Cryptography misuse detection method and device

Abstract

The embodiment of the invention discloses a cryptography misuse detection method and device. A specific embodiment of the method comprises the following steps: performing ontology knowledge detection and enhancement processing on original query information according to a cryptography misuse ontology knowledge base; performing initial detection on the code query enhancement information; according to a preliminary detection result, performing iterative detection on a knowledge base knowledge fragment sequence and a source code included in the code query enhancement information; generating a code detection analysis report according to the code iteration detection result and the source code; generating a target code misuse information set according to the high-confidence candidate misuse information and the code detection analysis report; and according to the cryptography misuse ontology knowledge base, filling the target code misuse information set into the structured misuse information report template to obtain a structured misuse information report. According to the embodiment, the efficiency and accuracy of overall detection are remarkably improved while the high call rate is ensured.

Description

Technical Field

[0001] The embodiments disclosed herein relate to the field of cryptographic misuse detection, specifically to cryptographic misuse detection methods and apparatus. Background Technology

[0002] As a critical infrastructure of modern society, the security of software systems is paramount. Among numerous security technologies, cryptography is a core pillar, but the correct implementation of its APIs is extremely challenging. Research and practice both demonstrate that misconfiguration and improper use of cryptographic APIs during development—a phenomenon known as "cryptographic misuse"—has become a widespread and dangerous problem, a key factor contributing to serious security vulnerabilities. These misuses can render strong cryptographic protections ineffective, directly threatening the security of personal privacy, corporate data, and even critical infrastructure. Therefore, accurately and efficiently detecting cryptographic API misuse in code is a crucial issue that urgently needs to be addressed in the field of software security.

[0003] To address this challenge, the industry has explored various detection techniques, including static analysis, dynamic analysis, and fuzzing. However, dynamic analysis and fuzzing have significant limitations in combating cryptographic misuse. Dynamic analysis performs interactive probing during program runtime, but it typically treats complex cryptographic operations as a "black box," making it difficult to delve into the internal logic to discover implementation-level flaws. Furthermore, its detection effectiveness is highly dependent on the quality and coverage of test cases. Similarly, fuzzing triggers program crashes by inputting anomalous data. While highly effective in discovering memory safety vulnerabilities, it lacks an understanding of algorithmic security attributes or protocol states, making it difficult to effectively discover complex logical vulnerabilities that do not directly cause program crashes but severely compromise security.

[0004] Despite the continuous development of existing static analysis tools, evolving from rigorous manual reduction to more general pattern detection, they all face a common fundamental challenge: limited understanding of the deep semantics and complex context of code. They are effective at identifying errors at the "syntactic level" or "pattern level," but when a misuse requires understanding the developer's intent, tracing complex data dependencies, or grasping subtle cryptographic contexts, these tools fall short, often resulting in high false positive and false negative rates. To overcome this bottleneck, research trends are shifting towards combining static analysis with more advanced semantic understanding techniques, aiming to identify complex and covert cryptographic API misuses more accurately and deeply. Summary of the Invention

[0005] The summary portion of this disclosure is intended to provide a brief overview of the concepts, which will be described in detail in the detailed description portion. This summary portion is not intended to identify key or essential features of the claimed technical solutions, nor is it intended to limit the scope of the claimed technical solutions.

[0006] Some embodiments of this disclosure provide cryptographic misuse detection methods, apparatuses, electronic devices, and computer-readable media to address the technical problems mentioned in the background section above.

[0007] In a first aspect, some embodiments of this disclosure provide a method for detecting cryptographic misuse. The method includes: performing preliminary screening and feature extraction on input source code to obtain low-confidence candidate misuse information and abstract syntax tree features; combining the source code, the low-confidence candidate misuse information, and the abstract syntax tree features into original query information; and performing ontology knowledge detection and enhancement processing on the original query information based on a pre-constructed cryptographic misuse ontology knowledge base to obtain code query enhancement information, wherein the code query enhancement information includes: a knowledge base knowledge fragment sequence, source code, low-confidence candidate misuse information, and abstract syntax tree features. The process involves: identifying and conducting initial detection on the enhanced code query information to obtain preliminary detection results; conducting iterative detection on the knowledge base knowledge fragment sequence included in the enhanced code query information and the source code to obtain iterative code detection results; generating a code detection analysis report based on the iterative code detection results and the source code; generating a target code misuse information set based on pre-determined high-confidence candidate misuse information and the code detection analysis report; and filling the target code misuse information set into a structured misuse information report template based on the cryptographic misuse ontology knowledge base to obtain a structured misuse information report.

