An application software development test system with real-time vulnerability detection

Abstract

The application belongs to the technical field of application software development test, and discloses an application software development test system with real-time vulnerability detection, which comprises a code real-time collection module, a multi-dimensional vulnerability detection module, a vulnerability accurate positioning module, a vulnerability risk quantitative evaluation module, a dynamic repair guidance module, a data storage module, a visual interaction module and an iterative optimization module, and each module cooperates to form a whole-process closed-loop vulnerability detection and management and control system. The application software development test system with real-time vulnerability detection is adopted, real-time capture, accurate positioning, risk evaluation and dynamic repair suggestion output of the vulnerability are realized, and the software development test efficiency and application program security are improved.

Description

Technical Field

[0001] This invention relates to the field of application software development and testing technology, and in particular to an application software development and testing system with real-time vulnerability detection. Background Technology

[0002] In the application software development process, testing is a core component for ensuring software quality and preventing security risks, with vulnerability detection being of paramount importance. Most current mainstream application software development testing systems adopt a separate testing model of static analysis and dynamic testing. Static analysis can only perform offline testing on the source code after development is complete, failing to capture real-time vulnerabilities during development. Dynamic testing, on the other hand, must be executed after software compilation and deployment, resulting in detection lag and difficulty in covering the entire process, including code writing, module integration, and system debugging.

[0003] Meanwhile, existing testing systems suffer from the following core defects: First, low vulnerability detection accuracy, relying heavily on fixed vulnerability signature databases for matching, resulting in weak identification capabilities for unknown and hidden vulnerabilities (such as branch vulnerabilities and context-dependent vulnerabilities), easily leading to missed detections and false positives; Second, low detection efficiency, with static analysis and dynamic testing data unable to be shared, resulting in a large number of redundant testing operations, leading to long testing cycles and high resource consumption. According to relevant technical statistics, redundant testing accounts for more than 48% of traditional testing systems, seriously affecting software development progress; Third, lack of real-time and linkage capabilities, with vulnerability detection disconnected from the code development process. Developers cannot obtain vulnerability prompts in real time while writing code, and problems can only be discovered during the testing phase, increasing vulnerability remediation costs; Fourth, vulnerability risk assessment lacks quantitative basis, only able to simply determine whether a vulnerability exists, unable to accurately assess the severity, scope of impact, and remediation priority of the vulnerability, which is not conducive to developers carrying out remediation work efficiently.

[0004] In addition, some existing testing systems attempt to introduce technologies such as knowledge graphs and machine learning to optimize vulnerability detection. However, they either only focus on the overall vulnerability prediction of open source software, and the prediction accuracy for specific types of vulnerabilities (such as branch vulnerabilities) in complex software is insufficient and prone to overfitting; or they only realize vulnerability detection in a single link and have not formed a closed-loop system of real-time detection-precise location-risk assessment-remediation guidance-iterative optimization, which cannot meet the vulnerability prevention and control needs of the entire application software development process.

[0005] Therefore, developing an application software development and testing system with real-time, high-precision, and full-process vulnerability detection capabilities, and capable of quantitative assessment of vulnerability risks and dynamic remediation guidance, has become an urgent technical problem to be solved in this field. Summary of the Invention

[0006] The purpose of this invention is to provide an application software development and testing system with real-time vulnerability detection, enabling real-time vulnerability capture, accurate location, quantitative evaluation, dynamic repair guidance, and iterative optimization throughout the entire software development process, thereby shortening the testing cycle, reducing repair costs, and improving the security and development efficiency of applications.

[0007] To achieve the above objectives, the present invention provides an application software development and testing system with real-time vulnerability detection, including a real-time code acquisition module, used to collect source code, code modification records, compilation logs and runtime context information during the application software development process in real time, and establish real-time linkage between the development process and the testing process; The multi-dimensional vulnerability detection module is used to perform real-time vulnerability detection on the collected preprocessed data, integrating three detection methods: static real-time detection, dynamic real-time detection, and unknown vulnerability prediction. The vulnerability precise location module is used to accurately locate detected vulnerabilities, and to identify the code segment, function, line number, and scope of impact of the vulnerability. The vulnerability risk quantification assessment module is used to quantify and assess detected vulnerabilities, determine their severity level, and prioritize remediation efforts. The dynamic remediation guidance module provides real-time vulnerability remediation suggestions based on vulnerability type, location results, and risk assessment results. The data storage module is used to store all data during system operation. It adopts a distributed storage architecture, combining relational databases and non-relational databases to realize data storage and retrieval. The visual interaction module provides an intuitive interface to display vulnerability detection results, location information, risk assessment results, remediation suggestions, and system operating status. The iterative optimization module is used to continuously optimize the system's vulnerability detection algorithm, vulnerability signature library, risk assessment indicators, and remediation solution library based on vulnerability remediation records and detection result feedback.

[0008] Preferably, the real-time code acquisition module includes: a code acquisition unit, a context information acquisition unit, and a data preprocessing unit; (1) Code collection unit: By interface with the development tools, a real-time monitoring mechanism is adopted to capture every operation of the developer in writing, modifying and saving code. Source code fragments, code differences before and after modification and code writing timestamps are collected in real time. The collection frequency is set according to the development needs to ensure the real-time nature of code data. (2) Context information collection unit: collects multi-dimensional context data of the development environment in real time, including user identity, device status, network environment, code running dependency environment, and operation behavior; (3) Data preprocessing unit: Cleans, deduplicates, and standardizes the collected code data and context information, removes invalid data, converts the source code into a standardized syntax format, extracts code features, and transmits the preprocessed data to the multi-dimensional vulnerability detection module and data storage module.

