A source code vulnerability detection method, device and storage medium

Abstract

The present invention provides a source code vulnerability detection method, device and storage medium, belonging to the field of code detection technology, the method comprises: S1: preprocessing the data of each original source code data to obtain preprocessed source code data; S2: dividing the multiple preprocessed source code data according to a preset ratio to obtain a training set, a verification set and a test set; S3: encoding the code graph of the training set to obtain multiple code graph data; S4: analyzing the model of the training model according to the multiple code graph data, the verification set and the test set to obtain a detection model; S5: obtaining a detection result by analyzing the detection model of the source code data to be detected. The present invention realizes automatic code vulnerability detection at the function level, can quickly and efficiently complete the code vulnerability detection task in the source code, and solves the technical problems of high false alarm rate and high false negative rate in the vulnerability detection of code static analysis tools.

Description

Technical Field

[0001] The present invention mainly relates to the technical field of code detection, and in particular to a source code vulnerability detection method, device and storage medium. Background Art

[0002] With the continuous breakthroughs of various smart devices and the continuous development and widespread application of the Internet, cyberspace has promoted the prosperity and progress of the economy and society, and is also comprehensively changing people's production and lifestyle, profoundly affecting the development process of human social history, but at the same time it has brought new security risks and challenges. The Internet industry is highly competitive, the software development cycle is getting shorter and shorter, and security issues are becoming increasingly prominent. With the massive growth in the number of software and the increase in complexity, traditional solutions are facing serious technical bottlenecks, which brings severe challenges to the research of software security vulnerabilities and can no longer meet the protection needs of cyberspace security. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide a source code vulnerability detection method, device and storage medium in view of the deficiencies in the prior art.

[0004] The technical solution of the present invention to solve the above technical problem is as follows: a source code vulnerability detection method, comprising the following steps:

[0005] S1: Acquire multiple original source code data through a crawler tool, and perform data preprocessing on each of the original source code data to obtain preprocessed source code data corresponding to each of the original source code data;

[0006] S2: Dividing the plurality of preprocessed source code data according to a preset ratio to obtain a training set, a validation set, and a test set;

[0007] S3: Encode the code graph of the training set to obtain multiple code graph data;

[0008] S4: construct a training model, and perform model analysis on the training model according to the plurality of code graph data, the verification set, and the test set to obtain a detection model;

[0009] S5: importing source code data to be detected, and performing detection and analysis on the source code data to be detected by using the detection model to obtain a detection result.

[0010] Another technical solution of the present invention to solve the above technical problem is as follows: a source code vulnerability detection device, comprising:

[0011] A data preprocessing module, used to obtain a plurality of original source code data through a crawler tool, and perform data preprocessing on each of the original source code data to obtain preprocessed source code data corresponding to each of the original source code data;

[0012] A data partitioning module, used for partitioning the plurality of preprocessed source code data according to a preset ratio to obtain a training set, a validation set and a test set;

[0013] A training set encoding module, used for encoding the code graph of the training set to obtain a plurality of code graph data;

[0014] A model analysis module is used to construct a training model, and perform model analysis on the training model according to the plurality of code graph data, the verification set and the test set to obtain a detection model;

[0015] The detection result acquisition module is used to import the source code data to be detected, and perform detection and analysis on the source code data to be detected through the detection model to obtain the detection result.

[0016] Another technical solution of the present invention to solve the above technical problem is as follows: a source code vulnerability detection device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the source code vulnerability detection method described above is implemented.

[0017] Another technical solution of the present invention to solve the above technical problem is as follows: a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the source code vulnerability detection method as described above is implemented.

[0018] The beneficial effects of the present invention are as follows: preprocessing of each original source code data is performed to obtain preprocessed source code data; a plurality of preprocessed source code data are divided according to a preset ratio to obtain a training set, a validation set and a test set; a code graph of the training set is encoded to obtain a plurality of code graph data; a detection model is obtained by analyzing a model of the training model according to the plurality of code graph data, the validation set and the test set; a detection result is obtained by analyzing the source code data to be detected by the detection model; automatic code vulnerability detection at the function level is realized; the code vulnerability detection task can be completed quickly and efficiently in the source code; and the technical problems of high false alarm rate and high missed alarm rate in vulnerability detection by code static analysis tools are solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A schematic diagram of a flow chart of a source code vulnerability detection method provided by an embodiment of the present invention;

[0020] Figure 2 A module block diagram of a source code vulnerability detection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0021] The principles and features of the present invention are described below in conjunction with the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0022] Figure 1 A schematic diagram of a flow chart of a source code vulnerability detection method provided by an embodiment of the present invention.

