Program bug fixing method and device, electronic equipment and storage medium

Abstract

This application provides a method, apparatus, electronic device, and storage medium for patching program vulnerabilities. The method includes: obtaining historical patch code based on source defect code and detection results obtained from defect detection of source code; wherein the historical patch code is patch code for historical defect code corresponding to the detection results; generating target patch code for the source defect code based on the characteristics of the historical patch code; and performing sequence fitting on the target patch code in the source code according to the source code structure of the source defect code to obtain patched source code. The technical solution of this application embodiment can automatically complete program vulnerability patching.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of computer, and in particular relates to a program vulnerability repair method and device, an electronic device and a storage medium. BACKGROUND

[0002] In the software development process, code defects cannot be avoided in programs, and if the code defects are not repaired in time, the frequency of errors in program running will become faster and faster, and even the hidden dangers of the code defects will affect the entire software field. Discovering and repairing possible vulnerabilities in programs is a very worthwhile research direction in the current software engineering discipline.

[0003] Automatic repair of programming errors, also known as program repair, can improve the efficiency of repairing program defects faster and can promote the process of software development. However, the current program repair process still mainly relies on manual repair, and the effect of automatic program repair is poor. In most cases, only repair suggestions related to defects are provided to program personnel, and manual intervention is still required. SUMMARY

[0004] To solve the above technical problems, embodiments of the present application provide a program vulnerability repair method and device, an electronic device, and a computer readable storage medium.

[0005] According to an aspect of an embodiment of the present application, a program vulnerability repair method is provided, including: obtaining historical repair code based on source defect code and detection results obtained by defect detection on source code; wherein the historical repair code is repair code of historical defect code corresponding to the detection results; generating target repair code of the source defect code based on features of the historical repair code; and performing sequence fitting on the target repair code in the source code according to a source code structure of the source defect code to obtain repaired source code.

[0006] In an embodiment, obtaining historical repair code based on source defect code and detection results obtained by defect detection on source code includes:

[0007] Performing defect detection on the source code to obtain detection results and source defect code corresponding to the detection results;

[0008] Obtaining historical defect code corresponding to the source defect code and repair code of the historical defect code based on the detection results;

[0009] Performing similarity calculation on the historical defect code and the source defect code to obtain similarity corresponding to each historical defect code;

[0010] The repair code of the historical defect code with a similarity greater than a preset similarity threshold is taken as the historical repair code.

[0011] In an embodiment, the generating of the target repair code of the source defect code based on the features of the historical repair code comprises:

[0012] The source defect code and the historical repair code are respectively subjected to abstraction processing, and an abstract source defect code and an abstract historical repair code are obtained correspondingly.

[0013] The abstract source defect code is translated into an abstract repair code based on the features of the abstract historical repair code.

[0014] The abstract repair code is subjected to reverse abstraction processing, and the target repair code is obtained.

[0015] In an embodiment, the respectively subjecting of the source defect code and the historical repair code to abstraction processing to obtain an abstract source defect code and an abstract historical repair code comprises:

[0016] According to the detection result of the source defect code, a source code structure related to the source defect code is obtained.

[0017] The functions and parameters of the source defect code and the functions and parameters of the historical repair code are respectively subjected to abstraction processing based on the source code structure, and an abstract source defect code and an abstract historical repair code are obtained; wherein the corresponding functions and corresponding parameters between the abstract source defect code and the abstract historical repair code are abstracted into the same identifier.

[0018] In an embodiment, the translating of the abstract source defect code into an abstract repair code based on the features of the abstract historical repair code comprises:

[0019] The abstract source defect code is encoded to obtain a code vector composed of a plurality of word vectors.

[0020] Each word vector in the code vector is respectively subjected to weighting processing based on an attention mechanism to obtain a weighted code vector.

[0021] The weighted code vector is decoded based on the character mapping in the abstract historical repair code to obtain the abstract repair code.

[0022] In an embodiment, the sequence fitting of the target repair code in the source code based on the source code structure of the source defect code to obtain a repaired source code comprises:

[0023] Extract the relationship between each function and each parameter in the source code structure, and confirm the fitted sequence of the target repair code in the source code;

[0024] The target repair code is fitted to the source code based on the fitted sequence to complete the repair of the source code and obtain the repaired source code.

[0025] In one embodiment, the method further includes:

[0026] The repaired source code was simulated and run to obtain the results.

