnerability probability and output the detection result; Step 5.7: Optimize the model parameters based on the cross-entropy loss function, and update the weights in combination with the gradient descent algorithm to improve the detection accuracy and generalization ability.

9. The PHP taint type vulnerability detection method based on heterogeneous graph neural network according to claim 8, characterized in that: Use HGNN for g SPG (V, E, T V , T E ) to perform representation learning, learning the hidden state of each node at each layer. In g SPG , there is one type of V, three types of E. The node v needs to perform message aggregation with the neighbors of each type of edge respectively, and its message aggregation formula can be expressed as: where N v (e) represents the adjacent node of type t connected to node v, h u (l) is the vector representation of node u at the l-th layer, α vu is the attention weight of neighbor node u to node v, and this weight is calculated by the following formula: Where W is the projection matrix, α is the attention vector, ∥ represents the vector concatenation operation. The same node aggregates the messages of the neighbors of the three types of edges respectively to generate three vectors. By introducing a new attention mechanism layer, the aggregated information generated by each type of edge is combined into a final node representation. The final aggregation formula is as follows: where is the i-th vector generated by node v in layer l, h v (l + 1) is the hidden state of node v in the (l + 1)-th layer, W a is the weight matrix for the final aggregated representation to be learned, and σ is the non-linear activation function ReLU.

10. The PHP taint vulnerability detection method based on the heterogeneous graph neural network according to claim 8, wherein: The Top-k pooling model in Step 5.3 evaluates the importance of each node by calculating the projection score of the feature vector of each node on a global reference vector. The model sorts the nodes according to the scores and selects the top k nodes with the highest scores. Among them, the pooling ratio k ∈ (0,1). Take the average of the vectors of these k nodes, input them into the fully connected layer for classification.

Images