[0023] like Figure 1 As shown, a source code vulnerability detection method includes the following steps:

[0024] S1: Acquire multiple original source code data through a crawler tool, and perform data preprocessing on each of the original source code data to obtain preprocessed source code data corresponding to each of the original source code data;

[0025] S2: Dividing the plurality of preprocessed source code data according to a preset ratio to obtain a training set, a validation set, and a test set;

[0026] S3: Encode the code graph of the training set to obtain multiple code graph data;

[0027] S4: construct a training model, and perform model analysis on the training model according to the plurality of code graph data, the verification set, and the test set to obtain a detection model;

[0028] S5: importing source code data to be detected, and performing detection and analysis on the source code data to be detected by using the detection model to obtain a detection result.

[0029] It should be understood that the basic data set (ie, the multiple original source code data) is formed by collecting source code with vulnerabilities of types CWE-119, CWE-120, CWE-469, CWE-476 and CWE-OTHERS and source code without vulnerabilities from the CWE official website through a crawler tool.

[0030] Specifically, the labeled data set code (ie, the training set) is encoded into a code graph with comprehensive program semantics.

[0031] In the above embodiment, preprocessed source code data is obtained by preprocessing each original source code data respectively, a plurality of preprocessed source code data are divided according to a preset ratio to obtain a training set, a validation set and a test set, a code graph of the training set is encoded to obtain a plurality of code graph data, a detection model is obtained by analyzing a model of the training model according to the plurality of code graph data, the validation set and the test set, a detection result is obtained by analyzing the source code data to be detected by the detection model, automatic code vulnerability detection at the function level is realized, the code vulnerability detection task can be completed quickly and efficiently in the source code, and the technical problems of high false alarm rate and high missed alarm rate in vulnerability detection by code static analysis tools are solved.

[0032] Optionally, as an embodiment of the present invention, the process of step S1 includes:

[0033] Performing downsampling processing on each of the original source code data respectively to obtain downsampled source code data corresponding to each of the original source code data;

[0034] Each of the downsampled source code data is labeled respectively to obtain preprocessed source code data corresponding to each of the original source code data.

[0035] It should be understood that the functions of the data set are labeled (ie, the plurality of downsampled source code data), and the distribution is marked as having vulnerabilities and not having vulnerabilities.

[0036] It should be understood that since the function codes without vulnerabilities account for too large a proportion in the code data set and the sample data is unevenly distributed, the data in the basic data set (i.e., the original source code data) is downsampled to form a downsampled code data set (i.e., multiple downsampled source code data).

[0037] Specifically, each function code in the data set (i.e., multiple source code data after downsampling) is labeled as 0 or 1, where 1 indicates that the function (i.e., the source code data after downsampling) has a vulnerability, and conversely, 0 indicates that there is no vulnerability, and all function codes in the data set are used as sample data (i.e., multiple source code data after preprocessing).

[0038] In the above embodiments, each original source code data is downsampled to obtain downsampled source code data, and each downsampled source code data is annotated to obtain preprocessed source code data, which provides a basis for subsequent data processing and solves the technical problems of high false alarm rate and high missed alarm rate in vulnerability detection by code static analysis tools.

[0039] Optionally, as an embodiment of the present invention, the training set includes a plurality of source code training data, and the process of step S3 includes:

[0040] Using the clang tool to extract abstract syntax trees from each of the source code training data, to obtain abstract syntax trees corresponding to each of the source code training data;

[0041] Code graph data is constructed through each of the abstract syntax trees respectively, so as to obtain code graph data corresponding to each of the source code training data.

[0042] It should be understood that the clang tool Clang is a C, C++ and Objective-C compiler, including preprocessing, parsing, optimization, code generation, assembly and linking operations. In addition, Clang also provides operations such as extracting the abstract syntax tree of the code, the code control flow graph, etc.

[0043] Specifically, the Clang compiler is used to extract the abstract syntax tree of the code (i.e., the source code training data). The nodes on the abstract syntax tree represent the structure in the code. These structural information are saved in the form of edges, and the out-degree of the nodes are saved. The two are combined to form a code graph (i.e., the code graph data).

