Software vulnerability identification method and device based on software gene and electronic equipment

Abstract

The application provides a software vulnerability identification method and device based on a software gene and electronic equipment, and relates to the technical field of network security, and comprises the following steps: obtaining sample software containing a target software vulnerability, and extracting a vulnerability code of the target software vulnerability in the sample software, wherein the target software vulnerability is any type of software vulnerability; converting the vulnerability code into a vulnerability gene, and generating an identification rule set of the vulnerability based on the vulnerability gene; after obtaining to-be-identified software, optimizing the identification rule set by using the to-be-identified software and a greedy algorithm to obtain a target identification rule set; if the to-be-identified software contains the target software vulnerability and the sample software does not include the to-be-identified software, adding the to-be-identified software to the sample software, and repeatedly executing the obtaining step, the generating step and the optimizing step, thereby solving the technical problem that the software vulnerability identification efficiency and accuracy of the prior art are low.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, and electronic device for identifying software vulnerabilities based on software genes. Background Technology

[0002] With the rapid development of internet technology, various cybersecurity issues are emerging one after another. In particular, the frequent exposure of software vulnerabilities provides malicious hackers with opportunities and convenience for attacks, causing huge economic losses to individuals and businesses. Therefore, the ability to quickly and accurately identify software vulnerabilities is of paramount importance for protecting people's property and building cybersecurity.

[0003] Current software vulnerability identification methods can be broadly categorized into the following types: vulnerability identification methods based on prior knowledge bases, vulnerability identification methods based on machine learning or deep learning, vulnerability identification methods based on dynamic attack testing, and vulnerability identification methods based on pseudocode features. However, these methods suffer from problems such as low accuracy, low efficiency, high cost, and poor universality.

[0004] No effective solution has yet been proposed to address the above problems. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a software vulnerability identification method, apparatus and electronic device based on software genes, so as to alleviate the technical problem of low efficiency and accuracy of software vulnerability identification in the prior art.

[0006] In a first aspect, embodiments of the present invention provide a software vulnerability identification method based on software genes, comprising: an acquisition step, acquiring sample software containing a target software vulnerability and extracting the vulnerability code of the target software vulnerability from the sample software, wherein the target software vulnerability is any type of software vulnerability; a generation step, converting the vulnerability code into a vulnerability gene and generating a vulnerability identification rule set based on the vulnerability gene; and an optimization step, after acquiring the software to be identified, optimizing the identification rule set using the software to be identified and a greedy algorithm to obtain a target identification rule set; if the software to be identified contains the target software vulnerability and the sample software does not include the software to be identified, then the software to be identified is added to the sample software, and the acquisition step, the generation step, and the optimization step are repeated.

[0007] Further, extracting the vulnerability code of the target software vulnerability from the sample software includes: performing a first preprocessing on the sample software to obtain a processed sample software, wherein the first preprocessing includes: decompression, unpacking, location, cleaning, and deduplication; performing vulnerability location on the sample software to determine the location information of the vulnerability code corresponding to the target software vulnerability; and extracting the vulnerability code of the target software vulnerability from the sample software based on the location information.

[0008] Further, converting the vulnerability code into a vulnerability gene includes: performing a second preprocessing on the vulnerability code to obtain target vulnerability code, wherein the second preprocessing includes: deduplication, sorting, and integration; converting the target vulnerability code into a standard format file; and using a software gene engine to parse the standard format file to obtain the vulnerability gene.

[0009] Further, generating a vulnerability identification rule set based on the vulnerability gene includes: performing a third preprocessing on the vulnerability gene to obtain an intermediate vulnerability gene, wherein the third preprocessing includes: reduction processing, sorting processing, and similarity integration processing; adding format data to the intermediate vulnerability gene to obtain a target vulnerability gene; and converting the target vulnerability gene into the identification rule set.

[0010] Further, the identification rule set is optimized using the software to be identified and a greedy algorithm to obtain a target identification rule set, including: using the identification rule set to perform vulnerability identification on the software to be identified, and determining the target software in the software to be identified, wherein the target software is the software to be identified that contains the vulnerability of the target software; determining the identification rate of each identification rule in the identification rule set, wherein the identification rate includes the correct identification rate and the incorrect identification rate; and optimizing the identification rule set based on the identification rate and the greedy algorithm to obtain the target identification rule set.

[0011] Further, based on the recognition rate and the greedy algorithm, the recognition rule set is optimized to obtain a target recognition rule set, including: ranking the recognition rules in the recognition rule set by importance based on the recognition rate to obtain a target sequence, wherein the target sequence contains the correct recognition rate and the incorrect recognition rate of each recognition rule; and determining the target recognition rule set based on the target sequence and the target software.