[0009] Preferably, the multi-dimensional vulnerability detection module specifically includes: a static real-time detection unit, a dynamic real-time detection unit, an unknown vulnerability prediction unit, and a detection result fusion unit; (1) Static Real-time Detection Unit: Employs an improved syntax and semantic analysis algorithm to perform online static analysis on the real-time acquired source code, specifically including: ① Construct an abstract syntax tree for the preprocessed source code. The source code is converted into an abstract syntax tree by a syntax parser to extract the syntax structure, function call relationships, variable definitions and usage. ② Based on the constructed abstract syntax tree and combined with the pre-set vulnerability feature library, a pattern matching algorithm is used to detect known vulnerabilities in the source code in real time; the vulnerability feature library adopts a dynamic update mechanism and is updated in real time through iterative optimization modules and external vulnerability libraries. ③ Introduce a branch coverage analysis mechanism to monitor conditional branches in the code in real time, extract branch guidance information, and represent it as a six-tuple, as shown below: ; in, Indicates the branch label value; Indicates a branch jump conditional operator; Indicates the target operand of the branch; Indicates the operand width; and This represents the edge label values ​​between the basic block containing the branch and the two subsequent branches; it analyzes the branch coverage status, including uncovered branches. semi-coverage and full coverage The focus is on detecting potential vulnerabilities in partially covered branches. The formula for calculating branch coverage is: ; in, Indicates branch coverage; Represents the set of branches that are covered; Represents the set of main branches; (2) Dynamic Real-Time Detection Unit: Employing dynamic instrumentation technology, detection code is inserted during real-time code execution to monitor the code's running status, function call flow, data transmission process, and resource usage in real time, thereby capturing runtime vulnerabilities. Specifically, this includes: ① Automatically insert lightweight detection instrumentation code during code compilation; ② Monitor key parameters during code execution in real time, including memory allocation and release, thread running status, function execution time, and data input / output validity, and establish a runtime behavior baseline; ③ A behavior-based anomaly detection algorithm is adopted to compare real-time runtime behavior with a preset behavior baseline. When abnormal behavior occurs, a vulnerability alarm is immediately triggered, and detailed information about the abnormal behavior is recorded. The determination of the anomaly judgment threshold is as follows: set up These are real-time monitoring values ​​of the operating parameters. The parameter represents the historical average value during normal operation. For standard deviation, when When this occurs, it is identified as abnormal behavior, triggering a vulnerability alert; ④ Introduce a context-aware vulnerability detection mechanism, which combines multi-dimensional data collected by the context information collection unit to detect vulnerabilities and avoid false detections caused by a single data dimension. (3) Unknown Vulnerability Prediction Unit: Based on an improved support vector machine and a code defect knowledge graph, it realizes real-time prediction of unknown vulnerabilities, specifically including: ① Construct a code defect knowledge graph. Based on historical vulnerability databases, CVE vulnerability databases, and vulnerability remediation records during the development process, associate code patterns, vulnerability types, remediation solutions, and contextual information to form a complete defect knowledge network and realize multi-dimensional association of vulnerability features. ② Extract key features from the code and use feature selection functions. From the original feature set Select a subset of features useful for vulnerability prediction. ,Right now The feature subset is preprocessed to obtain a standardized feature set, as shown below: ; in, This is a preprocessing function; ③ Construct an improved support vector machine prediction model, train the model using historical vulnerability data and code feature data, and optimize the model parameters; the model training process is represented as follows: ; in, For training set; For training functions; For the trained prediction model; ④ The model parameter optimization adopts the constrained maximization algorithm. Let the parameter set be... The optimization process is represented as follows: ; in, The number of samples in the training set; , The first Features and labels of each sample; Predict probabilities for the model; The regularization coefficient is used. Let be the sum of squares of the parametric 2 norms; ⑤ Input the real-time collected code features into the trained prediction model, and output the predicted probability and type of unknown vulnerabilities. When the predicted probability is greater than or equal to 85%, an unknown vulnerability warning is triggered, prompting developers to focus on investigation. The formula for calculating the unknown vulnerability prediction result is as follows: ; in, For the prediction results, positive numbers indicate the existence of unknown vulnerabilities, and negative numbers indicate their non-existence; This refers to the number of support vectors. For the first The weights of the support vectors; Support vector labels; The feature set to be predicted With the Support vector feature set The kernel function (for calculating similarity); For model bias terms; It is a symbolic function; (4) Detection Result Fusion Unit: A weighted fusion algorithm is used to fuse the results of static real-time detection, dynamic real-time detection, and unknown vulnerability prediction. Specifically, it includes: set up For static real-time detection results, weights ; For dynamic real-time detection results, weights ; Weighting of prediction results for unknown vulnerabilities ; Integrated vulnerability detection results As shown below: ; when When a vulnerability is detected, the detection results are transmitted to the vulnerability precise location module; when When it is identified as a suspected vulnerability, developers are prompted to conduct further investigation; when At that time, it was determined that there were no vulnerabilities.

[0010] The preferred implementation process of the vulnerability precise location module is as follows: (1) Combine abstract syntax tree, code execution log and context information to extract vulnerability-related feature information; (2) Using a code tracing algorithm, the source of the vulnerability is traced based on the timestamp of the vulnerability trigger and the code modification record; (3) Introduce a key information extraction mechanism and a lightweight key field identification method based on operand awareness. By analyzing the changes in the conditional branch operands before and after the mutation, identify the input bytes related to the vulnerability and reduce the scope of vulnerability investigation. set up For the set of input bytes, any input byte. With the branch where the vulnerability is located correlation As shown below: ; in, For input bytes Branch after mutation The change in operands; For branches The maximum value of the operands; when At that time, it was determined that the input bytes were highly correlated with the vulnerability; (4) Output a vulnerability location report, specifying the file path, line number, function name, vulnerability type and triggering conditions of the vulnerability, and marking the scope of the vulnerability's impact. The location results are then transmitted to the vulnerability risk quantification assessment module and the visualization interaction module.

