A method and apparatus for patching a target code

Abstract

The application discloses a vulnerability repairing method and device of target code, comprising the following steps: obtaining a preset mapping relationship when receiving the target code; performing similar code identification processing based on code information corresponding to each vulnerability type, to determine similar code segment information corresponding to each vulnerability type in the target code; determining patch information according to the preset mapping relationship and the similar code segment information; and performing vulnerability repairing processing on the target code based on the patch information. According to the technical scheme of the application, the similar code segment information in the target code is determined by performing similar code identification processing based on code information corresponding to each vulnerability type, the patch information is determined according to the preset mapping relationship and the similar code segment information, and the vulnerability repairing processing is performed on the target code based on the patch information, so that all the vulnerabilities needing to be repaired in the target code can be automatically identified, and the potential threat of the vulnerabilities to the host can be eliminated.

Description

Technical Field

[0001] This invention relates to the field of computer network technology, and in particular to a method and apparatus for fixing vulnerabilities in target code. Background Technology

[0002] Software vulnerabilities are exploitable flaws in software systems that pose security threats to computing information systems. Users frequently suffer from software vulnerabilities because software inevitably faces these vulnerabilities. The widespread existence of code duplication means that a single software vulnerability may exist in multiple applications, and patching a vulnerability on a host machine may not completely eliminate the potential threat it poses to the host. Summary of the Invention

[0003] The purpose of this invention is to provide a method and apparatus for patching vulnerabilities in target code. By obtaining a preset mapping relationship upon receiving the target code, performing similar code identification processing based on the code information corresponding to multiple vulnerability types to determine similar code segment information in the target code, determining patch information based on the preset mapping relationship and the similar code segment information, and performing vulnerability patching processing on the target code based on the patch information, it can automatically identify all vulnerabilities in the target code that need to be patched, thereby eliminating the potential threat of vulnerabilities to the host.

[0004] To achieve the above objectives, the present invention provides the following solution:

[0005] A method for patching vulnerabilities in target code, the method comprising:

[0006] Upon receiving the target code, a preset mapping relationship is obtained, which includes multiple vulnerability types and vulnerability remediation information corresponding to each of the multiple vulnerability types.

[0007] Based on the code information corresponding to each of the multiple vulnerability types, similar code identification processing is performed to determine the similar code segment information corresponding to at least one vulnerability type in the target code.

[0008] Based on the preset mapping relationship and the similar code segment information, patch information is determined, wherein the patch information includes at least one similar code segment and its corresponding vulnerability repair information;

[0009] Based on the patch information, the target code is subjected to vulnerability repair processing.

[0010] Optionally, the step of performing similar code identification processing based on the code information corresponding to each of the plurality of vulnerability types to determine the similar code segment information corresponding to at least one vulnerability type in the target code includes:

[0011] Obtain the mapping relationship between vulnerability types and code similarity algorithms;

[0012] Based on the mapping relationship between the vulnerability types and code similarity algorithms, determine the code similarity algorithm corresponding to each vulnerability type;

[0013] Based on the code similarity algorithm, similar code identification processing is performed to determine the similar code segment information corresponding to at least one vulnerability type in the target code.

[0014] Optionally, before obtaining the mapping relationship between vulnerability types and code similarity algorithms, the method further includes:

[0015] Obtain the code similarity algorithm corresponding to each vulnerability type;

[0016] Based on the multiple vulnerability types and their corresponding code similarity algorithms, a mapping relationship between the vulnerability types and code similarity algorithms is constructed.

[0017] Optionally, the method further includes:

[0018] Obtain code information and corresponding vulnerability remediation information for multiple sample vulnerabilities;

[0019] Based on the code information of the multiple sample vulnerabilities, the vulnerabilities are classified to obtain the multiple vulnerability types.

[0020] Obtain the code information and corresponding vulnerability remediation information for each of the multiple vulnerability types;

[0021] Based on the code information and corresponding vulnerability remediation information for each of the multiple vulnerability types, the preset mapping relationship is constructed.