[0027] If the execution result is reported as an error, the objective function corresponding to the error result will be converted into a feature code.

[0028] When encoding the abstract source defect code, the word vector corresponding to the target function is updated based on the feature code.

[0029] According to one aspect of the embodiments of this application, a program vulnerability repair apparatus is provided, comprising: a historical repair code acquisition module, configured to acquire historical repair code based on source defect code obtained by defect detection of source code and detection results; wherein the historical repair code is repair code of historical defect code corresponding to the detection results; a target repair code acquisition module, configured to generate target repair code of the source defect code based on the features of the historical repair code; and a source code repair module, configured to perform sequence fitting of the target repair code in the source code according to the source code structure of the source defect code to obtain repaired source code.

[0030] According to one aspect of the embodiments of this application, an electronic device is provided, including one or more processors; and a storage device for storing one or more computer programs, wherein when the one or more computer programs are executed by the one or more processors, the electronic device enables the program vulnerability repair method as described above.

[0031] According to one aspect of the embodiments of this application, a computer-readable storage medium is provided, on which computer-readable instructions are stored, which, when executed by a computer's processor, cause the computer to perform the program vulnerability repair method as described above.

[0032] According to one aspect of the embodiments of this application, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the program vulnerability repair methods provided in the various optional embodiments described above.

[0033] In the technical solution provided by the embodiments of this application, historical repair code is collected based on the detection results of source code defect detection. Target repair code for source defect code is generated based on the historical repair code, and the target repair code is sequence-fitted based on the source code structure so that it can be directly applied to the source code, thus automatically completing the program vulnerability repair without human intervention.

[0034] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0035] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:

[0036] Figure 1 This is a schematic diagram of one implementation environment involved in this application;

[0037] Figure 2 This is a flowchart illustrating a program vulnerability repair method as shown in an exemplary embodiment of this application;

[0038] Figure 3 yes Figure 2 The flowchart of step S210 in the illustrated embodiment is shown in an exemplary embodiment.

[0039] Figure 4 yes Figure 2 The flowchart of step S230 in the illustrated embodiment is shown in an exemplary embodiment.

[0040] Figure 5 yes Figure 4 A flowchart of step S410 in an exemplary embodiment shown in the illustrated example;

[0041] Figure 6 yes Figure 4 The flowchart of step S430 in the illustrated embodiment is shown in an exemplary embodiment.

[0042] Figure 7 This is a flowchart illustrating a neural machine translation process for generating abstract repair code, as shown in an exemplary embodiment of this application.

[0043] Figure 8 This is a flowchart illustrating a program vulnerability repair method, as shown in another exemplary embodiment of this application.

[0044] Figure 9 This is a schematic diagram illustrating the structure of a program vulnerability repair device according to an exemplary embodiment of this application;

[0045] Figure 10 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown. Detailed Implementation

[0046] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0047] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0048] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0049] It should also be noted that "multiple" as mentioned in this application refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0050] The following will provide a detailed description of the program vulnerability repair method and apparatus, electronic device, and storage medium proposed in the embodiments of this application.

[0051] Please refer to the following first. Figure 1 , Figure 1 This is a schematic diagram of an implementation environment related to this application. The implementation environment includes a terminal 100 and a server 200, which communicate with each other via a wired or wireless network.

[0052] Terminal 100 is used to obtain source code and send it to server 200 so that server 200 can fix program vulnerabilities in the source code. Finally, the program vulnerability fix results can be visualized through the display module built into terminal 100.

[0053] For example, after receiving the source code, the terminal 100 sends the source code to the server 200. The server 200 first performs defect detection on the source code and obtains the detection result. The detection result specifically refers to the detection result of finding vulnerabilities after defect detection. The detection result of passing defect detection is not described in detail in this embodiment.

[0054] After obtaining the detection results, the server 200 can obtain the corresponding source defect code based on the detection structure. Subsequently, based on the source defect code obtained from the source code defect detection and the detection results, the server 200 obtains the historical repair code. This historical repair code is the repair code of the historical defect code corresponding to the detection results. Based on the characteristics of the historical repair code, the target repair code of the source defect code can be generated through Neural Machine Translation (NMT). Finally, according to the source code structure of the source defect code, the target repair code is sequence-fitted into the source code to obtain the repaired source code.

