Vulnerability mining system and method based on intermediate language and transfer representation learning

Abstract

A vulnerability mining system based on intermediate language and transfer representation learning comprises: a transfer representation model training module, a convolutional network training module and a software vulnerability mining module. The transfer representation model training module uses data compiled into an intermediate language and preprocessed with labels to perform transfer learning training on a bidirectional long short-term memory network, and outputs the calculation results of the intermediate hidden layer in the BiLSTM network as a high-level representation form of the data set; the convolutional network training module uses the high-level representation form of the data and the corresponding labels to train a convolutional neural network classifier for distinguishing the high-level representation; the software vulnerability mining module uses the model generated by the training of the other two modules, first compiles and preprocesses the unknown software, and inputs the processed code segment into the BiLSTM network, obtains the high-level representation of the data from the hidden layer of the BiLSTM network, and then inputs it into the convolutional neural network classifier, and finally obtains the result of distinguishing whether the code segment has a vulnerability.

Description

Technical Field

[0001] The present invention relates to a technology in the field of information security, specifically a vulnerability mining system and method based on intermediate language and transfer representation learning. The vulnerability described in the present invention generally refers to a defect in a computer program, which can be easily exploited by malicious attackers to cause program crashes, data leaks, loss of control and other consequences. Background Art

[0002] Software vulnerabilities, also known as software vulnerabilities, usually refer to defects in computer programs that can be easily exploited by malicious attackers to cause program crashes, data leaks, loss of control, and other consequences. Software vulnerability mining is of great significance for protecting the security of computer systems and software, but most traditional vulnerability mining methods require tedious and inefficient manual analysis, and the accuracy and recall rates are still not ideal. At present, some deep learning-based methods have emerged in the industry, using deep neural networks for feature extraction to avoid tedious manual feature extraction engineering, but they are still lacking in versatility and generalization. Summary of the invention

[0003] In view of the above-mentioned deficiencies and defects of the prior art, the present invention proposes a vulnerability mining system based on intermediate language and transfer representation learning, and by converting different high-level languages ​​into intermediate languages ​​and then performing preprocessing and feature extraction, the versatility of the vulnerability mining method for different programming languages ​​is improved, and then the preprocessed data set is transferred using a bidirectional long short-term memory network to extract the hidden layer output of the bidirectional long short-term extremely easy network as a high-level representation form of the data, and then the high-level representation is input into a deep convolutional network for classification training to obtain a convolutional neural network that can perform high-level representation classification. When performing vulnerability mining on unknown software, the unknown software is preprocessed and the processed code segment is input into a bidirectional long short-term memory network to obtain a high-level representation, which is then input into a convolutional classification network, and then the judgment result of whether the output code segment has a vulnerability is calculated. This method of transfer representation learning can effectively avoid overfitting and improve the generalization of the model.

[0004] The present invention is achieved through the following technical solutions:

[0005] The invention relates to a vulnerability mining system based on intermediate language and transfer representation learning, comprising: a transfer representation model training module, a convolutional network training module and a software vulnerability mining module, wherein: the transfer representation model training module uses data compiled into an intermediate language and preprocessed and labels to perform transfer learning training on a bidirectional long short-term memory (BiLSTM) network, and outputs the calculation result of the intermediate hidden layer in the BiLSTM network as a high-level representation form of a data set; the convolutional network training module uses the high-level representation form of the data and the corresponding labels to train a convolutional neural network classifier for distinguishing the high-level representation; the software vulnerability mining module uses the models generated by the training of the other two modules, firstly compiles and preprocesses the unknown software, and inputs the processed code segment into the BiLSTM network, obtains the high-level representation of the data from the hidden layer of the BiLSTM network, and then inputs it into the convolutional neural network classifier, and finally obtains the result of distinguishing whether the code segment has a vulnerability.

[0006] The preprocessing includes intermediate language compilation, high-risk point location, code slicing and function name standardization.

