Code vulnerability detection method and device

Abstract

A code vulnerability detection method and device can be used in the field of information security, finance or other fields. The method includes: generating corresponding control flow graphs according to the obtained program fragments to be analyzed and the program fragments with known vulnerabilities respectively; performing weight score calculations on the basic blocks in the control flow graph respectively to obtain weight score calculation results; selecting a preset number of weight tokens from the basic blocks of the control flow graph; converting the weight tokens into feature matrices, inputting them into a pre-established twin neural network model, obtaining the similarity between the feature matrices of the program fragments to be analyzed and the program fragments with known vulnerabilities, and performing vulnerability detection on the program fragments to be analyzed based on the similarity. The present invention performs code vulnerability mining based on the twin neural network, and can batch discover other similar codes existing in the system after a vulnerability is discovered, thereby deeply revealing the relevant risks in the application system and effectively ensuring the security of the application code.

Description

Technical Field

[0001] The present invention relates to the technical field of code vulnerability mining, and in particular to a code vulnerability detection method and device. Background Art

[0002] With the development of information technology, software has become an important element in our lives, and the number of cyber attacks related to it is also increasing year by year. Among the endless stream of vulnerabilities, how to quickly and accurately find similar vulnerabilities in application code and prevent unsafe code from being continuously exposed in high-risk environments is an issue that every software developer must pay attention to.

[0003] In actual development, a development model with vulnerabilities can be easily found in other modules of the system. However, the existing static analysis methods, mainly based on taint tracking, symbolic execution and other technologies, are not suitable for searching for similar vulnerability codes. Summary of the invention

[0004] In view of the problems existing in the prior art, the main purpose of the embodiments of the present invention is to provide a code vulnerability detection method and device, so as to achieve rapid matching of similar codes in the application system and batch mining of similar risk issues.

[0005] In order to achieve the above object, an embodiment of the present invention provides a code vulnerability detection method, the method comprising:

[0006] Obtaining a program fragment to be analyzed and a program fragment with known vulnerabilities, and generating a control flow graph of the program fragment to be analyzed and a control flow graph of the program fragment with known vulnerabilities respectively according to the program fragment to be analyzed and the program fragment with known vulnerabilities;

[0007] Performing weight score calculations on the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively, to obtain weight score calculation results for each basic block;

[0008] According to the weight score calculation result, a preset number of weight tokens are selected from the basic blocks of the control flow graph of the program fragment to be analyzed and the basic blocks of the control flow graph of the program fragment with known vulnerabilities respectively;

[0009] The weight tokens are converted into a feature matrix, and the feature matrix is ​​input into a pre-established twin neural network model to obtain the similarity between the feature matrix of the program fragment to be analyzed and the feature matrix of the program fragment with known vulnerabilities, and vulnerability detection is performed on the program fragment to be analyzed based on the similarity.

[0010] Optionally, in an embodiment of the present invention, the weight score calculation is performed on the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, and the weight score calculation results of each basic block are obtained, including:

[0011] According to the control flow graph of the program fragment to be analyzed and the control flow graph of the program fragment with known vulnerabilities, determine the basic blocks in the control flow graph of the program fragment to be analyzed and the multiple tokens corresponding thereto, and determine the basic blocks in the control flow graph of the program fragment with known vulnerabilities and the multiple tokens corresponding thereto;

[0012] By using an importance ranking algorithm, weight score calculations are performed on the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively, to obtain weight score calculation results for each basic block.

[0013] Optionally, in an embodiment of the present invention, selecting a preset number of weight tokens from the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively, according to the weight score calculation result, includes:

[0014] According to the weight score calculation results of each basic block, the total weight score of each token in the control flow graph of the program fragment to be analyzed and the total weight score of each token in the control flow graph of the program fragment with known vulnerabilities are obtained respectively;

[0015] According to the total weight score, a preset number of weight tokens are selected from the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities.

[0016] Optionally, in an embodiment of the present invention, converting the weight token into a feature matrix includes:

[0017] Using word embedding algorithm, generate semantic vectors of each weighted token;

[0018] According to the semantic vector of each weighted token and the total weight score corresponding to each weighted token, a feature vector of each weighted token is obtained;

[0019] According to the feature vector, a feature matrix of weighted tokens corresponding to the program fragment to be analyzed and a feature matrix of weighted tokens corresponding to the program fragment with known vulnerabilities are generated respectively.