[0012] Further, based on the target sequence and the target software, the target identification rule set is determined, including: determining the target software corresponding to each identification rule in the identification rule set, wherein the corresponding target software is the software to be identified that contains the vulnerability of the target software, identified based on the identification rule; adding the first identification rule, which is the first position in the target sequence, to the initial rule set, and adding the target software corresponding to the first identification rule to the initial software set; sequentially determining the final software among the target software corresponding to each identification rule in the target sequence, wherein the final software is the software not included in the initial software set; adding the identification rule corresponding to the final software to the initial rule set, and adding the final software to the initial software set, until the initial software set completely contains the target software, and determining the initial rule set corresponding to when the initial software set completely contains the target software as the target identification rule set.

[0013] Secondly, embodiments of the present invention also provide a software vulnerability identification device based on software genes, comprising: an acquisition unit, configured to acquire sample software containing a target software vulnerability and extract the vulnerability code of the target software vulnerability from the sample software, wherein the target software vulnerability is any type of software vulnerability; a generation unit, configured to convert the vulnerability code into a vulnerability gene and generate a vulnerability identification rule set based on the vulnerability gene; an optimization unit, configured to optimize the identification rule set using the software to be identified and a greedy algorithm after acquiring the software to be identified, to obtain a target identification rule set; and an execution unit, configured to add the software to be identified to the sample software when the software to be identified contains the target software vulnerability and the sample software does not include the software to be identified, and to control the acquisition unit, the generation unit, and the optimization unit to work repeatedly.

[0014] Thirdly, embodiments of the present invention also provide an electronic device, including a memory and a processor, wherein the memory is used to store a program that supports the processor in executing the method described in the first aspect above, and the processor is configured to execute the program stored in the memory.

[0015] Fourthly, embodiments of the present invention also provide a computer-readable storage medium on which a computer program is stored.

[0016] In this embodiment of the invention, the acquisition step involves acquiring sample software containing the target software vulnerability and extracting the vulnerability code of the target software vulnerability from the sample software, wherein the target software vulnerability can be any type of software vulnerability; the generation step involves converting the vulnerability code into a vulnerability gene and generating a vulnerability identification rule set based on the vulnerability gene; the optimization step involves optimizing the identification rule set using the software to be identified and a greedy algorithm after acquiring the software to be identified, to obtain the target identification rule set; if the software to be identified contains the target software vulnerability but the sample software does not contain the software to be identified, then the software to be identified is added to the sample software, and the acquisition step, generation step, and optimization step are repeated, thereby achieving the goal of identifying software vulnerabilities using software genes, thus solving the technical problem of low efficiency and accuracy of software vulnerability identification in the prior art, and achieving the technical effect of efficient and accurate identification of software vulnerabilities.

[0017] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention are realized and obtained in accordance with the structures particularly pointed out in the description, claims and drawings.

[0018] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0019] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 A flowchart illustrating the software vulnerability identification method based on software genes provided in this embodiment of the invention;

[0021] Figure 2 A schematic diagram of a software vulnerability identification device based on software genes provided in an embodiment of the present invention;

[0022] Figure 3 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] Example 1:

[0025] According to an embodiment of the present invention, an embodiment of a software vulnerability identification method based on software genes is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0026] Figure 1 This is a flowchart of software vulnerability identification based on software genes according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0027] Step S 102, the acquisition step, acquires sample software containing the target software vulnerability, and extracts the vulnerability code of the target software vulnerability in the sample software, wherein the target software vulnerability is any type of software vulnerability;

[0028] Step S 104, generation step, converting the vulnerability code into a vulnerability gene, and generating a vulnerability identification rule set based on the vulnerability gene;

[0029] Step S 106, optimization step: After obtaining the software to be identified, the identification rule set is optimized using the software to be identified and a greedy algorithm to obtain the target identification rule set;

[0030] Step S 108: If the software to be identified contains the target software vulnerability and the sample software does not include the software to be identified, then the software to be identified is added to the sample software, and the acquisition step, the generation step, and the optimization step are repeated.

[0031] In this embodiment of the invention, the acquisition step involves acquiring sample software containing the target software vulnerability and extracting the vulnerability code of the target software vulnerability from the sample software, wherein the target software vulnerability can be any type of software vulnerability; the generation step involves converting the vulnerability code into a vulnerability gene and generating a vulnerability identification rule set based on the vulnerability gene; the optimization step involves optimizing the identification rule set using the software to be identified and a greedy algorithm after acquiring the software to be identified, to obtain the target identification rule set; if the software to be identified contains the target software vulnerability but the sample software does not contain the software to be identified, then the software to be identified is added to the sample software, and the acquisition step, generation step, and optimization step are repeated, thereby achieving the goal of identifying software vulnerabilities using software genes, thus solving the technical problem of low efficiency and accuracy of software vulnerability identification in the prior art, and achieving the technical effect of efficient and accurate identification of software vulnerabilities.