[0011] Preferably, the implementation process of the vulnerability risk quantification assessment module is as follows: (1) Construct a vulnerability risk assessment indicator system, including 4 primary indicators and 13 secondary indicators, as follows: Severity of harm, weighted at 0.4: includes risks of data breach, system crash, malfunction, and privacy breach; Scope of impact, weighted at 0.2: includes the number of affected users, the number of affected modules, and the scope of affected business. Vulnerability exploitability, weight 0.2: includes attack difficulty, exploitation cost, and exploitation success rate; Repair difficulty, weight 0.2: includes the amount of code to be repaired, the time required to repair, and the technical complexity; (2) The weights of each secondary indicator are determined by the analytic hierarchy process, and the scores of each indicator are determined by the expert scoring method. (3) Calculate the vulnerability risk value As shown below: ; in, For the first The weight of each primary indicator, For the first The first primary indicator The weights of each secondary indicator, For the first The first primary indicator Scoring of each secondary indicator; (4) Based on vulnerability risk value The vulnerabilities are classified into 5 severity levels, as follows: Fatal vulnerability, S≥9: Must be fixed immediately; High-risk vulnerabilities, 7≤S<9: highest priority for remediation; Medium-risk vulnerabilities, 5≤S<7: medium priority for remediation; Low-risk vulnerabilities, 3≤S<5: lower priority for remediation; Minor vulnerability, S<3: Further optimization is needed; (5) Output a vulnerability risk assessment report, specifying the vulnerability's risk value, severity level, remediation priority, and impact analysis, and transmit the assessment results to the dynamic remediation guidance module and the visualization interaction module.

[0012] Preferably, the implementation process of the dynamic repair guidance module is as follows: (1) Based on the code defect knowledge graph, associate vulnerability types with remediation solutions, establish a remediation solution library, which includes standard remediation code, remediation steps and precautions for various vulnerabilities; (2) Based on the vulnerability location results, extract the core issues of the vulnerability and match suitable remediation solutions from the remediation solution library; (3) For complex vulnerabilities, virtual patching technology is used to generate temporary repair scripts without modifying the source code, thereby mitigating the vulnerability risk and providing long-term repair suggestions. (4) Real-time push of repair suggestions to the developer's development tool interface, including repair code examples, repair steps, and precautions during the repair process. Developers can directly refer to the repair suggestions to modify the code. After the modification is completed, the system will automatically perform real-time detection on the repaired code to verify whether the vulnerability has been successfully repaired. If the repair fails, the system will re-analyze the cause of the vulnerability and update the repair suggestions.

[0013] Preferably, the implementation process of the data storage module is as follows: The data storage module includes the following data types: code collection data, vulnerability detection data, vulnerability location data, risk assessment data, remediation record data, code defect knowledge graph data, and system configuration data. Relational databases store structured data, such as vulnerability detection results, risk assessment results, remediation records, user information, and system configuration parameters. Non-relational databases store unstructured data, such as source code snippets, abstract syntax trees, code logs, context information, and vulnerability remediation solutions. At the same time, a data backup mechanism should be established to regularly back up the stored data to prevent data loss; a data encryption mechanism should be established to encrypt and store sensitive data to ensure data security.

[0014] Preferably, the implementation process of the visual interaction module is as follows: Real-time monitoring interface: Displays the real-time status of vulnerability detection during the software development process, including the number of vulnerabilities, vulnerability types, severity distribution, and remediation progress; Vulnerability Details Interface: Displays detailed information about a single vulnerability, including location information, risk assessment results, remediation suggestions, and remediation history; Data statistics interface: Statistics on vulnerability detection and remediation data, generating visual charts; System configuration interface: Allows users to set system parameters; Developers and testers can view vulnerability information, receive remediation prompts, and perform vulnerability remediation verification through a visual interactive interface. They can also export vulnerability detection reports and risk assessment reports.

[0015] Preferably, the implementation process of the iterative optimization module is as follows: (1) Collect vulnerability remediation records in real time and analyze the shortcomings in the vulnerability detection and remediation process; (2) Based on the repair records, update the code defect knowledge graph and vulnerability feature library, supplement new vulnerability features and repair solutions, optimize the pattern matching algorithm and improve the parameters of the support vector machine prediction model; (3) Optimize the weighting and scoring criteria of vulnerability risk assessment indicators through user feedback and detection data statistics; (4) Optimize the algorithms for code collection and vulnerability detection to reduce system resource consumption; (5) Establish a system iterative update mechanism, regularly push system update packages, and realize automatic updates of algorithms, feature libraries and functional modules.

[0016] Therefore, the present invention employs the above-mentioned application software development and testing system with real-time vulnerability detection, and the beneficial effects are as follows: (1) Strong real-time performance: Real-time vulnerability detection is realized throughout the entire software development process. Vulnerabilities are captured from the code writing stage. Developers can obtain vulnerability prompts in real time, avoid the accumulation of vulnerabilities, and reduce the cost of repair. (2) High detection accuracy: It integrates three detection methods: static, dynamic and unknown vulnerability prediction. Combined with context awareness and branch coverage analysis, it effectively reduces missed detections and false detections, and can accurately identify known vulnerabilities, unknown vulnerabilities and hidden vulnerabilities. (3) Precise location: It can clearly identify the code segment, line number, function and scope of impact of the vulnerability, and provide a detailed location report to facilitate developers to quickly identify the vulnerability; (4) Risk quantification: Construct a scientific risk assessment system to realize the quantitative calculation of vulnerability risks, clarify the remediation priority, help developers allocate resources efficiently, and improve remediation efficiency; (5) Closed-loop management: Form a closed-loop system of detection-location-evaluation-repair-verification-optimization to achieve full life-cycle management of vulnerabilities, while continuously optimizing system performance to meet the needs of different types of application software development; (6) High efficiency and low resource consumption: Reduce the proportion of redundant tests, optimize the detection algorithm, and adopt lightweight instrumentation technology. While ensuring the detection effect, reduce the system resource consumption, do not affect the normal work of developers, and shorten the software development and testing cycle.

[0017] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the architecture of an application software development and testing system with real-time vulnerability detection. Figure 2 This is a schematic diagram of the architecture of the real-time code acquisition module of this invention; Figure 3 This is a schematic diagram of the architecture of the multi-dimensional vulnerability detection module of the present invention. Detailed Implementation

[0019] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0020] like Figure 1 As shown, the present invention provides an application software development and testing system with real-time vulnerability detection, including a real-time code acquisition module, a multi-dimensional vulnerability detection module, a vulnerability precise location module, a vulnerability risk quantification and assessment module, a dynamic remediation guidance module, a data storage module, a visualization interaction module, and an iterative optimization module. The modules work together to form a closed-loop vulnerability detection and control system.

