A deep learning-based mobile application security defect abstract generation method

Abstract

The application discloses a kind of based on deep learning's mobile application security defect abstract generation method, steps are as follows: the original user comment obtained in mobile application store is preprocessed;The comment sentence after preprocessing is carried out sentiment analysis, and the sentence with positive sentiment tendency is eliminated, and the sentence with neutral and negative sentiment tendency is retained;The comment sentence after processing is classified, and is divided into security defect related comment and security defect unrelated comment using logistic regression algorithm, and the comment dataset related to security defect is constructed;From the security defect related comment, extract the <aspect-opinion-undesirable behavior> triplet, and constitute the security defect related comment abstract.The application can extract the triplet representing security defect in unstructured user comment, construct the comment abstract generation model for mobile application security defect using deep learning technology, and provide the key information of security defect for the mobile application to be tested.

Description

Technical Field

[0001] This invention belongs to the field of mobile application security vulnerability mining, specifically involving a deep learning-based method for mobile application security vulnerability mining. Background Technology

[0002] Because mobile apps often lack sufficient security considerations during design and development, software defects caused by improper coding or unreasonable configuration in behavioral logic and data access can lead to violations of security policies during program execution. These specific software defects are known as security flaws or vulnerabilities. Attackers can exploit these vulnerabilities to steal or even sell users' private information, maliciously deduct fees from users' accounts without authorization, and even create an attack chain spanning the entire process from development and release to user interaction. This not only causes privacy breaches and financial losses for users but also severely impacts the commercial value of mobile apps, resulting in significant losses for developers. How to detect and analyze mobile app security flaws in a timely and effective manner has become a focus of attention for both industry and academia.

[0003] The rapid rise of mobile apps has led to a greater tendency for people to express their opinions and views, resulting in a large volume of online comments. Faced with fierce market competition, app developers must quickly launch new features and promptly fix vulnerabilities. Analyzing mobile app security flaws based on user comments offers an effective approach. Currently, some work focuses on mining user comments. Galvis et al. used the ASUM (Aspect Sentiment Unification Model) topic mining model to automatically extract topics from comments, and provided representative sentences for each topic to help requirements engineers better understand the keywords. Chen et al. proposed a user comment analysis method called RASL based on support vector machines and topic models. First, they used support vector machines to classify comments using multiple labels, and then used an LDA model to extract effective keywords and representative sentences for each comment type. In recent years, due to the widespread application of machine learning and deep learning, computers' ability to process natural language has reached a new level. At this point, if these intelligent technologies can be used to mine a certain amount of user comment data to form a summary of mobile application security flaws, it is possible to describe the key information in the comments more conveniently and efficiently, reducing the burden on developers. Summary of the Invention

[0004] To address the shortcomings of the existing technologies, the present invention aims to provide a deep learning-based method for generating mobile application security defect summaries, overcoming the problem that existing topic mining models are insufficient to clearly describe key information about security defects in reviews. This invention can extract triples representing security defects from unstructured user reviews, utilize deep learning technology to construct a review summary generation model for mobile application security defects, provide key information about security defects for the mobile application under test, and simultaneously provide users with a visual radar chart display.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] The present invention provides a method for generating mobile application security defect summaries based on deep learning, comprising the following steps:

[0007] 1) Preprocess the original user reviews obtained from mobile app stores, including sentence segmentation, spelling correction, abbreviation and acronym expansion;

[0008] 2) Perform sentiment analysis on the preprocessed comment sentences, remove sentences with a positive sentiment tendency, and retain sentences with a neutral or negative sentiment tendency;

[0009] 3) Classify the comment sentences processed in step 2), and use the logistic regression algorithm to divide them into comments related to security defects and comments unrelated to security defects, and construct a comment dataset related to security defects;

[0010] 4) Extract the <aspect-viewpoint-misbehavior> triple from comments related to security defects to form a summary of comments related to security defects.

[0011] Preferably, step 1) specifically includes:

[0012] 11) Sentence segmentation: Sentence segmentation is performed using a delimiter combined with the split() method of the Python third-party library re.

[0013] 12) Spelling error correction: PyEnchant, the built-in spell checking library in Python, is used to check the comment sentences for errors. If a misspelled word is detected, it is replaced.

