A software security vulnerability detection method based on text features and function dependency features

Abstract

The application discloses a software security vulnerability detection method based on text features and function dependency features, and the method comprises the following steps: pre-processing the code in a project, extracting all function information in the project and saving, extracting and merging function text features and function dependency relationship features of the function information, using an Autoencoder to reduce dimensions and remove noise of the merged feature vectors, and finally using a local outlier factor detection method (LOF) to perform anomaly detection to obtain functions containing security vulnerabilities. The application performs software security vulnerability detection based on unsupervised learning, does not need to provide labels of whether samples contain security vulnerabilities, simultaneously considers text features of software and dependency relationship features between functions in the software, and improves the correctness of software security vulnerability detection.

Description

Technical Field

[0001] This invention relates to a software security vulnerability detection technology, and more particularly to a software security vulnerability detection method based on text features and functional dependency features, belonging to the field of software security in software engineering. Background Technology

[0002] With the rapid development of computer technology, human society is becoming increasingly information-driven, software applications are becoming more widespread, and the number of open-source software programs is growing rapidly. In this context, software security has received increasing attention. The number of common software security vulnerabilities worldwide has exceeded 160,000. A survey report by Accenture, a globally renowned management consulting firm, of 254 companies showed that 98% of the surveyed companies had suffered malware attacks, resulting in an average loss of $2.36 million per company. To avoid losses caused by software security vulnerabilities, a series of software security vulnerability detection technologies and tools have emerged.

[0003] Software security vulnerability detection methods are mainly divided into static detection methods and dynamic detection methods. Compared with dynamic detection methods, static detection methods have become a popular technology for software security vulnerability detection due to their advantages such as high code coverage, fast detection speed, and ability to detect all security vulnerabilities.

[0004] Existing static vulnerability detection methods mainly include code rule-based techniques, code semantic execution-based techniques, and code similarity-based techniques. Code rule-based techniques detect software vulnerabilities by having experts analyze and design rules for software code and security vulnerabilities. Semantic execution-based techniques detect vulnerabilities by analyzing and executing software semantics. Code similarity-based techniques detect vulnerabilities based on code similarity. Code rule-based and code semantic execution-based techniques require significant human effort to design rules or execute semantics, while code similarity-based techniques can only detect vulnerabilities in code clones, resulting in a narrow detection scope. To automate software vulnerability detection, reduce manual operation, and improve detection accuracy, researchers have proposed machine learning-based software vulnerability detection methods. Common machine learning-based methods involve supervised learning of code. The general steps are: first, extract features from the software code; then, train a classification machine learning model; and finally, determine whether the given code contains security vulnerabilities based on the model's training results. The drawbacks of these methods are: first, when extracting code features, only one of the text features or the functional dependency features of the code is considered, without considering both simultaneously; second, in practical applications, software samples do not have vulnerability labels, and assuming that software samples can provide vulnerability labels is inconsistent with reality; third, software vulnerabilities account for a very small proportion in the code, generally less than 10%, and due to this small proportion, the difference between positive and negative samples is large, i.e., the samples are imbalanced, which indirectly leads to poor classification results, i.e., low detection accuracy.

[0005] Improving the accuracy of static detection methods is an urgent problem to be solved in the field of software security vulnerability detection, and it has important scientific significance and practical application value. Summary of the Invention

[0006] The purpose of this invention is to address the shortcomings of existing technologies by proposing a software security vulnerability detection method that simultaneously considers the textual features of software and the dependency features between functions in the software, and performs security vulnerability detection based on unsupervised learning.

[0007] The technical solution of the present invention is as follows:

[0008] This invention discloses a software security vulnerability detection method based on text features and functional dependency features, comprising the following steps:

[0009] Step 1. Code Preprocessing: Input project code information, preprocess the code in the project, extract all function information in the project and save it. The language of the preprocessed project can be JAVA, C, C++ or C#;

[0010] Step 2. Function Text Feature Extraction: The function information obtained in Step 1 is used to extract function text features using the Doc2Vec method. First, a Doc2Vec training model is constructed, and all extracted functions are trained. During training, the word prediction error in the function is used as the loss function. The parameters of the training model are iteratively adjusted using stochastic gradient descent to minimize the loss function, thus obtaining the training model. After obtaining the training model, it is loaded. The text feature vector of the function to be predicted is randomly initialized and put into the training model. The parameters of the training model remain unchanged. The word prediction error in the function is used as the loss function. The text feature vector of the function to be predicted is iteratively adjusted using stochastic gradient descent to minimize the loss function, and the text feature vector of the function to be predicted is obtained after iteration.

