A code security detection method and system based on incremental clustering

Abstract

The present disclosure relates to a code security detection method and system based on incremental clustering, the method comprising: an input data preprocessing step, determining the specific content of the input data including the code to be tested, and when determining that the code to be tested in the input data is the code to be detected for the first time, parsing the code to be tested to obtain a set of control flow graphs of the code to be tested; a data dimension reduction processing step, performing dimension reduction processing on the control flow graph using random projection based on the JL lemma and linear discriminant analysis to obtain dimension reduction data of the control flow graph; a defect matching step, performing taint function feature matching on the dimension reduction data to extract defects as matching results; and a grid clustering step, projecting the matching results into a grid to generate grid data, and performing grid clustering using the DBSCAN algorithm.

Description

Technical Field

[0001] The present disclosure relates to the field of data security, and more specifically to a code security detection method and system based on incremental clustering. Background Art

[0002] In recent years, with the advancement of computer and communication technology, new technologies such as artificial intelligence have continued to develop rapidly. In the context of overall technological progress, in the process of software system development and maintenance, development security capabilities based on intelligent detection have become a hot topic. Code review is the work of analyzing program source code to find out the security problems in the code; its purpose is to fully explore the security defects and normative defects in the current code, so that developers can understand the threats that the application system they develop may face, and guide developers to correctly fix program defects. In this work, security service personnel with rich coding experience and a deep understanding of secure coding principles and application security usually conduct a comprehensive security check on the security and reliability of the system's source code and software architecture.

[0003] Before manual code auditing, in order to improve the efficiency of auditing, it is usually necessary to perform automated / semi-automated code detection using machines. In the traditional code detection process, potential defects in the code are usually automatically matched using, for example, taint functions, so as to extract the defects for subsequent manual auditing.

[0004] However, in the existing code detection process, whenever the code is modified, the code detection work needs to be re-performed. At this time, all codes are still detected, and the unmodified files and codes will be repeatedly detected, resulting in the problem of repeated resource occupation and low detection efficiency. In addition, in the existing code detection work, usually only all the results matching the tainted function are displayed together, and the defects in the presented results lack correlation, which increases the burden of subsequent manual audits. Therefore, the industry urgently needs a feasible code detection solution based on intelligent detection to improve the efficiency of code detection. Summary of the invention

[0005] In response to the problems of repeated resource occupation, low detection efficiency, and lack of correlation between the presented defects in the above-mentioned code detection process, researchers in this field have conducted in-depth research and development using various intelligent algorithms. A feasible solution is to introduce data processing methods such as clustering algorithms into code detection. The purpose of the present disclosure is to provide a code security detection method and system based on incremental clustering, so as to effectively improve the efficiency of code security detection and defect tracing.

[0006] A brief overview of the disclosure is given below in order to provide a basic understanding of some aspects of the disclosure. However, it should be understood that this overview is not an exhaustive overview of the disclosure. It is not intended to limit the key or important parts of the disclosure, nor is it intended to limit the scope of the disclosure. Its purpose is simply to give some concepts about the disclosure in a simplified form as a prelude to a more detailed description given later.

[0007] According to one aspect of the present disclosure, a code security detection method based on incremental clustering is provided. The method may include: an input data preprocessing step, determining the specific content of the input data including the code to be tested, and when determining that the code to be tested in the input data is the code to be tested for the first time, parsing the code to be tested to obtain a set of control flow graphs (CFGs) of the code to be tested; a data dimension reduction processing step, using random projection based on the Johnson-Lindenstrauss Lemma (Johnson-Lindenstrauss Lemma) and linear discriminant analysis (LDA) to perform dimension reduction processing on the control flow graph of the code to be tested, so as to obtain dimension reduction data of the control flow graph; a defect matching step, performing stain function feature matching on the dimension reduction data, so as to extract defects in the dimension reduction data as matching results; and a grid clustering step, projecting the matching results into a grid to generate grid data, and using a DBSCAN (Density-Based Spatial Clustering of Applications with Noise) algorithm to perform grid clustering, wherein, in the clustering initialization stage, the following formula (1) representing the grid density is used to generate an initial cluster:

[0008]

[0009] Where n represents the total number of results contained in the grid, V represents the grid volume, and DBSCAN clustering is used to obtain the initial clustering result for the obtained grid density d(g).