[0044] In the above embodiment, the clang tool is used to extract the abstract syntax tree of each source code training data to obtain an abstract syntax tree, and code graph data is constructed through each abstract syntax tree to obtain code graph data, which lays the foundation for subsequent data processing and can quickly and efficiently complete the code vulnerability detection task in the source code.

[0045] Optionally, as an embodiment of the present invention, the process of step S4 includes:

[0046] Constructing a training model, and training the training model according to the plurality of code graph data to obtain a trained model;

[0047] Testing the trained model according to the test set to obtain a model to be verified;

[0048] The parameters of the model to be verified are adjusted according to the verification set to obtain a detection model.

[0049] It should be understood that the validation set is used to validate the trained residual gated graph convolutional neural network detection model for code vulnerability detection (i.e., the model to be verified) and adjust the model parameters.

[0050] It should be understood that the validation set is used to adjust the parameters of the model (i.e., the model to be verified); and the validation set is used multiple times to continuously adjust the parameters.

[0051] In the above embodiment, a training model is constructed, and a trained model is obtained by training the training model according to multiple code graph data. The trained model is tested according to the test set to obtain a model to be verified, and the parameters of the model to be verified are adjusted according to the verification set to obtain a detection model. This realizes automatic code vulnerability detection at the function level, and can quickly and efficiently complete the code vulnerability detection task in the source code, solving the technical problems of high false alarm rate and high missed alarm rate in vulnerability detection by code static analysis tools.

[0052] Optionally, as an embodiment of the present invention, the process of constructing a training model, training the training model according to the plurality of code graph data, and obtaining the trained model includes:

[0053] Calculating target feature vectors for each of the code graph data based on a residual gated graph neural network to obtain multiple target feature vectors corresponding to each of the source code training data;

[0054] Performing graph pooling processing on a plurality of target feature vectors corresponding to each of the source code training data respectively to obtain a global feature vector corresponding to each of the source code training data;

[0055] Using the Sigmoid function to map each of the global feature vectors respectively, to obtain a prediction vector corresponding to each of the source code training data;

[0056] The real label vectors corresponding to the source code training data are imported, and the loss values ​​of all the prediction vectors and all the real label vectors are analyzed to obtain the trained model.

[0057] It should be understood that the residual gated graph convolutional network (i.e., the residual gated graph neural network) is used to perform representation learning on the training set (i.e., the code graph data) to learn the characteristics of the code.

[0058] Specifically, the code graph of the source code (i.e., the code graph data) is first used as the input of the network, and the residual gated graph convolutional neural network (i.e., the residual gated graph neural network) aggregates the feature information of the adjacent nodes of the graph at each step. After the layer, the feature information of the adjacent nodes of the entire graph is gathered, and then the graph pooling layer is used to aggregate the global information of the graph to obtain a feature vector combining the entire graph (i.e., the global feature vector), and the Sigmoid function is used to map the vector value to between 0 and 1. Finally, a trained source code vulnerability detection residual gated graph convolutional neural network detection model (i.e., the trained model) is generated.

[0059] It should be understood that the prediction vector value is mapped to between 0 and 1 using the Sigmoid function. The Sigmoid function can map a real number to the interval (0, 1). The formula is as follows:

[0060]

[0061] In the above embodiment, a training model is constructed, and the trained model is obtained by training the training model according to a plurality of code graph data, the features of the code are learned, the global information of the graph is aggregated, and the detection accuracy is improved.

[0062] Optionally, as an embodiment of the present invention, the code graph data includes a plurality of nodes and original feature vectors corresponding to each of the nodes, and each of the nodes corresponds to a plurality of adjacent nodes;

[0063] The process of calculating the target feature vectors for each of the code graph data based on the residual gated graph neural network to obtain multiple target feature vectors corresponding to each of the source code training data includes:

[0064] The target feature vector is calculated by respectively calculating the original feature vector corresponding to each node and the original feature vectors of multiple adjacent nodes corresponding to each node through the first formula to obtain the target feature vector of each node. The first formula is:

[0065]

[0066] in, is the target feature vector, is the original feature vector of node i, is the original feature vector of all adjacent nodes corresponding to node i, is the preset number of layers, W is the weight matrix, and f is the mapping function.