[0020] Optionally, in one embodiment of the present invention, the inputting the feature matrix into a pre-established twin neural network model to obtain the similarity between the feature matrix of the program fragment to be analyzed and the feature matrix of the program fragment with known vulnerabilities comprises:

[0021] The feature matrix is ​​input into a pre-established twin neural network model. After being processed by the convolutional layer, pooling layer and fully connected layer in the twin neural network model, the Euclidean distance corresponding to the feature matrix of the program fragment to be analyzed and the feature matrix of the known vulnerability program fragment is obtained, and the Euclidean distance is used as the similarity.

[0022] Optionally, in an embodiment of the present invention, the performing vulnerability detection on the program fragment to be analyzed according to the similarity includes:

[0023] If it is learned that the similarity is greater than a preset threshold, it is determined that a vulnerability of the same type as that in the known vulnerability program fragment exists in the program fragment to be analyzed.

[0024] The embodiment of the present invention further provides a code vulnerability detection device, the device comprising:

[0025] A control flow graph module is used to obtain a program fragment to be analyzed and a program fragment with known vulnerabilities, and generate a control flow graph of the program fragment to be analyzed and a control flow graph of the program fragment with known vulnerabilities respectively according to the program fragment to be analyzed and the program fragment with known vulnerabilities;

[0026] A weight scoring module is used to perform weight scoring calculations on the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively, to obtain weight scoring calculation results for each basic block;

[0027] A weight token module, configured to select a preset number of weight tokens from the basic blocks of the control flow graph of the program fragment to be analyzed and the basic blocks of the control flow graph of the program fragment with known vulnerabilities, respectively, according to the weight score calculation result;

[0028] The vulnerability detection module is used to convert the weight tokens into a feature matrix, and input the feature matrix into a pre-established twin neural network model to obtain the similarity between the feature matrix of the program fragment to be analyzed and the feature matrix of the program fragment with known vulnerabilities, and perform vulnerability detection on the program fragment to be analyzed based on the similarity.

[0029] Optionally, in one embodiment of the present invention, the weight scoring module includes:

[0030] A basic block unit, configured to determine a basic block and a plurality of corresponding tokens in the control flow graph of the program fragment to be analyzed and a basic block and a plurality of corresponding tokens in the control flow graph of the program fragment to be analyzed, and to determine a basic block and a plurality of corresponding tokens in the control flow graph of the program fragment to be analyzed;

[0031] The scoring calculation unit is used to use an importance ranking algorithm to perform weight scoring calculations on the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively, to obtain weight scoring calculation results for each basic block.

[0032] Optionally, in one embodiment of the present invention, the weight token module includes:

[0033] A total scoring unit, used to obtain the total weight score of each token in the control flow graph of the program fragment to be analyzed and the total weight score of each token in the control flow graph of the program fragment with known vulnerabilities according to the weight score calculation results of each basic block;

[0034] The weight token unit is used to select a preset number of weight tokens from the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively, according to the total weight score.

[0035] Optionally, in an embodiment of the present invention, the vulnerability detection module includes:

[0036] A semantic vector unit, used to generate a semantic vector of each weighted token using a word embedding algorithm;

[0037] A feature vector unit, used to obtain a feature vector of each weighted token according to the semantic vector of each weighted token and the total weight score corresponding to each weighted token;

[0038] The feature matrix unit is used to generate a feature matrix of weighted tokens corresponding to the program fragment to be analyzed and a feature matrix of weighted tokens corresponding to the program fragment with known vulnerabilities according to the feature vector.

[0039] Optionally, in one embodiment of the present invention, the vulnerability detection module is also used to input the feature matrix into a pre-established twin neural network model, and after processing by the convolutional layer, pooling layer and fully connected layer in the twin neural network model, obtain the Euclidean distance corresponding to the feature matrix of the program fragment to be analyzed and the feature matrix of the known vulnerability program fragment, and use the Euclidean distance as the similarity.

[0040] Optionally, in one embodiment of the present invention, the vulnerability detection module is further used to determine that there is a vulnerability in the program fragment to be analyzed that is consistent with the type in the known vulnerability program fragment if it is learned that the similarity is greater than a preset threshold.

[0041] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above method when executing the program.

[0042] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for executing the above method.