[0007] The present invention relates to a vulnerability mining method based on the above system. The method uses a collected vulnerability code data set to train a BiLSTM network for characterization extraction in an offline stage, and then uses the extracted high-level characterization to train a CNN classification network. In an online stage, after the software code to be tested is compiled and preprocessed, high-risk points are located and the program is sliced, the slices are sequentially input into the trained BiLSTM network and the CNN classification network to obtain a vulnerability discrimination result for each slice.

[0008] The vulnerability code data set refers to: pre-collected vulnerability codes, each of which should be a relatively complete software source code, and has a label corresponding to it, and the value of the label is 0 or 1, wherein 0 indicates that the code segment has no vulnerability, and 1 indicates that the code segment has a vulnerability. The present invention uses the U.S. National Public Vulnerability Database SARD (Software Assurance Reference Dataset) database published by NIST (National Institute of Standards and Technology) as the vulnerability code data set. In order to enable the model to learn clearer features, only the stack-based buffer overflow type vulnerability (CWE121) is selected for training, and the generated model can give a high-accuracy discrimination result for buffer overflow type vulnerabilities.

[0009] The compilation refers to compiling the high-level language source code of the training data set into an intermediate language. In the present invention, the clang compiler is used to compile the source code into the intermediate language.

[0010] The intermediate language refers to: a syntax-oriented, equivalent internal representation code of a source program that is easy to translate into a target program. Its comprehensibility and the degree of ease of generating target code are between the source language and the target language. The LLVM language is used as the selected intermediate language in the present invention, which has a highly modular design, clearer code and richer semantic features. As a language-independent intermediate code, the LLVM intermediate language can connect different high-level languages ​​to each other, thereby improving the versatility of the present invention for different programming languages.

[0011] The high-level representation refers to the calculation output result of the middle hidden layer in the deep learning network. In the deep learning network, after the original data passes through the input layer, each hidden layer actually performs feature extraction and combination, and the more layers it passes through, the more advanced the extracted features are. High-level features can be regarded as a combination of low-level features. In the present invention, the high-level representation is extracted from the output layer of the second layer BiLSTM. The high-level representation contains the high-level features learned by the BiLSTM network, which can be further input into the CNN network for classification.

[0012] The high-risk functions are: based on existing vulnerability research conclusions, common library functions that are prone to cause vulnerabilities.

[0013] Taking C language as an example, some memory writing functions do not perform buffer boundary checks before writing, such as memcpy, strcpy, strncpy and other functions. When the payload length written into the buffer is greater than the buffer length, the written payload will overflow the buffer boundary, so that the attacker can arbitrarily write to the uncontrollable area outside the buffer, which may cause the attacker to change the program control flow and obtain system control. The above vulnerability is a buffer overflow vulnerability. In addition, printf, sprintf, fprintf and other functions may cause buffer overflow vulnerabilities because these functions do not check the number of formatted variables in the string. The present invention collects and organizes a high-risk function library by searching Internet information and existing vulnerability-related research papers.

[0014] The program slicing refers to: searching for high-risk functions in the software source code to be tested, taking a certain high-risk function as a slicing point, searching for all related code lines that have control dependency and data dependency relationships with the slicing point, and extracting these code lines as program slices based on the slicing point.

[0015] The vulnerability identification result means that all program slices extracted from the software to be tested correspond to a vulnerability prediction result, which is a number between 0 and 1. The closer the value is to 1, the greater the possibility that the program slice has a vulnerability, and vice versa. Each line of the program slice records the file location and line number of the source code corresponding to the line. When the judgment result of any program slice is that there is a vulnerability, the location of these codes in the source file is obtained, and the vulnerability is further analyzed and verified.

[0016] Technical Effects

[0017] Compared with the prior art, the present invention divides the code data set according to the source through the migration representation model, and uses them for pre-training and migration training respectively. It also compiles the software code into an intermediate language and then uses the BiLSTM network to extract its semantic features. This can improve the versatility of the method and reduce the complexity of the code. Traditional methods often directly use rules to match the source code or use deep learning methods to directly extract features from the source code. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 The figure is a schematic diagram of the overall process of vulnerability mining technology based on intermediate language and transfer representation learning.