[0010] According to another aspect of the present disclosure, a code security detection system based on incremental clustering is provided. The system may include: an input data preprocessing unit, which determines the specific content of the input data including the code to be tested, and when it is determined that the code to be tested in the input data is the code to be tested for the first time, the code to be tested is parsed to obtain a set of control flow graphs of the code to be tested; a data dimension reduction processing unit, which uses random projection based on the JL lemma and linear discriminant analysis to perform dimension reduction processing on the control flow graph of the code to be tested, respectively, to obtain the reduced dimension data of the control flow graph; a defect matching unit, which performs taint function feature matching on the reduced dimension data to extract defects in the reduced dimension data as matching results; and a grid clustering unit, which projects the matching results into a grid to generate grid data, and uses the DBSCAN algorithm to perform grid clustering, wherein, in the clustering initialization stage, the following formula (1) representing the grid density is used to generate the initial cluster:

[0011]

[0012] Where n represents the total number of results contained in the grid, V represents the grid volume, and DBSCAN clustering is used to obtain the initial clustering result for the obtained grid density d(g).

[0013] According to another aspect of the present disclosure, a code security detection device based on incremental clustering is provided. The device may include: a memory having instructions stored thereon; and a processor configured to execute the instructions stored on the memory to execute the code security detection method based on incremental clustering according to one aspect of the present disclosure.

[0014] According to another aspect of the present disclosure, a computer-readable storage medium is provided. The computer-readable storage medium may store computer-executable instructions, which, when executed by one or more processors, enable the one or more processors to perform the code security detection method based on incremental clustering according to one aspect of the present disclosure.

[0015] According to another aspect of the present disclosure, a computer program product is provided. The computer program product may include a computer program / instruction, and when the computer program / instruction is executed by a processor, the steps of the code security detection method based on incremental clustering according to one aspect of the present disclosure are implemented.

[0016] According to the technical solution disclosed in the present invention, defect matching is performed after dimensionality reduction processing is performed on the control flow graph of the data to be tested, and then the detection results are gridded and clustered. Defect detection and clustering adjustment are performed on the incremental results of the updated data to be tested. This can effectively improve the efficiency of code security detection and defect tracing, significantly reduce the detection time and difficulty of the updated code, effectively reduce the resource cost and time cost of repeated security detection of the code, and intuitively see the clustering results of the code defects, which is convenient for subsequent auditing and repair of the code defects. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 An exemplary flow chart of a code security detection method 100 according to the prior art is shown;

[0018] Figure 2 An exemplary flow chart of a code security detection method 200 based on incremental clustering according to an embodiment of the present disclosure is shown;

[0019] Figure 3 An exemplary schematic diagram showing a grid clustering process in a code security detection method 200 based on incremental clustering according to an embodiment of the present disclosure;

[0020] Figure 4 An exemplary flow chart showing the processing of incremental data in the code security detection method 200 based on incremental clustering according to an embodiment of the present disclosure;

[0021] Figure 5 An exemplary schematic diagram of a code security detection system 500 based on incremental clustering according to an embodiment of the present disclosure is shown;

[0022] Figure 6 An exemplary block diagram of a code security detection device 600 based on incremental clustering according to an embodiment of the present disclosure is shown;

[0023] Figure 7 An exemplary configuration of a computing device 700 that can implement the incremental clustering-based code security detection method 200 according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0024] The preferred embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. It should be noted that, unless otherwise specifically stated, the relative arrangement of the components and steps, the numerical expressions and the numerical values ​​described in these embodiments do not limit the scope of the present disclosure. At the same time, for ease of description, the sizes of the various parts shown in the accompanying drawings are not drawn according to the actual proportional relationship. The following description of at least one exemplary embodiment is actually only illustrative and is not intended to limit the present disclosure and its application or use.

[0025] The techniques, methods and devices known to those of ordinary skill in the relevant art may not be discussed in detail, but where appropriate, the techniques, methods and devices should be considered as part of the specification.The technology of the present disclosure can be applied to various products.