[0032] It should be noted that the above acquisition steps can obtain sample software with different types of vulnerabilities, and the above methods can be used to process each type of sample software.

[0033] In this embodiment of the invention, step S102 includes the following steps:

[0034] The sample software is subjected to a first preprocessing to obtain the processed sample software, wherein the first preprocessing includes: decompression, unpacking, positioning, cleaning and deduplication;

[0035] Vulnerability localization is performed on the sample software to determine the location information of the vulnerability code corresponding to the vulnerability in the target software;

[0036] Based on the location information, the vulnerability code of the target software vulnerability in the sample software is extracted.

[0037] In this embodiment of the invention, a brief preprocessing operation is performed on each original sample in the sample software, mainly including decompression, unpacking, localization, cleaning, and deduplication, to remove software samples from which the software genes cannot be extracted, thus preparing for subsequent extraction of vulnerability genes. The implementation process of the main preprocessing operations is as follows:

[0038] Decompression: Performs decompression operations on compressed samples;

[0039] Uncoating: Perform uncoating operation on the shelled sample;

[0040] Location: Locate the sample file that actually contains the vulnerability after decompression or unpacking;

[0041] Cleaning: Remove sample files from which the software's genes cannot be extracted;

[0042] Deduplication: Performs deduplication operations on the sample files.

[0043] The specific expression is as follows:

[0044] raw_train_samples=[raw_vulnerabilityl_samples,..., raw_vulnerabilityN_samples] (Formula 1)

[0045] raw_vulnerabilityN_samples=[raw_vulnerabilityN_sample1,..., raw_vulnerabilityN_sampleM] (Formula 2)

[0046] pretreat_train_samples=[pretreat_vulnerability1_samples,..., pretreat-vulnerabilityN_samples] (Formula 3)

[0047] pretreat_vulnerabilityN_samples=[pretreat_vulnerabilityN_sample1,..., pretreat_vulnerabilityN_sampleM′] (Formula 4)

[0048] Formula explanation:

[0049] When obtaining sample software with different types of software vulnerabilities in the acquisition step, raw_train_samples: represents all sample software;

[0050] raw_vulnerabilityN_samples: Represents all sample software for the Nth type of software vulnerability;

[0051] raw_vulnerabilityN_sampleM: Represents the Mth sample software of the Nth type of software vulnerability;

[0052] pretreat_train_samples: represents all the first preprocessed samples from the software;

[0053] pretreat_vulnerabilityN_samples: Represents all first-preprocessed sample software of the Nth type of software vulnerability;

[0054] pretreat_vulnerabilityN_sampleM′: Represents the first pre-processed sample software of the M'th type of vulnerability N.

[0055] In this embodiment of the invention, step S104 includes the following steps:

[0056] The vulnerability code is subjected to a second preprocessing step to obtain the target vulnerability code, wherein the second preprocessing step includes: deduplication, sorting, and integration;

[0057] Convert the target vulnerability code into a standard format file;

[0058] The vulnerability gene is obtained by parsing the standard format file using a software gene engine.

[0059] The vulnerability gene is subjected to a third preprocessing to obtain an intermediate vulnerability gene, wherein the third preprocessing includes: reduction processing, sorting processing and similar integration processing;

[0060] Add formatted data to the intermediate vulnerability gene to obtain the target vulnerability gene;

[0061] The target vulnerability gene is converted into the identification rule set.

[0062] In this embodiment of the invention, a big data-based vulnerability preprocessing platform automatically analyzes the causes of vulnerabilities in sample software, locates the code segments in the sample software that trigger the vulnerabilities, and constructs a vulnerability code library for the target software.

[0063] The specific expression is as follows:

[0064] ulnerability_codes_db=[vulnerability1_codes,..., vulnerabilityN_codes] (Formula 5)

[0065] vulnerabilityN_codes=[vulnerabilityN-code1,..., vulnerabilityN_codeM] (Formula 6)

[0066] Formula explanation:

[0067] vulnerability_codes_db: Represents a database of vulnerability codes;

[0068] vulnerabilityN_codes: Represents all vulnerability codes for the Nth type of software vulnerability;

[0069] vulnerabilityN_codeM: Represents the Mth vulnerability code of the Nth type of software vulnerability.

[0070] Next, the "vulnerable code-software gene" conversion algorithm is used to convert all the vulnerability code of the target software vulnerability into vulnerability genes or vulnerability gene sequences. This is because describing a vulnerability may require one vulnerability gene or a sequence of multiple vulnerability genes working together.

[0071] The implementation process of the "vulnerable code - software gene" conversion algorithm is as follows:

[0072] Obtain the complete collection of vulnerability codes for the target software from the vulnerability code repository;

[0073] The code snippet for the target software vulnerability is deduplicated, sorted, and integrated.

