Code detection method, device and storage medium

Abstract

In the embodiments of the present application, a code detection method, device and storage medium are provided. Through the frequent sequence pattern mining method, the correct code sequence pattern is extracted according to the reference code set, and the security processing sequence pattern is extracted according to the correct code sequence pattern; the code defect sequence pattern is obtained according to the defect code set; the code sequence pattern to be detected is obtained according to the code to be detected; the code sequence pattern to be detected is matched with the code defect sequence pattern and / or the security processing sequence pattern to determine whether the code to be detected has defects according to the matching result. Therefore, on the one hand, a concise and accurate security processing sequence pattern is obtained through data mining for code detection, which effectively reduces the amount of data and improves the detection efficiency; on the other hand, the false alarm probability of the code can be reduced and the accuracy of code detection can be improved by combining the two-way detection of the security processing sequence pattern and the code defect sequence pattern.

Description

Technical Field

[0001] The present application relates to the field of computer programming technology, and in particular to a code detection method, device and storage medium. Background Art

[0002] Currently, when performing static code detection, the main method is to match the code to be detected with tainted data or universal security functions, or use preset code correct patterns to determine whether the code to be detected has defects.

[0003] However, all of the above methods have shortcomings. For example, if private security functions are processed in the code to be detected, the match with the general security function will fail, which can easily lead to false positives. In addition, the method of using only the code to be detected to match the tainted data also has a large false positive rate. In addition, if only the preset code correct pattern is used for judgment, the matching efficiency is low due to the large amount of data in the preset code correct pattern; and the code to be detected that violates the code correct pattern does not necessarily have defects, which can lead to false positives.

[0004] Therefore, how to find more accurate and efficient code detection methods has become a technical problem that needs to be solved urgently in the industry. Summary of the invention

[0005] In view of the above-mentioned shortcomings of the prior art, the purpose of the present application is to provide a code detection method, device and storage medium, which can improve the accuracy and efficiency of code detection through a two-way matching method with correct and defective patterns.

[0006] The first aspect of the present application provides a code detection method, comprising: extracting a correct code sequence pattern according to a reference code set through a frequent sequence pattern mining method, and extracting a safe processing sequence pattern according to the correct code sequence pattern; obtaining a code defect sequence pattern according to a defect code set; obtaining a code sequence pattern to be detected according to the code to be detected; matching the code sequence pattern to be detected with the code defect sequence pattern and / or the safe processing sequence pattern to determine whether the code to be detected has a defect based on the matching result; wherein the matching result refers to determining whether the code sequence pattern to be detected is a subset of the code defect sequence pattern and / or the safe processing sequence pattern.

[0007] In an embodiment of the first aspect, elements in the correct code sequence pattern, the defective code sequence pattern and the to-be-detected code sequence pattern are related to functions called sequentially in their respective corresponding codes.

[0008] In an embodiment of the first aspect, the method of extracting correct code sequence patterns according to a reference code set by using a frequent sequence pattern mining method, and extracting safe processing sequence patterns according to the correct code sequence patterns, includes: extracting a control flow graph according to the reference code set; mapping the function identifier of each function called by each basic block in the control flow graph into an item to form a calling function sequence corresponding to each basic block, each of the calling function sequences forming a calling function sequence database corresponding to the control flow graph; obtaining each correct code sequence pattern that meets a first support condition according to the calling function sequence database by using the frequent sequence pattern mining method, and selecting a safe processing sequence pattern that meets a second support condition from each of the correct code sequence patterns.

[0009] In an embodiment of the first aspect, the function identification comprises a function signature.

[0010] In an embodiment of the first aspect, mapping the function identifier into an item includes: calculating the characteristic value of the function identifier of each of the functions and using the characteristic value as the item; the code detection method includes: mapping each characteristic value in the selected correct sequence of codes that meets the second support condition into the function identifier of the corresponding function to form the security processing sequence pattern.

[0011] In an embodiment of the first aspect, the frequent sequence pattern mining method includes a frequent closed sequence pattern mining method, and the code correct sequence pattern and the security processing sequence pattern are closed sequences.

[0012] In an embodiment of the first aspect, obtaining a code defect sequence pattern based on a defect code set includes: extracting a first data flow graph based on the defect code set; and forming a code defect sequence pattern corresponding to each of the code features based on function identifiers of functions called by each code feature in the first data flow graph.

[0013] In an embodiment of the first aspect, obtaining the code sequence pattern to be detected of the code to be detected includes: extracting a second data flow graph according to the code to be detected; and forming the code sequence pattern to be detected according to the function identifier of each calling function in each of the second data flow graphs.