[0026] For ease of understanding and explanation, as the code security detection method and system based on incremental clustering according to the embodiment of the present disclosure, the application scenario of security detection of data containing code is mainly used as an example for explanation, but this is not restrictive. The technical subject of the present disclosure can be applied not only to any general code security detection scenario, but also to any other suitable security detection scenario in all data processing fields including big data processing.

[0027] The following first briefly describes the code security detection method as the background technology of the present disclosure. Figure 1 An exemplary flow chart of a code security detection method 100 according to the prior art is shown. First, in step S110, the original data to be detected, including the code to be tested, related files, etc., is input, and then in step S120, the control flow graph of all the input data is obtained. At this time, if the updated code, i.e., iterative data, is input in step S111, the control flow graph of all the updated data input is also obtained in step S120. Then, the features of the control flow graph are extracted in step S130, and then the extracted features are matched with taint functions in step S140. If the taint function matching is unsuccessful in step S140, it is determined in step S161 that there is no defect in the data to be tested, and the corresponding detection result is output in step S170; if the taint function matching is successful in step S140, it is entered into step S150 to perform actual security configuration verification, and if the verification of this step is successful, it is determined that there is actually no defect, otherwise it is determined that there is a defect, and then the corresponding detection result is output in step S170.

[0028] In the above-mentioned prior art code security detection method 100, there is room for improvement at least in the processing method for iterative data in step S111 and the processing process of "defect matching" in steps S140 to S161. The existing problems are as follows:

[0029] (1) Each time the data to be tested is obtained, feature matching must be performed on all control flows regardless of the data type. This will occupy a lot of resources and take a long time.

[0030] (2) There is no strategy for duplicate code detection, which results in all processes being repeated for each code audit.

[0031] (3) Similar defects cannot be identified simultaneously, and the control flow can only be judged one by one. There is a lack of correlation between defects, resulting in high costs for subsequent audit work.

[0032] In response to the above problems, the present invention proposes a code security detection scheme based on incremental clustering, which first reduces the dimensionality of the control flow graph of the data to be tested, performs defect matching on the reduced dimensionality data, and then initializes clustering of the detected defect results to obtain clustering results corresponding to the defective code; when the code is updated, the incremental data of the latest code is obtained and the incremental data is compared with the original data, and clustering adjustments are made based on the comparison results, thereby effectively solving the above-mentioned problems of duplicate resource occupation and low security detection efficiency, and based on the clustering results of the detected defective code, it can effectively provide strong support for subsequent code auditing and repair work.

[0033] The following describes the overall process of the code security detection method based on incremental clustering according to an embodiment of the present disclosure. Figure 2 A schematic diagram of a code security detection method 200 based on incremental clustering according to an exemplary embodiment of the present disclosure is shown. Preferably, the code security detection method 200 based on incremental clustering according to an embodiment of the present disclosure may generally include the following steps S210 to S240, and the details of each step S210 to S240 are as follows:

[0034] Input data preprocessing step S210: determining specific contents of the input data including the code to be tested, and when it is determined that the code to be tested in the input data is the code to be tested for the first time, parsing the code to be tested to obtain a set of control flow graphs of the code to be tested;

[0035] Data dimensionality reduction processing step S220: using random projection based on the JL lemma and linear discriminant analysis to perform dimensionality reduction processing on the control flow graph of the code to be tested, so as to obtain dimensionality reduction data of the control flow graph;

[0036] Defect matching step S230: performing stain function feature matching on the reduced-dimensionality data to extract defects in the reduced-dimensionality data as matching results; and

[0037] Grid clustering step S240: Project the matching results into a grid to generate grid data, and use the DBSCAN algorithm to perform grid clustering.

[0038] In the cluster initialization stage, the following formula (1) representing the grid density is used to generate the initial clusters:

[0039]

[0040] Where n represents the total number of results contained in the grid, V represents the grid volume, and DBSCAN clustering is used to obtain the initial clustering result for the obtained grid density d(g).

[0041] Through the above steps S210 to S240 , the clustering initialization of the data to be tested can be completed, and the clustering result of the defect code can be obtained.