[0022] Optionally, the patch information also includes location information corresponding to each similar code segment. Determining the patch information based on the preset mapping relationship and the similar code segment information includes:

[0023] Based on the preset mapping relationship and the similar code segment information, obtain the vulnerability remediation information corresponding to each similar code segment;

[0024] Based on the similar code segment information and the target code, determine the location information corresponding to each similar code segment information;

[0025] The vulnerability fix information and the corresponding location information for each similar code segment are obtained to obtain the patch information.

[0026] Optionally, the step of performing vulnerability patching on the target code based on the patch information includes:

[0027] Based on the location information corresponding to each similar code segment, multiple similar code segments in the target code are searched.

[0028] Based on the vulnerability repair information corresponding to each similar code segment, vulnerability repair processing is performed on multiple similar code segments in the target code.

[0029] Optionally, the step of performing vulnerability patching on the target code based on the patch information includes:

[0030] The target code is scanned and identified.

[0031] If similar code segments are identified in the target code, vulnerability remediation processing is performed on the similar code segments based on the vulnerability remediation information corresponding to the similar code segment information until the target code scanning is completed.

[0032] On the other hand, the present invention also provides a vulnerability repair device for target code, the device comprising:

[0033] The information acquisition module is used to acquire a preset mapping relationship upon receiving the target code. The preset mapping relationship includes multiple vulnerability types and vulnerability remediation information corresponding to each of the multiple vulnerability types.

[0034] The similar code identification module is used to perform similar code identification processing based on the code information corresponding to each of the multiple vulnerability types, and to determine the similar code segment information corresponding to at least one vulnerability type in the target code.

[0035] The patch information determination module is used to determine patch information based on the preset mapping relationship and the similar code segment information. The patch information includes multiple similar code segment information and their respective corresponding vulnerability repair information.

[0036] The vulnerability remediation module is used to perform vulnerability remediation processing on the target code based on the patch information.

[0037] On the other hand, the present invention also provides an electronic device, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the vulnerability repair method of the aforementioned target code.

[0038] On the other hand, the present invention also provides a non-volatile computer-readable storage medium storing computer program instructions thereon, wherein the computer program instructions, when executed by a processor, implement the vulnerability repair method of the above-mentioned target code.

[0039] The present invention provides a method and apparatus for patching vulnerabilities in target code. Upon receiving the target code, a preset mapping relationship is obtained. Based on the code information corresponding to multiple vulnerability types, similar code identification processing is performed to determine similar code segment information in the target code. Patch information is determined according to the preset mapping relationship and the similar code segment information. Based on the patch information, vulnerability patching processing is performed on the target code. This method can automatically identify all vulnerabilities in the target code that need to be patched, thereby eliminating the potential threat of vulnerabilities to the host. Attached Figure Description

[0040] To more clearly illustrate the technical solutions of the present invention, the accompanying drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any creative effort.

[0041] Figure 1 This is a flowchart of a method for fixing vulnerabilities in target code provided by an embodiment of the present invention;

[0042] Figure 2 This is a flowchart of a method provided by an embodiment of the present invention for identifying similar code segments in a target code based on code information corresponding to multiple vulnerability types;

[0043] Figure 3 This is a flowchart of a method for obtaining the mapping relationship between vulnerability types and code similarity algorithms provided in an embodiment of the present invention;

[0044] Figure 4 This is a flowchart of a method for constructing a preset mapping relationship provided by an embodiment of the present invention;

[0045] Figure 5 This is a flowchart of a method for determining patch information based on a preset mapping relationship and similar code segment information provided by an embodiment of the present invention;

[0046] Figure 6 This is a flowchart of a method for vulnerability repair processing of target code based on patch information provided by an embodiment of the present invention;

[0047] Figure 7 This is a flowchart of another method for vulnerability repair processing of target code based on patch information provided in an embodiment of the present invention;

[0048] Figure 8 This is a structural block diagram of a target code vulnerability repair device provided in an embodiment of the present invention. Detailed Implementation

[0049] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0050] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0051] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0052] The following describes an embodiment of a vulnerability repair method for target code according to the present invention. Figure 1 This is a flowchart illustrating a method for patching vulnerabilities in target code according to an embodiment of the present invention. It should be noted that this specification provides the operational steps described in the embodiments or flowcharts, but based on conventional or non-inventive methods, more or fewer operational steps may be included. The order of steps listed in the embodiments is merely one possible execution order among many and does not represent the only possible execution order. In actual system products, the methods can be executed in the order shown in the embodiments or drawings, or in parallel (e.g., in a parallel processor or multi-threaded processing environment). Figure 1 As shown, this embodiment provides a method for patching vulnerabilities in target code, the method including:

[0053] S101. Upon receiving the target code, obtain the preset mapping relationship, which includes multiple vulnerability types and their respective vulnerability remediation information.