[0014] In an embodiment of the first aspect, the matching of the code sequence pattern to be detected with the code defect sequence pattern and / or the security processing sequence pattern to determine whether the code to be detected has a defect based on the matching result includes: matching the code sequence pattern to be detected with the code defect sequence pattern; if the match fails, determining that the code to be detected does not have a defect; if the match succeeds, matching the code sequence pattern to be detected with the security processing sequence pattern; if the match succeeds, determining that the code to be detected does not have a defect; if the match fails, determining that the code to be detected has a defect.

[0015] The second aspect of the present application provides a code detection device, including: a first code sequence pattern acquisition module, which is used to extract a correct code sequence pattern according to a reference code set through a frequent sequence pattern mining method, and extract a safe processing sequence pattern according to the correct code sequence pattern; a second code sequence pattern acquisition module, which is used to acquire a code defect sequence pattern according to a defect code set; a third code sequence pattern acquisition module, which is used to acquire a code sequence pattern to be detected according to the code to be detected; a code sequence pattern matching module, which is used to match the code sequence pattern to be detected with the code defect sequence pattern and / or the safe processing sequence pattern, so as to determine whether the code to be detected has a defect based on the matching result; wherein the matching result refers to determining whether the code sequence pattern to be detected is a subset of the code defect sequence pattern and / or the safe processing sequence pattern.

[0016] The third aspect of the present application provides a computer device, comprising: a memory and a processor; the memory stores program instructions; the processor is used to run the program instructions to execute the code detection method as described in the first aspect.

[0017] A fourth aspect of the present application provides a computer-readable storage medium storing program instructions, wherein the program instructions are executed to execute the code detection method as described in the first aspect.

[0018] In summary, the embodiments of the present application provide a code detection method, device and storage medium, which extracts the correct code sequence pattern according to the reference code set through the frequent sequence pattern mining method, and extracts the security processing sequence pattern according to the correct code sequence pattern; obtains the code defect sequence pattern according to the defect code set; obtains the code sequence pattern to be detected according to the code to be detected; matches the code sequence pattern to be detected with the code defect sequence pattern and / or the security processing sequence pattern, so as to judge whether the code to be detected has defects according to the matching results. On the one hand, by obtaining a streamlined and accurate security processing sequence pattern for code detection through frequent sequence pattern mining, the amount of data is effectively reduced and the detection efficiency is improved; on the other hand, by combining the two-way detection of the security processing sequence pattern and the code defect sequence pattern, the probability of false alarm of the code can be reduced and the accuracy of code detection can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A flowchart showing the code detection method in an embodiment of the present application is shown.

[0020] Figure 2 A schematic diagram showing a flow chart of obtaining a security processing sequence mode according to a reference code set in an embodiment of the present application.

[0021] Figure 3A schematic diagram showing the process of obtaining a code defect sequence pattern in an embodiment of the present application.

[0022] Figure 4 A schematic diagram showing the process of obtaining the code sequence pattern to be detected in an embodiment of the present application.

[0023] Figure 5 A schematic diagram showing the flow of matching the code to be detected with the defect sequence pattern and the safety processing sequence pattern in an embodiment of the present application.

[0024] Figure 6 A schematic diagram showing the functional modules of the code detection device in an embodiment of the present application is shown.

[0025] Figure 7 A schematic diagram showing the structure of a computer device in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0026] The following describes the implementation of the present application through specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the information disclosed in the present application. The present application can also be implemented or applied through other different specific implementations, and the details of each project in the present application can also be modified or changed in various ways according to different viewpoints and application systems without departing from the spirit of the present application. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0027] The following is a detailed description of the embodiments of the present application with reference to the accompanying drawings so that those skilled in the art can easily implement the present application. The present application can be embodied in a variety of different forms and is not limited to the embodiments described herein.

[0028] In the representations of the present application, the representations with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" etc. mean that the specific features, structures, materials or characteristics represented in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the represented specific features, structures, materials or characteristics may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples represented in the present application and the features of the different embodiments or examples, unless they contradict each other.

[0029] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the representation of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0030] In order to clearly describe the present application, components irrelevant to the description are omitted, and the same reference symbols are given to the same or similar components throughout the specification.

[0031] Throughout the specification, when a device is said to be "connected" to another device, this includes not only the case of "direct connection" but also the case of "indirect connection" by placing other elements therebetween. In addition, when a device is said to "include" a certain component, unless otherwise stated, it does not exclude other components, but means that other components may be included.