[0014] 13) Abbreviations and abbreviation expansion: Use regular expressions to replace abbreviations in comment sentences with complete expressions.

[0015] Preferably, step 2) specifically includes:

[0016] 21) The Vader sentiment analysis module (built into the Natural Language Processing Toolkit (NLTK)) is used to perform sentiment analysis on the preprocessed comment data (Vader is a lexical and rule-based sentiment analysis model). The sentiment expressed by the comment sentence is judged and divided into three polarities: positive, negative, and neutral. The probabilities of the three sentiment polarities of the comment sentence and a composite score are obtained. The composite score is calculated by adding the valence scores of each word in the dictionary, adjusting according to the rules, and then normalizing to between -1 (the most extreme negative) and 1 (the most extreme positive).

[0017] 22) Based on the composite score obtained in step 21), determine the sentiment tendency of the comment sentences and extract the comment sentences with negative and neutral sentiment tendencies.

[0018] Preferably, step 3) specifically includes:

[0019] 31) Constructing the dataset for the classification model: Using some of the comment sentences obtained in step 2), construct the dataset for the classification model and store it in CSV file format. The first column of the file is the label, which is the category of the comment sentence. 1 indicates that the comment is related to security and 0 indicates that the comment is not related to security. The second column is the review, which is the content of the user's comment. The training and test sets for the classification model are constructed by manually labeling the comments.

[0020] 32) Feature extraction is performed using the Term Frequency-Inverse Document Frequency (TF-IDF) algorithm. HashingTF, IDF, and Tokenizer are imported from the SparkML library. A document set is constructed, creating a DataFrame where each sentence represents a document. After obtaining the document set, the sentences are segmented using the tokenizer. After obtaining the segmented document sequence, the transform() method of HashingTF is used to hash the sentences into feature vectors, with each word hashed into a different index value. IDF is used to modify the simple term frequency feature vectors to reflect the differentiating power of different words in the text. The fit() method is called, passing in the term frequency feature vectors to generate an IDFModel. The transform() method of the IDFModel is called to obtain the TF-IDF matrix corresponding to each word.

[0021] 33) The LogisticRegression() method of the sklearn library in Python is used to construct the logistic regression model;

[0022] 34) The logistic regression model was trained and tested using the 10-fold cross-validation method; then the unclassified comment data was input into the trained logistic regression model and divided into security-related and security-independent categories to obtain a security defect-related comment dataset.

[0023] Preferably, step 4) specifically includes:

[0024] 41) A dataset based on the BERT-BiLSTM-CRF (Bidirectional Long Short-Term Memory-Conditional Random Field) model and the textCNN (Text Convolutional Neural Network) model was constructed using manual annotation.

[0025] 42) In the BERT-BiLSTM-CRF model, BERT is a deep bidirectional pre-trained language understanding model that uses Transformers as feature extractors to extract word-level features, syntactic structure features, and semantic features from security defect-related comment sentences; the bidirectional long short-term memory neural network model (BiLSTM) is composed of forward LSTM and backward LSTM; the BERT-BiLSTM-CRF model extracts words or phrases representing aspects, opinions, and bad behaviors, resulting in <aspect-opinion-bad behavior> triples;

[0026] 43) Train the textCNN model. textCNN is a neural network derived from Convolutional Neural Networks (CNNs) for text classification. The textCNN model includes: word embedding layers, convolutional layers, pooling layers, and fully connected layers. The word embedding layer obtains a word vector matrix. Convolutional kernels of different sizes are used on the word vector matrix to extract some features of the input. Then, the convolution result is processed by an activation function (using the ReLU function) and input into the pooling layer. The pooling layer generates higher-dimensional vectors. The results of the pooling layer are randomly selected by the dropout layer and then connected by the fully connected layer to obtain the classification result.

[0027] 44) Use the trained textCNN model to classify the triples obtained in step 42) into invalid and valid triples, and filter out the invalid triples.

[0028] 45) Use Python's Natural Language Processing Toolkit (NLTK) to perform lemmatization on the aspect words and bad behavior words in the effective triples obtained in step 44) above, and form the final comment summary triples.