[0011] Step 3. Function Dependency Feature Extraction: Construct a directed graph of function dependencies using the call relationships between functions from Step 1, represent the directed graph of function dependencies using an adjacency matrix, and transform the adjacency matrix into a function dependency feature vector through singular value decomposition;

[0012] Step 4. Merging Function Text Features and Function Dependency Features: Merge the function text feature vectors and function dependency feature vectors obtained in Steps 2 and 3 to obtain a merged feature vector to represent the function features;

[0013] Step 5. Feature Dimensionality Reduction: The merged feature vector obtained in Step 4 is reduced in dimension and denoised using an autoencoder. The autoencoder consists of two parts: encoding and decoding. The optimal encoding result is obtained by comparing the decoding result with the original feature vector as a loss function.

[0014] Step 6. Anomaly Detection: Use the Local Outlier Factor (LOF) method to detect anomalies and identify functions containing vulnerabilities.

[0015] Furthermore, step 1 involves preprocessing the code in the project, specifically including the following steps:

[0016] Step 1.1. Extract the source code files from the project;

[0017] Step 1.2. Based on the code structure information in the source code file, extract the function information contained in the source code file (the source code file contains both variables and functions, but the vulnerability only exists in functions, so ignore variable information and only extract function information);

[0018] Step 1.3. Save the extracted functions in a text file named after the source code file name plus the function name.

[0019] The above steps break down the source code file into a series of function files, and perform security vulnerability detection on specific functions. This results in more granular detection results, allowing developers and security testers to directly check for security vulnerabilities in suspicious functions without having to look at the entire source code file.

[0020] Furthermore, step 2 of the Doc2Vec method mainly includes two steps: the first step is to train the model, which trains all functions to obtain the trained model; the second step is the prediction process, which obtains the text feature vector of the function to be predicted.

[0021] The above method, Doc2Vec, considers both the meaning of the current word and the context information, thus achieving significant results in code text feature extraction. This invention uses Doc2Vec for feature extraction.

[0022] Furthermore, the training process is as follows: For the input function, the functions are grouped, and a word in each function is randomly masked for prediction. The prediction error is used as the loss function. According to the principle of minimizing the loss function, stochastic gradient descent is used to iteratively adjust the parameter values. Numerous experiments have shown that setting the number of iterations to 10 results in high efficiency and accuracy in software security vulnerability detection. Therefore, the number of iterations in this invention is set to 10. After obtaining the training model through iteration, the training model is saved. The prediction process is as follows: The training model is loaded, and the text feature vector of the function to be predicted is randomly initialized and placed into the loaded training model. Consistent with the training process, the prediction error of the word is used as the loss function, and stochastic gradient descent is used for iteration. The difference from the training process is that the parameters in the training model remain unchanged during the iteration process, while the text feature vector is changed. The number of iterations in the prediction process is also set to 10. After iteration, the text feature vector of the function to be predicted is obtained.

[0023] Furthermore, in step 3, the directed graph of functional dependencies is represented by G, where G = (V, E), and V represents the functions in the project, and E represents the dependencies between functions; the adjacency matrix of G is represented by A. n×n Let n be the number of functions, and A be the function name. n×n A pairwise matrix with all elements on the main diagonal being 0, denoted by A(i,j). n×n The element in the i-th row and j-th column represents the dependency relationship between function i and function j, and i ≠ j; where A(i,j) = 1 when function i depends on function j, and A(i,j) = 0 when function i does not depend on function j.

[0024] The above method, in the process of extracting functional dependency features, first constructs a directed graph of functional dependencies based on the calling relationships between functions, then uses an adjacency matrix to represent the directed graph of functional dependencies, and finally transforms the adjacency matrix into a functional dependency feature vector through singular value decomposition. The adjacency matrix is ​​transformed into a low-dimensional vector by using singular value decomposition, and the vector obtained by singular value decomposition can well represent the similarity information between methods and the structural information of the graph in the original graph.

[0025] Furthermore, the adjacency matrix A n×n The algorithm complexity is O(n 2 l), where n is the number of functions in the project, and l is the number of calling functions contained in each function; after constructing the adjacency matrix, singular value decomposition (SVD) is used to convert the adjacency matrix into a low-dimensional vector.

[0026] Furthermore, in step 4, the text feature length of the function is 200, the dependency feature length of the function is 10, and the vector length of the merged feature of the function is 210.