[0042] Therefore, when the data including the code and related files are first security checked, the control flow graph of the code is obtained, and the control flow graph is reduced in dimension through random projection and linear discriminant analysis, and defect detection is performed on the reduced-dimensional data. The defect detection results are then gridded, and DBSCAN clustering is performed on the gridded defect data, thus completing clustering initialization. The clustering results of defects are obtained by this method, so that developers and auditors can intuitively see the clustering results of code defects, and conduct subsequent audits and repairs on code defects based on the similarity and correlation of the results.

[0043] More specifically, in the data dimensionality reduction processing step S220, a random projection sub-step S221 based on the JL lemma and a linear discriminant analysis LDA dimensionality reduction processing sub-step S222 may be included. Among them, in sub-step S221, as a common algorithm for data dimensionality reduction in the field of machine learning, based on the JL lemma, the set of control flow graphs obtained is randomly projected to reduce its dimension to a suitable range to ensure that the distance relationship between the data after projection is unlikely to change. In other words, after the space transformation, the distance between every two points remains almost unchanged.

[0044] On the other hand, considering the insufficiency of the results obtained by the data dimensionality reduction processing based on the JL lemma, the linear discriminant analysis LDA is also used in parallel for the set of control flow graphs to perform dimensionality reduction processing to compensate for the negative impact of the change in the distance relationship between samples in the random projection results. More specifically, for data with long distances in high-dimensional space, due to the space compression caused by the dimensionality reduction based on the JL lemma, the data may be relatively close in low-dimensional space, which is not conducive to clustering in the subsequent steps. For this, the linear discriminant analysis LDA can be used in parallel for dimensionality reduction processing. The basic idea of ​​the linear discriminant analysis LDA is to project the labeled data samples in the high-dimensional space to the optimal discriminant vector space, so as to achieve the purpose of reducing the dimension of the data space while ensuring that the category information can be extracted, so that the inter-class distance of the data samples after projecting to the new space is as large as possible and the intra-class distance is as small as possible, that is, the separability of the data samples in the new space is maximized. After the results of the data dimensionality reduction based on the JL lemma and the dimensionality reduction processing of the linear discriminant analysis LDA are integrated and then combined with the subsequent clustering algorithm, the high-dimensional samples can be projected into a subspace with a lower dimension, and after the above-mentioned projection transformation, the samples belonging to different categories still have a high degree of distinction. Therefore, in the clustering algorithm disclosed in the present invention, the linear discriminant analysis LDA can effectively compensate for the negative impact of the change in the distance relationship between samples in the random projection based on the JL lemma.

[0045] More specifically, in the grid clustering step S240, the matching results are projected into the grid to generate grid data, and then the DBSCAN density clustering algorithm is used to perform grid clustering. First, when the matching results are projected into the grid space W, regarding the grid space W, let A1, A2, ..., A r is a data set X = {x1, x2, ..., x n} is a bounded domain of r dimensions of the data sample vector, then the grid space W = A1×A2×...×A r is an r-dimensional space. Divide each dimension m of the grid space W into equal parts. i For example, A i is divided into {(a i0 , a i1 ],(a i1 , a i2 ],...,(a i(m-1) , a im ]}. By analogy, the grid space W can be divided into m r grid units. Each grid g can be expressed as in Regarding the grid density, let the data sample vector If for any j∈{1, 2, …, r} we have Grid Contains the sample vector So, the grid The grid density is defined as follows:

[0046]

[0047] Where n represents the total number of results contained in the grid and V represents the volume of the grid.

[0048] After obtaining the grid density, use DBSCAN clustering to obtain the initial clustering result. As a representative density-based clustering algorithm, DBSCAN clustering algorithm defines a cluster as the largest set of density-connected points. It can divide areas with sufficiently high density into clusters and can find clusters of any shape in a noisy spatial database. Figure 3 , which shows an exemplary schematic diagram of the grid clustering process in the code security detection method 200 based on incremental clustering according to an embodiment of the present disclosure. Figure 3 (a) shows the process of grid clustering, wherein each point on the linear discriminant analysis projection on the right side is subjected to grid clustering and, after processing in step S240, is clustered into different categories located at different positions in the grid space W. The above completes the processing of the code security detection method 200 based on incremental clustering according to the embodiment of the present disclosure when the code to be tested is the code to be detected for the first time.