[0067] It should be understood that the code graph data is used as the input of the residual gated graph neural network (i.e., the residual gated graph neural network), and the code graph data includes nodes, edges, and feature matrices, which are described in mathematical language as g i (V,X,A), where i represents the index, V represents the node in the graph, X represents the feature matrix, and A represents the edge relationship in the graph.

[0068] Specifically, for the residual gated graph neural network (i.e., the residual gated graph neural network), given a graph g k (V,X,A), for each node v in the graph i ∈V has an initial D-dimensional vector Represented as the feature vector of the current node (ie, the original feature vector), if the real-valued vector xi When the dimension of is less than D, then Fill with 0, and but Described by formula:

[0069]

[0070] in Represents the feature vectors of all adjacent nodes of node i (i.e., the original feature vector), f is the mapping function, and the input is the feature matrix of the current node (i.e. the original feature vector) and the feature matrix of all adjacent nodes of the current node (i.e., the original feature vector), is the number of layers, and W is the weight matrix.

[0071] In the above embodiment, the target feature vector is calculated by the first formula for the original feature vector corresponding to each node and the target feature vector of the original feature vectors of multiple adjacent nodes, thereby gathering the feature information of the adjacent nodes of the graph and improving the detection accuracy.

[0072] Optionally, as an embodiment of the present invention, the process of analyzing the loss values ​​of all prediction vectors and all true label vectors to obtain the trained model includes:

[0073] Using a binary cross entropy loss function, respectively calculating the loss value of each of the prediction vectors and the true label vector, to obtain a loss value corresponding to each of the source code training data;

[0074] Perform back propagation calculation on each of the loss values ​​to obtain a gradient value corresponding to the loss value;

[0075] All gradient values ​​are input into the training model using the gradient descent algorithm to update parameters. After the parameters are updated, the process returns to step S1 until a preset number of iterations is reached, and the training model after parameter update is used as the trained model.

[0076] It should be understood that the gradient descent algorithm is a kind of iterative method, which can be used to solve the least squares problem (both linear and nonlinear). When solving the model parameters of the machine learning algorithm, that is, the unconstrained optimization problem, gradient descent is one of the most commonly used methods, and another commonly used method is the least squares method. When solving the minimum value of the loss function, the gradient descent method can be used to iterate step by step to obtain the minimized loss function and model parameter values. Conversely, if we need to solve the maximum value of the loss function, we need to iterate with the gradient ascent method. In machine learning, two gradient descent methods have been developed based on the basic gradient descent method, namely the stochastic gradient descent method and the batch gradient descent method.

[0077] It should be understood that after obtaining the prediction vector, it is input into the binary cross entropy loss function together with the true label vector to obtain the loss value (i.e., the loss value), and then back propagation calculation is performed based on the loss value (i.e., the loss value) to obtain the gradient value of each parameter, and finally a one-step parameter update is performed through gradient descent to update the parameters of the model and perform several iterations.

[0078] In the above embodiment, the loss value analysis of all prediction vectors and all true label vectors results in a trained model, which can quickly and efficiently complete the code vulnerability detection task in the source code, solve the technical problems of high false alarm rate and high missed alarm rate in vulnerability detection by code static analysis tools, and improve the accuracy of the detection model.

[0079] Optionally, as an embodiment of the present invention, in step S5, the process of performing detection and analysis on the source code data to be detected by using the detection model to obtain the detection result includes:

[0080] Input the source code data to be detected into step S3, and obtain the code graph data to be detected through step S3;

[0081] The code graph data to be detected is detected by using the detection model to obtain a detection value;

[0082] Determine whether the detection value is greater than or equal to a preset detection threshold. If so, use the preset first result as the detection result; if not, use the preset second result as the detection result.

[0083] Preferably, the preset detection threshold may be 0.5.

[0084] Specifically, the detection value is a value between 0 and 1. If the detection value is greater than 0.5, it is regarded as 1, indicating that there is a vulnerability. If the detection value is less than 0.5, it is regarded as 0, indicating that there is no vulnerability.

[0085] It should be understood that after the source code to be detected (i.e., the source code data to be detected) is collected and converted into a code graph (i.e., the code graph data to be detected), the residual gated graph convolutional neural network detection model for vulnerability detection (i.e., the detection model) is input to obtain the detection result.

[0086] In the above embodiment, the detection results are obtained by analyzing the source code data to be detected by the detection model, which realizes automatic code vulnerability detection at the function level, and can quickly and efficiently complete the code vulnerability detection task in the source code, solving the technical problems of high false alarm rate and high missed alarm rate in vulnerability detection by code static analysis tools.