[0021] Example 1. Real-time code acquisition module: This module is used to collect source code, code modification records, compilation logs, and runtime context information during the application software development process in real time. It establishes real-time linkage between the development and testing processes and provides data support for real-time vulnerability detection.

[0022] like Figure 2 As shown, the real-time code acquisition module specifically includes: a code acquisition unit, a context information acquisition unit, and a data preprocessing unit.

[0023] (1) Code collection unit: By interface with mainstream development tools (such as VS Code, IntelliJ IDEA, Android Studio), a real-time listening mechanism is adopted to capture every operation of developers in writing, modifying and saving code. Source code fragments, code differences before and after modification and code writing timestamps are collected in real time. The collection frequency is set to 1 time / second to 5 times / second according to development needs to ensure the real-time nature of code data.

[0024] (2) Context information collection unit: collects multi-dimensional context data of the development environment in real time, including user identity, device status, network environment, code running dependency environment, operation behavior, etc. The specific collection content is implemented through the following code snippet as shown in Table 1.

[0025] Table 1 Content Acquisition Code Snippets

[0026] (3) Data preprocessing unit: Cleans, deduplicates, and standardizes the collected code data and context information, removes invalid data (such as blank code and duplicate modification records), converts the source code into a standardized syntax format, extracts code features including function names, variable names, branch structures and call relationships, and transmits the preprocessed data to the multi-dimensional vulnerability detection module and data storage module.

[0027] 2. The multi-dimensional vulnerability detection module, as the core module of the system, is used to perform real-time vulnerability detection on the collected preprocessed data. It integrates three detection methods: static real-time detection, dynamic real-time detection, and unknown vulnerability prediction, to achieve multi-dimensional and comprehensive vulnerability capture and solve the problems of missed detection, false detection, and inability to identify unknown vulnerabilities in existing technologies.

[0028] like Figure 3 As shown, the multi-dimensional vulnerability detection module specifically includes: a static real-time detection unit, a dynamic real-time detection unit, an unknown vulnerability prediction unit, and a detection result fusion unit.

[0029] (1) Static real-time detection unit.

[0030] Employing an improved syntax and semantic analysis algorithm, the system performs online static analysis on the source code collected in real time. It can detect syntax errors, logical vulnerabilities, and security vulnerabilities (such as SQL injection, cross-site scripting (XSS), and null pointer references) in real time without waiting for the code to be compiled.

[0031] ① Construct an Abstract Syntax Tree (AST) from the preprocessed source code. Use a syntax parser to convert the source code into an AST and extract the syntax structure, function call relationships, variable definitions and usage.

[0032] ② Based on the constructed abstract syntax tree, combined with the pre-set vulnerability feature library (containing the syntax patterns and logical features of common vulnerabilities), a pattern matching algorithm is used to detect known vulnerabilities in the source code in real time; among them, the vulnerability feature library adopts a dynamic update mechanism, and is updated in real time through iterative optimization modules and external vulnerability libraries (such as the CVE vulnerability library).

[0033] ③ Introduce a branch coverage analysis mechanism to monitor conditional branches in the code in real time, extract branch guidance information, and represent it as a six-tuple, as shown below: ; in, This represents the branch label value (uniquely identifying the conditional branch); Indicates branch jump condition operators (equal to, not equal to, greater than, etc.); Indicates the target operand of the branch; Indicates the operand width; and This represents the edge label values ​​between the base block containing the branch and two subsequent branches. Analysis of branch coverage status includes uncovered branches. semi-coverage and full coverage The focus is on detecting potential vulnerabilities in partially covered branches. The formula for calculating branch coverage is: ; in, Indicates branch coverage; Represents the set of branches that are covered; Represents the set of main branches; when When this happens, the system automatically marks it as a high-risk branch and focuses on vulnerability detection.

[0034] (2) Dynamic real-time detection unit.

[0035] Dynamic instrumentation technology is used to insert detection code during real-time code execution, which monitors the code's running status, function call flow, data transmission process and resource usage in real time, and captures runtime vulnerabilities (such as memory leaks, deadlocks and buffer overflows).

[0036] ① Lightweight instrumentation code is automatically inserted during code compilation, requiring no manual operation from developers. The instrumentation code consumes very low system resources (CPU usage ≤5%, memory usage ≤3%), and does not affect developers' normal development work.

[0037] ② Monitor key parameters during code execution in real time, including memory allocation and release, thread running status, function execution time, and data input / output validity, and establish a runtime behavior baseline.

[0038] ③ A behavior-based anomaly detection algorithm is adopted to compare real-time runtime behavior with a preset behavior baseline. When anomalies occur, such as continuous memory growth without release, thread blocking exceeding a preset threshold, or data input not conforming to specifications, a vulnerability alarm is immediately triggered, and detailed information about the anomaly is recorded, including the time of occurrence, the code segment involved, and the runtime context. The determination of the anomaly judgment threshold is as follows: set up This refers to the real-time monitoring value of a certain operating parameter. This is the historical average value of the parameter during normal operation. For standard deviation, when When this occurs, it is identified as abnormal behavior, triggering a vulnerability alert.

[0039] ④ Introduce a context-aware vulnerability detection mechanism. Combine the multi-dimensional data collected by the context information collection unit to accurately detect vulnerabilities such as SQL injection and cross-site scripting, avoiding false detections caused by a single data dimension. The specific detection logic is implemented through the code snippets in Table 2.

[0040] Table 2 Detection logic code snippets

[0041] (3) Unknown vulnerability prediction unit.

[0042] Based on an improved support vector machine (SVM) and a code defect knowledge graph, this technology enables real-time prediction of unknown vulnerabilities, addressing the shortcomings of existing technologies that cannot identify unknown vulnerabilities.