[0043] The present invention performs code vulnerability mining based on a twin neural network. After a vulnerability is discovered, it can batch discover other similar codes existing in the system, thereby deeply revealing the relevant risks in the application system and effectively ensuring the security of the application code. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 A flowchart of a code vulnerability detection method according to an embodiment of the present invention;

[0046] Figure 2 A flowchart of calculating a weight score in an embodiment of the present invention;

[0047] Figure 3 A flowchart of selecting weighted tokens in an embodiment of the present invention;

[0048] Figure 4 A flow chart of obtaining a feature matrix in an embodiment of the present invention;

[0049] Figure 5 A schematic diagram of the structure of a system for detecting application code vulnerabilities according to an embodiment of the present invention;

[0050] Figure 6 This is a schematic diagram of the structure of a code parsing module in an embodiment of the present invention;

[0051] Figure 7 Schematic diagram of a code control flow graph in an embodiment of the present invention;

[0052] Figure 8 A schematic diagram of the structure of a vulnerability discovery module in an embodiment of the present invention;

[0053] Fig. 9 The following is a flowchart of a system for applying a code vulnerability detection method in an embodiment of the present invention;

[0054] Fig.10 This is a schematic diagram of the structure of a code vulnerability detection device according to an embodiment of the present invention;

[0055] Fig.11 This is a schematic diagram of the structure of a weight scoring module in an embodiment of the present invention;

[0056] Fig.12 Schematic diagram of the structure of the weighted token module in an embodiment of the present invention;

[0057] Fig.13 A schematic diagram of the structure of a vulnerability detection module in an embodiment of the present invention;

[0058] Fig.14 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0059] The embodiments of the present invention provide a code vulnerability detection method and device, which can be used in the financial field and other fields. It should be noted that the code vulnerability detection method and device of the present invention can be used in the financial field, and can also be used in any field other than the financial field. The application field of the code vulnerability detection method and device of the present invention is not limited.

[0060] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0061] like Figure 1 The flowchart of a code vulnerability detection method according to an embodiment of the present invention is shown. The execution subject of the code vulnerability detection method provided by the embodiment of the present invention includes but is not limited to a computer. The method shown in the figure includes:

[0062] Step S1, obtaining a program fragment to be analyzed and a program fragment with known vulnerabilities, and generating a control flow graph of the program fragment to be analyzed and a control flow graph of the program fragment with known vulnerabilities respectively according to the program fragment to be analyzed and the program fragment with known vulnerabilities.

[0063] Among them, the program fragments with known vulnerabilities are obtained from the database or other storage devices, and the program fragments to be analyzed input by the user are received. For different programming languages, the corresponding static code analysis tools currently available are used to generate corresponding control flow graphs for the program fragments to be analyzed and the program fragments with known vulnerabilities. The generated control flow examples are as follows: Figure 7 As shown. Figure 7 It can be seen that the control flow of a program fragment is represented as a directed graph containing a node set and an edge set. Each node in the graph represents a basic block (a basic block refers to a linear code sequence that can only be entered from its beginning and left from its end). The basic block set and the directed edge set as a whole represent the control flow logic of the program fragment.

[0064] Step S2, performing weight score calculations on the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively, to obtain weight score calculation results for each basic block.

[0065] Among them, based on lexical analysis, a weighted token (token for short) is obtained, and a token indicates that a word is the smallest analysis unit. Specifically, Figure 7 The basic block 'if r0! = "sum" goto label3' can be split into six token blocks: if, r0, ! =, sum, goto, label3. Since a piece of code contains a large number of code blocks, and each code block contains multiple tokens, in order to improve the analysis efficiency, it is necessary to select weighted tokens with important semantics, that is, weighted tokens.

[0066] Furthermore, based on the importance ranking algorithm, such as the Pagerank algorithm, the importance score of each basic block is calculated. In the first step, each code block is assigned the same weight score PR(i), and then the score is updated according to formula (1) until the score value becomes stable and no longer changes.

[0067]

[0068] Among them, G i represents the set of all basic blocks that can jump to i, L(j) represents the total number of basic blocks to which basic block j jumps externally, N is the total number of basic blocks, and α is generally taken as 0.85.

[0069] Step S3, according to the weight score calculation result, select a preset number of weight tokens from the basic blocks of the control flow graph of the program fragment to be analyzed and the basic blocks of the control flow graph of the program fragment with known vulnerabilities.

[0070] Among them, after calculating the weight score of each basic block, all tokens in the basic block are assigned corresponding scores, and then the weight scores of the same token in different basic blocks are summed up to get the total weight score of the token, and then the weight token is selected according to the preset number.

[0071] Step S4, converting the weight tokens into a feature matrix, and inputting the feature matrix into a pre-established twin neural network model to obtain the similarity between the feature matrix of the program fragment to be analyzed and the feature matrix of the program fragment with known vulnerabilities, and performing vulnerability detection on the program fragment to be analyzed based on the similarity.