[0087] Optionally, as another embodiment of the present invention, the present invention first converts the source code (i.e., the original source code data) into code graph data containing semantic and grammatical feature information, and then uses a residual gated graph convolutional neural network (i.e., the residual gated graph neural network) to perform model training and testing on the graph structure data (i.e., the code graph data), and finally uses this to predict code vulnerabilities. Automatic code vulnerability detection is mainly performed on C / C++ code, automatic code vulnerability detection at the function level is realized, and code vulnerability detection tasks can be completed quickly and efficiently in the source code.

[0088] Optionally, as another embodiment of the present invention, the present invention uses the test set to test the model, converts the source code into a code graph, and then inputs the residual gated graph convolutional neural network detection model for vulnerability detection to obtain the detection result, thereby determining whether there is a vulnerability.

[0089] Figure 2 A module block diagram of a source code vulnerability detection device provided by an embodiment of the present invention.

[0090] Optionally, as another embodiment of the present invention, Figure 2 As shown, a source code vulnerability detection device includes:

[0091] A data preprocessing module, used to obtain a plurality of original source code data through a crawler tool, and perform data preprocessing on each of the original source code data to obtain preprocessed source code data corresponding to each of the original source code data;

[0092] A data partitioning module, used for partitioning the plurality of preprocessed source code data according to a preset ratio to obtain a training set, a validation set and a test set;

[0093] A training set encoding module, used for encoding the code graph of the training set to obtain a plurality of code graph data;

[0094] A model analysis module is used to construct a training model, and perform model analysis on the training model according to the plurality of code graph data, the verification set and the test set to obtain a detection model;

[0095] The detection result acquisition module is used to import the source code data to be detected, and perform detection and analysis on the source code data to be detected through the detection model to obtain the detection result.

[0096] Optionally, another embodiment of the present invention provides a source code vulnerability detection device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the source code vulnerability detection method described above is implemented. The device may be a computer or other device.

[0097] Optionally, another embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the source code vulnerability detection method as described above is implemented.

[0098] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0099] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0100] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0101] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present invention.

[0102] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0103] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0104] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A source code vulnerability detection method, characterized in that: The steps include: S1: Acquire multiple original source code data through a crawler tool, and perform data preprocessing on each of the original source code data to obtain preprocessed source code data corresponding to each of the original source code data; S2: Dividing the plurality of preprocessed source code data according to a preset ratio to obtain a training set, a validation set, and a test set; S3: Encode the code graph of the training set to obtain multiple code graph data; S4: construct a training model, and perform model analysis on the training model according to the plurality of code graph data, the verification set, and the test set to obtain a detection model; S5: importing source code data to be detected, and performing detection and analysis on the source code data to be detected by using the detection model to obtain a detection result of whether a vulnerability exists; The process of step S4 includes: Constructing a training model, and training the training model according to the plurality of code graph data to obtain a trained model; Testing the trained model according to the test set to obtain a model to be verified; Adjusting parameters of the model to be verified according to the verification set to obtain a detection model; The process of constructing a training model and training the training model according to the plurality of code graph data to obtain a trained model includes: Calculating target feature vectors for each of the code graph data based on a residual gated graph neural network to obtain multiple target feature vectors corresponding to each of the source code training data; Performing graph pooling processing on a plurality of target feature vectors corresponding to each of the source code training data respectively to obtain a global feature vector corresponding to each of the source code training data; Using the Sigmoid function to map each of the global feature vectors respectively, to obtain a prediction vector corresponding to each of the source code training data; Importing the true label vectors corresponding to the source code training data, and analyzing the loss values ​​of all the prediction vectors and all the true label vectors to obtain a trained model; The code graph data includes a plurality of nodes and original feature vectors corresponding to each of the nodes, and each of the nodes corresponds to a plurality of adjacent nodes; The process of calculating the target feature vectors for each of the code graph data based on the residual gated graph neural network to obtain multiple target feature vectors corresponding to each of the source code training data includes: The target feature vector is calculated by respectively calculating the original feature vector corresponding to each node and the original feature vectors of multiple adjacent nodes corresponding to each node through the first formula to obtain the target feature vector of each node. The first formula is: in, is the target feature vector, is the original feature vector of node i, is the original feature vector of all adjacent nodes corresponding to node i, l is the preset number of layers, W is the weight matrix, and f is the mapping function.