[0055] The server 200 can send the repaired source code to the terminal 100, and the terminal 100 can visualize the program vulnerability repair results through its built-in display module. The server 200 can also run the repaired source code and visualize the running results through the terminal 100's built-in display module.

[0056] The terminal 100 can be any electronic device capable of data visualization, such as a smartphone, tablet, laptop, or computer; no restrictions are imposed here. The server 200 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. Multiple servers can form a blockchain, with the server being a node on the blockchain. The server 200 can also be a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms; no restrictions are imposed here either.

[0057] Of course, the program vulnerability repair method proposed in this embodiment can also be completed separately in terminal 100, that is, terminal 100 is both the source code and the program vulnerability repair process of the source code.

[0058] Figure 2 This is a flowchart illustrating a program vulnerability repair method according to an exemplary embodiment. This program vulnerability repair method can be applied to... Figure 1 The implementation environment shown is specifically executed by the server 200 in that implementation environment. It should be understood that the method can also be used in other exemplary implementation environments and specifically executed by devices in other implementation environments. This embodiment does not limit the implementation environment to which the method is applicable.

[0059] like Figure 2 As shown, in an exemplary embodiment, the method may include steps S210 to S250, which are described in detail below:

[0060] Step S210: Based on the source defect code and detection results obtained from defect detection of the source code, obtain the historical repair code.

[0061] In this embodiment, source code defects can be detected using code defect detection tools, such as Sonar and Fortify (both code scanning and detection tools), to obtain the detection results.

[0062] It should be noted that the program vulnerability repair proposed in this embodiment is for defects that appear in the code. Therefore, the detection results in this embodiment can be regarded as defect-related detection results. If the detection result of the source code is defect-free, it is not regarded as the above-mentioned detection result, that is, no program vulnerability repair is performed on it.

[0063] Defect detection of source code can detect different types of defects that may appear in the source code, such as failure to release resources after use, use of released resources, overflow of calculation results, etc., and the detection results can be used to obtain the source defect code in the source code.

[0064] In this embodiment, the source defect code refers to the code in the source code that is related to the defect indicated by the detection result. For example, in one embodiment, if a function references an undefined parameter, the source defect code corresponding to its detection result is the code related to this parameter, such as the code that calls the parameter.

[0065] Of course, there may be multiple defects in a source code, resulting in multiple detection results. The defects corresponding to the detection results can be fixed sequentially, or the defective code at the higher execution level can be fixed first according to the code structure of the source code.

[0066] In this embodiment, based on the detection results, multiple related historical defect codes and their fixes can be obtained from an open-source website. For example, if a detection result indicates that a released resource is being used, then historical defect codes with the same detection result as "using released resources" can be obtained from the open-source website.

[0067] Since the repair code of the historical defect code needs to be used in the future, in order to ensure the relevance of the repair code, this embodiment also calculates the similarity between the historical defect code and the source defect code, and selects the repair code of the historical defect code with high similarity as the historical repair code. In this way, the accuracy of the historical repair code as reference data for program vulnerability repair is guaranteed.

[0068] Step S230: Based on the characteristics of historical repair codes, generate target repair codes for the source defect codes.

[0069] In this embodiment, the generation of the target repair code for the source defect code can be achieved based on neural machine translation (NMT).

[0070] Specifically, by extracting the code structure of the source defect code, the source defect code and the historical repair code can be abstracted to obtain the abstract source defect code and the abstract historical repair code. That is, functions or parameters with the same meaning but different names in the source defect code and the historical repair code are abstracted so that functions or parameters with the same meaning in the source defect code and the historical repair code are identified by the same name.

[0071] Subsequently, the abstract source defect code and the abstract history repair code can be input into NMT. ​​NMT translates the abstract source defect code into abstract repair code based on the abstract history repair code, and then de-abstracts the functions and parameters in the abstract repair code to obtain the target repair code.

[0072] Step S250: Based on the source code structure of the source defect code, perform sequence fitting on the target repair code in the source code to obtain the repaired source code.

[0073] After obtaining the target fix code, it needs to be placed into or replaced in the source code to fix the program vulnerability.

[0074] In this embodiment, the relationship between each function and each parameter in the source code structure can be extracted, the fitting sequence of the target repair code can be identified in the source code, and then the target repair code can be fitted to the source code based on the fitting sequence to complete the repair of the source code and obtain the repaired source code.