[0049] In some embodiments, the detection result output step S250 may also be included: output the results of defects in the code to be tested in a classified form based on the clustering results. In traditional code detection work, in the detection report as the output result, usually only all the results matching the taint function are listed and displayed, and the necessary correlation between the results is lacking, which increases the burden of subsequent manual audits. According to the code security detection method 200 based on incremental clustering of the exemplary embodiment of the present disclosure, its output result is the result of the defects in the code to be tested output in a classified form according to the clustering result of step S240. According to the clustering result of step S240, defects with similarities can be aggregated together for display, so that auditors or developers can quickly and clearly grasp the general type of defects as a whole, and then confirm, identify and analyze each defect in detail under each major category. As a result, it is possible to quickly diagnose whether the defect is caused by, for example, the developer's personal coding habits, or other accidental factors, etc., which is conducive to subsequent targeted repairs and significantly improves the efficiency of code security detection and defect tracing.

[0050] Next, in the actual operation process after the code to be tested has been tested for the first time, when the code is modified and the code detection work needs to be re-performed, as mentioned above, according to the traditional code detection mode, all codes are still detected, and the files and codes that have not been modified will be repeatedly detected, resulting in repeated resource occupation and low detection efficiency. In this regard, in the code security detection method 200 based on incremental clustering according to the exemplary embodiment of the present disclosure, it is preferred that in the input data preprocessing step S210, when it is determined that the code to be tested in the input data is an updated code, the code to be tested is compared with the tested code of the previous version to obtain the incremental result of the data, and the obtained incremental data is converted into a control flow graph, and the control flow graph of the incremental data is judged for the operation type. In actual applications, with each update of the software version, most of the code remains unchanged, and its corresponding control flow graph still holds, so it is not necessary to recalculate all of it.

[0051] Figure 4 An exemplary flow chart showing the processing of incremental data in the incremental clustering-based code security detection method 200 of an exemplary embodiment of the present disclosure is shown.

[0052] Preferably, for the incremental data, in the input data preprocessing step S210, when it is determined that the operation type of the control flow graph of the incremental data is an increase, a process similar to the data dimension reduction processing step S220, the defect matching step S230 and the grid clustering step S240 is performed on the newly added control flow graph to adjust the clustering result; that is, Figure 4 As shown in the branch on the left side of , the dimension reduction processing of the newly added control flow graph in step S411, the defect matching in step S412, the grid projection in step S413 and the cluster adjustment in step S414 are performed.

[0053] Preferably, for the incremental data, in the input data preprocessing step S210, when it is determined that the operation type of the control flow graph of the incremental data is deletion, the original control flow graph and its grid data are deleted to adjust the clustering result; that is, Figure 4 As shown in the middle branch, the original data is deleted in step S421 and the cluster is adjusted in step S422.

[0054] Preferably, for the incremental data, in the input data preprocessing step S210, when it is determined that the operation type of the control flow graph of the incremental data is modification, the original control flow graph of the incremental data and its grid data are deleted, and the modified control flow graph is added. The added modified control flow graph is processed similar to the data dimensionality reduction processing step S220, the defect matching step S230 and the grid clustering step S240 to adjust the clustering results; that is, Figure 4 As shown in the branch on the right side of , the original data is deleted in step S431, the dimension reduction processing of the modified control flow graph is performed in step S432, the defect matching is performed in step S433, the grid projection is performed in step S434, and the cluster adjustment is performed in step S435.

[0055] Return to Figure 3 , Figure 3 (b) shows an exemplary schematic diagram of cluster adjustment, which shows that when the code to be tested is determined to be an updated code, it is not necessary to process all the codes, but only the incremental data indicated by the circle on the right needs to be processed accordingly, and only the processing results of the incremental data are reflected in the grid space W as indicated by the circle on the left.

[0056] Next, Figure 5 An exemplary schematic diagram of a code safety detection system 500 based on incremental clustering according to an exemplary embodiment of the present disclosure is shown.

[0057] In a preferred embodiment, the incremental clustering-based code security detection system 500 according to the embodiment of the present disclosure may include: an input data preprocessing unit 510 , a data dimension reduction processing unit 520 , a defect matching unit 530 and a grid clustering unit 540 .