[0032] Although the terms first, second, etc. are used to represent various elements in some examples, these elements should not be limited by these terms. These terms are only used to distinguish one element from another element. For example, the first interface and the second interface, etc. are represented. Moreover, as used in this article, the singular forms "one", "one" and "the" are intended to also include plural forms, unless there is an opposite indication in the context. It should be further understood that the terms "comprising" and "including" indicate that there are the described features, steps, operations, elements, modules, projects, kinds, and / or groups, but do not exclude the existence, occurrence or addition of one or more other features, steps, operations, elements, modules, projects, kinds, and / or groups. The terms "or" and "and / or" used herein are interpreted as inclusive, or mean any one or any combination. Therefore, "A, B or C" or "A, B and / or C" means "any of the following: A; B; C; A and B; A and C; B and C; A, B and C". Only when the combination of elements, functions, steps or operations is inherently mutually exclusive in some way, will there be an exception to this definition.

[0033] The technical terms used herein are only used to refer to specific embodiments and are not intended to limit the present application. The singular form used herein also includes the plural form unless the sentence clearly indicates the contrary meaning. The meaning of "including" used in the specification is to specify specific characteristics, regions, integers, steps, operations, elements and / or components, and does not exclude the existence or addition of other characteristics, regions, integers, steps, operations, elements and / or components.

[0034] Although not defined differently, all terms, including technical and scientific terms used herein, have the same meaning as those generally understood by those skilled in the art to which this application belongs. Terms defined in commonly used dictionaries are additionally interpreted as having meanings consistent with relevant technical literature and the message of the present disclosure, and as long as they are not defined, they should not be overly interpreted as ideal or very formal meanings.

[0035] At present, in static code detection, the code to be detected is usually matched with tainted data or general security functions, or the preset code correct mode is used to detect defects, but there are various problems. On the one hand, using general tainted data or security functions to match the code to be detected will result in many false positives and poor accuracy; on the other hand, using the preset code correct mode for defect detection also has the problem of low matching efficiency due to the large amount of data used.

[0036] In view of this, a code detection method can be provided in an embodiment of the present application, which performs multiple mining operations through a frequent pattern mining method to extract a streamlined security processing sequence pattern from a reference code set for matching the code to be detected, thereby effectively reducing the amount of data and improving the code detection efficiency while maintaining the accuracy of detection; moreover, by combining two-way detection of security processing sequence patterns and code defect sequence patterns, the probability of false alarms can be reduced and the accuracy of code detection can be improved.

[0037] The following is a detailed description through multiple embodiments and drawings.

[0038] like Figure 1 As shown, a flow chart of the code detection method in an embodiment of the present application is shown.

[0039] In a specific example, the code detection method can be applied to code detection in various computer programming languages, such as Java, C, C++, C#, Python, HTML5, QML, etc.

[0040] In this embodiment, the code detection method specifically includes:

[0041] Step S101: extracting correct code sequence patterns according to a reference code set through a frequent sequence pattern mining method, and extracting secure processing sequence patterns according to the correct code sequence patterns.

[0042] In some embodiments, the frequent sequence pattern mining method mines corresponding patterns based on features that frequently appear in the code. The features can be exemplarily represented as functions called in sequence in the code. Therefore, the features of the code can be represented by forming a sequence of function identifiers of the called functions in the order of calling. In a specific example, the function identifier can be a function signature, which includes the function name and the number and type of parameters. For example, the execution statement is "pstmt=con.prepareStatemet(query)", the calling function is assumed to be "Connect.prepareStatemet()", and the parameter "query" type is a string, i.e. "String", then its function signature is represented as "Connect.prepareStatemet(String)".

[0043] The frequent sequence pattern mining method can be used to extract the "frequently" occurring function identification sequences from the reference code set. In the case of fewer code defects in the reference code set, that is, more correct code, the more "frequently" occurring function identification sequences of each calling function are likely to be more correct and safe.

[0044] In some embodiments, the reference code set may come from an open source code library, which may contain open source codes from different developers, including codes with private security functions. By performing frequent sequence pattern mining on such a reference code set, the correct sequence pattern of the code covering various private security functions may be obtained, and then the security processing sequence pattern may be extracted, thereby avoiding the problem of being unable to match the private security functions in the code to be detected during matching.

[0045] In frequent sequence pattern mining, there are terms such as item, item set and sequence. Among them, items occur in chronological order, and a collection of multiple items is a call function sequence. The call function sequence is also called an event, and events constitute a sequence in the chronological order of occurrence. Therefore, a sequence is a collection of call function sequences arranged in order. Frequent sequence pattern mining is to find the sequence that meets the frequent occurrence requirements in each sequence as a sequence pattern. The frequent occurrence requirement can be expressed in the form of support, such as a minimum support threshold N. The sequence that meets the requirements can be screened as a sequence pattern by requiring the sequence pattern to appear as a subset in each sequence more than N times.