[0019] Figure 2 Schematic diagram of compilation and data preprocessing process.

[0020] Figure 3 This is a structural diagram of the BiLSTM representation model and the CNN classification model.

[0021] Figure 4 Schematic diagram of the training process for transfer representation learning.

[0022] Figure 5 Schematic diagram of the process of using the model to mine software vulnerabilities. DETAILED DESCRIPTION

[0023] The present embodiment involves a vulnerability mining system based on intermediate language and transfer representation learning, including: a transfer representation model training module, a convolutional network training module and a software vulnerability mining module, wherein: the transfer representation model training module uses the data and labels compiled into the intermediate language and preprocessed to perform transfer learning training on the BiLSTM network (bidirectional long short-term memory network), and outputs the calculation results of the intermediate hidden layer in the BiLSTM network as a high-level representation form of the data set; the convolutional network training module uses the high-level representation form of the data and the corresponding labels to train a convolutional neural network classifier for distinguishing the high-level representation; the software vulnerability mining module uses the model generated by the training of the other two modules, first compiles and preprocesses the unknown software, and inputs the processed code segment into the BiLSTM network, obtains the high-level representation of the data from the hidden layer of the BiLSTM network, and then inputs it into the convolutional neural network classifier, and finally obtains the judgment result of whether the code segment has a vulnerability.

[0024] like Figure 3 As shown, the convolutional network training module includes: a convolutional network building unit and a convolutional network training unit, wherein: the convolutional network building unit builds a convolutional neural network (CNN) structure and initializes the number and parameters of convolution kernels; the convolutional network training unit uses the high-level representations and labels output by the transfer representation model training module to train the CNN.

[0025] like Figure 4 As shown, the transfer representation model training module includes: a training data preprocessing unit, a BiLSTM building unit, a transfer learning training unit and a representation extraction unit, wherein: the training data preprocessing unit preprocesses the collected vulnerability code data, and divides the data into two parts according to whether the data set is collected from real software or artificially synthesized; the BiLSTM building unit establishes a BiLSTM network structure; the transfer learning training unit uses artificially synthesized data for preliminary training, and then uses data collected from real open source software projects with available source code for transfer learning training to obtain a trained BiLSTM model; the representation extraction unit is used to extract and output the output of the hidden layer in the BiLSTM model as a high-level representation of the original data.

[0026] like Figure 5As shown, the software vulnerability mining module includes: an intermediate language compilation unit, a software high-risk point positioning unit, a software code slicing unit, a software code preprocessing unit, a high-level representation calculation unit and a result prediction unit, wherein: the intermediate language compilation unit compiles the compilable part of the software source code into an intermediate language; the software high-risk point positioning unit searches for and locates high-risk functions that may cause vulnerabilities in the software; the software code slicing unit searches for all code lines that have control flow dependencies and data flow dependencies with each high-risk point, and integrates them into code slices; the software code preprocessing unit deletes the compilation information in the code slice and standardizes the function name; the high-level representation calculation unit inputs the processed code slice into the BiLSTM network, and calculates its hidden layer output to obtain the high-level representation of the data; the result prediction unit inputs the high-level representation into the CNN network, and calculates the vulnerability prediction result of the code slice.

[0027] like Figure 1 As shown, a vulnerability mining method based on intermediate language and transfer representation learning involved in this embodiment specifically includes:

[0028] Step 1: Input the existing vulnerability code dataset into the transfer representation model training module, compile and preprocess the dataset through the training data preprocessing unit, build a BiLSTM network and perform preliminary training and transfer learning training, and then obtain the high-level representation of the data through the representation extraction unit.

[0029] The compilation refers to compiling the high-level language source code of the training data set into an intermediate language.

[0030] In this embodiment, the clang compiler is used to compile the source code into an intermediate language.

[0031] The intermediate language is a syntax-oriented, internal equivalent representation code of a source program that is easily translated into a target program. Its understandability and ease of generating target code are between the source language and the target language.