[0027] Furthermore, in step 5, the autoencoder is a multi-layer neural network used for dimensionality reduction. It learns a good dimensionality-reduced vector by minimizing the reconstruction error. The autoencoder consists of two parts: an encoding part z = h(x) and a decoding part x′ = g(z), where x is the input vector, h(x) is the encoding process in the autoencoder, z is the encoding result of the autoencoder with a dimension of 10, and g(z) is the decoding process in the autoencoder with a dimension of 10. The input is x, and the output is x′. The autoencoder is trained by using the difference between x and x′ as the loss function and adjusting the autoencoder parameters. The number of training iterations of the autoencoder is set to 50. After training, the value of z is taken as the dimensionality reduction vector of the original vector x. The autoencoder has 7 hidden layers, with 500, 500, 2000, 10, 2000, 500, and 500 nodes in each layer. Through dimensionality reduction, the vector dimension is reduced from 210 dimensions to 10 dimensions.

[0028] The above methods employ autoencoders for feature dimensionality reduction and noise reduction, thereby improving the accuracy of software security vulnerability detection.

[0029] Furthermore, in step 6, functions containing security vulnerabilities are treated as outliers, and the Local Outlier Factor (LOF) method is used to detect these outliers. The formula for calculating the outlier value LOF is as follows:

[0030]

[0031] Where k is the number of nearest neighbors, AR k Let (x) be the set of points closest to x, AR k (x) is the average distance of x to its k nearest neighbors, and y is the distance of each point in the set of the k nearest points to x. k (y) is the average distance from y to its k nearest neighbors.

[0032] Furthermore, by calculating LOF k (x) Obtain the LOF value of each function, sort all the calculated LOF values ​​of functions from largest to smallest, and regard the functions with the LOF values ​​in the top 30% (experiments show that taking the top 30% can achieve a balance between the accuracy and correctness of software security vulnerability detection) as anomalous functions, that is, functions containing security vulnerabilities.

[0033] The above method treats the problem of detecting security vulnerability functions as an unsupervised learning anomaly detection problem, and uses anomaly detection algorithms to detect functions containing security vulnerabilities, thus providing support for subsequent software security vulnerability evaluation and remediation.

[0034] Compared with existing technologies, the advantages of this invention are:

[0035] 1. This invention utilizes feature extraction models and machine learning models for software security vulnerability detection. It focuses on the textual features of functions themselves as well as the dependencies between functions, which is consistent with reality. In practice, when a function calls a function containing a security vulnerability, the caller itself is also at risk of security vulnerability. By combining textual feature vectors and dependency vectors, the function features can be more comprehensively represented, thereby improving the accuracy of security vulnerability detection.

[0036] 2. This invention generates software code features by combining text features and function dependency features of the software code, extracts text features of function code using Doc2Vec, and extracts function dependency features by calling the relation matrix, thereby improving the accuracy of detection.

[0037] 3. This invention uses an autoencoder for feature dimensionality reduction, which not only reduces dimensionality but also removes noise and improves the detection accuracy.

[0038] 4. This invention employs an anomaly detection algorithm to detect functions containing vulnerabilities. The input is a dimensionality-reduced feature vector, and the output is the function containing the security vulnerability. Unlike other methods that use supervised machine learning such as support vector machine (SVM), logistic regression, neural network, decision tree, random forest, and k-nearest neighbor, this invention treats the problem of detecting security vulnerability functions as an unsupervised anomaly detection problem, considering the unavailability of software security vulnerability labels and the fact that functions containing vulnerabilities account for a small proportion of the total function. It does not require providing software samples with vulnerability labels to perform detection, thereby improving detection efficiency and accuracy. Attached Figure Description

[0039] Figure 1 This is a schematic diagram of the technical process of the present invention;

[0040] Figure 2 This is a schematic diagram of the Doc2Vec training model of the present invention;

[0041] Figure 3 This is a structural diagram of the Autoencoder of the present invention. Detailed Implementation

[0042] It should be noted that relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0043] The technical solution of the present invention will be further described in detail below with reference to the embodiments.