[0072] Specifically, a word embedding algorithm such as Word2Vec can be used to generate a semantic vector of a weight token, converting each weight token into a semantic vector of a fixed dimension k. Then Multiply it by the total weight score corresponding to the token to get the feature vector of the weight token Then, 50 (preset number is 50) weight token feature vectors are sequentially concatenated to generate a feature matrix with 50 rows and k columns, where each row in the feature matrix represents the feature vector of the corresponding weight token.

[0073] Furthermore, the feature matrix is ​​input into the pre-established twin neural network model, and the similarity between the weighted token feature matrix of the known vulnerable program fragment and the program fragment to be analyzed is calculated, and whether there is a vulnerability in the program fragment to be analyzed is determined based on the similarity. Specifically, the twin neural network is a coupling architecture based on a deep learning neural network, which consists of two neural networks of the same structure, and the two networks share the same parameters.

[0074] As an embodiment of the present invention, Figure 2 As shown, weight score calculations are performed on the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, and the weight score calculation results of each basic block include:

[0075] Step S21, determining the basic blocks and the corresponding multiple tokens in the control flow graph of the program fragment to be analyzed, and determining the basic blocks and the corresponding multiple tokens in the control flow graph of the program fragment to be analyzed, according to the control flow graph of the program fragment to be analyzed and the control flow graph of the program fragment with known vulnerabilities;

[0076] Step S22, using an importance ranking algorithm, weight score calculations are performed on the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively, to obtain weight score calculation results for each basic block.

[0077] Among them, Figure 7 The basic block 'if r0! = "sum" goto label3' can be split into six token blocks: if, r0, ! =, sum, goto, label3. Because a piece of code contains a large number of code blocks, and each code block contains multiple tokens.

[0078] Furthermore, an importance ranking algorithm, such as the Pagerank algorithm, is used to calculate the importance score of each basic block. In the first step, each code block is assigned the same weight score PR(i), and then the score is updated according to formula (1) until the score value becomes stable and no longer changes.

[0079] In this embodiment, if Figure 3As shown, according to the weight score calculation result, a preset number of weight tokens are selected from the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, including:

[0080] Step S31, according to the weight score calculation results of each basic block, respectively obtain the total weight score of each token in the control flow graph of the program fragment to be analyzed and the total weight score of each token in the control flow graph of the program fragment with known vulnerabilities;

[0081] Step S32, according to the total weight score, select a preset number of weight tokens from the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities.

[0082] After calculating the weight score of each basic block, all tokens in the basic block are assigned corresponding scores, and then the weight scores of the same token in different basic blocks are summed to get the total weight score of the token. Select weight tokens according to the preset number, for example, take the top 50 tokens in the total weight score as the weight tokens of this code.

[0083] In this embodiment, if Figure 4 As shown, converting the weight token into a feature matrix includes:

[0084] Step S41, using a word embedding algorithm to generate a semantic vector for each weighted token;

[0085] Step S42, obtaining a feature vector of each weighted token according to the semantic vector of each weighted token and the total weight score corresponding to each weighted token;

[0086] Step S43, generating a feature matrix of weighted tokens corresponding to the program fragment to be analyzed and a feature matrix of weighted tokens corresponding to the program fragment with known vulnerabilities, respectively, based on the feature vector.

[0087] Among them, a word embedding algorithm, such as the Word2Vec algorithm, is used to generate the semantic vector of the weight token, and each weight token is converted into a semantic vector of a fixed dimension k. Then Multiply it by the total weight score corresponding to the token to get the feature vector of the weight token Then, the 50 weight token feature vectors are concatenated sequentially to generate a feature matrix with 50 rows and k columns, where each row in the feature matrix represents the feature vector of the corresponding weight token.

[0088] As an embodiment of the present invention, the feature matrix is ​​input into a pre-established twin neural network model to obtain the similarity between the feature matrix of the program fragment to be analyzed and the feature matrix of the program fragment with known vulnerabilities, including: inputting the feature matrix into a pre-established twin neural network model, and after calculation by the convolutional layer, pooling layer and fully connected layer in the twin neural network model, obtaining the Euclidean distance corresponding to the feature matrix of the program fragment to be analyzed and the feature matrix of the program fragment with known vulnerabilities, and using the Euclidean distance as the similarity.