[0058] In a preferred embodiment, the input data preprocessing unit 510 can be configured to determine the specific content of the input data including the code to be tested. When it is determined that the code to be tested in the input data is the code to be tested for the first time, the code to be tested is parsed to obtain a set of control flow graphs of the code to be tested.

[0059] In a preferred embodiment, the data dimension reduction processing unit 520 may be configured to perform dimension reduction processing on the control flow graph of the code to be tested using random projection based on the JL lemma and linear discriminant analysis to obtain dimension reduction data of the control flow graph.

[0060] In a preferred embodiment, the defect matching unit 530 may be configured to perform stain function feature matching on the reduced-dimensionality data to extract defects in the reduced-dimensionality data as a matching result.

[0061] In a preferred embodiment, the grid clustering unit 540 may be configured to project the matching results into a grid to generate grid data, and perform grid clustering using a DBSCAN algorithm.

[0062] In the cluster initialization stage, the following formula (1) representing the grid density is used to generate the initial clusters:

[0063]

[0064] Where n represents the total number of results contained in the grid, V represents the grid volume, and DBSCAN clustering is used to obtain the initial clustering result for the obtained grid density d(g).

[0065] According to the code security detection method and system based on incremental clustering of the embodiments of the present disclosure, the control flow graph of the code to be tested in the data is subjected to dimensionality reduction processing by random projection based on the JL lemma and linear discriminant analysis. After defect matching is performed on the control flow graph after dimensionality reduction, it is projected into a grid, and the clustering result of the defective code is obtained by using the DBSCAN clustering algorithm. When the code is updated, the incremental data of the latest code is obtained from the file content level, and the difference between the incremental data and the original data is deeply compared. Clustering adjustment is performed on the incremental results, thereby effectively solving the problems of resource duplication and low security detection efficiency in previous technologies, greatly reducing the time and difficulty of security detection of updated codes, and effectively reducing the resource cost and time cost of code duplication detection. The clustering results can intuitively see the similarity and correlation of defective codes, and based on the clustering results, provide correlation analysis capabilities based on defective codes, so that the work effect and efficiency of subsequent code auditing and defect repair can be significantly improved.

[0066] The code security detection method and system based on incremental clustering according to the embodiments of the present disclosure can be applied to scenarios of security detection of data containing code, and are particularly suitable for application scenarios of repeated security detection and repair of code.

[0067] Next, Figure 6 An exemplary block diagram of a code security detection device 600 based on incremental clustering according to an embodiment of the present disclosure is shown.

[0068] like Figure 6 As shown, the incremental clustering-based code security detection device 600 of this embodiment includes: a memory 610 and a processor 620 coupled to the memory 610, and the processor 620 is configured to execute the incremental clustering-based code security detection method 200 in any one of the embodiments of the present disclosure based on instructions stored in the memory 610.

[0069] The memory 610 may include, for example, a system memory, a fixed non-volatile storage medium, etc. The system memory may store, for example, an operating system, an application program, a boot loader, a database, and other programs.

[0070] Figure 7 An exemplary configuration diagram of a computing device 700 capable of implementing the incremental clustering-based code security detection method 200 according to an exemplary embodiment of the present disclosure is shown.

[0071] The computing device 700 is an example of a hardware device to which the above aspects of the present disclosure can be applied. The computing device 700 can be any machine configured to perform processing and / or computing. The computing device 700 can be, but is not limited to, a workstation, a server, a desktop computer, a laptop computer, a tablet computer, a personal data assistant (PDA), a smart phone, a vehicle-mounted computer, or a combination thereof.

[0072] like Figure 7 As shown, the computing device 700 may include one or more elements that can be connected or communicated with the bus 702 via one or more interfaces. The bus 702 may include, but is not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus, etc. The computing device 700 may include, for example, one or more processors 704, one or more input devices 706, and one or more output devices 708. The one or more processors 704 may be any kind of processor, and may include, but is not limited to, one or more general-purpose processors or special-purpose processors (such as special-purpose processing chips). The processor 704 may be configured, for example, to implement the code security detection method 200 based on incremental clustering of the exemplary embodiment of the present disclosure described in the above aspects of the present disclosure. The input device 706 may be any type of input device capable of inputting information to the computing device, and may include, but is not limited to, a mouse, a keyboard, a touch screen, a microphone, and / or a remote controller. Output device 708 may be any type of device capable of presenting information and may include, but is not limited to, a display, speakers, video / audio output terminals, a vibrator, and / or a printer.