[0044] like Figure 1 As shown, this invention discloses a software security vulnerability detection method based on text features and functional dependency features, including the following specific operation steps:

[0045] Step 1. Code Preprocessing: Input project code information, preprocess the code in the project, extract all function information in the project and save it. The language of the preprocessed project can be JAVA, C, C++ or C#; specifically: extract the source code file in the project, extract the function information contained in the source code file according to the code structure information in the source code file (the source code file contains both variables and functions, but the vulnerability only exists in the functions, so variable information is ignored and function information is extracted), and save the extracted functions in a text file named after the source code file name plus the function name;

[0046] Step 2. Function text feature extraction: The function obtained in Step 1 is used to extract function text features using the Doc2Vec method to obtain the function text feature vector; the Doc2Vec method mainly includes two steps: the first step is to train the model, which is performed on all functions to obtain the trained model; the second step is the prediction process to obtain the text feature vector of the function to be predicted.

[0047] Step 3. Function Dependency Feature Extraction: A directed graph of function dependencies is constructed using the function call relationships from Step 1. An adjacency matrix is ​​used to represent this graph, and singular value decomposition (SVD) is used to transform the adjacency matrix into a function dependency feature vector. Specifically, there are two types of relationships between functions: parameter passing and function return. Parameter passing is the process of a function passing data to a called function, occurring when the function is called. Function return is the process of the called function returning its result to the calling function after completing its operation, occurring when the call is complete. Therefore, the relationship between functions is a caller-called relationship. In the function dependency feature extraction process, a directed graph of function dependencies is first constructed based on the function call relationships. Then, an adjacency matrix is ​​used to represent this graph. Finally, singular value decomposition (SVD) is used to transform the matrix into a function dependency feature vector. The directed graph of function dependencies is represented by G, where G = (V, E), and V represents the functions in the project, and E represents the dependencies between functions. The adjacency matrix of G is represented by A. n×n Let n be the number of functions, and A be the function name. n×n A pairwise matrix with all elements on the main diagonal being 0, denoted by A(i,j). n×n The element in the i-th row and j-th column represents the dependency relationship between function i and function j, where i ≠ j; where A(i,j) = 1 when function i depends on function j, and A(i,j) = 0 when function i does not depend on function j; the adjacency matrix A n×n The specific construction process is shown in Algorithm 1:

[0048] Algorithm 1: Constructing the adjacency matrix

[0049] Input: F, function set

[0050] Output: A, adjacency matrix

[0051]

[0052]

[0053] The algorithm for constructing the adjacency matrix A has a time complexity of O(n^2). 2 l), where n is the number of functions in the project, and l is the number of calling functions contained in each function; after constructing the adjacency matrix, singular value decomposition (SVD) is used to convert the adjacency matrix into a low-dimensional vector to obtain the function dependency vector. Experiments show that when the length of the dependency vector of each function is 10, the overall performance of the software vulnerability detection results is better.

[0054] Step 4. Merging Function Text Features and Function Dependency Features: Merge the function text feature vector and function dependency feature vector obtained in Steps 2 and 3 to obtain a merged feature vector that represents the function features; for example, if the function text features are T = [0.03, 0.02, ..., 0.06, 0.01], and the function dependency features are D = [0.23, 0.33, ..., 0.08, 0.07, 0.02], then the merged feature vector is B = [ [0.03,0.02,…,0.06,0.01,0.23,0.33,…,0.08,0.07,0.02], quantitative experiments show that the software security vulnerability detection effect is best when the length of the function text feature vector is 200 and the length of the function dependency feature vector is 10. Therefore, this invention sets the lengths of the function text feature vector and the dependency feature vector to 200 and 10 respectively, and the vector length of the function's merged features is 200+10=210.

[0055] Step 5. Feature Dimensionality Reduction: Since the merged feature vector obtained in the previous steps has high dimensionality and contains noise, this invention uses an autoencoder to reduce the dimensionality and remove noise from the merged feature vector obtained in Step 4. The autoencoder is divided into two parts: encoding and decoding. The optimal encoding result is obtained by comparing the decoding result with the original feature vector as a loss function.

[0056] Step 6. Anomaly Detection: Functions containing security vulnerabilities are identified as outliers. The Local Outlier Factor (LOF) method is used to detect these outliers. The formula for calculating the LOF value is as follows:

[0057]

[0058] Where k is the number of nearest neighbors, AR k Let (x) be the set of points closest to x, ARk (x) is the average distance of x to its k nearest neighbors, and y is the distance of each point in the set of the k nearest points to x. k (y) represents the average distance from y to its k nearest neighbors, calculated using the LOF (Low-Oriented Flytek) algorithm. k (x) Obtain the LOF value of each function, sort all the calculated LOF values ​​of the functions from largest to smallest, and regard the functions with the top 30% of LOF values ​​as anomalous functions (experiments show that taking the top 30% can achieve a balance between the accuracy and correctness of software security vulnerability detection), that is, functions containing security vulnerabilities.