[0008] Secondly, some embodiments of this disclosure provide a cryptographic misuse detection apparatus, comprising: an extraction unit configured to perform preliminary screening and feature extraction on input source code to obtain low-confidence candidate misuse information and abstract syntax tree features; a combination unit configured to combine the source code, the low-confidence candidate misuse information, and the abstract syntax tree features into original query information; an enhancement unit configured to perform ontology knowledge detection and enhancement processing on the original query information based on a pre-constructed cryptographic misuse ontology knowledge base to obtain code query enhancement information, wherein the code query enhancement information includes: a knowledge base knowledge fragment sequence, source code, low-confidence candidate misuse information, and abstract syntax tree features; and a detection unit configured to detect... The code query enhancement information is used for initial detection to obtain preliminary detection results. An iterative detection unit is configured to perform iterative detection on the knowledge base knowledge fragment sequence included in the code query enhancement information and the source code based on the preliminary detection results, obtaining iterative code detection results. A first generation unit is configured to generate a code detection analysis report based on the iterative code detection results and the source code. A second generation unit is configured to generate a target code misuse information set based on pre-determined high-confidence candidate misuse information and the code detection analysis report. A filling unit is configured to fill the target code misuse information set into a structured misuse information report template based on the cryptographic misuse ontology knowledge base, obtaining a structured misuse information report.

[0009] Thirdly, some embodiments of this disclosure provide an electronic device, including: one or more processors; and a storage device having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation of the first aspect above.

[0010] Fourthly, some embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described in any of the implementations of the first aspect above.

[0011] The various embodiments of this disclosure have the following beneficial effects: The cryptographic misuse detection method of some embodiments of this disclosure integrates efficient static analysis with accurate LLM deep analysis, constructing a collaborative process for rapid screening and precise judgment. This framework utilizes static analysis to quickly filter simple scenarios and identify obvious vulnerabilities, then concentrates the reasoning capabilities of LLM to solve complex and context-dependent problems, thereby significantly improving the overall efficiency and accuracy of detection while ensuring a high recall rate; a structured cryptographic misuse ontology is constructed. This ontology, through RAG technology, dynamically injects accurate and authoritative expert knowledge into LLM during analysis, thus largely solving the illusion problem of LLM analysis and greatly improving the reliability and interpretability of the detection results. Attached Figure Description

[0012] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and elements are not necessarily drawn to scale.

[0013] Figure 1 This is a flowchart of some embodiments of the cryptographic misuse detection method according to this disclosure;

[0014] Figure 2 This is a schematic flowchart of the abstract syntax tree feature extraction process in the cryptographic misuse detection method of some embodiments of this disclosure;

[0015] Figure 3 This is a schematic diagram of ontology knowledge detection and enhancement processing in the cryptographic misuse detection method of some embodiments of this disclosure;

[0016] Figure 4 This is a schematic diagram of the structure of some embodiments of the cryptographic misuse detection device according to the present disclosure;

[0017] Figure 5 This is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. Detailed Implementation

[0018] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0019] It should also be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings. Unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other.

[0020] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0021] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0022] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0023] This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0024] Figure 1 This is a flow 100 of some embodiments of a cryptographic misuse detection method according to some embodiments of this disclosure. The cryptographic misuse detection method includes the following steps:

[0025] Step 101: Perform preliminary screening and feature extraction on the input source code to obtain low-confidence candidate misuse information and abstract syntax tree features.

[0026] In some embodiments, the execution subject (e.g., a computing device) of the cryptographic misuse detection method can perform preliminary screening and feature extraction on the input source code to obtain low-confidence candidate misuse information and abstract syntax tree features.

[0027] In practice, the aforementioned executing entity can perform preliminary screening and feature extraction on the input source code through the following steps to obtain low-confidence candidate misuse information and abstract syntax tree features:

[0028] The first step is to perform data standardization on the input source code to generate standardized source code. Data standardization may include removing comments, blank lines, and other non-logical elements from the source code.

[0029] The second step is to format the standardized source code to generate formatted source code. For example, code formatting tools such as Black can be used to standardize the source code (formatting).