[0029] Furthermore, the method also includes step 5): using a radar chart to visualize and summarize the security defect-related comment summary obtained in step 4).

[0030] Preferably, step 5) specifically includes:

[0031] Triples with the same aspect are grouped together, and the number of triples for each aspect is calculated as the frequency; the radar chart is drawn using the pygal library that comes with Python, and the Rader class is called to set the parameters of the radar chart.

[0032] The beneficial effects of this invention are:

[0033] This invention utilizes deep learning technology to construct a comment summary generation model targeting security vulnerabilities in mobile applications, providing key information on security flaws in the mobile application under test, while simultaneously offering users a visual radar chart display. It offers several key advantages:

[0034] (1) This invention addresses security flaws by extracting information about security flaws and user opinions from comments in the form of comment summaries, providing a reference for developers and testers to discover and analyze security flaws.

[0035] (2) This invention avoids complex code reverse engineering and analysis, and makes full use of comment data to mine information related to security vulnerabilities.

[0036] (3) This invention proposes an intelligent mobile application security defect summary generation model, which can mine security defects of applications that have been released in the mobile application market and have certain user reviews, and visualize the key information of security defects, thereby improving work efficiency and reducing the burden on users. Attached Figure Description

[0037] Figure 1 This is a general framework diagram of the method of the present invention.

[0038] Figure 2 This is a diagram of the BERT-BiLSTM-CRF model framework used in this invention.

[0039] Figure 3 This is a radar chart showing information related to security flaws in user reviews generated in this invention. Detailed Implementation

[0040] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to embodiments and accompanying drawings. The content mentioned in the embodiments is not intended to limit the present invention.

[0041] Reference Figure 1 As shown, the present invention provides a method for generating mobile application security defect summaries based on deep learning, comprising the following steps:

[0042] Step 1) Preprocessing: Preprocess the original reviews obtained from mobile app stores, including sentence segmentation, spelling correction, and abbreviation and acronym expansion; among which,

[0043] 11) Sentence segmentation: Sentence segmentation is performed using a delimiter combined with the split() method of the Python third-party library re.

[0044] 12) Spelling error correction: PyEnchant, the spell checking library that comes with Python, is used to check for errors in the comments. If a misspelled word is detected, it is replaced.

[0045] 13) Abbreviations and abbreviation expansions: Comments often contain abbreviations. Use regular expressions to replace the abbreviations in the comment with the complete expressions; such as "don't-do not" and "can't-cannot".

[0046] Step 2) Sentiment Analysis: Perform sentiment analysis on the preprocessed sentences, removing sentences with a positive sentiment tendency and retaining sentences with a neutral or negative sentiment tendency; among them,

[0047] 21) The sentiment analysis module Vader, which comes with the Natural Language Processing Toolkit (NLTK), is used to perform sentiment analysis on the preprocessed comment data. Vader is a lexical and rule-based sentiment analysis model that distinguishes the sentiment expressed by the comment sentence and divides it into three polarities: positive, negative, and neutral. The probability of the three sentiment polarities of the comment sentence and a composite score are obtained. The composite score is calculated by adding the valence scores of each word in the dictionary, adjusting them according to the rules, and then normalizing them to between -1 (the most extreme negative) and 1 (the most extreme positive).

[0048] 22) Determine the sentiment of the comment sentences based on the composite score returned by Vader. If a sentence's composite score is greater than or equal to 0.05, its sentiment is positive; if a sentence's composite score is less than or equal to -0.05, its sentiment is negative; sentences with a neutral sentiment have a composite score between -0.05 and 0.05. Based on this, extract comment sentences with negative or neutral sentiment.

[0049] Step 3) User Comment Classification: The comment data obtained after Step 2) is classified using a logistic regression algorithm to construct a comment dataset related to security vulnerabilities; whereby,

[0050] 31) Constructing the dataset for the classification model: Using the partial comment sentences obtained in step 2), construct the dataset for the classification model and store it in CSV file format. The first column of the file is the label, which is the category of the comment sentence. 1 indicates that the comment is related to security, and 0 indicates that the comment is not related to security. The second column is the review, which is the content of the user's comment. The training and test sets of the model are constructed by manually labeling the comments.