[0075] Specifically, the source code structure of the source defect code is used to indicate the calling relationship between parameters and functions in the source defect code. Based on this calling relationship, the target repair code and the source code can be sequence fitted to determine the correct sequence of each parameter or function in the target repair code, thereby completing the program vulnerability repair and obtaining the repaired source code.

[0076] After the program vulnerability is fixed, the repaired source code can be simulated to test whether the vulnerability repair results are accurate.

[0077] This embodiment proposes a program vulnerability repair method. Based on the detection results of source code defects, historical repair code is collected. Target repair code for the source defect code is then generated based on this historical repair code. The target repair code is then sequence-fitted based on the source code structure, allowing it to be directly applied to the source code. This eliminates the need for manual vulnerability repair based on the target repair code, reducing the cost of manual intervention and improving the efficiency of code defect repair. Furthermore, the repaired source code is simulated and run to further verify and ensure the integrity of the program, further reducing the cost of manual program repair. This program vulnerability repair method solves the problems of traditional program repair processes being complex, requiring full manual intervention, and resulting in low accuracy and poor effectiveness.

[0078] Figure 3 yes Figure 2 The flowchart of step S210 in the illustrated embodiment is shown in an exemplary embodiment. Figure 3 As shown, in an exemplary embodiment, the process of obtaining historical repair code based on the source defect code obtained by defect detection of the source code and the detection result may include steps S310 to S370, which are described in detail below:

[0079] Step S310: Perform defect detection on the source code to obtain the detection results and the source defect code corresponding to the detection results.

[0080] In this embodiment, by using a code defect detection tool to detect defects in the source code, the detection results of defects in the source code and the source defect code corresponding to the detection results can be obtained.

[0081] Step S330: Based on the detection results, obtain the historical defect code corresponding to the source defect code and the repair code for the historical defect code.

[0082] Based on the detection results, multiple historical defect codes related to the detection results and the repair codes for each historical defect code can be obtained from open source websites. The historical defect codes can be source defect codes obtained when other source codes are detected for defects, and the repair codes for the historical defect codes are the repair codes used when finally fixing program vulnerabilities in the historical defect codes in the source code.

[0083] Step S350: Calculate the similarity between the historical defect code and the source defect code to obtain the similarity corresponding to each historical defect code.

[0084] In this embodiment, in order to increase the similarity between the repair code of the historical defect code and the repair code of the source defect code, the similarity between the historical defect code and the source defect code can be calculated first, so as to obtain the similarity value between each historical defect code and the source defect code.

[0085] Step S370: Use the repair code of historical defect code with a similarity greater than the preset similarity threshold as historical repair code.

[0086] Since subsequent fixes need to be generated from historical fixes to repair the source defect code, fixes from historical defect codes with high similarity are selected as historical fixes for subsequent program vulnerability repairs.

[0087] In this embodiment, the preset similarity threshold can be obtained through empirical parameters, and the number of historical repair codes can be multiple. When there are multiple historical repair codes, they are sorted from largest to smallest based on their similarity, and then processed sequentially based on different historical repair codes. Figure 2 The program vulnerability is shown in the diagram. After a program vulnerability is fixed, the fixed source code is simulated and run. If the source code does not report any errors, the program vulnerability can be fixed without using the next historical fixed code in the sort. If the simulated run still reports errors, the program vulnerability can be fixed based on the next historical fixed code in the sort.

[0088] In this embodiment, after collecting historical defective codes based on the detection results of the source code, the historical defective codes and the source defective codes are compared for similarity. This yields historical defective codes with high similarity, and the repair codes of these historical defective codes are used as historical repair codes. Based on these historical repair codes, program vulnerabilities can be repaired, which can greatly improve the accuracy of the repair.

[0089] Figure 4 yes Figure 2 The flowchart of step S230 in the illustrated embodiment is shown in an exemplary embodiment. Figure 4 As shown in an exemplary embodiment, the process of generating target repair code from source defect code based on the characteristics of historical repair code may include steps S410 to S450, which are described in detail below:

[0090] Step S410: Abstract the source defect code and the historical repair code respectively to obtain the abstract source defect code and the abstract historical repair code.

[0091] In this embodiment, due to different programmers writing code in different ways, functions and parameters with the same meaning may use different name identifiers, and functions and parameters with different identifiers will affect the subsequent processing of source defect code and historical repair code.