[0030] The third step involves performing low-confidence code misuse detection on the format-adjusted source code based on a pre-built low-confidence code misuse detection table, yielding low-confidence candidate misuse information. This low-confidence candidate misuse information includes a set of low-confidence candidate misuse detection indicators. As an example, the low-confidence code misuse detection table can be illustrated in Table 1 below:

[0031] Table 1

[0032]

[0033] It is important to note whether it is b. k As long as its test_id is in "b k The rule is in the "List of Relevant Rule IDs" and does not meet the strict criteria of M_SA (i.e., it is not an M_SA rule, or although it is an M_SA rule, its Bandit confidence is not HIGH).

[0034] It should be noted that this application also relates to a high-confidence code misuse detection table, used to detect a set of high-confidence code misuse indicators. An example of the high-confidence code misuse detection table is shown in Table 2 below:

[0035] Table 2

[0036]

[0037] Note: To qualify as an M_SA, both of the following conditions must be met: its test_id must be in the "M_SA Rule ID List". Bandit itself evaluates its issue_confidence as "HIGH".

[0038] The predefined rule mapping table loaded by the framework is represented in the code as two Python set collections: HIGH_CONFIDENCE_TEST_IDS_ABSOLUTE and LLM_CANDIDATE_TEST_IDS.

[0039] Next, the Bandit scanner is executed to analyze the input Python source code. This step is accomplished by calling the Bandit command-line tool through Python's subprocess module. It identifies all potential security issues that match its rules (both native and custom) and outputs the results in a structured JSON format without filtering Bandit's own confidence judgments, as the final classification decision is made by the framework itself.

[0040] Bandit's raw JSON output is processed and identified by a dedicated data processing function. This function iterates through each detected vulnerability record: it first filters out any `test_id`s unrelated to our predefined rule table. Then, for the remaining relevant vulnerabilities, the framework performs precise classification based on a dual standard: if the vulnerability's `test_id` belongs to the `HIGH_CONFIDENCE_TEST_IDS_ABSOLUTE` set, and Bandit's own confidence assessment for it is HIGH, then the vulnerability is directly identified as a high-confidence misuse M_SA, and its record is temporarily stored for the final report without further LLM intervention. Conversely, all other vulnerabilities that meet the relevance filtering conditions (i.e., `test_id` is in `LLM_CANDIDATE_TEST_IDS`, or although it is of type `HIGH_CONFIDENCE_TEST_IDS_ABSOLUTE`, Bandit's confidence is insufficient to be HIGH) are marked as low-confidence candidate misuse information b. k And along with its code context information, it is passed to the next stage.

[0041] The fourth step is to extract abstract syntax tree features from the above format-adjusted source code to obtain the abstract syntax tree features.

[0042] For the low-confidence candidate misuse information that has been screened out, the executing entity will extract key AST features, such as Figure 2 As shown, the system uses Python's built-in `ast` module to parse relevant code snippets into an Abstract Syntax Tree (AST). Through depth-first traversal of the AST, the system can extract a series of structured AST features (Abstract Syntax Tree features), which cover API import and call relationships, sensitive data assignment and flow paths, and hard-coded constant values. These precise structured features, along with low-confidence candidates and their code context, constitute the complete input for the next stage of knowledge retrieval and LLM deep analysis.

[0043] Step 102: Combine the above source code, the above low-confidence candidate misuse information, and the above abstract syntax tree features into the original query information.

[0044] In some embodiments, the execution entity may combine the source code, the low-confidence candidate misuse information, and the abstract syntax tree features to form the original query information. The original query information can be represented by Q. s S represents source code. b k This indicates misuse of information by low-confidence candidates. A s This represents the features of the abstract syntax tree mentioned above.

[0045] Step 103: Based on the pre-constructed cryptographic misuse ontology knowledge base, perform ontology knowledge detection and enhancement processing on the above original query information to obtain code query enhancement information.

[0046] In some embodiments, the aforementioned execution entity can perform ontology knowledge detection and enhancement processing on the original query information based on a pre-built cryptographic misuse ontology knowledge base to obtain code query enhancement information. This code query enhancement information includes: knowledge base knowledge fragment sequences, source code, low-confidence candidate misuse information, and abstract syntax tree features.