[0051] 32) After the dataset is constructed, the Term Frequency-Inverse Document Frequency (TF-IDF) algorithm is used for feature extraction.

[0052] Import HashingTF, IDF, and Tokenizer from the SparkML library; construct a document collection and create a DataFrame, where each sentence represents a document; after obtaining the document collection, use the tokenizer to segment the sentences; after obtaining the segmented document sequence, use the transform() method of HashingTF to hash the sentences into feature vectors, with each word hashed into a different index value; use IDF to modify the simple word frequency feature vectors to reflect the ability of different words to distinguish the text, call the fit() method and pass in the word frequency feature vectors to generate an IDFModel; call the transform() method of IDFModel to obtain the TF-IDF matrix corresponding to each word;

[0053] 33) The LogisticRegression() method of the sklearn library in Python is used to build the logistic regression model. The solver parameter of this method is the optimization algorithm selection parameter. Setting this parameter to sag, lbfgs and newton-cg can achieve good results. The maximum number of convergence times max_iter is set to 500.

[0054] 34) A 10-fold cross-validation method was used to train and test the logistic regression model. The data was split into test data:train data in a 2:8 ratio. 70 different random number seeds were used to split the training set, and the `train_test_split()` method was used to divide the dataset into four parts: `x_train`, `x_test`, `y_train`, and `y_test`. The model was trained using `x_train` and `y_train`. Unclassified comment data was input into the model, which categorized these comments into security-related and security-independent categories. This step yielded comments related to security vulnerabilities.

[0055] Step 4) <Aspect-Opinion-Misconduct> Extraction: The BERT-BiLSTM-CRF model is used to extract <Aspect-Opinion-Misconduct> triples from security vulnerability-related comments; the textCNN model is used to filter invalid triples; and the Natural Language Processing (NLTK) toolkit in Python is used to perform lemmatization on the aspect terms and misconduct terms obtained in the above steps, thereby constructing a summary of security vulnerability-related comments; where,

[0056] 41) Use Tornado to build an annotation platform. On the annotation page, annotators need to input the sentence to be annotated, as well as the misconduct, aspect, and opinion. The triples are displayed, and valid triples are labeled as 1, while invalid triples are labeled as 0, forming the dataset for the textCNN classification model. The relationship between the three elements of the <misconduct-aspect-opinion> triple is: the opinion holder (user) has expressed an opinion on a certain aspect of the security flaw.

[0057] 42) The BIO annotation system is used to perform sequence annotation on security defect-related comment sentences to form the dataset for the BERT-BiLSTM-CRF model. The example involves seven annotation types: B-aspect, I-aspect, B-misbehavior, I-misbehavior, B-opinion, I-opinion, and O. Here, "aspect" refers to the object described in a security defect-related comment sentence, "misbehavior" refers to the verb that poses a security threat to the user, and "opinion" refers to the specific opinion expressed by the user regarding a particular aspect in the comment sentence.

[0058] 43) In this embodiment, a pre-trained BERT encoder is used as a pre-trained language model to encode the contextual information of sentence S, obtaining word vectors. These word vectors are then input into a Bidirectional Long Short-Term Memory Network-Conditional Stochastic (BiLSTM-CRF) model for further training. The vectors are first input into the BiLSTM layer, assuming... To represent a sequence of sentences, we first need to obtain the hidden state sequence using a forward long short-term memory model. Then, the hidden state sequence is obtained through the backward long short-term memory model. Then perform combination operations to obtain This leads to the complete hidden state sequence:

[0059] (x1, x2, ..., x n )∈R n×m

[0060] The sentence feature matrix P = (p1, p2, ..., p) is obtained. n )∈R n×k After that, you can put p i ∈R k Each element p ij Consider the word x iThe probability of identifying a word as the j-th label is calculated, which is the score probability of each word corresponding to each label. The output is the score probability of each word corresponding to each label, which will serve as the input to the next CRF layer. The CRF layer first requires a parameter matrix A; A is a (k+2)×(k+2)-dimensional probability transition matrix (k is the number of labels); the elements of matrix A represent the transition probabilities between labels. Therefore, this matrix A can be used to establish the connections between labels; the score of sentence x corresponding to label sequence y can be calculated as follows:

[0061]

[0062] It can be seen that the total score is a summation formula, and the final result is jointly determined by the parameter matrix A and the output probability obtained from the previous layer of bidirectional long short-term memory model; after normalization, the following formula is obtained:

[0063]

[0064] During training, the log-likelihood function needs to be maximized:

[0065] log P(y x |x)=score(x,y x )-log(∑ y′ exp(scare(x,y')))

[0066] The specific algorithm implementation uses a forward-backward algorithm to improve computational efficiency;

[0067] To obtain the most accurate predicted labels when making predictions, the Viterbi algorithm is required.

[0068] y * =argmax y′ score(x,y′)

[0069] In summary, the CRF layer can learn the relationships between the already output predicted labels during training, and combined with the probabilities output by the previous bidirectional long short-term memory model, it can efficiently determine the final predicted sequence; see also Figure 2 As shown;

[0070] 44) Divide the dataset formed in step 41) into a training set and a test set in a ratio of 8:2, and train and evaluate the text CNN classification model to determine whether the triples are effective and effectively solve the problem of comment sentences containing multiple security defect triples. textCNN is a neural network for text classification derived from the classic convolutional neural network (CNN). textCNN consists of four parts: word embedding layer, convolutional layer, pooling layer, and fully connected layer. The word embedding layer obtains the word embedding matrix, and then convolves the word embedding matrix with convolution kernels of different sizes. Each convolution kernel is similar to a trainable filter, extracting some features of the input. Then, the convolution result is processed by the activation function and input into the pooling layer. The pooling layer generates a higher-dimensional vector. Then, the result of the pooling layer is randomly selected by the dropout layer and connected by the fully connected layer to finally obtain the classification result. The word embedding matrix is ​​an S×d matrix, where S is the number of elements in the vocabulary and d is the dimension of the word embedding vector of each word. This invention employs the skip-grams method and sets the window size to 3 based on the characteristics of security vulnerability texts to complete the construction of the word embedding matrix; Num_filters is 32, filter_sizes is "3,4,5", and the activation function is ReLU;

[0071] 45) The Natural Language Processing (NLTK) toolkit in Python is used to perform lemmatization on the aspect words and misbehavior words obtained in the above steps to form the final comment summary triplet;

[0072] 46) After the model training is completed, the newly obtained user comment data is processed by extracting <aspect-viewpoint-misbehavior> triples to form a comment summary related to security flaws.

[0073] Step 5) Visual Summary: After obtaining the security defect triples through the above steps, sentences with the same aspects are merged and grouped, and a radar chart is used for visual summary, such as... Figure 3 As shown, taking NPR News as an example, a total of 1725 comments were crawled, and 164 security-related vulnerabilities were extracted. The top five aspects extracted from these security-related comments were notification, screen, privacy, content, and location. (See also...) Figure 3 As shown.

[0074] This invention has many specific applications. The above description is only a preferred embodiment of this invention. It should be noted that for those skilled in the art, several improvements can be made without departing from the principle of this invention, and these improvements should also be considered within the scope of protection of this invention.