[0092] Therefore, in this embodiment, the source defect code and the historical repair code are abstracted to obtain abstract source defect code and abstract historical repair code. In the abstract source defect code and the abstract historical repair code, functions or parameters with the same meaning and function are regarded as the same abstract identifier.

[0093] Step S430: Based on the characteristics of the abstract historical repair code, translate the abstract source defect code into abstract repair code.

[0094] In this embodiment, after the source defect code and historical repair code are abstracted, the resulting abstract source defect code and abstract historical repair code can be input into NMT. ​​NMT then translates the abstract source defect code into abstract repair code based on the structural characteristics of the abstract historical repair code.

[0095] Step S450: De-abstract the abstract repair code to obtain the target repair code.

[0096] In this embodiment, since the functions and parameters in the abstract repair code output by NMT are all abstracted, the functions and parameters in the abstract repair code can be de-abstracted, that is, the function abstraction identifier or parameter abstraction identifier can be de-abstracted into the same name identifier as the corresponding function or parameter in the source defect code.

[0097] Specifically, when both function A in the source defect code and function AA in the historical repair code are summation functions, during the abstraction process, function A and function AA can be abstracted into a function labeled 'a'. That is, function 'a' in the abstract source defect code was originally described as function A, while function 'a' in the abstract historical repair code was originally described as function AA.

[0098] When performing de-abstraction, the function 'a' in the abstract repair code should be described as function A. By converting the abstract identifier in the abstract repair code into the corresponding identifier in the original defect code, the target repair code can be obtained.

[0099] In this embodiment, by abstracting the source defect code and the historical repair code, the similarity between the source defect code and the historical repair code is increased, the complexity of translating the abstract repair code is reduced, and the accuracy of translating the abstract repair code is improved. At the same time, the abstract repair code is de-abstracted, which reduces the difficulty of sequence fitting for the subsequent target repair code.

[0100] Figure 5 yesFigure 4 The flowchart of step S410 in the illustrated embodiment is shown in an exemplary embodiment. Figure 5 As shown, in an exemplary embodiment, the process of abstracting the source defect code and the historical repair code to obtain the abstract source defect code and the abstract historical repair code may include steps S510 to S530, which are described in detail below:

[0101] Step S510: Based on the detection results of the source defect code, obtain the source code structure related to the source defect code.

[0102] In this embodiment, after the code defect detection is completed, the source code structure related to the source defect code can be extracted based on the detection results, combined with the abstract syntax tree, program call graph and data dependency relationship.

[0103] It should be noted that this source code structure is only used to indicate the relationships between functions and parameters in the source defect code, such as calls and calculations, and not to indicate the name of a specific function or parameter in the source defect code.

[0104] For example, if function A calls function B to perform a summation operation, in the code structure, this represents the existence of a function calling another function to perform a summation operation. That is, the source code structure is only used to indicate the function logic and parameter logic in the source defect code, and is not limited to the specific names of functions and parameters in the source defect code. In this way, the source defect code and the functions or parameters of the historical repair code that are under the same relationship can be abstracted through the relationship between functions and parameters in the source code structure.

[0105] Step S530: Based on the source code structure, the functions and parameters of the source defect code and the functions and parameters of the historical repair code are abstracted to obtain the abstract source defect code and the abstract historical repair code.

[0106] In this embodiment, after obtaining the source code structure, the functions or parameters of the source defect code and the historical repair code located in the same position in the source code structure can be abstracted. The corresponding functions and parameters between the abstract source defect code and the abstract historical repair code are abstracted into the same identifier.

[0107] In this embodiment, based on the source code structure, the source defect code and historical repair code are abstracted to reduce the complexity of translating the abstract repair code using NMT, while improving the efficiency and accuracy of translating the abstract repair code.

[0108] Figure 6 yes Figure 4 The flowchart of step S430 in the illustrated embodiment is shown in an exemplary embodiment. Figure 6As shown in an exemplary embodiment, the process of translating abstract source defect code into abstract repair code based on the characteristics of abstract historical repair code may include steps S610 to S650, which are described in detail below:

[0109] Step S610: Encode the abstract source defect code to obtain a code vector composed of multiple word vectors.

[0110] In this embodiment, the generation of abstract repair code is completed in neural machine translation (NMT). The process of generating abstract repair code in neural machine translation can be found in [reference needed]. Figure 7 .