[0047] Here, a cryptographic misuse ontology is designed as the knowledge base (cryptographic misuse ontology knowledge base), which is carefully constructed from two core related data tables, such as... Figure 3 As shown. Table1 instantiates a set of categories, while Table2 instantiates a set of patterns. The contents of these two tables are connected by a core association function. The cryptographic misuse ontology O is formally defined as a quintuple:

[0048] .

[0049] Where C is a finite set of all misuse categories, defining a high-level classification system for misuse; P is a finite set of all specific misuse patterns; and V is a searchable attribute vocabulary constructed as a pair. The searchable text attributes of the category set C and the specific misuse pattern set P are defined respectively. and These are the core functions defined on these sets, which describe the hierarchical relationships between categories and the relationship between patterns and categories. This is a function that maps a child misuse category to its direct parent misuse category. If the input category is the top-level root category in the hierarchy, it will return Ø, indicating that there is no parent category. The subscript paren indicates that the function's purpose is to find the parent category of a given category. The module defines the attribution relationship between misuse patterns and their corresponding categories in the ontology. This function takes a specific misuse pattern as input and always returns a specific misuse category. Following this, the module iterates through each low-confidence entry in the report and performs a complete knowledge augmentation process for it.

[0050] In practice, the aforementioned executing entity can perform ontology knowledge detection and enhancement processing on the original query information through the following steps:

[0051] The first step is to retrieve relevant knowledge fragment sequences from the aforementioned cryptographic misuse ontology knowledge base based on the original query information. This information is then transformed into one or more search queries suitable for retrieval within the ontology knowledge base. , It is a query generation function that aggregates and transforms raw information from the initial static analysis phase to generate queries suitable for retrieval in a cryptographic misuse ontology knowledge base.

[0052] Generated search query It was used for knowledge retrieval. We adopted a hybrid retrieval strategy, choosing the BGE-M3 model as the core embedding tool for a given query. A misuse pattern Mixed similarity score By dense similarity S d Sparse similarity S sp It is composed of weighted combinations. The definition is as follows:

[0053] .

[0054] Among them, S d S represents the cosine similarity; sp The dot product of sparse vectors; This is a hyperparameter used to balance the importance of semantics and lexical analysis. The initial recall function uses this mixed score to assign a Q value to the entire query set. s Retrieve a candidate knowledge set from the pattern library P. .

[0055] The second step involves reordering the relevant knowledge fragment sequence based on the original query information, resulting in a reordered knowledge fragment sequence. To further refine the retrieval results, we introduce a reordering stage. We use the high-performance cross-encoder model bge-reranker-v2 as the reorderer M. r It can more accurately evaluate the relevance of the query to candidate knowledge. Reorderer M r It can calculate each candidate knowledge Compared with the original query information Q s The relevance scores are then used to rank the relevant knowledge fragment sequences from highest to lowest, resulting in a reordered knowledge fragment sequence.

[0056] The third step is to select the top-K (target number) reordered knowledge fragments from the above reordered knowledge fragment sequence as the target knowledge fragment sequence. For example, the top-K (target number) knowledge fragments with the highest scores can be selected as the final search results. (Sequence of target knowledge fragments).

[0057] Fourth, based on the original query information and the target knowledge fragment sequence mentioned above, construct code query enhancement information. In the final prompt-building stage, the relevant knowledge fragments refined in the previous step... This will be carefully integrated with the original input information into a structured, information-rich prompt. This process is accomplished by a construction function. Complete, generating the final enhanced input used to guide LLM in deep analysis. This process is defined as:

[0058]

[0059]

[0060]

[0061] .

[0062] Here, both k' and k represent the number of results returned, i.e., "Top-K" selection. k' (with an apostrophe) typically indicates a larger initial recall, i.e., a larger set of candidates that may contain noise. k (without an apostrophe) typically indicates a smaller final, refined set, i.e., the most relevant, high-quality results selected through methods such as reordering. and middle: This refers to the initial set of candidate knowledge fragments recalled. This refers to the final, refined set of knowledge fragments. Here, 's' indicates that this is a "selected" form of knowledge, prepared for use in building an enhanced Prompt.

[0063] Step 104: Perform initial detection on the above code query enhancement information to obtain preliminary detection results.

[0064] In some embodiments, the aforementioned execution entity may perform initial detection on the aforementioned code query enhancement information to obtain preliminary detection results.