[0043] ① Construct a code defect knowledge graph. Based on historical vulnerability databases, CVE vulnerability databases, and vulnerability remediation records during the development process, associate code patterns, vulnerability types, remediation solutions, and contextual information to form a complete defect knowledge network and achieve multi-dimensional association of vulnerability features.

[0044] ② Extract key features from the code, including branch complexity, call frequency, modification history, and contextual features, and use feature selection functions. From the original feature set Select a subset of features useful for vulnerability prediction. ,Right now The feature subset is preprocessed to obtain a standardized feature set, as shown below: ; in, This is a preprocessing function (implementing standardization and normalization operations).

[0045] ③ Construct an improved support vector machine prediction model. Train the model using historical vulnerability data and code feature data, optimize model parameters, and avoid the problems of inaccurate parameter adjustment and overfitting in traditional SVM models in complex software testing.

[0046] The model training process is represented as follows: ; in, For training set; For training functions; The trained prediction model.

[0047] ④ The model parameter optimization adopts the constrained maximization algorithm. Let the parameter set be... The optimization process is represented as follows: ; in, The number of samples in the training set; , The first Features and labels of each sample; Predict probabilities for the model; The regularization coefficient is used. It is the sum of squares of the second norm of the parameter (to prevent overfitting).

[0048] ⑤ Input the real-time collected code features into the trained prediction model, and output the predicted probability and type of unknown vulnerabilities. When the predicted probability is greater than or equal to 85%, an unknown vulnerability warning is triggered, prompting developers to focus on investigation. The formula for calculating the unknown vulnerability prediction result is as follows: ; in, The predicted result is shown in the figure (positive numbers indicate the existence of unknown vulnerabilities, and negative numbers indicate their non-existence). This refers to the number of support vectors. For the first The weights of the support vectors; Support vector labels; The feature set to be predicted With the Support vector feature set The kernel function (for calculating similarity); For model bias terms; It is a symbolic function.

[0049] (4) Detection result fusion unit.

[0050] A weighted fusion algorithm is adopted to combine the results of static real-time detection, dynamic real-time detection, and unknown vulnerability prediction, thereby eliminating the limitations of a single detection method and improving the accuracy of vulnerability detection.

[0051] set up The results are static real-time detection results (1 indicates the presence of a vulnerability, 0 indicates its absence), with weights. ; For dynamic real-time detection results (1 indicates the existence of a vulnerability, 0 indicates its absence), the weights are... ; The weights are the prediction results for unknown vulnerabilities (values ​​range from 0 to 1, representing the probability of vulnerability existence). ; Integrated vulnerability detection results As shown below: ; when When a vulnerability is detected, the detection results are transmitted to the vulnerability precise location module; when When it is identified as a suspected vulnerability, developers are prompted to conduct further investigation; when At that time, it was determined that there were no vulnerabilities.

[0052] 3. The vulnerability precise location module is used to accurately locate detected vulnerabilities, identify the code segment, function, line number and scope of impact of the vulnerability, and solve the problem of vague vulnerability location and difficulty in rapid investigation in existing technologies.

[0053] (1) Combine abstract syntax tree, code execution log and context information to extract vulnerability-related feature information (such as vulnerability type, triggering conditions, involved variables, and call relationships).

[0054] (2) Use code tracing algorithm to trace the source of vulnerability (such as the writing stage, modification stage, and integration stage) based on the timestamp of vulnerability triggering and code modification record.

[0055] (3) Introduce a key information extraction mechanism and a lightweight key field identification method based on operand awareness. By analyzing the changes in the conditional branch operands before and after the mutation, the input bytes related to the vulnerability can be quickly identified, thus reducing the scope of vulnerability investigation.

[0056] set up For the set of input bytes, any input byte. With the branch where the vulnerability is located correlation As shown below: ; in, For input bytes Branch after mutation The change in operands; For branches The maximum value of the operands; when If the input byte is determined to be highly relevant to the vulnerability, it will be the focus of the vulnerability investigation.

[0057] (4) Output a vulnerability location report, specifying the file path, line number, function name, vulnerability type and triggering conditions of the vulnerability, and also indicate the scope of the vulnerability's impact (such as the affected modules, functions and user groups), and transmit the location results to the vulnerability risk quantification assessment module and the visualization interaction module.

[0058] 4. The vulnerability risk quantification assessment module is used to quantify and assess detected vulnerabilities, determine their severity level and remediation priority, provide developers with scientific remediation guidance, and solve the problem of lack of quantitative basis for vulnerability risk assessment in existing technologies.

[0059] (1) Construct a vulnerability risk assessment indicator system, including 4 primary indicators and 13 secondary indicators, as follows: Severity of harm (weight 0.4): includes risks of data breach, system crash, malfunction, and privacy breach; Scope of impact (weight 0.2): includes the number of affected users, the number of affected modules, and the scope of affected business. Vulnerability exploitability (weight 0.2): includes attack difficulty, exploitation cost, and exploitation success rate; Repair difficulty (weight 0.2): includes the amount of code to be repaired, the time required to repair, and the technical complexity.

[0060] (2) The weight of each secondary indicator is determined by the Analytic Hierarchy Process (AHP), and the score of each indicator is determined by the expert scoring method (0~10 points, the higher the score, the higher the risk).

[0061] (3) Calculate the vulnerability risk value As shown below: ; in, For the first The weight of each primary indicator, For the first The first primary indicator The weights of each secondary indicator, For the first The first primary indicator Scoring of each secondary indicator.

[0062] (4) Based on vulnerability risk value The vulnerabilities are classified into 5 severity levels, as follows: Critical vulnerabilities (S≥9): These could lead to system crashes and large-scale data breaches, and must be fixed immediately. High-risk vulnerabilities (7≤S<9): may cause complete functional abnormality and partial data leakage, and have the highest priority for remediation; Medium-risk vulnerability (5≤S<7): May cause some functions to malfunction, no serious data leakage risk, medium priority for remediation; Low-risk vulnerabilities (3≤S<5): only affect local functionality, pose no risk of data leakage, and have a low priority for remediation; Minor vulnerabilities (S<3): Do not affect the use of functionality, only have code non-standard issues, and can be optimized later.