[0089] Among them, the pre-established twin neural network inputs the weight token feature matrix of the known vulnerability program fragment and the weight token feature matrix of the program fragment to be analyzed, obtains the high-dimensional feature vector through the convolution layer, pooling layer and fully connected layer, and outputs the similarity of the two high-dimensional feature vectors.

[0090] As an embodiment of the present invention, performing vulnerability detection on the program fragment to be analyzed according to the similarity includes: if it is known that the similarity is greater than a preset threshold, determining that there is a vulnerability in the program fragment to be analyzed that is consistent with the type in the known vulnerability program fragment.

[0091] The similarity is represented by the Euclidean distance between two high-dimensional feature vectors. When the Euclidean distance is greater than a threshold k, it is determined that the same type of vulnerability exists in the code.

[0092] In a specific embodiment of the present invention, Figure 5 The diagram is a schematic diagram of the structure of a system of an application code vulnerability detection method according to an embodiment of the present invention. The system shown in the diagram includes: a code parsing module 101 , a vulnerability discovery module 102 , and a result display module 103 .

[0093] Among them, the code parsing module 101 is responsible for analyzing the source code, generating a control flow graph, and then extracting weight tokens based on the control flow graph. The vulnerability discovery module 102 converts the weight tokens into feature vectors and sends them to the twin neural network model for identification, and passes them to the result display module 103 for display.

[0094] In this embodiment, if Figure 6 The code parsing module shown includes two parts: a code control flow generation unit 201 and a token extraction unit 202.

[0095] The code control flow generation unit 201 generates a corresponding control flow graph for the program fragment to be analyzed using the corresponding static code analysis tool for different programming languages. Figure 7 shown.

[0096] The weight token extraction unit 202 obtains the weight token based on lexical analysis according to the control flow graph generated by the code control flow generation unit 201. As shown in the figure above, the basic block 'if r0! = "sum" goto label3' can be divided into six token blocks: if, r0,! =, sum, goto, label3. Since a piece of code contains a large number of code blocks, and each code block contains multiple tokens, in order to improve the analysis efficiency, it is necessary to screen weight tokens with important semantics. First, the importance score of each basic block is calculated based on the Pagerank algorithm. In the first step, the same weight score PR(i) is assigned to each code block, and then the score is updated according to formula (1) until the score value stabilizes and no longer changes.

[0097] Furthermore, after calculating the weight score of each basic block, all tokens in the basic block are assigned corresponding scores. Then, the weight scores of the same token in different basic blocks are summed up to get the total weight score w of the token. The top 50 tokens in the total weight score are taken as the important tokens of this code and passed to the vulnerability discovery module for comparison.

[0098] In this embodiment, if Figure 8 The vulnerability discovery module shown includes two parts: a feature extraction unit 401 and a vulnerability identification unit 402 .

[0099] The feature extraction unit 401 is responsible for converting the weight token into a feature matrix for model training and identification of the vulnerability identification unit 402. Specifically, the Word2Vec algorithm is used to generate the semantic vector of the weight token, and each weight token is converted into a semantic vector of a fixed dimension k. Then Multiply it by the total weight score corresponding to the token to get the feature vector of the weight token Then, the 50 weighted token feature vectors are sequentially concatenated to generate a feature matrix with 50 rows and k columns, where each row in the matrix represents a feature vector of a corresponding token, and is transmitted to the vulnerability identification unit 302 .

[0100] The vulnerability identification unit 402 is responsible for inputting the feature matrix into the twin neural network, calculating the similarity of the weighted token feature matrix between the known vulnerability program fragment and the program fragment to be analyzed, and judging whether there is a vulnerability in the program fragment to be analyzed based on the similarity.

[0101] Specifically, the twin neural network is a coupling architecture based on deep learning neural networks, consisting of two neural networks of the same structure, and the two networks share the same parameters. The twin neural network inputs the weight token feature matrix of the program fragment with known vulnerabilities and the weight token feature matrix of the program fragment to be analyzed, obtains a high-dimensional feature vector through the convolution layer, pooling layer and fully connected layer, and finally outputs the similarity of the two feature matrices. The similarity is represented by the Euclidean distance of the two high-dimensional feature vectors. When the Euclidean distance is greater than the threshold k, it is judged that the same type of vulnerability exists in the code, and the vulnerability information is passed to the result display module.

[0102] In this embodiment, the result display module is responsible for displaying the discovered vulnerabilities on the page, and the displayed content includes the code segment with the vulnerability, the weight token, the known vulnerability program segment for comparison, the weight token, and the code similarity between the two code segments.