[0073] The computing device 700 may also include or be connected to a non-transitory storage device 714, which may be any non-transitory storage device that can implement data storage, and may include but is not limited to a disk drive, an optical storage device, a solid-state memory, a floppy disk, a flexible disk, a hard disk, a tape or any other magnetic medium, a compressed disk or any other optical medium, a cache memory and / or any other storage chip or module, and / or any other medium from which a computer can read data, instructions and / or codes. The computing device 700 may also include a random access memory (RAM) 710 and a read-only memory (ROM) 712. The ROM 712 may store programs, utilities or processes to be executed in a non-volatile manner. The RAM 710 may provide volatile data storage and store instructions related to the operation of the computing device 700. The computing device 700 may also include a network / bus interface 716 coupled to a data link 718. The network / bus interface 716 can be any type of device or system capable of enabling communication with external devices and / or networks, and can include but is not limited to modems, network cards, infrared communication devices, wireless communication devices and / or chipsets (such as Bluetooth™ devices, 802.11 devices, WiFi devices, WiMax devices, cellular communication facilities, etc.).

[0074] The present disclosure may be implemented as any combination of an apparatus, a system, an integrated circuit, and a computer program on a non-transitory computer-readable medium. One or more processors may be implemented as an integrated circuit (IC), an application specific integrated circuit (ASIC), or a large scale integrated circuit (LSI), a system LSI, a super LSI, or a super LSI component that performs some or all of the functions described in the present disclosure.

[0075] The present disclosure includes the use of software, applications, computer programs, or algorithms. The software, applications, computer programs, or algorithms may be stored on a non-transitory computer-readable medium to enable a computer such as one or more processors to perform the above steps and the steps described in the accompanying drawings. For example, one or more memories store the software or algorithm in executable instructions, and one or more processors may associate a set of instructions to execute the software or algorithm to provide various functions according to the embodiments described in the present disclosure.

[0076] Software and computer programs (which may also be referred to as programs, software applications, applications, components or code) include machine instructions for a programmable processor and may be implemented in a high-level procedural language, an object-oriented programming language, a functional programming language, a logic programming language, or an assembly language or a machine language. The term "computer-readable medium" refers to any computer program product, apparatus or device for providing machine instructions or data to a programmable data processor, such as magnetic disks, optical disks, solid-state storage devices, memories and programmable logic devices (PLDs), including computer-readable media that receive machine instructions as computer-readable signals.

[0077] For example, computer readable media may include dynamic random access memory (DRAM), random access memory (RAM), read-only memory (ROM), electrically erasable read-only memory (EEPROM), compact disk read-only memory (CD-ROM) or other optical disk storage devices, magnetic disk storage devices or other magnetic storage devices, or any other medium that can be used to carry or store the desired computer readable program code in the form of instructions or data structures and can be accessed by a general or special purpose computer or a general or special purpose processor. As used herein, disk or disc includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray disc, where disks usually reproduce data magnetically, while discs reproduce data optically by laser. Combinations of the above are also included in the scope of computer readable media.

[0078] The subject matter of the present disclosure is provided as an example of devices, systems, methods and programs for performing the features described in the present disclosure. However, in addition to the above features, other features or variations may also be expected. It is expected that the implementation of the components and functions of the present disclosure may be accomplished with any emerging technology that may replace any of the above-mentioned implementation technologies.

[0079] In addition, the above description provides examples without limiting the scope, applicability or configuration set forth in the claims. Without departing from the spirit and scope of the present disclosure, the functions and arrangements of the elements discussed may be changed. Various embodiments may appropriately omit, replace or add various processes or components. For example, features described with respect to certain embodiments may be combined in other embodiments.

[0080] In addition, in the description of the present disclosure, although operations are depicted in a particular order in the drawings, this should not be understood as requiring that such operations be performed in the particular order shown or in a sequential order, or requiring that all illustrated operations be performed to achieve the desired results. In some cases, multitasking and parallel processing can be advantageous.