[0111] NMT includes an encoder and a decoder. First, the encoder encodes the abstract source defect code, thereby obtaining a code vector composed of multiple word vectors, namely the context word vector.

[0112] Step S630: Based on the attention mechanism, each word vector in the code vector is weighted to obtain a weighted code vector.

[0113] In this embodiment, an attention mechanism is added during the generation of abstract repair code in neural machine translation. The attention mechanism is used to weight each word vector in the code vector. Each word vector should correspond to a character in the abstract source defect code. In this way, a weighted code vector can be obtained, in which each word vector has its own weight value.

[0114] Step S650: Based on the character mapping in the abstract historical repair code, decode the weighted code vector to obtain the abstract repair code.

[0115] In the decoder, the weighted code vector is decoded based on the character mapping in the abstract historical repair code to obtain the abstract repair code. In this embodiment, since the historical defect code corresponding to the abstract historical repair code has a high similarity to the source defect code, the abstract repair code can be automatically generated through the abstract historical repair code without manual intervention. This provides reference code for subsequent automatic program vulnerability repair in the source code.

[0116] Figure 8 This is a flowchart illustrating a method for fixing program vulnerabilities according to another exemplary embodiment. For example... Figure 8 As shown, in an exemplary embodiment, the method is implemented after step S250, and may specifically include steps S810 to S850, which are described in detail below:

[0117] Step S810: Simulate and run the repaired source code to obtain the running results.

[0118] In this embodiment, the repaired source code is simulated and run to obtain the running results. These results can be used to detect the accuracy of the program vulnerability repair, and can also be fed back to NMT to train NMT and improve the accuracy of abstract repair code generation.

[0119] Step S830: If the running result reports an error, convert the objective function corresponding to the error report into a feature code.

[0120] In this embodiment, if the running result is normal, it proves that the program vulnerability repair is highly reliable. If the running result reports an error, the objective function corresponding to the error is converted into a feature code, and NMT is trained based on the feature code.

[0121] Specifically, if the repaired source code results in an error, such as an error occurring during the execution of a function, the target function corresponding to the error is converted into a feature code, and this feature code is fed back into the abstract repair code generation process, that is, into the encoder in NMT.

[0122] Step S850: When encoding the abstract source defect code, update the word vector corresponding to the target function based on the feature code.

[0123] refer to Figure 7 By introducing a feature code into NMT, this feature code can correspond to some word vectors in the abstract source defect code. If the feature code is obtained by the objective function, then the word vectors corresponding to the objective function in the abstract source defect code can be updated based on the feature code. For example, the weight of the corresponding word vector can be increased, so that NMT pays more attention to the processing of the word vector when generating the abstract repair code.

[0124] In this embodiment, by recursively updating the abstract source defect code step by step through the feature code during the decoding process, the traditional attention mechanism can be effectively supplemented, thereby enabling the decoder to better utilize the encoded information during the decoding process.

[0125] In this embodiment, during the feature code update process, the word vectors in the encoding stage are precisely updated by gradually fusing the decoding state. By directly fusing the encoding and decoding information, and utilizing the self-learning capability of NMT, a subtraction operation can be directly learned during the mapping process. This allows each update step to use the decoder state to subtract the abstract source defect code to be translated, which can better alleviate overtranslation and undertranslation problems and improve the accuracy and precision of abstract repair code generation.

[0126] Figure 9 This is a schematic diagram illustrating the structure of a program vulnerability repair device according to an exemplary embodiment. Figure 9 As shown, in one exemplary embodiment, the device includes:

[0127] The historical repair code acquisition module 910 is configured to acquire historical repair codes based on the source defect codes and detection results obtained from defect detection of the source code; wherein, the historical repair codes are the repair codes of the historical defect codes corresponding to the detection results;

[0128] The target repair code acquisition module 930 is configured to generate target repair codes for source defect codes based on the characteristics of historical repair codes.

[0129] The source code repair module 950 is configured to perform sequence fitting on the target repair code in the source code based on the source code structure of the source defect code, so as to obtain the repaired source code.

[0130] The program vulnerability repair device proposed in this embodiment can automatically repair program defects with high precision, and can ensure the integrity of the code and normal operation after the defect repair is completed.