[0103] In this embodiment, if Fig. 9 The system workflow diagram shown in the figure is as follows:

[0104] Step 1: Use static code analysis tools to generate corresponding control flow graphs for known vulnerable program fragments and program fragments to be analyzed;

[0105] Step 2: Calculate the weight score of each basic block based on the Pagerank algorithm and select the top 50 weighted tokens;

[0106] Step 3: Use the Word2Vec algorithm to generate the feature matrix of weight tokens;

[0107] Step 4: Use the twin neural network to calculate the similarity of the weighted token feature matrix between the known vulnerability code and the code to be detected;

[0108] Step 5: Determine whether there is a vulnerability in the code to be detected based on the similarity and display the result.

[0109] The present invention utilizes artificial intelligence technologies such as importance ranking algorithms and twin neural network models to quickly locate whether there is a similar code semantic structure in the application system after a vulnerability is discovered, thereby discovering high-risk issues in batches and fully exposing potential risks from the source code level.

[0110] like Fig.10 FIG. 1 is a schematic diagram of the structure of a code vulnerability detection device according to an embodiment of the present invention. The device shown in the figure includes:

[0111] A control flow graph module 10 is used to obtain a program fragment to be analyzed and a program fragment with known vulnerabilities, and generate a control flow graph of the program fragment to be analyzed and a control flow graph of the program fragment with known vulnerabilities respectively according to the program fragment to be analyzed and the program fragment with known vulnerabilities;

[0112] A weight scoring module 20 is used to perform weight scoring calculations on the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively, to obtain weight scoring calculation results for each basic block;

[0113] A weight token module 30, configured to select a preset number of weight tokens from the basic blocks of the control flow graph of the program fragment to be analyzed and the basic blocks of the control flow graph of the program fragment with known vulnerabilities, respectively, according to the weight score calculation result;

[0114] The vulnerability detection module 40 is used to convert the weight tokens into a feature matrix, and input the feature matrix into a pre-established twin neural network model to obtain the similarity between the feature matrix of the program fragment to be analyzed and the feature matrix of the program fragment with known vulnerabilities, and perform vulnerability detection on the program fragment to be analyzed based on the similarity.

[0115] As an embodiment of the present invention, Fig.11 As shown, the weight scoring module 20 includes:

[0116] A basic block unit 21 is used to determine the basic blocks and the corresponding multiple tokens in the control flow graph of the program fragment to be analyzed, and determine the basic blocks and the corresponding multiple tokens in the control flow graph of the program fragment with known vulnerabilities according to the control flow graph of the program fragment to be analyzed and the control flow graph of the program fragment with known vulnerabilities;

[0117] The score calculation unit 22 is used to use an importance ranking algorithm to perform weight score calculations on the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively, to obtain weight score calculation results for each basic block.

[0118] In this embodiment, if Fig.12 As shown, the weight token module 30 includes:

[0119] A total scoring unit 31 is used to obtain the total weight score of each token in the control flow graph of the program fragment to be analyzed and the total weight score of each token in the control flow graph of the program fragment with known vulnerabilities according to the weight score calculation results of each basic block;

[0120] The weight token unit 32 is used to select a preset number of weight tokens from the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively, according to the total weight score.

[0121] In this embodiment, if Fig.13 As shown, the vulnerability detection module 40 includes:

[0122] A semantic vector unit 41, used to generate a semantic vector of each weighted token using a word embedding algorithm;

[0123] A feature vector unit 42, for obtaining a feature vector of each weighted token according to the semantic vector of each weighted token and the total weight score corresponding to each weighted token;

[0124] The feature matrix unit 43 is used to generate a feature matrix of weighted tokens corresponding to the program fragment to be analyzed and a feature matrix of weighted tokens corresponding to the program fragment with known vulnerabilities according to the feature vector.

[0125] As an embodiment of the present invention, the vulnerability detection module is also used to input the feature matrix into a pre-established twin neural network model, and after processing by the convolutional layer, pooling layer and fully connected layer in the twin neural network model, obtain the Euclidean distance corresponding to the feature matrix of the program fragment to be analyzed and the feature matrix of the known vulnerability program fragment, and use the Euclidean distance as the similarity.

[0126] As an embodiment of the present invention, the vulnerability detection module is further configured to determine that a vulnerability of the same type as that in the known vulnerability program fragment exists in the program fragment to be analyzed if it is known that the similarity is greater than a preset threshold.