[0032] In this embodiment, LLVM language is used as the selected intermediate language, which has a highly modular design, clearer code and richer semantic features. As a language-independent intermediate code, LLVM intermediate language can connect different high-level languages ​​to each other, improving the versatility of this embodiment for different programming languages.

[0033] The preprocessing refers to: processing the LLVM intermediate language file generated by compilation, deleting redundant information and performing word segmentation and vectorization operations on the intermediate language code, and converting the LLVM intermediate language text code into an input form that can be processed by the BiLSTM network, specifically including: high-risk point positioning, code slicing, function name standardization, removal of compilation information, word segmentation processing, word number replacement and word vector conversion.

[0034] The high-risk point location is to search for functions in the high-risk function library in the compiled LLVM code file, regard all the searched high-risk functions as high-risk points, and record the files and line numbers where they are located.

[0035] The program slicing refers to: searching for high-risk functions in the software source code to be tested, taking a certain high-risk function as a slicing point, searching for all related code lines that have control dependency and data dependency relationships with the slicing point, and extracting these code lines as program slices based on the slicing point.

[0036] This embodiment uses the open source tool llvm-slicer to slice the program. The input of the llvm-slicer tool is the llvm code file to be sliced ​​and the function name of the slicing point, and the output is the slicing result with the function as the slicing point.

[0037] The function name standardization mentioned above means changing all function names to standard forms. Since the function names will not be modified during the LLVM compilation process, some function names may contain vulnerability related information, such as

[0038] The bad in _ZN37CWE401_Memory_Leak__new_array_char_543badEv() indicates that the function has a vulnerability, which will affect the features learned by the model. Therefore, to avoid this impact, we search for all function names and modify them to the form of fun1, fun2, ... funN.

[0039] The word segmentation process refers to converting the LLVM code into a sequence of words.

[0040] This embodiment also regards all special symbols in the code as an independent word, and divides all variable names, function names, keywords, and special symbols into independent words.

[0041] The word number replacement means: replacing all words with a number.

[0042] This embodiment analyzes all codes that have completed word segmentation processing, counts all words that have appeared, and organizes them into a dictionary, which stores all words that have appeared and their numbers. Then, all words in the code are replaced with corresponding numbers in the dictionary, and the words in string form are converted into integers to facilitate the next step of vectorization.

[0043] The word vector conversion is to convert each word into an n-dimensional vector. The form of the n-dimensional vector is:

[0044] (x1,x2,x3,…,xn).

[0045] This embodiment uses the word2vec algorithm to train word vectors using all codes that have undergone word number replacement as a corpus. After the training is completed, all words correspond to an n-dimensional vector that contains certain semantic features of the word.

[0046] After experiments, this embodiment adopts n=50 as the dimension of the word vector.

[0047] The preliminary training refers to: using artificially synthesized partial data and labels in the data set to train the BiLSTM network.

[0048] In this embodiment, the data of the artificially synthesized part is divided into a training set and a test set in a ratio of 4:1. The training set part is used for training in preliminary training, and the test set part is used for testing.

[0049] The transfer learning training refers to: using the real software in the data set to collect some data and labels, and fine-tuning the BiLSTM network that has completed the preliminary training to make it better adapt to the classification task on the transfer learning data set.

[0050] In this embodiment, part of the data collected by the real software is divided into a training set and a test set in a ratio of 4:1. The training set part is used for training in the transfer learning training, and the test set part is used for testing.

[0051] The high-level representation refers to the calculation output result of the middle hidden layer in the deep learning network. In the deep learning network, after the original data passes through the input layer, each hidden layer actually performs feature extraction and combination, and the more layers it passes through, the higher the level of features extracted. High-level features can be regarded as a combination of low-level features.

[0052] In this embodiment, the high-level representation is extracted from the output layer of the second BiLSTM layer. The high-level representation contains high-level features learned by the BiLSTM network and can be further input into the CNN network for classification.

[0053] The method for extracting high-level representations used in this embodiment is to input all preprocessed data sets into the BiLSTM network, and save the output of the maximum pooling layer (the hidden layer in the middle of the model) in the BiLSTM model as a high-level representation of the original data.