[0065] In practice, the aforementioned execution entity can input the code query enhancement information into a pre-trained large-scale code misuse detection model to obtain preliminary detection results. Upon receiving the enhancement input carefully constructed by the RAG module... Then, the LLM (large language model) initiates a multi-stage knowledge-guided reasoning and vulnerability confirmation process. Initially, the LLM performs preliminary analysis and interpretation, comprehensively reviewing all information in the enhanced Prompt to form a preliminary detection result R0 for potential cryptographic misuse. This is denoted as:

[0066] .

[0067] Step 105: Based on the above preliminary detection results, iteratively detect the knowledge base knowledge fragment sequence included in the above code query enhancement information and the above source code to obtain the code iterative detection results.

[0068] In some embodiments, the execution entity may perform iterative detection on the knowledge base knowledge fragment sequence included in the code query enhancement information and the source code based on the preliminary detection results to obtain code iterative detection results.

[0069] To deepen understanding and ensure the accuracy of the analysis, a core internal probing and refinement mechanism was designed. In the (i+1)th round, the system constructs a function based on a probing prompt. Based on the response in the previous round Knowledge retrieved by RAG Together with the original source code S, it generates a challenging internal follow-up question. The LLM's response to this follow-up question constitutes a new, more refined set of actions. , denoted as:

[0070]

[0071] This iterative process will run for a fixed number of N rounds (in our framework, N=2).

[0072] Step 106: Based on the above code iteration detection results and the above source code, generate a code detection and analysis report.

[0073] In some embodiments, the execution entity may generate a code detection and analysis report based on the code iteration detection results and the source code.

[0074] After completing these two rounds of internal questioning and refinement, to ensure the rigor of the final output and its close correlation with the original code, the module will perform a final code audit and verification. Following this final verification, LLM will generate a detailed analysis report. , denoted as:

[0075] .

[0076] Step 107: Generate a target code misuse information set based on the pre-determined high-confidence candidate misuse information and the above code detection and analysis report.

[0077] In some embodiments, the execution entity may generate a target code misuse information set based on the predetermined high-confidence candidate misuse information and the code detection and analysis report.

[0078] In practice, the aforementioned implementing entities can generate a target code misuse information set through the following steps:

[0079] The first step is to merge the high-confidence candidate misuse information with the code detection and analysis report to obtain the initial code misuse information set.

[0080] The second step is to remove duplicates from the initial code misuse information set to obtain the target code misuse information set.

[0081] In practice, we handle outputs from two main analytical paths. The first is high-confidence static analysis results, which are clearly patterned misuses directly identified by Bandit, denoted as set M. SA Second, the results confirmed by LLM in-depth analysis, denoted as set M. LLM (i.e. M) * We compiled all potential misuse findings into a unified set. In order to eliminate redundancy, we define a deduplication function called Deduplicate, denoted as:

[0082] .

[0083] For the same vulnerability discovered by both paths, we designed a priority rule: the analysis results from the LLM are adopted by default. This is because it typically includes richer contextual explanations, deeper root cause analysis, and more targeted remediation suggestions.

[0084] Step 108: Based on the above cryptographic misuse ontology knowledge base, fill the above target code misuse information set into the structured misuse information report template to obtain the structured misuse information report.

[0085] In some embodiments, the execution entity may, based on the aforementioned cryptographic misuse ontology knowledge base, populate the aforementioned target code misuse information set into the structured misuse information report template to obtain a structured misuse information report. To obtain a unified and non-redundant set of misuses. Next, the report will be generated. We first defined a structured template for the final report. This template specifies the core fields that each vulnerability report should include. Subsequently, a report generation function, GenReport, will iterate through these fields. Each misuse record m in the file, and using a template Fill in and format its information, and record it as:

[0086] .

[0087] For fields such as description and remediation recommendations, we will prioritize using standardized descriptions from the cryptographic misuse ontology O to ensure the professionalism and consistency of the report.

[0088] Further reference Figure 4 As an implementation of the methods shown in the above figures, this disclosure provides some embodiments of a cryptographic misuse detection device, which are similar to... Figure 1 Corresponding to the method embodiments shown, this cryptographic misuse detection device can be specifically applied to various electronic devices.