[0059] like Figure 2 As shown, in step 2, Doc2Vec considers both the meaning of the current word and the contextual information, thus achieving significant results in code text feature extraction. The present invention uses the Doc2Vec method for function text feature extraction as follows: First, a Doc2Vec training model is constructed, and all extracted functions are trained. The training process involves: grouping the input functions, randomly masking a word in each function for prediction, using the prediction error as the loss function, and iteratively adjusting the model parameters using stochastic gradient descent based on the principle of minimizing the loss function (numerous experiments show that setting the number of iterations to 1...). The software security vulnerability detection efficiency and accuracy are high when the time is 0, therefore the iteration number in this invention is set to 10. After iteration, the training model is obtained and saved. The prediction process is as follows: load the training model, randomly initialize the text feature vector of the function to be predicted, and put it into the loaded training model. Consistent with the training process, the prediction error of the word is used as the loss function, and stochastic gradient descent is used for iteration. The difference from the training process is that the parameters in the training model remain unchanged during the iteration process, while the text feature vector is changed (the number of iterations in the prediction process is also set to 10). After iteration, the text feature vector of the function to be predicted is obtained. Experiments show that the software security vulnerability detection result is the best when the length of the function text feature vector is set to 200. Therefore, the length of the function text feature vector in this invention is set to 200.

[0060] like Figure 3As shown, in step 5, the autoencoder is a multi-layer neural network used for dimensionality reduction. It learns a good dimensionality-reduced vector by minimizing the reconstruction error. The autoencoder consists of two parts: an encoding part z = h(x) and a decoding part x′ = g(z), where x is the input vector, h(x) is the encoding process in the autoencoder, z is the encoding result of the autoencoder with a dimension of 10, g(z) is the decoding process in the autoencoder, z is the decoding input, and x′ is the autoencoder's decoding function. The output of the autoencoder is used to train the autoencoder by using the difference between x and x′ as the loss function and adjusting the autoencoder parameters. Experiments show that the training efficiency and effect of the autoencoder are high when the number of training iterations is 50. Therefore, the number of training iterations of the autoencoder is set to 50. After training, the value of z is taken as the dimensionality reduction vector result of the original vector x. The autoencoder has 7 hidden layers, and the number of nodes in each layer is 500, 500, 2000, 10, 2000, 500, and 500 respectively. Through dimensionality reduction, the vector dimension is reduced from 210 dimensions to 10 dimensions.

[0061] The specific embodiments described in this application are quite detailed, but they should not be construed as limiting the scope of protection of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the technical solution of this application, and these modifications and improvements all fall within the scope of protection of this application.

Claims

1. A software security vulnerability detection method based on text features and functional dependency features, characterized in that, The specific operating steps are as follows: Step 1. Code Preprocessing: Input project code information, preprocess the code in the project, extract all function information in the project and save it; Step 2. Function text feature extraction: The function information obtained in Step 1 is used to extract function text features using the Doc2Vec method to obtain the function text feature vector; Step 3. Function Dependency Feature Extraction: Construct a directed graph of function dependencies using the call relationships between functions from Step 1, represent the directed graph of function dependencies using an adjacency matrix, and transform the adjacency matrix into a function dependency feature vector through singular value decomposition; Step 4. Merging Function Text Features and Function Dependency Features: Merge the function text feature vectors and function dependency feature vectors obtained in Steps 2 and 3 respectively to obtain a merged feature vector to represent the function features; Step 5. Feature Dimensionality Reduction: The merged feature vector obtained in Step 4 is reduced in dimension and denoised using an autoencoder. The autoencoder consists of two parts: encoding and decoding. The optimal encoding result is obtained by comparing the decoding result with the original feature vector as a loss function. Step 6. Anomaly Detection: Use the Local Outlier Factor (LOF) method to detect anomalies and identify functions containing security vulnerabilities.

2. The software security vulnerability detection method based on text features and functional dependency features according to claim 1, characterized in that, Step 1 involves preprocessing the code in the project. Specific steps include: Step 1.

1. Extract the source code files from the project; Step 1.

2. Based on the code structure information in the source code file, extract the function information contained in the source code file. The source code file contains both variables and functions, but the security vulnerability only exists in the functions. Therefore, ignore the variable information and only extract the function information. Step 1.