[0054] The target code can refer to the software code that requires vulnerability patching. The pre-defined mapping relationship can be a pre-established mapping relationship between vulnerability types and vulnerability patching information. Vulnerability types can be used to distinguish the category of a vulnerability. It is understood that each vulnerability type can include multiple vulnerabilities; the code of vulnerabilities under a vulnerability type can be patched using its corresponding vulnerability patching information. The vulnerability patching information corresponding to each vulnerability type can refer to the patching method for fixing vulnerabilities under that vulnerability type.

[0055] In practical applications, after patching vulnerabilities on a host machine, a pre-defined mapping relationship can be generated based on the patch file and stored in memory. Upon receiving target code, the pre-defined mapping relationship can be retrieved from memory. Specifically, the patch file can include pre-patched code information and vulnerability repair information. The corresponding vulnerability type can be determined based on the pre-patched code information, and then a pre-defined mapping relationship can be established based on the vulnerability type and the corresponding vulnerability repair information.

[0056] S102. Based on the code information corresponding to each of the multiple vulnerability types, perform similar code identification processing to determine the similar code segment information corresponding to at least one vulnerability type in the target code.

[0057] The code information for each vulnerability type can be typical code that characterizes that vulnerability type, or it can be a segment of code belonging to that vulnerability type. This code information can be used as a reference to identify similar code in the target code. The similar code segment information corresponding to each vulnerability type refers to a code segment in the target code that is similar to the code information for that vulnerability type. Each vulnerability type can have one or more similar code segment information entries. It is understood that multiple vulnerability types may exist in the target code, and each vulnerability type can correspond to multiple similar code segment information entries.

[0058] In practical applications, based on the code information corresponding to each vulnerability type, similar code identification processing can be performed on the target code. If the target code contains a vulnerability of that type, at least one similar code segment can be identified within the target code that is similar to the code information of that vulnerability type. Specifically, similar code identification processing can be based on code similarity algorithms. For example, a modified cosine similarity algorithm can be used to calculate the similarity between the code information of the vulnerability type and the input code, thereby detecting the existence of similar code segments.

[0059] S103. Determine patch information based on preset mapping relationships and similar code segment information.

[0060] Patch information can be used to fix target code. Patch information may include information on at least one similar code segment and its corresponding vulnerability fix information.

[0061] In practical applications, based on the similarity between vulnerability type code information and similar code segment information in the preset mapping relationship, as well as the correspondence between vulnerability type and vulnerability repair information, vulnerability repair information corresponding to each similar code segment can be obtained, and all similar code segment information and their corresponding vulnerability repair information can be used as patch information.

[0062] S104. Based on the patch information, perform vulnerability patching on the target code.

[0063] In practical applications, scanning the target code can identify similar code segments in the target code that correspond to similar code segments in the patch information. Based on the vulnerability repair information corresponding to those similar code segments, the vulnerability of those similar code segments can be repaired.

[0064] By obtaining a preset mapping relationship upon receiving the target code, similar code segment information is identified based on the code information corresponding to multiple vulnerability types. Patch information is then determined based on the preset mapping relationship and the similar code segment information. Based on the patch information, vulnerability repair processing is performed on the target code. This method can automatically identify all vulnerabilities in the target code that need to be repaired, thereby eliminating the potential threat of vulnerabilities to the host.

[0065] Figure 2 This is a flowchart illustrating a method for identifying similar code segments corresponding to at least one vulnerability type in target code, based on code information corresponding to multiple vulnerability types, according to an embodiment of the present invention. In one possible implementation, such as... Figure 2 As shown, step S102 above may include:

[0066] S201. Obtain the mapping relationship between vulnerability types and code similarity algorithms.