[0089] like Figure 4 As shown, a cryptographic misuse detection device 400 in some embodiments includes: an extraction unit 401, a combination unit 402, an enhancement unit 403, a detection unit 404, an iterative detection unit 405, a first generation unit 406, a second generation unit 407, and a filling unit 408. The extraction unit 401 is configured to perform preliminary screening and feature extraction on the input source code to obtain low-confidence candidate misuse information and abstract syntax tree features; the combination unit 402 is configured to combine the source code, the low-confidence candidate misuse information, and the abstract syntax tree features into original query information; the enhancement unit 403 is configured to perform ontology knowledge detection and enhancement processing on the original query information based on a pre-built cryptographic misuse ontology knowledge base to obtain code query enhancement information, wherein the code query enhancement information includes: a knowledge base knowledge fragment sequence, source code, low-confidence candidate misuse information, and abstract syntax tree features; the detection unit 404 is configured to perform initial detection on the code query enhancement information. The system obtains preliminary detection results; the iterative detection unit 405 is configured to perform iterative detection on the knowledge base knowledge fragment sequence included in the code query enhancement information and the source code based on the preliminary detection results, and obtain code iterative detection results; the first generation unit 406 is configured to generate a code detection analysis report based on the code iterative detection results and the source code; the second generation unit 407 is configured to generate a target code misuse information set based on the predetermined high-confidence candidate misuse information and the code detection analysis report; the filling unit 408 is configured to fill the target code misuse information set into the structured misuse information report template based on the cryptographic misuse ontology knowledge base, and obtain a structured misuse information report.

[0090] It is understandable that the units described in the cryptographic misuse detection device 400 are related to the reference. Figure 1 The steps in the described method correspond to each other. Therefore, the operations, features, and beneficial effects described above for the method also apply to the cryptographic misuse detection device 400 and the units contained therein, and will not be repeated here.

[0091] The following is for reference. Figure 5 It illustrates a schematic diagram of the structure of an electronic device (such as a computing device) suitable for implementing some embodiments of the present disclosure. Figure 5 The electronic device shown is merely an example and should not be construed as limiting the functionality or scope of the embodiments of this disclosure. Figure 5 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The memory may include non-volatile storage media and internal memory. The non-volatile storage media may store the operating system and computer programs. The computer programs include program instructions that, when executed, cause the processor to perform any cryptographic misuse detection method. The processor provides computational and control capabilities to support the operation of the entire computer device. The internal memory provides an environment for the execution of the computer programs in the non-volatile storage media; when executed by the processor, these programs cause the processor to perform any cryptographic misuse detection method. The network interface is used for network communication, such as sending assigned tasks. Those skilled in the art will understand that... Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present disclosure and does not constitute a limitation on the computer device to which the present disclosure is applied. A specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0092] It should be understood that the processor can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among these, a general-purpose processor can be a microprocessor or any conventional processor.

[0093] In one embodiment, the processor is configured to run a computer program stored in a memory to perform the following steps: preliminary screening and feature extraction of the input source code to obtain low-confidence candidate misuse information and abstract syntax tree features; combining the source code, the low-confidence candidate misuse information, and the abstract syntax tree features into original query information; and performing ontology knowledge detection and enhancement processing on the original query information based on a pre-constructed cryptographic misuse ontology knowledge base to obtain code query enhancement information, wherein the code query enhancement information includes: a knowledge base knowledge fragment sequence, source code, low-confidence candidate misuse information, and abstract syntax tree features. The syntax tree features are used to perform initial detection on the code query enhancement information to obtain preliminary detection results. Based on the preliminary detection results, the knowledge base knowledge fragment sequence included in the code query enhancement information and the source code are iteratively detected to obtain code iterative detection results. Based on the code iterative detection results and the source code, a code detection analysis report is generated. Based on the predetermined high-confidence candidate misuse information and the code detection analysis report, a target code misuse information set is generated. Based on the cryptographic misuse ontology knowledge base, the target code misuse information set is filled into the structured misuse information report template to obtain the structured misuse information report.

[0094] This disclosure also provides a computer-readable storage medium storing a computer program, the computer program including program instructions, and the method implemented when the program instructions are executed can be referred to various embodiments of the cryptographic misuse detection method of this disclosure.

[0095] The aforementioned computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiments, such as the hard disk or memory of the computer device. Alternatively, the aforementioned computer-readable storage medium may be an external storage device of the computer device, such as a plug-in hard disk, SmartMedia Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the computer device.

[0096] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0097] The above description is merely a selection of preferred embodiments of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in the embodiments of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in the embodiments of this disclosure.