[0046] Taking the mining process of "reference code set->code correct sequence pattern->safe processing sequence pattern" in step S101 as an example, the "project" corresponds to the calling function in the reference code set. According to the order of calling the function, a calling function sequence and sequence can be formed, and then the sequence pattern that best meets the "frequent occurrence" requirement is gradually mined, so that it can be considered as a reliable safe processing sequence pattern.

[0047] In some embodiments, in order to make the acquired correct code sequence a closed sequence rather than a single item, a frequent closed sequence pattern mining method (such as CloFAST, etc.) can be selected to obtain a closed sequence. For example, {a, b, c, d, e} and {{a, b}, d, e, f} are all closed sequences.

[0048] The following specifically describes the method of obtaining the security processing sequence mode through an embodiment.

[0049] like Figure 2FIG. 1 is a flow chart showing a process of obtaining a security processing sequence mode in an embodiment of the present application, that is, a specific implementation process of step S101 in an embodiment.

[0050] Figure 2 The process in the embodiment includes:

[0051] Step S201: extracting a control flow graph according to the reference code set.

[0052] The control flow graph is represented by a control flow graph (CFG). A control flow graph is also called a control flow chart, which is an abstract representation of a process or program, representing all paths that will be traversed during the execution of a program. It uses a graph to represent the possible flow of execution of all basic blocks (i.e., nodes) in a process, and can also reflect the real-time execution process of a process. In some embodiments, the control flow graph can be extracted manually or through software tools, such as Soot.

[0053] Step S202: Map the function identifier of each function called by each basic block in the control flow graph into an item to form a calling function sequence corresponding to each basic block, and each calling function sequence forms a calling function sequence database (Sequence Data Base, SDB) corresponding to the control flow graph.

[0054] Specifically, the function identifier of the calling function of each basic block can be mapped into an item to form a calling function sequence corresponding to each basic block, and the set of calling function sequences corresponding to each basic block of the control flow graph is placed in the calling function sequence database.

[0055] Step S203: by using the frequent sequence pattern mining method, the correct sequence patterns of each code that meet the first support condition are obtained according to the calling function sequence database, and a safe processing sequence pattern that meets the second support condition is selected from each correct sequence pattern of the code.

[0056] In some embodiments, the first support condition may be related to a minimum support, such as a minimum support count value.

[0057] In the CloFAST approach, all closed frequently called function sequences are first mined to obtain an initial sequence set of size 1, and then new sequences (i.e., code-correct sequence patterns) are generated directly on this initial sequence set without mining additional frequently called function sequences.

[0058] For example, the first support condition is set to a minimum support count value of 3, which means that a closed call function sequence that appears at least three times is selected as the correct code sequence. For example: the call function sequence library is represented by {<a,b,c,d,e> ,<a,b,d,e,f> ,<a,b,d,g> ,<a,b,d> ,<a,c,h>}, a~h are item sets (for example, formed by the combination of items in i1~i4 above), then according to the minimum support count of 3, the call function sequence that appears at least 3 times is<a,b,d> , as a code-correct sequence.

[0059] In some embodiments, each of the mined calling function sequences may be pruned (also called "pruning"), such as pruning out relatively "infrequent" sequences, and using the remaining sequences after pruning as the correct sequence pattern of the code.

[0060] In some embodiments, each item may be directly represented in the form of a function identifier. For example, the function identifier includes a function signature, and the function signature may be directly used as the item.

[0061] However, considering that the reference code set may have a huge amount of code (such as an open source code base), if the function signature is directly used as an item, the data volume of the calling function sequence database is still huge. Therefore, in other embodiments, each item can be represented by a characteristic value of a function identifier to reduce the data volume of the calling function sequence database. For example, the hash value of the function identifier is calculated by a hash algorithm to form a calling function sequence as an item.

[0062] For example, as shown in Table 1 below, a Java example is used to intuitively illustrate the calling function sequence formed by using the characteristic value of the function identifier as the project.

[0063] Table 1

[0064]

[0065] According to Table 1 above, the leftmost column is the source code, the middle column is the function identifier of the function called by the execution statement in the left source code, and the rightmost column is the hash value corresponding to each function identifier in the middle column. Taking each hash value as an item, the item set corresponding to this section of code is {i1,i2,i3,i4,....}; and so on, according to the order of the basic blocks of the control flow graph, multiple item sets can be obtained in sequence, such as {i1,i2,i3,i4}, {i5,i6}, {i7}, {i8}, etc., so that the calling function sequence <{i1,i2,i3,i4}, {i5,i6}, {i7}, {i8}> can be obtained, which can be placed in the calling function sequence database.

[0066] The principle is similar, and a correct code sequence database can be further formed according to the set of correct sequence patterns of each code, and a safe processing sequence pattern can be mined from it according to the second support condition through a frequent sequence pattern mining method.