[0067] The code similarity algorithm corresponding to each vulnerability type can be used to calculate the similarity of the vulnerability code corresponding to that vulnerability type.

[0068] In practical applications, the mapping relationship between vulnerability types and code similarity algorithms can be pre-established and stored in memory; the mapping relationship between vulnerability types and code similarity algorithms can be obtained by retrieving it from memory.

[0069] S202. Based on the mapping relationship between vulnerability type and code similarity algorithm, determine the code similarity algorithm corresponding to each vulnerability type.

[0070] In practical applications, based on the mapping relationship between vulnerability types and code similarity algorithms, the code similarity algorithm corresponding to each vulnerability type in the target code can be obtained.

[0071] S203. Based on the code similarity algorithm, perform similar code identification processing to determine the similar code segment information corresponding to at least one vulnerability type in the target code.

[0072] In practical applications, based on the code similarity algorithm corresponding to each vulnerability type in the target code, and using the code information of that vulnerability type as reference information, similar code identification processing can be performed on the target code to obtain similar code segment information in the target code that is similar to the code information of that vulnerability type.

[0073] By employing code similarity algorithms corresponding to vulnerability types to calculate code similarity, the identification results can be more accurate because the corresponding algorithms are more adapted to the vulnerability type. This can solve the problem that there is currently no code similarity algorithm applicable to all vulnerabilities.

[0074] Figure 3 This is a flowchart illustrating a method prior to obtaining the mapping relationship between vulnerability types and code similarity algorithms, as provided in an embodiment of the present invention. In one possible implementation, such as... Figure 3 As shown, before obtaining the mapping relationship between vulnerability types and code similarity algorithms, it may also include:

[0075] S301. Obtain the code similarity algorithm corresponding to each vulnerability type.

[0076] In practical applications, the code similarity algorithms corresponding to different vulnerability types can be pre-set based on experiments. Understandably, multiple experiments can be conducted to determine a code similarity algorithm that is more suitable for different vulnerability types.

[0077] S302. Based on multiple vulnerability types and their corresponding code similarity algorithms, construct a mapping relationship between vulnerability types and code similarity algorithms.

[0078] In practical applications, based on the code similarity algorithm corresponding to each vulnerability type, we can obtain the code similarity algorithms corresponding to multiple vulnerability types, and then construct a mapping relationship between vulnerability types and code similarity algorithms.

[0079] Figure 4 This is a flowchart illustrating a method for constructing a preset mapping relationship according to an embodiment of the present invention. In one possible implementation, such as... Figure 4 As shown, the above method may further include:

[0080] S401. Obtain code information for multiple sample vulnerabilities and corresponding vulnerability remediation information.

[0081] Sample vulnerabilities can be used to obtain multiple vulnerability types and construct preset mapping relationships. Sample vulnerabilities can be vulnerabilities that have already been patched for the host to be patched, or vulnerabilities from a vulnerability database. The code information for each sample vulnerability can refer to the code information before the vulnerability was patched. The vulnerability patching information corresponding to each sample vulnerability can refer to the patching method for that sample vulnerability.

[0082] In practical applications, code information and corresponding vulnerability fixes for multiple sample vulnerabilities can be obtained from patch files on the host machine, or from a vulnerability database. The vulnerability database can be a general vulnerability database or a database built based on vulnerabilities discovered within a preset time period; this disclosure does not impose any limitations. For sample vulnerabilities that do not have corresponding vulnerability fixes when added to the database, their vulnerability fixes can be added later.

[0083] S402. Based on the code information of multiple sample vulnerabilities, classify them to obtain multiple vulnerability types.

[0084] In practical applications, classifiers can be used to classify vulnerabilities based on code information from multiple samples, resulting in multiple vulnerability types. Specifically, the classification algorithm used by the classifier can be based on probability density methods or discriminant function methods, such as Bayesian estimation, maximum likelihood estimation, Parzen window method, Kn nearest neighbor method, etc., and this disclosure does not limit the specific methods used.

[0085] S403. Obtain the code information and corresponding vulnerability remediation information for each of the multiple vulnerability types.