Claims

1. A method for detecting cryptographic misuse, characterized in that, include: The input source code is initially screened and features are extracted to obtain low-confidence candidate misuse information and abstract syntax tree features; The source code, the low-confidence candidate misuse information, and the abstract syntax tree features are combined to form the original query information; Based on a pre-built cryptographic misuse ontology knowledge base, the original query information is subjected to ontology knowledge detection and enhancement processing to obtain code query enhancement information, wherein the code query enhancement information includes: knowledge base knowledge fragment sequence, source code, low-confidence candidate misuse information and abstract syntax tree features; Initial detection is performed on the code query enhancement information to obtain preliminary detection results; Based on the preliminary detection results, the knowledge base knowledge fragment sequence included in the code query enhancement information and the source code are iteratively detected to obtain the code iterative detection results. Based on the code iteration detection results and the source code, a code detection analysis report is generated; Based on the pre-determined high-confidence candidate misuse information and the code detection and analysis report, a target code misuse information set is generated; Based on the cryptographic misuse ontology knowledge base, the target code misuse information set is filled into the structured misuse information report template to obtain the structured misuse information report.

2. The method according to claim 1, characterized in that, The initial screening and feature extraction of the input source code yields low-confidence candidate misuse information and abstract syntax tree features, including: The input source code is processed to standardize the data, generating standardized source code. The standardized source code is formatted to generate formatted source code; Based on a pre-built low-confidence code misuse detection table, the format adjustment source code is subjected to low-confidence code misuse detection to obtain low-confidence candidate misuse information, wherein the low-confidence candidate misuse information includes: a set of low-confidence candidate misuse detection indicators; Abstract syntax tree features are extracted from the source code of the format adjustment to obtain abstract syntax tree features.

3. The method according to claim 2, characterized in that, The step involves performing ontology knowledge detection and enhancement processing on the original query information based on a pre-constructed cryptographic misuse ontology knowledge base to obtain enhanced code query information, including: Based on the original query information, relevant knowledge fragment sequences are retrieved from the cryptographic misuse ontology knowledge base; Based on the original query information, the relevant knowledge fragment sequence is reordered to obtain a reordered knowledge fragment sequence; Select the top target number of reordered knowledge fragments from the reordered knowledge fragment sequence as the target knowledge fragment sequence; Based on the original query information and the target knowledge fragment sequence, code query enhancement information is constructed.

4. The method according to claim 3, characterized in that, The step of generating a target code misuse information set based on pre-determined high-confidence candidate misuse information and the code detection and analysis report includes: The high-confidence candidate misuse information is merged with the code detection and analysis report to obtain an initial code misuse information set; The initial code misuse information set is deduplicated to obtain the target code misuse information set.

5. The method according to claim 4, characterized in that, The initial detection of the code query enhancement information yields preliminary detection results, including: The enhanced code query information is input into a pre-trained large-scale code misuse detection model to obtain preliminary detection results.

6. A cryptographic misuse detection device, characterized in that, include: The extraction unit is configured to perform preliminary screening and feature extraction on the input source code to obtain low-confidence candidate misuse information and abstract syntax tree features; The combination unit is configured to combine the source code, the low-confidence candidate misuse information, and the abstract syntax tree features into the original query information; The enhancement unit is configured to perform ontology knowledge detection and enhancement processing on the original query information based on a pre-built cryptographic misuse ontology knowledge base to obtain code query enhancement information, wherein the code query enhancement information includes: knowledge base knowledge fragment sequence, source code, low-confidence candidate misuse information and abstract syntax tree features; The detection unit is configured to perform initial detection on the code query enhancement information to obtain preliminary detection results; The iterative detection unit is configured to perform iterative detection on the knowledge base knowledge fragment sequence included in the code query enhancement information and the source code based on the preliminary detection results, and obtain code iterative detection results. The first generation unit is configured to generate a code detection and analysis report based on the code iteration detection results and the source code; The second generation unit is configured to generate a target code misuse information set based on a pre-determined high-confidence candidate misuse information and the code detection and analysis report. The filling unit is configured to fill the target code misuse information set into the structured misuse information report template according to the cryptographic misuse ontology knowledge base, so as to obtain a structured misuse information report.

7. An electronic device, characterized in that, include: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1 to 5.

8. A computer-readable medium, characterized in that, It stores a computer program thereon, wherein the computer program, when executed by a processor, implements the method as described in any one of claims 1 to 5.

Images