2. The source code vulnerability detection method according to claim 1, characterized in that: The process of step S1 includes: Performing downsampling processing on each of the original source code data respectively to obtain downsampled source code data corresponding to each of the original source code data; Each of the downsampled source code data is labeled respectively to obtain preprocessed source code data corresponding to each of the original source code data.

3. The source code vulnerability detection method according to claim 1, characterized in that: The training set includes a plurality of source code training data, and the process of step S3 includes: Using the clang tool to extract abstract syntax trees from each of the source code training data, to obtain abstract syntax trees corresponding to each of the source code training data; Code graph data is constructed through each of the abstract syntax trees respectively, so as to obtain code graph data corresponding to each of the source code training data.

4. The source code vulnerability detection method according to claim 1, characterized in that: The process of analyzing the loss values ​​of all prediction vectors and all true label vectors to obtain the trained model includes: Using a binary cross entropy loss function, respectively calculating the loss value of each of the prediction vectors and the true label vector, to obtain a loss value corresponding to each of the source code training data; Perform back propagation calculation on each of the loss values ​​to obtain a gradient value corresponding to the loss value; All gradient values ​​are input into the training model using the gradient descent algorithm to update parameters. After the parameters are updated, the process returns to step S1 until a preset number of iterations is reached, and the training model after parameter update is used as the trained model.

5. The source code vulnerability detection method according to claim 1, characterized in that: In step S5, the process of performing detection and analysis on the source code data to be detected by using the detection model to obtain a detection result of whether a vulnerability exists includes: Input the source code data to be detected into step S3, and obtain the code graph data to be detected through step S3; The code graph data to be detected is detected by using the detection model to obtain a detection value; It is determined whether the detection value is greater than or equal to a preset detection threshold. If so, the existence of a vulnerability is taken as the detection result; if not, the absence of a vulnerability is taken as the detection result.

6. A source code vulnerability detection device, characterized in that: include: A data preprocessing module, used to obtain a plurality of original source code data through a crawler tool, and perform data preprocessing on each of the original source code data to obtain preprocessed source code data corresponding to each of the original source code data; A data partitioning module, used for partitioning the plurality of preprocessed source code data according to a preset ratio to obtain a training set, a validation set and a test set; A training set encoding module, used for encoding the code graph of the training set to obtain a plurality of code graph data; A model analysis module, used for constructing a training model, performing model analysis on the training model according to the plurality of code graph data, the validation set and the test set, to obtain a detection model; A detection result acquisition module is used to import the source code data to be detected, and to perform detection and analysis on the source code data to be detected by the detection model to obtain a detection result of whether there is a vulnerability; The model analysis module is specifically used for: Constructing a training model, and training the training model according to the plurality of code graph data to obtain a trained model; Testing the trained model according to the test set to obtain a model to be verified; Adjusting parameters of the model to be verified according to the verification set to obtain a detection model; In the model analysis module, a training model is constructed, and the training model is trained according to the plurality of code graph data to obtain a trained model, and the process includes: Calculating target feature vectors for each of the code graph data based on a residual gated graph neural network to obtain multiple target feature vectors corresponding to each of the source code training data; Performing graph pooling processing on a plurality of target feature vectors corresponding to each of the source code training data respectively to obtain a global feature vector corresponding to each of the source code training data; Using the Sigmoid function to map each of the global feature vectors respectively, to obtain a prediction vector corresponding to each of the source code training data; Importing the true label vectors corresponding to the source code training data, and analyzing the loss values ​​of all the prediction vectors and all the true label vectors to obtain a trained model; The code graph data includes a plurality of nodes and original feature vectors corresponding to each of the nodes, and each of the nodes corresponds to a plurality of adjacent nodes; In the model analysis module, the process of calculating the target feature vector of each of the code graph data based on the residual gated graph neural network to obtain multiple target feature vectors corresponding to each of the source code training data includes: The target feature vector is calculated by respectively calculating the original feature vector corresponding to each node and the original feature vectors of multiple adjacent nodes corresponding to each node through the first formula to obtain the target feature vector of each node. The first formula is: in, is the target feature vector, is the original feature vector of node i, is the original feature vector of all adjacent nodes corresponding to node i, l is the preset number of layers, W is the weight matrix, and f is the mapping function.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the source code vulnerability detection method according to any one of claims 1 to 5 is implemented.

Images