[0067] In some embodiments, the second support condition may also be related to a minimum support, such as a minimum of 3 occurrences.

[0068] For example, the following Table 2 shows a sequence database of correct sequence patterns of each code in an example.

[0069] Table 2

[0070] Sequence Identifier (SID) Code Correct Sequence Pattern 1 <{a,b,f},{d},{e},{a},{d}> 2 <{e},{a}> 3 <{e},{a,b,f},{b,d,e}>

[0071] Assuming that the second support is also the minimum support count 3, the sequence <{e},{a}> can be mined from the sequence database in Table 2 as a secure processing sequence pattern.

[0072] It should be noted that, in some embodiments, since when mapping items according to function identifiers, the hash value of the function identifier is used as the item, the correct code sequence pattern may be in the form of a hash value sequence. Therefore, to facilitate subsequent matching, the hash value of each item in the correct code sequence pattern that meets the second support condition mined from each correct code sequence pattern can be mapped back to the function identifier of the corresponding function to form the secure processing sequence pattern.

[0073] For example, according to Table 1, the mined code correct sequence pattern <{i1},{i2,i3},{i4},{i1}> can be mapped to <{HttpServletRequest.getParameter(string)},{Connect.prepareStatement(String),Prep aredStatement.setString(Interger,Object)},{PreparedStatement.executeQuery()},{Htt pServletRequest.getParameter(string)}> as a safe processing sequence.

[0074] Step S102: Acquire a code defect sequence pattern according to the defect code set.

[0075] In some embodiments, Figure 3 As shown, the step S102 may specifically include:

[0076] Step S301: extracting and obtaining a first data flow graph according to the defect code set.

[0077] Step S302: according to the function identifiers of the functions called by the code features in the first data flow graph, code defect sequence patterns corresponding to the code features are respectively formed.

[0078] The data flow graph describes the process from parameter input to output, and there will also be various functions called in sequence in the data flow graph path. The defect code set can be an existing defect code library. The code features can be certain specific execution statements, execution statement structures, specific functions or combinations, etc. Extracting code defect sequence patterns through the code features of defect codes can effectively reduce the amount of data to be processed.

[0079] The code defect sequence pattern can be obtained by referring to the principle of mapping function identifiers to items and forming sequences through item sets similar to the previous embodiment.

[0080] For example, as shown in Table 3 below, the principle of obtaining a defect sequence pattern in a specific example is demonstrated.

[0081] Table 3

[0082]

[0083] According to the data flow of this defect code, the defect sequence pattern can be obtained according to the function identifier of the called function: <{System.getProperty(String)},{StringBuilder.append(String)},{RunTime.getRuntime(),RunTime.exec(String)}>.

[0084] Step S103: obtaining a sequence pattern of the code to be detected according to the code to be detected.

[0085] In some embodiments, Figure 4 As shown, the step S103 may specifically include:

[0086] Step S401: extracting and obtaining a second data flow graph according to the code to be detected;

[0087] Step S402: forming a code sequence pattern to be detected according to the function identifier of each calling function in each of the second data flow graphs.

[0088] In some embodiments, since the amount of data of the code to be detected is usually much smaller than the amount of data of the defect code library, the code sequence pattern to be detected can be directly formed according to the calling function of the code to be detected, without having to Figure 3 Of course, it can also be changed according to actual needs, and is not limited to this.

[0089] It should be noted that in steps S102 and S103, the sequence patterns obtained for the defective codes and the codes to be detected may include items such as the original function identifiers or feature values ​​(such as hash values) generated based on the function identifiers. The implementation may be selected based on the actual amount of data, with the priority being on minimizing occupied resources and efficiency, and is not limited to the above embodiments.

[0090] Step S104: matching the code sequence pattern to be detected with the code defect sequence pattern and / or the security processing sequence pattern to determine whether the code to be detected has defects according to the matching result.

[0091] The matching result refers to determining whether the code sequence pattern to be detected is a subset of the code defect sequence pattern and / or the security processing sequence pattern.

[0092] In a specific embodiment, if the sequence pattern of the code to be detected includes a safety processing sequence pattern, the code to be detected can be considered to be free of defects; if the sequence pattern of the code to be detected does not include a defect sequence pattern, the code to be detected can be considered to be free of defects; if the sequence pattern of the code to be detected includes a defect sequence pattern, it may be defective or not, and the safety processing sequence pattern can be matched to assist in the judgment. In some embodiments, the sequence pattern of the code to be detected can be one or more, and both the defect sequence pattern and the safety processing sequence pattern can be multiple.