[0131] In one embodiment, the historical repair code acquisition module includes:

[0132] The defect detection unit is configured to perform defect detection on the source code and obtain the detection results and the corresponding source defect code.

[0133] The historical defect code acquisition unit is configured to acquire historical defect codes corresponding to the source defect codes and their repair codes based on the detection results.

[0134] The similarity calculation unit is configured to calculate the similarity between historical defect codes and source defect codes, and obtain the similarity corresponding to each historical defect code.

[0135] The historical repair code acquisition unit is configured to use repair codes of historical defect codes with a similarity greater than a preset similarity threshold as historical repair codes.

[0136] In one embodiment, the target repair code acquisition module includes:

[0137] The abstraction unit is configured to abstract the source defect code and the historical repair code respectively, thereby obtaining the abstract source defect code and the abstract historical repair code.

[0138] The abstract fix code generation unit is configured to translate abstract source defect code into abstract fix code based on the characteristics of abstract historical fix code;

[0139] The de-abstraction unit is configured to de-abstract the abstract fix code to obtain the target fix code.

[0140] In one embodiment, the abstraction unit includes:

[0141] The source code structure acquisition module is configured to acquire the source code structure related to the source defect code based on the detection results of the source defect code.

[0142] The abstraction module is configured to abstract the functions and parameters of the source defect code and the functions and parameters of the historical repair code based on the source code structure, resulting in abstract source defect code and abstract historical repair code. The corresponding functions and parameters between the abstract source defect code and the abstract historical repair code are abstracted into the same identifier.

[0143] In one embodiment, the abstract repair code generation unit includes:

[0144] The encoding module is configured to encode the abstract source defect code, resulting in a code vector composed of multiple word vectors;

[0145] The weighted section is configured to perform weighted processing on each word vector in the code vector based on an attention mechanism to obtain a weighted code vector;

[0146] The decoding module is configured to decode the weighted code vector based on the character mapping in the abstract historical repair code to obtain the abstract repair code.

[0147] In one embodiment, the source code repair module includes:

[0148] The fitted sequence acquisition unit is configured to extract the relationship between each function and each parameter in the source code structure and confirm the fitted sequence of the target repair code in the source code;

[0149] The source code repair unit is configured to fit the target repair code to the source code based on the fitted sequence in order to complete the source code repair and obtain the repaired source code.

[0150] In one embodiment, the program vulnerability repair terminal further includes:

[0151] The simulation module is configured to simulate running the repaired source code and obtain the running results.

[0152] The feature code acquisition module is configured to convert the target function corresponding to the error in the running result into a feature code if the running result reports an error.

[0153] The feature code feedback module is configured to update the word vector corresponding to the target function based on the feature code when encoding the abstract source defect code.

[0154] It should be noted that the program vulnerability repair device provided in the above embodiments and the program vulnerability repair method provided in the above embodiments belong to the same concept. The specific way in which each module and unit performs operations has been described in detail in the method embodiments, and will not be repeated here.

[0155] Embodiments of this application also provide an electronic device, including: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the electronic device enables the program vulnerability repair method provided in the above embodiments.

[0156] Figure 10 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown.

[0157] It should be noted that, Figure 10 The computer system 1000 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0158] like Figure 10 As shown, the computer system 1000 includes a Central Processing Unit (CPU) 1001, which can perform various appropriate actions and processes, such as executing the methods described in the above embodiments, based on programs stored in Read-Only Memory (ROM) 1002 or programs loaded from Storage Unit 1008 into Random Access Memory (RAM) 1003. The RAM 1003 also stores various programs and data required for system operation. The CPU 1001, ROM 1002, and RAM 1003 are interconnected via a bus 1004. An Input / Output (I / O) interface 1005 is also connected to the bus 1004.

[0159] The following components are connected to I / O interface 1005: an input section 1006 including a keyboard, mouse, etc.; an output section 1007 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to I / O interface 1005 as needed. Removable media 1011, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 1010 as needed so that computer programs read from them can be installed into storage section 1008 as needed.

[0160] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1009, and / or installed from removable medium 1011. When the computer program is executed by central processing unit (CPU) 1001, it performs various functions defined in the system of this application.

[0161] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying a computer-readable computer program. The transmitted data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0162] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0163] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0164] Another aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned program vulnerability repair method. This computer-readable storage medium may be included in the electronic device described in the above embodiments, or it may exist independently and not assembled into the electronic device.