[0054] Step 2: Input the high-level representation of the data into the convolutional network training module. First, build the CNN network and initialize the convolution kernel parameters. Then use the high-level representation and corresponding labels to train the CNN classification network.

[0055] The CNN network is a multi-layer convolutional neural network. Figure 3 The convolutional network can further extract features from the high-level representation and finally output the judgment result of whether the slice corresponding to the high-level representation contains a vulnerability, which is a value between 0 and 1.

[0056] Step 3: After completing the training of the first two steps, the obtained BiLSTM network and CNN network can be used for vulnerability mining in actual software projects. After the software to be tested is input into the intermediate language compilation unit for compilation, it is input into the software high-risk point location unit, all high-risk functions are searched, and these high-risk functions are used as slice points. The slice points are sliced ​​and preprocessed according to the control dependency and data dependency relationship. After completion, the preprocessed code slices are input into the BiLSTM network to obtain high-level representations, and finally the high-level representations are input into the CNN classification network to obtain vulnerability prediction results for each slice.

[0057] The vulnerability prediction result refers to: all program slices and their corresponding information, including: high-risk function names, file names and line numbers where high-risk points are located, expressed in the form of file name: line number, and the final vulnerability prediction result of the slice, which is a floating point number between 0 and 1. The closer the value is to 1, the greater the possibility that the slice contains a vulnerability, and the closer the value is to 0, the less likely the slice contains a vulnerability. The vulnerability prediction result may contain false positives, so it needs to be further verified using dynamic testing methods.

[0058] This embodiment uses a deep learning method to solve the problem of large workload and low efficiency of manual feature extraction in traditional vulnerability mining methods, and uses LLVM intermediate language as a unified data form to improve the versatility of this method for different high-level languages.

[0059] This embodiment adopts the transfer learning method, divides the data of the vulnerability database into two parts according to different sources, and conducts targeted training, which can better extract the common features of the two types of data. The method of extracting representations and inputting them separately into another CNN classification model for classification improves the common overfitting problem in code classification problems based on deep learning, and has good generalization.

[0060] This method was tested on the test data set, and vuldeepecker was used to test the LSTM-based direct classification method on the same test set. The accuracy, recall, and false alarm rate were calculated as test indicators.

[0061] The test indicators include: accuracy, recall rate and false alarm rate.

[0062] This example provides the evaluation index of the experiment based on the binary confusion matrix. According to the difference between the predicted value and the true value, there are four types of classification of samples:

[0063] i) TP (True Positive): The actual code is a vulnerable code, and the predicted code is also a vulnerable code.

[0064] ii) FN (False Negative): It is actually a vulnerable code, but is predicted to be a non-vulnerable code.

[0065] iii) FP (False Positive): The code is actually vulnerability-free but predicted to be vulnerable.

[0066] iv)TN (True Negative): The actual code is vulnerability-free and the predicted code is also vulnerability-free.

[0067] The accuracy rate is the percentage of correctly predicted samples to all samples, which is used to evaluate the performance of the model as a whole. The formula is: Accuracy = (TP + TN) / (TP + FN + FP + TN).

[0068] The recall rate is the percentage of all the correctly predicted vulnerability codes to all the samples containing vulnerability codes. It indicates the probability of vulnerability codes being detected, and measures the ability of the model to accurately find vulnerability codes. Therefore, the detection rate needs to be improved as much as possible. The formula is: TPR = TP / (TP+FN).

[0069] The false alarm rate refers to the percentage of samples that are falsely reported as having vulnerabilities when the true value is no vulnerability to the total number of samples predicted to have vulnerabilities. It indicates the probability of normal code being detected as a vulnerability. When the false alarm rate is high, it will cause a waste of subsequent manpower costs. Therefore, the false alarm rate needs to be reduced as much as possible. The formula is: FPR = FP / (FP+TN).