[0086] In practical applications, for each vulnerability type, the code information of a sample vulnerability belonging to that vulnerability type can be used as the code information corresponding to that vulnerability type, and the vulnerability repair information of that sample vulnerability can be used as the vulnerability repair information corresponding to that vulnerability type.

[0087] S404. Based on the code information and corresponding vulnerability remediation information for each of the multiple vulnerability types, a preset mapping relationship is constructed.

[0088] In practical applications, based on the code information and corresponding vulnerability remediation information for each vulnerability type, we can obtain the code information and corresponding vulnerability remediation information for multiple vulnerability types, and construct a preset mapping relationship based on this.

[0089] By classifying vulnerabilities based on samples, multiple vulnerability types and their corresponding remediation information can be obtained. This facilitates modular vulnerability remediation and avoids increasing the workload by using similar remediation methods for similar vulnerabilities.

[0090] Figure 5 This is a flowchart illustrating a method for determining patch information based on a preset mapping relationship and similar code segment information, provided by an embodiment of the present invention. In one possible implementation, the patch information may further include location information corresponding to each similar code segment, such as... Figure 5 As shown, step S103 above may include:

[0091] S501. Based on the preset mapping relationship and similar code segment information, obtain the vulnerability remediation information corresponding to each similar code segment.

[0092] In practical applications, based on the mapping relationship between vulnerability types and vulnerability remediation information, as well as the vulnerability types described by the similar code information corresponding to similar code segments, the vulnerability remediation information corresponding to each similar code segment can be obtained.

[0093] S502. Based on the similar code segment information and the target code, determine the location information corresponding to each similar code segment.

[0094] The location information corresponding to each similar code segment can represent the relative position of the corresponding similar code segment in the target code. This location information can be used to quickly locate the corresponding similar code segment. The location information can be represented by a range of paragraph numbers or other methods; this disclosure does not limit its representation.

[0095] In practical applications, similar code segment information can be matched with target code to obtain the specific similar code segment in the target code corresponding to the similar code segment information. The paragraph numbers of the first and last paragraphs of the similar code segment can be obtained, thus obtaining the paragraph number range of the similar code segment, and this paragraph number range can be used as the location information of the similar code segment information.

[0096] S503. Obtain the vulnerability fix information and corresponding location information for each similar code segment to obtain patch information.

[0097] In practical applications, based on the vulnerability repair information corresponding to each similar code segment and the location information corresponding to each similar code segment, the vulnerability repair information and location information corresponding to each similar code segment can be obtained. At least one vulnerability repair information and location information corresponding to each similar code segment can be obtained, and then patch information can be obtained.

[0098] Figure 6 This is a flowchart illustrating a method for patching target code based on patch information, provided by an embodiment of the present invention. In one possible implementation, such as... Figure 6 As shown, step S104 above may include:

[0099] S601. Based on the location information corresponding to each similar code segment, find multiple similar code segments in the target code.

[0100] In practical applications, for each similar code segment in the target code, it can be searched according to the location information of its corresponding similar code segment information.

[0101] S602. Based on the vulnerability remediation information corresponding to each similar code segment, perform vulnerability remediation processing on multiple similar code segments in the target code.

[0102] In practical applications, based on the vulnerability repair information corresponding to each similar code segment, the vulnerability repair information corresponding to each similar code segment can be obtained, and then the vulnerability repair information can be used to repair the vulnerability of the similar code segment.

[0103] By finding similar code segments by identifying their location information, it is possible to quickly locate similar code segments in the target code, thereby improving the efficiency of vulnerability remediation.

[0104] Figure 7 This is a flowchart illustrating another method for vulnerability remediation of target code based on patch information provided by an embodiment of the present invention. In another possible implementation, such as... Figure 7 As shown, step S104 above may include:

[0105] S701. Scan and identify the target code.

[0106] In practical applications, after determining the patch information, scanning and identification can be performed based on this information. Specifically, this can be done by matching similar code segments within the patch information.

[0107] S702. If similar code segments are identified in the target code, vulnerability remediation is performed on the similar code segments based on the vulnerability remediation information corresponding to the similar code segment information until the target code scan is completed.

[0108] In practical applications, when similar code segments are identified in the target code, the vulnerability repair information corresponding to each similar code segment can be obtained, and then the vulnerability repair information can be used to repair the vulnerability of the similar code segment.