3. Save the extracted function information in a text file named after the source code file name plus the function name.

3. The software security vulnerability detection method based on text features and functional dependency features according to claim 1, characterized in that, In step 2, the Doc2Vec method converts the function into a fixed-length vector to represent the text features of the function. This mainly includes two steps: the first step is to train the model, which trains all functions to obtain the trained model; the second step is the prediction process, which obtains the text feature vector of the function to be predicted.

4. The software security vulnerability detection method based on text features and functional dependency features according to claim 3, characterized in that, The training process is as follows: For the input function, the functions are grouped, and a word in each function is randomly masked for prediction. The prediction error is used as the loss function. Based on the principle of minimizing the loss function, stochastic gradient descent is used to iteratively adjust the model parameter values. The number of iterations is set to 10. After iteration, the trained model is obtained and saved. The prediction process is as follows: The trained model is loaded, and the text feature vector of the function to be predicted is randomly initialized and put into the loaded trained model. Consistent with the training process, the prediction error of the word is used as the loss function, and stochastic gradient descent is used for iteration. The difference from the training process is that the parameters in the trained model remain unchanged during the iteration process, while the text feature vector is changed. The number of iterations in the prediction process is also set to 10. After iteration, the text feature vector of the function to be predicted is obtained.

5. The software security vulnerability detection method based on text features and functional dependency features according to claim 1, characterized in that, In step 3, the directed graph of functional dependencies is represented by G, where G = (V, E), and V represents the functions in the project, and E represents the dependencies between functions; the adjacency matrix of G is represented by A. n×n Let n be the number of functions, and A be the number of functions. n×n A pairwise matrix with all elements on the main diagonal being 0, denoted by A(i,j). n×n The element in the i-th row and j-th column represents the dependency relationship between function i and function j, where i ≠ j. When function i depends on function j, A(i,j) = 1, and when function i does not depend on function j, A(i,j) = 0.

6. The software security vulnerability detection method based on text features and functional dependency features according to claim 5, characterized in that, The adjacency matrix A n×n The algorithm complexity is O(n 2 l), where n is the number of functions in the project, and l is the number of calling functions contained in each function; after constructing the adjacency matrix, singular value decomposition (SVD) is used to convert the adjacency matrix into a low-dimensional vector, namely the function dependency feature vector.

7. The software security vulnerability detection method based on text features and functional dependency features according to claim 1, characterized in that, In step 4, the text features of the function and the dependency features between functions are merged, and the function features are represented by the merged vector; the length of the text feature of the function is 200, the length of the dependency feature of the function is 10, and the length of the vector of the merged feature of the function is 210.

8. The software security vulnerability detection method based on text features and functional dependency features according to claim 1, characterized in that, In step 5, the autoencoder is a multi-layer neural network used for dimensionality reduction. It learns a good dimensionality-reduced vector by minimizing the reconstruction error. The autoencoder consists of two parts: an encoding part z = h(x) and a decoding part x′ = g(z), where x is the input vector, h(x) is the encoding process in the autoencoder, z is the result of the autoencoder encoding (z has a dimension of 10), and g(z) is the decoding process in the autoencoder (z is the decoding input). x′ is the output of the autoencoder. The autoencoder is trained by using the difference between x and x′ as the loss function and adjusting the autoencoder parameters. The number of training iterations of the autoencoder is set to 50. After training, the value of z is taken as the dimensionality reduction vector of the original vector x. The autoencoder has 7 hidden layers, with 500, 500, 2000, 10, 2000, 500, and 500 nodes in each layer. Through dimensionality reduction, the vector dimension is reduced from 210 dimensions to 10 dimensions.

9. The software security vulnerability detection method based on text features and functional dependency features according to claim 1, characterized in that, In step 6, functions containing security vulnerabilities are identified as outliers. The Local Outlier Factor (LOF) method is used to detect these outliers. The formula for calculating the LOF outlier is as follows: Where k is the number of nearest neighbors, AR k Let (x) be the set of points closest to x, AR k (x) is the average distance of x to its k nearest neighbors, and y is the distance of each point in the set of the k nearest points to x. k (y) is the average distance from y to its k nearest neighbors.

10. A software security vulnerability detection method based on text features and functional dependency features according to claim 9, characterized in that, By calculating LOF k (x) Obtain the LOF value of each function, sort all the calculated LOF values ​​of the functions from largest to smallest, and regard the functions with the top 30% of LOF values ​​as outliers, that is, functions containing security vulnerabilities.

Images