Claims

1. A code security detection method based on incremental clustering, comprising: An input data preprocessing step, determining specific contents of the input data including the code to be tested, and when it is determined that the code to be tested in the input data is the code to be tested for the first time, parsing the code to be tested to obtain a set of control flow graphs of the code to be tested; When it is determined that the code to be tested in the input data is an updated code, the code to be tested is compared with the tested code of the previous version to obtain an incremental result of the data, the obtained incremental data is converted into a control flow graph, and the operation type of the control flow graph of the incremental data is determined; In the data dimension reduction processing step, random projection based on the JL lemma and linear discriminant analysis are used to reduce the dimension of the control flow graph of the code to be tested, so as to obtain the dimension reduction data of the control flow graph; The defect matching step performs stain function feature matching on the dimension-reduced data to extract defects in the dimension-reduced data as matching results; as well as In the grid clustering step, the matching results are projected into the grid to generate grid data, and the DBSCAN algorithm is used for grid clustering. In the cluster initialization stage, the following formula (1) representing the grid density is used to generate the initial clusters: Where n is the total number of results contained in the grid, V is the volume of the grid, Use DBSCAN clustering on the obtained grid density d(g) to obtain the initial clustering result; Among them, in the input data preprocessing step, when it is determined that the operation type of the control flow graph of the incremental data is increase, the data dimension reduction processing step, the defect matching step and the grid clustering step are performed on the newly added control flow graph to adjust the clustering results.

2. The code security detection method based on incremental clustering according to claim 1, further comprising: The detection result output step outputs the results of defects in the code to be tested in a classified form based on the clustering results.

3. The code security detection method based on incremental clustering according to claim 1, wherein: In the input data preprocessing step, when it is determined that the operation type of the control flow graph of the incremental data is deletion, the original control flow graph and its grid data are deleted to adjust the clustering result.

4. The code security detection method based on incremental clustering according to claim 1, wherein: In the input data preprocessing step, when it is determined that the operation type of the control flow graph of the incremental data is modification, the original control flow graph of the incremental data and its grid data are deleted, and the modified control flow graph is added. The added modified control flow graph is subjected to processing similar to the data dimension reduction processing step, the defect matching step and the grid clustering step to adjust the clustering results.

5. A code security detection system based on incremental clustering, comprising: An input data preprocessing unit is configured to determine specific contents of the input data including the code to be tested, and when it is determined that the code to be tested in the input data is the code to be tested for the first time, parse the code to be tested to obtain a set of control flow graphs of the code to be tested; When it is determined that the code to be tested in the input data is an updated code, the code to be tested is compared with the tested code of the previous version to obtain an incremental result of the data, the obtained incremental data is converted into a control flow graph, and the operation type of the control flow graph of the incremental data is determined; The data dimension reduction processing unit uses random projection based on the JL lemma and linear discriminant analysis to reduce the dimension of the control flow graph of the code to be tested, and obtains the dimension reduction data of the control flow graph; A defect matching unit performs stain function feature matching on the dimension-reduced data to extract defects in the dimension-reduced data as matching results; as well as The grid clustering unit projects the matching results into the grid to generate grid data and uses the DBSCAN algorithm to perform grid clustering. In the cluster initialization stage, the following formula (1) representing the grid density is used to generate the initial clusters: Where n is the total number of results contained in the grid, V is the volume of the grid, Use DBSCAN clustering on the obtained grid density d(g) to obtain the initial clustering result; Among them, in the input data preprocessing, when the operation type of the control flow graph of the incremental data is determined to be increase, data dimensionality reduction, defect matching and grid clustering are performed on the newly added control flow graph to adjust the clustering results.

6. A code security detection device based on incremental clustering, comprising: a memory having instructions stored therein; as well as A processor is configured to execute instructions stored in the memory to perform the code security detection method based on incremental clustering according to any one of claims 1 to 4.

7. A computer-readable storage medium having computer-executable instructions stored thereon, wherein when the computer-executable instructions are executed by one or more processors, the one or more processors execute the code security detection method based on incremental clustering according to any one of claims 1 to 4.

8. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the code security detection method based on incremental clustering described in any one of claims 1 to 4 are implemented.

Images