[0070] The test set refers to: during the preliminary training and migration training process, the original data set is divided into a training set and a test set in a 4:1 ratio, and this part of the test set is used for testing here.

[0071] This method and the above two control methods were used to conduct experiments on the test set. On a Linux server with an Ubuntu 18.04 operating system, a virtual environment was configured using miniconda 3-4.6.14, which included python 3.6.2, gensim 3.8.3, tensorflow 2.0.0, and keras 2.3.1. This method, vuldeepecker, and the LSTM direct classification program were run in the above virtual environment. The experimental data obtained are shown in the following table:

[0072] method Accuracy Recall False Positive Rate This method 92.3％ 95.6％ 15.4％ Vuldeepecker 89.8％ 94.4％ 16.8％ LSTM direct classification 85.7％ 89.1％ 18.2％

[0073] It can be seen from the results that this embodiment achieves better results than LSTM direct classification, which shows that the method of extracting high-level representations and then inputting them into another CNN model for classification effectively alleviates the overfitting problem, thereby having better performance on the test set; this embodiment achieves better results than vuldeepecker, which shows that the use of transfer learning can better extract features in the training data, and the data from real software sources and artificial synthetic data are trained separately, so that the model can learn key features related to vulnerabilities, which can be applicable to software codes written in various high-level languages, as long as the software code can be compiled into LLVM intermediate language using clang or other compilers.

[0074] Compared with the prior art, this embodiment collects a large number of vulnerability code data sets, compiles and preprocesses the data sets, and uses them to train a high-level representation extraction model. The extracted high-level representations are used to train a CNN classifier, thereby realizing the function of distinguishing whether a code segment contains vulnerabilities. In the actual detection stage, this embodiment performs a series of processing on the software to be tested to obtain several program slices, and inputs these slices into the above model to obtain the vulnerability judgment results corresponding to each slice code segment, which can be used for further analysis and verification, greatly improving the efficiency of program vulnerability mining.

[0075] This embodiment uses LLVM intermediate language to convert high-level language source code into intermediate language, improves the versatility of the method for different languages, and retains the semantic features in the high-level language code. On the other hand, due to the complexity of high-level languages, there are many different ways of writing the code to implement the same function. After being compiled into the intermediate language, these different ways of writing will be optimized by the compiler and will obtain the same or mostly the same intermediate language code, thereby enabling the model to learn clearer features.

[0076] This embodiment adopts the method of transfer representation learning. The data source is divided into a real software collection part and an artificially generated part according to different sources. There is a large difference in the code length of these two parts. The code length in the real software is generally longer, while the artificially synthesized code is often used for conceptual verification of vulnerabilities and is generally shorter. On the other hand, for the same type of vulnerabilities, the codes from these two sources have the same vulnerability characteristics, but different sources will also lead to some differences in their code styles. Therefore, using artificially synthesized data for preliminary training and then using real software code for transfer learning has better accuracy and recall than directly using all data for training.

[0077] This embodiment uses representation learning to separate the feature extraction and classification judgment parts of the conventional deep learning model, which can prevent overfitting to a certain extent. Compared with the traditional deep learning code classification method, this embodiment has better generalization.

[0078] The above-mentioned specific implementation can be partially adjusted in different ways by those skilled in the art without departing from the principle and purpose of the present invention. The protection scope of the present invention shall be based on the claims and shall not be limited by the above-mentioned specific implementation. Each implementation scheme within its scope shall be subject to the constraints of the present invention.

Claims

1. A vulnerability mining system based on intermediate language and transfer representation learning, characterized in that: include: Transfer representation model training module, convolutional network training module and software vulnerability mining module, wherein: the transfer representation model training module uses the data and labels compiled into the intermediate language and preprocessed to perform transfer learning training on the bidirectional long short-term memory network, and outputs the calculation results of the intermediate hidden layer in the BiLSTM network as the high-level representation form of the data set; the convolutional network training module uses the high-level representation form of the data and the corresponding labels to train a convolutional neural network classifier for distinguishing the high-level representation; the software vulnerability mining module uses the model trained and generated by the other two modules, first compiles and preprocesses the unknown software, and inputs the processed code segment into the BiLSTM network, obtains the high-level representation of the data from the hidden layer of the BiLSTM network, and then inputs it into the convolutional neural network classifier, and finally obtains the result of whether the code segment has a vulnerability; The preprocessing includes intermediate language compilation, high-risk point location, code slicing and function name standardization.