[0109] Figure 8 This is a structural block diagram of a target code vulnerability repair device provided in an embodiment of the present invention. On the other hand, the present invention also provides a target code vulnerability repair device, which includes:

[0110] The information acquisition module 10 is used to acquire a preset mapping relationship when the target code is received. The preset mapping relationship includes multiple vulnerability types and the vulnerability remediation information corresponding to each of the multiple vulnerability types.

[0111] The similar code identification module 20 is used to perform similar code identification processing based on the code information corresponding to each of multiple vulnerability types, and to determine the similar code segment information corresponding to at least one vulnerability type in the target code.

[0112] The patch information determination module 30 is used to determine patch information based on a preset mapping relationship and similar code segment information. The patch information includes multiple similar code segment information and their respective corresponding vulnerability repair information.

[0113] Vulnerability repair module 40 is used to perform vulnerability repair processing on target code based on patch information.

[0114] On the other hand, embodiments of the present invention also provide an electronic device, including: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the vulnerability repair method of the aforementioned target code.

[0115] On the other hand, embodiments of the present invention also provide a non-volatile computer-readable storage medium storing computer program instructions thereon, wherein the computer program instructions, when executed by a processor, implement the vulnerability repair method of the above-mentioned target code.

[0116] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as combinations of two series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, as some steps can be performed in other orders or simultaneously according to the present invention. Similarly, each module of the above-described target code vulnerability repair device refers to a computer program or program segment used to perform one or more specific functions. Furthermore, the distinction between the above modules does not mean that the actual program code must also be separate. In addition, the above embodiments can be arbitrarily combined to obtain other embodiments.

[0117] In the above embodiments, the descriptions of each embodiment have their own emphasis. Parts not described in detail in one embodiment can be referred to in the relevant descriptions of other embodiments. Those skilled in the art will also understand that the various illustrative logical blocks, units, and steps listed in the embodiments of the present invention can be implemented by electronic hardware, computer software, or a combination of both. To clearly demonstrate the interchangeability of hardware and software, the functions of the various illustrative components, units, and steps described above have been generally described. Whether such functions are implemented by hardware or software depends on the specific application and the overall system design requirements. Those skilled in the art can implement the described functions using various methods for each specific application, but such implementations should not be construed as exceeding the scope of protection of the embodiments of the present invention.

[0118] The foregoing description has fully disclosed the specific embodiments of the present invention. It should be noted that any modifications made to the specific embodiments of the present invention by those skilled in the art do not depart from the scope of the claims. Accordingly, the scope of the claims is not limited to the foregoing specific embodiments.

Claims

1. A method for patching vulnerabilities in target code, characterized in that, The method includes: Upon receiving the target code, a preset mapping relationship is obtained, which includes multiple vulnerability types and corresponding vulnerability remediation information for each of the multiple vulnerability types; the target code refers to the software code that needs vulnerability remediation. Based on the code information corresponding to each of the multiple vulnerability types, similar code identification processing is performed to determine the similar code segment information corresponding to at least one vulnerability type in the target code; the similar code segment information corresponding to each vulnerability type is the code segment in the target code that is similar to the code information of each vulnerability type, and the code information of each vulnerability type is the typical code that represents each vulnerability type. Based on the preset mapping relationship and the similar code segment information, patch information is determined, wherein the patch information includes at least one similar code segment and its corresponding vulnerability repair information; Based on the patch information, vulnerability remediation processing is performed on the target code, including: scanning and identifying the target code; if similar code segments are identified in the target code, vulnerability remediation processing is performed on the similar code segments based on the vulnerability remediation information corresponding to the similar code segments, until the target code scanning is completed; The step of performing similar code identification processing based on the code information corresponding to each of the multiple vulnerability types to determine the similar code segment information corresponding to at least one vulnerability type in the target code includes: Obtain the mapping relationship between vulnerability types and code similarity algorithms; the code similarity algorithm corresponding to each vulnerability type is used to calculate the similarity of the vulnerability code corresponding to each vulnerability type; Based on the mapping relationship between the vulnerability types and code similarity algorithms, determine the code similarity algorithm corresponding to each vulnerability type; Based on the code similarity algorithm, similar code identification processing is performed to determine the similar code segment information corresponding to at least one vulnerability type in the target code. This includes: based on the code similarity algorithm corresponding to each vulnerability type in the target code, and using the code information of each vulnerability type as reference information, performing similar code identification processing on the target code to obtain similar code segment information in the target code that is similar to the code information of each vulnerability type.