[0063] (5) Output a vulnerability risk assessment report, specifying the vulnerability's risk value, severity level, remediation priority, and impact analysis, and transmit the assessment results to the dynamic remediation guidance module and the visualization interaction module.

[0064] 5. The dynamic remediation guidance module provides developers with real-time and accurate vulnerability remediation suggestions based on vulnerability type, location results, and risk assessment results, thereby shortening vulnerability remediation time.

[0065] (1) Based on the code defect knowledge graph, associate vulnerability types with remediation solutions, establish a remediation solution library, which includes standard remediation code, remediation steps and precautions for various vulnerabilities.

[0066] (2) Combine the vulnerability location results (code snippets, functions, line numbers) to extract the core issues of the vulnerability (such as syntax errors, logical defects, security risks) and match the most suitable remediation solution from the remediation solution library.

[0067] (3) For complex vulnerabilities (such as unknown vulnerabilities and multi-module related vulnerabilities), virtual patching technology is used to generate temporary repair scripts without modifying the source code, thereby mitigating the vulnerability risk and providing long-term repair suggestions.

[0068] (4) Real-time push of repair suggestions to the developer's development tool interface, including repair code examples, repair steps, and precautions during the repair process. Developers can directly refer to the repair suggestions to modify the code. After the modification is completed, the system will automatically perform real-time detection on the repaired code to verify whether the vulnerability has been successfully repaired. If the repair fails, the system will re-analyze the cause of the vulnerability and update the repair suggestions.

[0069] 6. Data storage module, used to store all data during system operation. It adopts a distributed storage architecture, combining relational databases (such as MySQL) and non-relational databases (such as MongoDB) to achieve efficient data storage and fast query.

[0070] The data storage module includes the following data types: code collection data, vulnerability detection data, vulnerability location data, risk assessment data, remediation record data, code defect knowledge graph data, and system configuration data.

[0071] Relational databases store structured data, such as vulnerability detection results, risk assessment results, remediation records, user information, and system configuration parameters.

[0072] Non-relational databases store unstructured data, such as source code snippets, abstract syntax trees, code logs, context information, and vulnerability remediation solutions.

[0073] At the same time, establish a data backup mechanism to regularly back up the stored data (which can be set to daily backup or weekly full backup) to prevent data loss; establish a data encryption mechanism to encrypt and store sensitive data (such as source code and vulnerability information) to ensure data security.

[0074] 7. Visual interaction module, which provides developers and testers with an intuitive interactive interface to display vulnerability detection results, location information, risk assessment results, remediation suggestions and system running status.

[0075] Real-time monitoring interface: Displays the real-time status of vulnerability detection during the software development process, including the number of vulnerabilities, vulnerability types, severity levels, and remediation progress.

[0076] Vulnerability Details Interface: Displays detailed information about a single vulnerability, including location information, risk assessment results, remediation suggestions, and remediation history.

[0077] Data statistics interface: Statistics on vulnerability detection data and remediation data, generating visual charts (such as vulnerability type distribution chart, severity level distribution chart, and remediation progress chart) to provide data support for development management.

[0078] System configuration interface: Allows users to set system parameters, such as code collection frequency, vulnerability detection threshold, weight parameters, data backup cycle, etc.

[0079] Developers and testers can view vulnerability information, receive remediation prompts, and perform vulnerability remediation verification through a visual interactive interface. They can also export vulnerability detection reports and risk assessment reports for project management and auditing.

[0080] 8. Iterative optimization module, used to continuously optimize the system's vulnerability detection algorithm, vulnerability signature library, risk assessment indicators and remediation solution library based on vulnerability remediation records and detection result feedback, so as to improve the system's detection accuracy and efficiency.

[0081] (1) Collect vulnerability repair records in real time, including repair solutions, repair effects, problems encountered during the repair process, and analyze the shortcomings in the vulnerability detection and repair process.

[0082] (2) Based on the repair records, update the code defect knowledge graph and vulnerability feature library, supplement new vulnerability features and repair solutions, optimize the pattern matching algorithm and improve the parameters of the support vector machine prediction model.

[0083] (3) Optimize the weight and scoring criteria of vulnerability risk assessment indicators through user feedback and detection data statistics to improve the accuracy of risk assessment.

[0084] (4) Optimize the algorithms for code collection and vulnerability detection, reduce system resource consumption, improve detection speed, and further reduce the proportion of redundant tests, with the goal of controlling the proportion of redundant tests to within 10%.

[0085] (5) Establish a system iterative update mechanism, regularly push system update packages, realize automatic updates of algorithms, feature libraries and functional modules without manual operation by users.

[0086] Therefore, the present invention employs the above-mentioned application software development and testing system with real-time vulnerability detection, which realizes real-time vulnerability capture, accurate location, quantitative evaluation, dynamic repair guidance and iterative optimization throughout the entire software development process, shortens the testing cycle, reduces repair costs, and improves the security and development efficiency of applications.

[0087] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. An application software development and testing system with real-time vulnerability detection, characterized in that, It includes a real-time code acquisition module, which is used to collect source code, code modification records, compilation logs and runtime context information in real time during the application software development process, and establish real-time linkage between the development process and the testing process; The multi-dimensional vulnerability detection module is used to perform real-time vulnerability detection on the collected pre-processed data, integrating three detection methods: static real-time detection, dynamic real-time detection, and unknown vulnerability prediction. The vulnerability precise location module is used to accurately locate detected vulnerabilities, and to identify the code segment, function, line number, and scope of impact of the vulnerability. The vulnerability risk quantification assessment module is used to quantify and assess detected vulnerabilities, determine their severity level, and prioritize remediation efforts. The dynamic remediation guidance module provides real-time vulnerability remediation suggestions based on vulnerability type, location results, and risk assessment results. The data storage module is used to store all data during system operation. It adopts a distributed storage architecture, combining relational databases and non-relational databases to realize data storage and retrieval. The visual interaction module provides an intuitive interface to display vulnerability detection results, location information, risk assessment results, remediation suggestions, and system operating status. The iterative optimization module is used to continuously optimize the system's vulnerability detection algorithm, vulnerability signature library, risk assessment indicators, and remediation solution library based on vulnerability remediation records and detection result feedback.