[0093] like Figure 5 As shown, a specific judgment logic flow chart is shown. Among them, successful matching means that the code sequence pattern to be detected is a subset of the corresponding sequence pattern, and failed matching means that the code sequence pattern to be detected is not a subset of the corresponding sequence pattern.

[0094] Figure 5 The process specifically includes:

[0095] Step S501: Match the code sequence pattern to be detected with the code defect sequence pattern; if the match fails, obtain a matching result: the code to be detected does not have a defect; if the match succeeds, proceed to step S502;

[0096] Step S502: Match the code sequence pattern to be detected with the security processing sequence pattern; if the match fails, it is determined that the code to be detected has defects; if the match succeeds, it is determined that the code to be detected does not have defects.

[0097] like Figure 6 As shown, a schematic diagram of a module of a code detection device in an embodiment of the present application is shown. Since the implementation of the code detection device can refer to the code detection method in the previous embodiment, the same technical content will not be repeated here.

[0098] The code detection device 600 comprises:

[0099] A first code sequence pattern acquisition module 601 is used to extract a correct code sequence pattern according to a reference code set by using a frequent sequence pattern mining method, and to extract a security processing sequence pattern according to the correct code sequence pattern;

[0100] A second code sequence pattern acquisition module 602, configured to acquire a code defect sequence pattern according to a defect code set;

[0101] The third code sequence pattern acquisition module 603 is used to acquire the code sequence pattern to be detected according to the code to be detected;

[0102] The code sequence pattern matching module 604 is used to match the code sequence pattern to be detected with the code defect sequence pattern and / or the security processing sequence pattern to determine whether the code to be detected has defects based on the matching result; wherein the matching result refers to determining whether the code sequence pattern to be detected is a subset of the code defect sequence pattern and / or the security processing sequence pattern.

[0103] In some embodiments, elements in the correct code sequence pattern, the defective code sequence pattern, and the to-be-detected code sequence pattern are related to functions called sequentially in their respective corresponding codes.

[0104] In some embodiments, the first code sequence pattern acquisition module 601 may include:

[0105] A first control flow graph extraction module, configured to extract a control flow graph according to the reference code set;

[0106] A first mapping module is used to map the function identifier of each function called by each basic block in the control flow graph into an item to form a calling function sequence corresponding to each basic block, and each calling function sequence forms a calling function sequence database corresponding to the control flow graph;

[0107] The sequence pattern mining module is used to obtain the correct sequence patterns of each code that meet the first support condition according to the calling function sequence database through the frequent sequence pattern mining method, and select the safe processing sequence pattern that meets the second support condition from each correct sequence pattern of the code.

[0108] In some embodiments, the function identification includes a function signature.

[0109] In some embodiments, the first mapping module is used to calculate the characteristic value of the function identifier of each of the functions and use the characteristic value as the item; the code detection device also includes: a second mapping module, which is used to map each characteristic value in the selected correct sequence of codes that meets the second support condition into the function identifier of the corresponding function to form the security processing sequence pattern.

[0110] In some embodiments, the frequent sequence pattern mining method includes a frequent closed sequence pattern mining method, and the code correct sequence pattern and the security processing sequence pattern are closed sequences.

[0111] In some embodiments, the second code sequence pattern 602 acquisition module includes: a first data flow graph extraction module, used to extract a first data flow graph based on the defective code set; a first sequence formation module, used to form a code defect sequence pattern corresponding to each of the code features according to the function identifier of the function called by each code feature in the first data flow graph.

[0112] In some embodiments, the third code sequence pattern 603 acquisition module includes: a second data flow graph extraction module, used to extract a second data flow graph based on the code to be detected; a second sequence formation module, which forms a code sequence pattern to be detected according to the function identifier of each calling function in each of the second data flow graphs.

[0113] In some embodiments, the sequence pattern mining module 604 includes: a first matching module and a second matching module; the first matching module is used to match the code sequence pattern to be detected with the code defect sequence pattern; if the match fails, it is judged that the code to be detected does not have a defect; if the match is successful, the second matching module is used to match the code sequence pattern to be detected with the security processing sequence pattern; if the match is successful, it is judged that the code to be detected does not have a defect; if the match fails, it is judged that the code to be detected has a defect.

[0114] It should be noted that in Figure 6 Each functional module in the embodiment can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a program instruction product. The program instruction product includes one or more program instructions. When loading and executing program instructions on a computer, the process or function according to the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable devices. The program instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.

[0115] and, Figure 6The device disclosed in the embodiment can also be implemented by other module division methods. The device embodiments shown above are only schematic. For example, the module division is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or modules can be combined or dynamically transferred to another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or modules can be electrical or other forms.