2. The vulnerability mining system based on intermediate language and transfer representation learning according to claim 1 is characterized in that: The convolutional network training module includes: a convolutional network building unit and a convolutional network training unit, wherein: the convolutional network building unit builds a convolutional neural network structure and initializes the number and parameters of convolution kernels; the convolutional network training unit uses the high-level representations and labels output by the transfer representation model training module to train CNN.

3. The vulnerability mining system based on intermediate language and transfer representation learning according to claim 1 is characterized in that: The transfer representation model training module includes: a training data preprocessing unit, a BiLSTM building unit, a transfer learning training unit and a representation extraction unit, wherein: the training data preprocessing unit preprocesses the collected vulnerability code data, and divides the data into two parts according to whether the data set is collected from real software or artificially synthesized; the BiLSTM building unit establishes a BiLSTM network structure; the transfer learning training unit uses artificially synthesized data for preliminary training, and then uses data collected from real open source software projects with available source code for transfer learning training to obtain a trained BiLSTM model; the representation extraction unit is used to extract and output the output of the hidden layer in the BiLSTM model as a high-level representation of the original data.

4. The vulnerability mining system based on intermediate language and transfer representation learning according to claim 1 is characterized in that: The software vulnerability mining module includes: an intermediate language compilation unit, a software high-risk point positioning unit, a software code slicing unit, a software code preprocessing unit, a high-level representation calculation unit and a result prediction unit, wherein: the intermediate language compilation unit compiles the compilable part of the software source code into an intermediate language; the software high-risk point positioning unit searches for and locates high-risk functions that may cause vulnerabilities in the software; the software code slicing unit searches for all code lines that have control flow dependencies and data flow dependencies with each high-risk point, and integrates them into code slices; the software code preprocessing unit deletes the compilation information in the code slices and standardizes the function names; the high-level representation calculation unit inputs the processed code slices into the BiLSTM network, and calculates its hidden layer output to obtain the high-level representation of the data; the result prediction unit inputs the high-level representation into the CNN network, and calculates the vulnerability prediction result of the code slice.

5. A vulnerability mining method based on intermediate language and transfer representation learning according to any one of claims 1 to 4, characterized in that: By using the collected vulnerability code dataset, the BiLSTM network is trained offline for representation extraction, and the CNN classification network is trained with the extracted high-level representations. In the online stage, after the software code to be tested is compiled and preprocessed, high-risk points are located and the program is sliced, the slices are sequentially input into the trained BiLSTM network and CNN classification network to obtain the vulnerability judgment results of each slice.

6. The vulnerability mining method according to claim 5 is characterized in that: The vulnerability code dataset refers to: pre-collected vulnerability codes, each of which should be a relatively complete piece of software source code and has a label corresponding to it. The value of the label is 0 or 1, where 0 indicates that the code segment has no vulnerability and 1 indicates that the code segment has a vulnerability.

7. The vulnerability mining method according to claim 5 is characterized in that: The program slicing refers to: searching for high-risk functions in the software source code to be tested, taking a certain high-risk function as a slicing point, searching for all related code lines that have control dependency and data dependency relationships with the slicing point, and extracting these code lines as program slices based on the slicing point.

8. The vulnerability mining method according to claim 5, characterized in that: The vulnerability identification result means that all program slices extracted from the software to be tested correspond to a vulnerability prediction result, which is a number between 0 and 1. The closer the value is to 1, the greater the possibility that the program slice has a vulnerability, and vice versa. Each line of the program slice records the file location and line number of the source code corresponding to the line. When the judgment result of any program slice is that there is a vulnerability, the location of these codes in the source file is obtained, and the vulnerability is further analyzed and verified.

Images