2. The application software development and testing system with real-time vulnerability detection according to claim 1, characterized in that, The real-time code acquisition module includes: a code acquisition unit, a context information acquisition unit, and a data preprocessing unit; (1) Code collection unit: By interface with the development tools, a real-time monitoring mechanism is adopted to capture every operation of the developer in writing, modifying and saving code. Source code fragments, code differences before and after modification and code writing timestamps are collected in real time. The collection frequency is set according to the development needs to ensure the real-time nature of code data. (2) Context information collection unit: collects multi-dimensional context data of the development environment in real time, including user identity, device status, network environment, code running dependency environment, and operation behavior; (3) Data preprocessing unit: Cleans, deduplicates, and standardizes the collected code data and context information, removes invalid data, converts the source code into a standardized syntax format, extracts code features, and transmits the preprocessed data to the multi-dimensional vulnerability detection module and data storage module.

3. The application software development and testing system with real-time vulnerability detection according to claim 1, characterized in that, The multi-dimensional vulnerability detection module specifically includes: a static real-time detection unit, a dynamic real-time detection unit, an unknown vulnerability prediction unit, and a detection result fusion unit; (1) Static Real-time Detection Unit: Employs an improved syntax and semantic analysis algorithm to perform online static analysis on the real-time acquired source code, specifically including: ① Construct an abstract syntax tree for the preprocessed source code. The source code is converted into an abstract syntax tree by a syntax parser to extract the syntax structure, function call relationships, variable definitions and usage. ② Based on the constructed abstract syntax tree and combined with the pre-set vulnerability feature library, a pattern matching algorithm is used to detect known vulnerabilities in the source code in real time; the vulnerability feature library adopts a dynamic update mechanism and is updated in real time through iterative optimization modules and external vulnerability libraries. ③ Introduce a branch coverage analysis mechanism to monitor conditional branches in the code in real time, extract branch guidance information, and represent it as a six-tuple, as shown below: ； in, Indicates the branch label value; Indicates a branch jump conditional operator; Indicates the target operand of the branch; Indicates the operand width; and This represents the edge label values ​​between the basic block containing the branch and the two subsequent branches; it analyzes the branch coverage status, including uncovered branches. semi-coverage and full coverage The focus is on detecting potential vulnerabilities in partially covered branches. The formula for calculating branch coverage is: ； in, Indicates branch coverage; Represents the set of branches that are covered; Represents the set of main branches; (2) Dynamic Real-Time Detection Unit: Employing dynamic instrumentation technology, detection code is inserted during real-time code execution to monitor the code's running status, function call flow, data transmission process, and resource usage in real time, thereby capturing runtime vulnerabilities. Specifically, this includes: ① Automatically insert lightweight detection instrumentation code during code compilation; ② Monitor key parameters during code execution in real time, including memory allocation and release, thread running status, function execution time, and data input / output validity, and establish a runtime behavior baseline; ③ A behavior-based anomaly detection algorithm is adopted to compare real-time runtime behavior with a preset behavior baseline. When abnormal behavior occurs, a vulnerability alarm is immediately triggered, and detailed information about the abnormal behavior is recorded. The determination of the anomaly judgment threshold is as follows: set up These are real-time monitoring values ​​of the operating parameters. The parameter represents the historical average value during normal operation. For standard deviation, when When this occurs, it is identified as abnormal behavior, triggering a vulnerability alert; ④ Introduce a context-aware vulnerability detection mechanism, which combines multi-dimensional data collected by the context information collection unit to detect vulnerabilities and avoid false detections caused by a single data dimension. (3) Unknown Vulnerability Prediction Unit: Based on an improved support vector machine and a code defect knowledge graph, it realizes real-time prediction of unknown vulnerabilities, specifically including: ① Construct a code defect knowledge graph. Based on historical vulnerability databases, CVE vulnerability databases, and vulnerability remediation records during the development process, associate code patterns, vulnerability types, remediation solutions, and contextual information to form a complete defect knowledge network and realize multi-dimensional association of vulnerability features. ② Extract key features from the code and use feature selection functions. From the original feature set Select a subset of features useful for vulnerability prediction. ,Right now The feature subset is preprocessed to obtain a standardized feature set, as shown below: ； in, This is a preprocessing function; ③ Construct an improved support vector machine prediction model, train the model using historical vulnerability data and code feature data, and optimize the model parameters; the model training process is represented as follows: ； in, For training set; For training functions; For the trained prediction model; ④ The model parameter optimization adopts the constrained maximization algorithm. Let the parameter set be... The optimization process is represented as follows: ； in, The number of samples in the training set; , The first Features and labels of each sample; Predict probabilities for the model; The regularization coefficient is used. Let be the sum of squares of the parametric 2 norms; ⑤ Input the real-time collected code features into the trained prediction model, and output the predicted probability and type of unknown vulnerabilities. When the predicted probability is greater than or equal to 85%, an unknown vulnerability warning is triggered, prompting developers to focus on investigation. The formula for calculating the unknown vulnerability prediction result is as follows: ； in, For the prediction results, positive numbers indicate the existence of unknown vulnerabilities, and negative numbers indicate their non-existence; This refers to the number of support vectors. For the first The weights of the support vectors; Support vector labels; The feature set to be predicted With the Support vector feature set The kernel function (for calculating similarity); For model bias terms; It is a symbolic function; (4) Detection Result Fusion Unit: A weighted fusion algorithm is used to fuse the results of static real-time detection, dynamic real-time detection, and unknown vulnerability prediction. Specifically, it includes: set up For static real-time detection results, weights ; For dynamic real-time detection results, weights ; Weighting of prediction results for unknown vulnerabilities ; Integrated vulnerability detection results As shown below: ； when When a vulnerability is detected, the detection results are transmitted to the vulnerability precise location module; when When it is identified as a suspected vulnerability, developers are prompted to conduct further investigation; when At that time, it was determined that there were no vulnerabilities.