2. The method according to claim 1, characterized in that, Before obtaining the mapping relationship between vulnerability types and code similarity algorithms, the following steps are also included: Obtain the code similarity algorithm corresponding to each vulnerability type; Based on the multiple vulnerability types and their corresponding code similarity algorithms, a mapping relationship between the vulnerability types and code similarity algorithms is constructed.

3. The method according to claim 1, characterized in that, The method further includes: Obtain code information and corresponding vulnerability remediation information for multiple sample vulnerabilities; Based on the code information of the multiple sample vulnerabilities, the vulnerabilities are classified to obtain the multiple vulnerability types. Obtain the code information and corresponding vulnerability remediation information for each of the multiple vulnerability types; Based on the code information and corresponding vulnerability remediation information for each of the multiple vulnerability types, the preset mapping relationship is constructed.

4. The method according to claim 1, characterized in that, The patch information also includes location information corresponding to each similar code segment. Determining the patch information based on the preset mapping relationship and the similar code segment information includes: Based on the preset mapping relationship and the similar code segment information, obtain the vulnerability remediation information corresponding to each similar code segment; Based on the similar code segment information and the target code, determine the location information corresponding to each similar code segment information; The vulnerability fix information and the corresponding location information for each similar code segment are obtained to obtain the patch information.

5. The method according to claim 4, characterized in that, The process of patching the target code based on the patch information includes: Based on the location information corresponding to each similar code segment, multiple similar code segments in the target code are searched. Based on the vulnerability repair information corresponding to each similar code segment, vulnerability repair processing is performed on multiple similar code segments in the target code.

6. A vulnerability patching device for target code, characterized in that, The device includes: The information acquisition module is used to acquire a preset mapping relationship upon receiving target code. The preset mapping relationship includes multiple vulnerability types and corresponding vulnerability remediation information for each of the multiple vulnerability types. The target code refers to software code that requires vulnerability remediation. A similar code identification module is used to perform similar code identification processing based on the code information corresponding to each of the multiple vulnerability types, and to determine the similar code segment information corresponding to at least one vulnerability type in the target code. The step of performing similar code identification processing based on the code information corresponding to each of the multiple vulnerability types to determine the similar code segment information corresponding to at least one vulnerability type in the target code includes: obtaining a mapping relationship between vulnerability types and code similarity algorithms; using a code similarity algorithm corresponding to each vulnerability type for similarity calculation of the vulnerability code corresponding to each vulnerability type; and determining the similarity of the code segments corresponding to each vulnerability type according to the mapping relationship between vulnerability types and code similarity algorithms. A code similarity algorithm is used to perform similar code identification processing to determine the similar code segment information corresponding to at least one vulnerability type in the target code. This includes: based on the code similarity algorithm corresponding to each vulnerability type in the target code, and using the code information of each vulnerability type as reference information, performing similar code identification processing on the target code to obtain similar code segment information in the target code that is similar to the code information of each vulnerability type; the similar code segment information corresponding to each vulnerability type is the code segment in the target code that is similar to the code information of each vulnerability type, and the code information of each vulnerability type is typical code representing each vulnerability type; The patch information determination module is used to determine patch information based on the preset mapping relationship and the similar code segment information. The patch information includes multiple similar code segment information and their respective corresponding vulnerability repair information. The vulnerability remediation module is used to perform vulnerability remediation processing on the target code based on the patch information, including: scanning and identifying the target code; and, if similar code segments are identified in the target code, performing vulnerability remediation processing on the similar code segments based on the vulnerability remediation information corresponding to the similar code segments, until the target code scanning is completed.

7. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to execute the executable instructions to implement the vulnerability repair method for the target code as described in any one of claims 1 to 5.

8. A non-volatile computer-readable storage medium storing computer program instructions thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the vulnerability repair method for the target code as described in any one of claims 1 to 5.

Images