[0165] Another aspect of this application provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the program vulnerability repair methods provided in the various embodiments described above.

[0166] The above description is merely a preferred exemplary embodiment of this application and is not intended to limit the implementation of this application. Those skilled in the art can easily make corresponding modifications or alterations based on the main concept and spirit of this application. Therefore, the scope of protection of this application should be determined by the scope of protection claimed in the claims.

Claims

1. A method for patching program vulnerabilities, characterized in that, include: Based on the source defect code and detection results obtained from defect detection of the source code, historical repair code is obtained; wherein, the historical repair code is the repair code of the historical defect code corresponding to the detection results; Based on the characteristics of the historical repair code, the target repair code for the source defect code is generated; Based on the source code structure of the source defect code, the target repair code is sequence-fitted into the source code to obtain the repaired source code; The step of generating the target fix code for the source defect code based on the characteristics of the historical fix code includes: Based on the detection results of the source defect code, obtain the source code structure related to the source defect code; Based on the source code structure, the functions and parameters of the source defect code and the functions and parameters of the historical repair code are abstracted to obtain abstract source defect code and abstract historical repair code; wherein, the corresponding functions and corresponding parameters between the abstract source defect code and the abstract historical repair code are abstracted into the same identifier. The abstract source defect code is encoded to obtain a code vector composed of multiple word vectors; The word vectors in the code vector are weighted based on an attention mechanism to obtain a weighted code vector. Based on the character mapping in the abstract history repair code, the weighted code vector is decoded to obtain the abstract repair code; The abstract repair code is de-abstracted to obtain the target repair code.

2. The method according to claim 1, characterized in that, Based on the source defect code and detection results obtained from defect detection of the source code, historical repair code is obtained, including: Defect detection is performed on the source code to obtain the detection results and the corresponding source defect code. Based on the detection results, obtain the historical defect code corresponding to the source defect code and the repair code for the historical defect code; The similarity between the historical defect codes and the source defect codes is calculated to obtain the similarity corresponding to each historical defect code; Repair codes for historical defective codes with a similarity greater than a preset similarity threshold are used as the historical repair codes.

3. The method according to claim 1, characterized in that, The step of performing sequence fitting on the target repair code within the source code based on the source code structure of the source defect code to obtain the repaired source code includes: Extract the relationship between each function and each parameter in the source code structure, and confirm the fitted sequence of the target repair code in the source code; The target repair code is fitted to the source code based on the fitted sequence to complete the repair of the source code and obtain the repaired source code.

4. The method according to claim 1, characterized in that, The method further includes: The repaired source code was simulated and run to obtain the results. If the execution result is reported as an error, the objective function corresponding to the error result will be converted into a feature code. When encoding the abstract source defect code, the word vector corresponding to the target function is updated based on the feature code.

5. A program vulnerability repair terminal, characterized in that, include: The historical repair code acquisition module is configured to acquire historical repair codes based on the source defect code and the detection results obtained from defect detection of the source code; wherein, the historical repair code is the repair code of the historical defect code corresponding to the detection results; The target repair code acquisition module is configured to generate target repair code for the source defect code based on the characteristics of the historical repair code; The source code repair module is configured to perform sequence fitting on the target repair code in the source code according to the source code structure of the source defect code, so as to obtain the repaired source code; The target repair code acquisition module is further configured as follows: Based on the detection results of the source defect code, obtain the source code structure related to the source defect code; Based on the source code structure, the functions and parameters of the source defect code and the functions and parameters of the historical repair code are abstracted to obtain abstract source defect code and abstract historical repair code; wherein, the corresponding functions and corresponding parameters between the abstract source defect code and the abstract historical repair code are abstracted into the same identifier. The abstract source defect code is encoded to obtain a code vector composed of multiple word vectors; The word vectors in the code vector are weighted based on an attention mechanism to obtain a weighted code vector. Based on the character mapping in the abstract history repair code, the weighted code vector is decoded to obtain the abstract repair code; The abstract repair code is de-abstracted to obtain the target repair code.

6. An electronic device, characterized in that, include: One or more processors; A storage device for storing one or more computer programs that, when executed by the one or more processors, cause the electronic device to perform the method as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, It stores computer-readable instructions that, when executed by the processor of a computer, cause the computer to perform the method described in any one of claims 1-4.

Images