[0116] in addition, Figure 6 Each functional module and submodule in the embodiment can be dynamically in a processing component, or each module can exist physically separately, or two or more modules can be dynamically in one component. The above-mentioned dynamic components can be implemented in the form of hardware or in the form of software functional modules. If the above-mentioned dynamic components are implemented in the form of software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. The storage medium can be a read-only memory, a disk or an optical disk, etc.

[0117] like Figure 7 , which shows a schematic diagram of the circuit structure of a computer device in an embodiment of the present application.

[0118] The computer device may be implemented in, for example, a desktop computer, a laptop computer, a smart phone, a tablet computer, etc.

[0119] The computer device 700 includes: a bus 701, a processor 702 and a memory 703. The processor 702 and the memory 703 can communicate with each other through the bus 701. The memory 703 can store program instructions (such as system or application software), and the memory 703 can also store data for program instructions to read and write. The processor 702 executes the code detection method in the above embodiment by running the program instructions in the memory 703.

[0120] The bus 701 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, although only one thick line is used in the figure, it does not mean that there is only one bus or one type of bus.

[0121] In some embodiments, the processor 702 may be implemented as a central processing unit (CPU), a microprocessing unit (MCU), a system on chip (System On Chip), or a field programmable logic array (FPGA). The memory 703 may include a volatile memory (Volatile Memory) for temporary storage of data when running a program, such as a random access memory (Random Access Memory, RAM).

[0122] The memory 703 may also include a non-volatile memory (non-volatile memory) for data storage, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid-state disk (SSD).

[0123] Optionally, the computer device may further include a communicator 704. The communicator 704 is used to communicate with the outside. In a specific example, the communicator 704 may include one or more wired and / or wireless communication circuit modules. For example, the communicator 704 may include one or more of a wired network card, a USB module, a serial interface module, etc. The wireless communication protocols followed by the wireless communication module include: for example, near field communication (NFC) technology, infrared (IR) technology, Global System for Mobile communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Time-Division Code Division Multiple Access (TD-SCDMA), Long Term Evolution (LTE), Bluetooth (BT), Global Navigation Satellite System (GNSS), etc. One or more.

[0124] In an embodiment of the present application, a computer-readable storage medium may also be provided, storing program instructions, wherein the program instructions are executed by the runtime to execute the previous embodiments (for example Figure 1 to Figure 5 ) in the process of method steps.

[0125] The method steps in the above-described embodiments are implemented as software or computer code that can be stored in a recording medium (such as a CD ROM, RAM, floppy disk, hard disk, or magneto-optical disk), or are implemented as computer code originally stored in a remote recording medium or a non-temporary machine-readable medium downloaded via a network and to be stored in a local recording medium, so that the methods represented herein can be stored in such software processing on a recording medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware (such as an ASIC or FPGA).

[0126] It should be noted that the process or method represented by the flowchart of the above embodiment of the present application can be understood as a module, fragment or part of a code that represents one or more executable instructions for implementing the steps of a specific logical function or process. And the scope of the preferred embodiment of the present application includes other implementations, in which the functions may not be performed in the order shown or discussed, including performing the functions in a substantially simultaneous manner or in a reverse order according to the functions involved.

[0127] For example, Figure 1 to Figure 5 The order of the steps in the embodiment may be changed in a specific scenario and is not limited to the above.

[0128] In summary, the embodiments of the present application provide a port connection control method, a management method, a device and a storage medium. When the traffic-free interaction state between the client and the server reaches a first preset duration, the client sends an authentication information packet to the server as a heartbeat data packet; wherein the heartbeat data packet contains time control information for setting the open duration of the port. Therefore, on the one hand, the authentication information carried by the authentication information packet can be used to improve network security, and on the other hand, the open duration of the port can be set accordingly according to the time control information to control network resource consumption, thereby achieving continuous authentication under long connections and solving the problems of the prior art.

[0129] The above embodiments are merely illustrative of the principles and effects of the present application and are not intended to limit the present application. Anyone familiar with the technology may modify or change the above embodiments without violating the spirit and scope of the present application. Therefore, all equivalent modifications or changes made by a person of ordinary skill in the art without departing from the spirit and technical ideas disclosed in the present application shall still be covered by the claims of the present application.