[0127] Based on the same application concept as the above-mentioned code vulnerability detection method, the present invention also provides the above-mentioned code vulnerability detection device. Since the principle of solving the problem by the code vulnerability detection device is similar to that of the code vulnerability detection method, the implementation of the code vulnerability detection device can refer to the implementation of the code vulnerability detection method, and the repeated parts will not be repeated.

[0128] The present invention performs code vulnerability mining based on a twin neural network. After a vulnerability is discovered, it can batch discover other similar codes existing in the system from the perspective of code semantic structure matching, thereby deeply revealing the relevant risks in the application system and effectively ensuring the security of the application code.

[0129] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above method when executing the program.

[0130] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for executing the above method.

[0131] like Fig.14As shown, the electronic device 600 may further include: a communication module 110, an input unit 120, an audio processing unit 130, a display 160, and a power supply 170. It is worth noting that the electronic device 600 does not necessarily have to include Fig.14 In addition, the electronic device 600 may also include Fig.14 For components not shown, reference may be made to the prior art.

[0132] like Fig.14 As shown, the central processor 100 is sometimes also referred to as a controller or an operation control, and may include a microprocessor or other processor devices and / or logic devices. The central processor 100 receives inputs and controls the operations of various components of the electronic device 600.

[0133] The memory 140 may be, for example, one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory or other suitable devices. The above-mentioned information related to the failure may be stored, and a program for executing the relevant information may also be stored. The CPU 100 may execute the program stored in the memory 140 to implement information storage or processing.

[0134] The input unit 120 provides input to the CPU 100. The input unit 120 is, for example, a key or a touch input device. The power supply 170 is used to provide power to the electronic device 600. The display 160 is used to display display objects such as images and text. The display may be, for example, an LCD display, but is not limited thereto.

[0135] The memory 140 may be a solid-state memory, such as a read-only memory (ROM), a random access memory (RAM), a SIM card, etc. It may also be a memory that saves information even when the power is off, can be selectively erased, and is provided with more data, examples of which are sometimes referred to as EPROMs, etc. The memory 140 may also be some other type of device. The memory 140 includes a buffer memory 141 (sometimes referred to as a buffer). The memory 140 may include an application / function storage unit 142, which is used to store application programs and function programs or processes for executing the operation of the electronic device 600 through the central processor 100.

[0136] The memory 140 may also include a data storage unit 143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 144 of the memory 140 may include various drivers for communication functions of the electronic device and / or for executing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0137] The communication module 110 is a transmitter / receiver 110 that transmits and receives signals via an antenna 111. The communication module (transmitter / receiver) 110 is coupled to the central processor 100 to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal.

[0138] Based on different communication technologies, multiple communication modules 110 may be provided in the same electronic device, such as a cellular network module, a Bluetooth module and / or a wireless LAN module. The communication module (transmitter / receiver) 110 is also coupled to a speaker 131 and a microphone 132 via an audio processor 130 to provide an audio output via the speaker 131 and receive an audio input from the microphone 132, thereby realizing a common telecommunication function. The audio processor 130 may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor 130 is also coupled to the central processor 100, so that the sound can be recorded on the local machine through the microphone 132, and the sound stored on the local machine can be played through the speaker 131.

[0139] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0140] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0141] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0142] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0143] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A code vulnerability detection method, characterized in that: The method comprises: Obtaining a program fragment to be analyzed and a program fragment with known vulnerabilities, and generating a control flow graph of the program fragment to be analyzed and a control flow graph of the program fragment with known vulnerabilities respectively according to the program fragment to be analyzed and the program fragment with known vulnerabilities; Performing weight score calculations on the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively, to obtain weight score calculation results for each basic block; According to the weight score calculation result, a preset number of weight tokens are selected from the basic blocks of the control flow graph of the program fragment to be analyzed and the basic blocks of the control flow graph of the program fragment with known vulnerabilities, respectively; specifically including: According to the weight score calculation results of each basic block, the total weight score of each weight token in the control flow graph of the program fragment to be analyzed and the total weight score of each weight token in the control flow graph of the program fragment with known vulnerabilities are obtained respectively; According to the total weight score, a preset number of weight tokens are selected from the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively; specifically comprising: sorting the total weight score of each weight token in order of size, and selecting the top preset number of weight tokens from the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively; The weight tokens are converted into a feature matrix, and the feature matrix is ​​input into a pre-established twin neural network model to obtain the similarity between the feature matrix of the program fragment to be analyzed and the feature matrix of the program fragment with known vulnerabilities, and vulnerability detection is performed on the program fragment to be analyzed based on the similarity.