4. The application software development and testing system with real-time vulnerability detection according to claim 1, characterized in that, The implementation process of the vulnerability precise location module is as follows: (1) Combine abstract syntax tree, code execution log and context information to extract vulnerability-related feature information; (2) Using a code tracing algorithm, the source of the vulnerability is traced based on the timestamp of the vulnerability trigger and the code modification record; (3) Introduce a key information extraction mechanism and a lightweight key field identification method based on operand awareness. By analyzing the changes in the conditional branch operands before and after the mutation, identify the input bytes related to the vulnerability and reduce the scope of vulnerability investigation. set up For the set of input bytes, any input byte. With the branch where the vulnerability is located correlation As shown below: ； in, For input bytes Branch after mutation The change in operands; For branches The maximum value of the operands; when At that time, it was determined that the input bytes were highly correlated with the vulnerability; (4) Output a vulnerability location report, specifying the file path, line number, function name, vulnerability type and triggering conditions of the vulnerability, and marking the scope of the vulnerability's impact. The location results are then transmitted to the vulnerability risk quantification assessment module and the visualization interaction module.

5. The application software development and testing system with real-time vulnerability detection according to claim 1, characterized in that, The implementation process of the vulnerability risk quantification and assessment module is as follows: (1) Construct a vulnerability risk assessment indicator system, including 4 primary indicators and 13 secondary indicators, as follows: Severity of harm, weighted at 0.4: includes risks of data breach, system crash, malfunction, and privacy breach; Scope of impact, weighted at 0.2: includes the number of affected users, the number of affected modules, and the scope of affected business. Vulnerability exploitability, weight 0.2: includes attack difficulty, exploitation cost, and exploitation success rate; Repair difficulty, weight 0.2: includes the amount of code to be repaired, the time required to repair, and the technical complexity; (2) The weights of each secondary indicator are determined by the analytic hierarchy process, and the scores of each indicator are determined by the expert scoring method. (3) Calculate the vulnerability risk value As shown below: ； in, For the first The weight of each primary indicator, For the first The first-level indicator The weights of each secondary indicator, For the first The first-level indicator Scoring of each secondary indicator; (4) Based on vulnerability risk value The vulnerabilities are classified into 5 severity levels, as follows: Fatal vulnerability, S≥9: Must be fixed immediately; High-risk vulnerabilities, 7≤S<9: highest priority for remediation; Medium-risk vulnerabilities, 5≤S<7: medium priority for remediation; Low-risk vulnerabilities, 3≤S<5: lower priority for remediation; Minor vulnerability, S<3: Further optimization is needed; (5) Output a vulnerability risk assessment report, specifying the vulnerability's risk value, severity level, remediation priority, and impact analysis, and transmit the assessment results to the dynamic remediation guidance module and the visualization interaction module.

6. The application software development and testing system with real-time vulnerability detection according to claim 1, characterized in that, The implementation process of the dynamic repair guidance module is as follows: (1) Based on the code defect knowledge graph, associate vulnerability types with remediation solutions, establish a remediation solution library, which includes standard remediation code, remediation steps and precautions for various vulnerabilities; (2) Based on the vulnerability location results, extract the core issues of the vulnerability and match suitable remediation solutions from the remediation solution library; (3) For complex vulnerabilities, virtual patching technology is used to generate temporary repair scripts without modifying the source code, thereby mitigating the vulnerability risk and providing long-term repair suggestions. (4) Real-time push of repair suggestions to the developer's development tool interface, including repair code examples, repair steps, and precautions during the repair process. Developers can directly refer to the repair suggestions to modify the code. After the modification is completed, the system will automatically perform real-time detection on the repaired code to verify whether the vulnerability has been successfully repaired. If the fix fails, the system will re-analyze the cause of the vulnerability and update the fix recommendations.

7. The application software development and testing system with real-time vulnerability detection according to claim 1, characterized in that, The implementation process of the data storage module is as follows: The data storage module includes the following data types: code collection data, vulnerability detection data, vulnerability location data, risk assessment data, remediation record data, code defect knowledge graph data, and system configuration data. Relational databases store structured data, such as vulnerability detection results, risk assessment results, remediation records, user information, and system configuration parameters. Non-relational databases store unstructured data, such as source code snippets, abstract syntax trees, code logs, context information, and vulnerability remediation solutions. At the same time, a data backup mechanism should be established to regularly back up the stored data to prevent data loss; a data encryption mechanism should be established to encrypt and store sensitive data to ensure data security.

8. The application software development and testing system with real-time vulnerability detection according to claim 1, characterized in that, The implementation process of the visual interaction module is as follows: Real-time monitoring interface: Displays the real-time status of vulnerability detection during the software development process, including the number of vulnerabilities, vulnerability types, severity distribution, and remediation progress; Vulnerability Details Interface: Displays detailed information about a single vulnerability, including location information, risk assessment results, remediation suggestions, and remediation history; Data statistics interface: Statistics on vulnerability detection and remediation data, generating visual charts; System configuration interface: Allows users to set system parameters; Developers and testers can view vulnerability information, receive remediation prompts, and perform vulnerability remediation verification through a visual interactive interface. They can also export vulnerability detection reports and risk assessment reports.

9. The application software development and testing system with real-time vulnerability detection according to claim 1, characterized in that, The implementation process of the iterative optimization module is as follows: (1) Collect vulnerability remediation records in real time and analyze the shortcomings in the vulnerability detection and remediation process; (2) Based on the repair records, update the code defect knowledge graph and vulnerability feature library, supplement new vulnerability features and repair solutions, optimize the pattern matching algorithm and improve the parameters of the support vector machine prediction model; (3) Optimize the weighting and scoring criteria of vulnerability risk assessment indicators through user feedback and detection data statistics; (4) Optimize the algorithms for code collection and vulnerability detection to reduce system resource consumption; (5) Establish a system iterative update mechanism, regularly push system update packages, and realize automatic updates of algorithms, feature libraries and functional modules.

Images