Claims

1. A code detection method, characterized in that: include: Extracting a correct code sequence pattern according to a reference code set by using a frequent sequence pattern mining method, and extracting a safe processing sequence pattern according to the correct code sequence pattern; Obtain code defect sequence patterns based on defect code sets; Obtaining a sequence pattern of a code to be detected according to the code to be detected; Matching the code sequence pattern to be detected with the code defect sequence pattern and / or the security processing sequence pattern to determine whether the code to be detected has defects according to the matching result; wherein the matching result refers to determining whether the code sequence pattern to be detected is a subset of the code defect sequence pattern and / or the security processing sequence pattern; The method of mining frequent sequence patterns, extracting correct code sequence patterns according to a reference code set, and extracting safe processing sequence patterns according to the correct code sequence patterns, comprises: Through the frequent sequence pattern mining method, the correct sequence patterns of each code that meet the first minimum support condition are obtained from the reference code set, and then the sequence that meets the second minimum support condition is selected from the correct sequence patterns of each code through the frequent sequence pattern mining method as the security processing sequence pattern.

2. The code detection method according to claim 1, characterized in that: The elements in the correct code sequence pattern, the defective code sequence pattern and the to-be-detected code sequence pattern are related to functions called sequentially in their respective corresponding codes.

3. The code detection method according to claim 1, characterized in that: The method of mining frequent sequence patterns, extracting correct code sequence patterns according to a reference code set, and extracting safe processing sequence patterns according to the correct code sequence patterns, includes: Extracting a control flow graph according to the reference code set; The function identifier of each function called by each basic block in the control flow graph is mapped into an item to form a calling function sequence corresponding to each basic block, and each calling function sequence forms a calling function sequence database corresponding to the control flow graph; Through the frequent sequence pattern mining method, each correct sequence pattern of the code that meets the first support condition is obtained according to the calling function sequence database, and a safe processing sequence pattern that meets the second support condition is selected from each correct sequence pattern of the code.

4. The code detection method according to claim 3, characterized in that: The function identifier includes a function signature.

5. The code detection method according to claim 3, characterized in that: Mapping the function identifiers to items, including: calculating characteristic values ​​of the function identifiers of each of the functions and using the characteristic values ​​as items; The code detection method comprises: Each characteristic value in the selected correct sequence of codes satisfying the second support condition is mapped to a function identifier of a corresponding function to form the security processing sequence pattern.

6. The code detection method according to claim 2, characterized in that: The frequent sequence pattern mining method includes a frequent closed sequence pattern mining method, and the code correct sequence pattern and the safety processing sequence pattern are closed sequences.

7. The code detection method according to claim 1, characterized in that: The obtaining of the code defect sequence pattern according to the defect code set includes: Extracting and obtaining a first data flow graph according to the defect code set; According to the function identifiers of the functions called by each code feature in the first data flow graph, code defect sequence patterns corresponding to each code feature are respectively formed.

8. The code detection method according to claim 7, characterized in that: The step of obtaining a code sequence pattern to be detected of the code to be detected includes: Extracting and obtaining a second data flow graph according to the code to be detected; A code sequence pattern to be detected is formed according to the function identifier of each calling function in each of the second data flow graphs.

9. The code detection method according to claim 1 or 7, characterized in that: The matching of the code sequence pattern to be detected with the code defect sequence pattern and / or the security processing sequence pattern to determine whether the code to be detected has defects according to the matching result includes: Matching the code sequence pattern to be detected with the code defect sequence pattern; If the match fails, it is determined that the code to be detected does not have defects; If the match is successful, the code sequence pattern to be detected is matched with the security processing sequence pattern; if the match is successful, it is determined that the code to be detected has no defects; if the match fails, it is determined that the code to be detected has defects.

10. A code detection device, characterized in that: include: A first code sequence pattern acquisition module is used to extract a correct code sequence pattern according to a reference code set by using a frequent sequence pattern mining method, and to extract a security processing sequence pattern according to the correct code sequence pattern; A second code sequence pattern acquisition module, used to acquire a code defect sequence pattern according to a defect code set; A third code sequence pattern acquisition module is used to acquire a code sequence pattern to be detected according to the code to be detected; A code sequence pattern matching module, used for matching the code sequence pattern to be detected with the code defect sequence pattern and / or the security processing sequence pattern, so as to determine whether the code to be detected has defects according to the matching result; wherein the matching result refers to determining whether the code sequence pattern to be detected is a subset of the code defect sequence pattern and / or the security processing sequence pattern; The method of mining frequent sequence patterns, extracting correct code sequence patterns according to a reference code set, and extracting safe processing sequence patterns according to the correct code sequence patterns, comprises: Through the frequent sequence pattern mining method, the correct sequence patterns of each code that meet the first minimum support condition are obtained from the reference code set, and then the sequence that meets the second minimum support condition is selected from the correct sequence patterns of each code through the frequent sequence pattern mining method as the security processing sequence pattern.

11. A computer device, characterized in that: include: Memory and processor; The memory stores program instructions; The processor is used to run the program instructions to execute the code detection method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: Program instructions are stored, and the program instructions are executed to perform the code detection method according to any one of claims 1 to 9.

Images