Claims

1.A method for generating a deep learning-based mobile application security defect summary, characterized by, The steps are as follows: 1) Preprocess the original user reviews obtained from mobile app stores, including sentence segmentation, spelling correction, abbreviation and acronym expansion; 2) Perform sentiment analysis on the preprocessed comment sentences, remove sentences with a positive sentiment tendency, and retain sentences with a neutral or negative sentiment tendency; 3) Classify the comment sentences processed in step 2), and use the logistic regression algorithm to divide them into comments related to security defects and comments unrelated to security defects, and construct a comment dataset related to security defects; 4) Extract the <aspect-viewpoint-misbehavior> triple from comments related to security defects to form a summary of comments related to security defects; Step 2) specifically includes: 21) The Vader sentiment analysis module, which comes with the Natural Language Processing Toolkit, is used to perform sentiment analysis on the preprocessed comment data. The sentiment expressed by the comment sentence is judged and divided into three polarities: positive, negative, and neutral. The probability of the three sentiment polarities of the comment sentence and a composite score are obtained. The composite score is calculated by adding the valence scores of each word in the dictionary, adjusting them according to the rules, and then normalizing them to between -1 and 1. 22) Based on the composite score obtained in step 21), determine the sentiment tendency of the comment sentences and extract the comment sentences with negative and neutral sentiment tendencies; Step 3) specifically includes: 31) Constructing the dataset for the classification model: Using the partial comment sentences obtained in step 2), construct the dataset for the classification model and store it in CSV file format. The first column of the file is the label, which is the category of the partial comment sentences. 1 indicates that the partial comment sentences are related to security, and 0 indicates that the partial comment sentences are not related to security. The second column is the review, which is the content of the user's review. The training and test sets for the classification model are constructed by manually labeling the comments. 32) Feature extraction is performed using the term frequency-inverse document frequency (IF-IDF) algorithm. HashingTF, IDF, and Tokenizer are imported from the SparkML library. A document set is constructed, creating a DataFrame where each sentence represents a document. After obtaining the document set, the sentences are segmented using the tokenizer. After obtaining the segmented document sequence, the transform() method of HashingTF is used to hash the sentences into feature vectors, with each word hashed into a different index value. IDF is used to refine the simple term frequency feature vectors to reflect the differentiating power of different words in the text. The fit() method is called, passing in the term frequency feature vectors to generate an IDFModel. The transform() method of the IDFModel is called to obtain the TF-IDF matrix corresponding to each word. 33) The LogisticRegression() method of the sklearn library in Python is used to construct the logistic regression model; 34) The logistic regression model was trained and tested using the 10-fold cross-validation method; then the unclassified comment data was input into the trained logistic regression model and divided into security-related and security-independent categories to obtain a security defect-related comment dataset. 2.The deep learning based mobile application security defect abstract generation method of claim 1, wherein, Step 1) specifically includes: 11) Sentence segmentation: Sentence segmentation is performed using a delimiter combined with the split() method of the Python third-party library re. 12) Spelling error correction: PyEnchant, the built-in spell checking library in Python, is used to check the comment sentences for errors. If a misspelled word is detected, it is replaced. 13) Abbreviations and abbreviation expansion: Use regular expressions to replace abbreviations in comment sentences with complete expressions. 3.The deep learning based mobile application security defect abstract generation method of claim 1, wherein, Step 4) specifically includes: 41) The datasets for the BERT-BiLSTM-CRF model and the textCNN model were constructed using manual annotation. 42) In the BERT-BiLSTM-CRF model, BERT is a deep bidirectional pre-trained language understanding model that uses Transformers as feature extractors to extract word-level features, grammatical structure features, and semantic features from comments related to security breaches; the bidirectional long short-term memory neural network model is composed of forward LSTM and backward LSTM; the BERT-BiLSTM-CRF model extracts words or phrases representing aspects, opinions, and bad behaviors, resulting in <aspect-opinion-bad behavior> triples; 43) Train the textCNN model. textCNN is a neural network derived from convolutional neural networks for text classification. The textCNN model includes: word embedding layer, convolutional layer, pooling layer, and fully connected layer. The word embedding layer obtains a word vector matrix. Convolutional kernels of different sizes are used on the word vector matrix to extract some features of the input. Then, the convolution result is processed by an activation function and input into the pooling layer, which generates higher-dimensional vectors. The results of the pooling layer are randomly selected by the dropout layer and then connected by the fully connected layer to obtain the classification result. 44) Use the trained textCNN model to classify the triples obtained in step 42) into invalid and valid triples, and filter out the invalid triples. 45) Use Python's natural language processing toolkit to perform lemmatization on the aspect words and bad behavior words in the effective triples obtained in step 44) above to form the final comment summary triples. 4.The deep learning based mobile application security defect abstract generation method of claim 1, wherein, The method further includes step 5): using a radar chart to visualize and summarize the security defect-related comment summary obtained in step 4). 5.The deep learning based mobile application security defect abstract generation method of claim 4, wherein, Step 5) specifically includes: Triples with the same aspect are grouped together, and the number of triples for each aspect is calculated as the frequency; the radar chart is drawn using the pygal library that comes with Python, and the Rader class is called to set the parameters of the radar chart.

Images