2. The method according to claim 1, characterized in that The weight score calculation is performed on the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively, to obtain the weight score calculation results of each basic block, including: According to the control flow graph of the program fragment to be analyzed and the control flow graph of the program fragment with known vulnerabilities, determine the basic blocks in the control flow graph of the program fragment to be analyzed and the multiple tokens corresponding thereto, and determine the basic blocks in the control flow graph of the program fragment with known vulnerabilities and the multiple tokens corresponding thereto; By using an importance ranking algorithm, weight score calculations are performed on the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively, to obtain weight score calculation results for each basic block.

3. The method according to claim 2, characterized in that The converting the weight tokens into a feature matrix comprises: Using word embedding algorithm, generate semantic vectors of each weighted token; According to the semantic vector of each weighted token and the total weight score corresponding to each weighted token, a feature vector of each weighted token is obtained; According to the feature vector, a feature matrix of weighted tokens corresponding to the program fragment to be analyzed and a feature matrix of weighted tokens corresponding to the program fragment with known vulnerabilities are generated respectively.

4. The method according to claim 1, characterized in that: The step of inputting the feature matrix into a pre-established twin neural network model to obtain the similarity between the feature matrix of the program fragment to be analyzed and the feature matrix of the program fragment with known vulnerabilities comprises: The feature matrix is ​​input into a pre-established twin neural network model. After being processed by the convolutional layer, pooling layer and fully connected layer in the twin neural network model, the Euclidean distance corresponding to the feature matrix of the program fragment to be analyzed and the feature matrix of the known vulnerability program fragment is obtained, and the Euclidean distance is used as the similarity.

5. The method according to claim 1, characterized in that The performing vulnerability detection on the program fragment to be analyzed according to the similarity comprises: If it is learned that the similarity is greater than a preset threshold, it is determined that a vulnerability of the same type as that in the known vulnerability program fragment exists in the program fragment to be analyzed.

6. A code vulnerability detection device, characterized in that: The device comprises: A control flow graph module is used to obtain a program fragment to be analyzed and a program fragment with known vulnerabilities, and generate a control flow graph of the program fragment to be analyzed and a control flow graph of the program fragment with known vulnerabilities respectively according to the program fragment to be analyzed and the program fragment with known vulnerabilities; A weight scoring module is used to perform weight scoring calculations on the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively, to obtain weight scoring calculation results for each basic block; A weight token module, configured to select a preset number of weight tokens from the basic blocks of the control flow graph of the program fragment to be analyzed and the basic blocks of the control flow graph of the program fragment with known vulnerabilities, respectively, according to the weight score calculation result; The weight token module includes: A total scoring unit, used to obtain the total weight score of each token in the control flow graph of the program fragment to be analyzed and the total weight score of each token in the control flow graph of the program fragment with known vulnerabilities according to the weight score calculation results of each basic block; The weight token unit is used to select a preset number of weight tokens from the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively, according to the total weight score; specifically comprising: sorting the total weight score of each weight token in order of size, and selecting the top preset number of weight tokens from the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively; The vulnerability detection module is used to convert the weight tokens into a feature matrix, and input the feature matrix into a pre-established twin neural network model to obtain the similarity between the feature matrix of the program fragment to be analyzed and the feature matrix of the program fragment with known vulnerabilities, and perform vulnerability detection on the program fragment to be analyzed based on the similarity.

7. The device according to claim 6, characterized in that The weight scoring module includes: A basic block unit, configured to determine a basic block and a plurality of corresponding tokens in the control flow graph of the program fragment to be analyzed and a basic block and a plurality of corresponding tokens in the control flow graph of the program fragment to be analyzed, and to determine a basic block and a plurality of corresponding tokens in the control flow graph of the program fragment to be analyzed; The scoring calculation unit is used to use an importance ranking algorithm to perform weight scoring calculations on the basic blocks in the control flow graph of the program fragment to be analyzed and the basic blocks in the control flow graph of the program fragment with known vulnerabilities, respectively, to obtain weight scoring calculation results for each basic block.

8. The device according to claim 7, characterized in that The vulnerability detection module includes: A semantic vector unit, used to generate a semantic vector of each weighted token using a word embedding algorithm; A feature vector unit, used to obtain a feature vector of each weighted token according to the semantic vector of each weighted token and the total weight score corresponding to each weighted token; The feature matrix unit is used to generate a feature matrix of weighted tokens corresponding to the program fragment to be analyzed and a feature matrix of weighted tokens corresponding to the program fragment with known vulnerabilities according to the feature vector.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 5.

Images