[0074] The processed vulnerability code is converted into a standard format file and input into the software gene engine;

[0075] The software gene engine is used to parse standard vulnerability code files and output software genes.

[0076] The output software genes are labeled as vulnerability gene sequences of the target software vulnerabilities.

[0077]

[0078] vulnerabilityN_genes=[vulnerabilityN_gene1,..., vulnerabilityN_geneM] (Formula 8)

[0079] vulnerability_genes_db=[vulnerability1_genes,..., vulnerabilityN_genes] (Formula 9)

[0080] Formula explanation:

[0081] vulnerabilityN_codes: Represents the complete set of vulnerability codes for the Nth type of software vulnerability;

[0082] vulnerabilityN_genes: Represents the complete set of vulnerability genes for the Nth type of software vulnerability;

[0083] vulnerabilityN_geneM: Represents the Mth vulnerability gene of the Nth type of software vulnerability;

[0084] vulnerability-genes_db: Represents the vulnerability gene database.

[0085] Finally, the "software gene-recognition rule" conversion algorithm is used to convert the extracted vulnerability gene of this type of vulnerability into recognition rules in a special format. These binary recognition rules can be used to quickly scan massive amounts of unknown samples.

[0086] The implementation process of the "software gene-recognition rule" conversion algorithm is as follows:

[0087] Obtain the complete set of vulnerability genes for the target software from the vulnerability gene library;

[0088] Reduce all vulnerability genes of the target software vulnerability according to specified conditions;

[0089] The vulnerability gene data after reduction is sorted by length and integrated based on similarity.

[0090] Add formatted data such as references, descriptions, and conditions to the integrated data according to different scanning methods;

[0091] The processed data is exported to a specified rule file for use by the scanning engine.

[0092] vulnerabilityN_rules=[vulnerabilityN_rule1,..., vulnerabilityN_ruleM] (Formula 10)

[0093] Formula explanation:

[0094] vulnerabilityN_rules: Represents the set of rules for identifying the Nth type of software vulnerability;

[0095] vulnerabilityN_ruleM: Represents the Mth identification rule for the Nth type of software vulnerability;

[0096] It should be noted that one identification rule corresponds to a vulnerability gene or a sequence of vulnerability genes. Each vulnerability identification rule has a different identification ID (which can be understood as the Nth way to trigger the target software vulnerability), such as rule_SQLINJECT_01. The generated identification rules are ultimately input into the sample scanning engine, so they need to be converted into a special format rule file. This involves defining the rule format, scanning conditions, external variables, inclusion relationships, and formatting the rule file, adding a file header (magic, file format, version number, copyright, license, etc.), and finally compressing the rule file.

[0097] In this embodiment of the invention, step S106 includes the following steps:

[0098] Using the identification rule set, vulnerability identification is performed on the software to be identified, and the target software in the software to be identified is determined, wherein the target software is the software to be identified that contains the vulnerability of the target software;

[0099] The recognition rate of each recognition rule in the recognition rule set is determined, wherein the recognition rate includes the correct recognition rate and the incorrect recognition rate;

[0100] Based on the recognition rate and the greedy algorithm, the recognition rule set is optimized to obtain the target recognition rule set.

[0101] Specifically, based on the recognition rate and the greedy algorithm, the recognition rule set is optimized to obtain the target recognition rule set, including:

[0102] Based on the recognition rate, the recognition rules in the recognition rule set are ranked by importance to obtain a target sequence, wherein the target sequence contains the correct recognition rate and the incorrect recognition rate of each recognition rule;

[0103] Based on the target sequence and the target software, the target identification rule set is determined.

[0104] Specifically, based on the target sequence and the target software, the target identification rule set is determined, including:

[0105] The target software corresponding to each identification rule in the identification rule set is determined, wherein the corresponding target software is the software to be identified that contains the vulnerability of the target software based on the identification rule;

[0106] Add the first identification rule that is the first element in the target sequence to the initial rule set, and add the target software corresponding to the first identification rule to the initial software set;

[0107] The final software in the target software corresponding to each identification rule in the target sequence is determined sequentially, wherein the final software is software not included in the initial software set;

[0108] The identification rules corresponding to the final software are added to the initial rule set, and the final software is added to the initial software set until the initial software set completely contains the target software. The initial rule set corresponding to the initial software set completely containing the target software is determined as the target identification rule set.

[0109] In this embodiment of the invention, the extracted identification rules are used to scan a large number of unknown samples (i.e., software to be identified) and quickly provide the scanning results, thereby determining whether the software to be identified contains the type of vulnerability.

[0110] unknown_samples=[sample1, sample2,..., sampleX] (Formula 11)

[0111] predict_results=[sample1_vulnerabilityN_rule1,...,sampleX_vulnerabilityN_ruleM] (Formula 12)

[0112] Formula explanation:

[0113] unknown_samples: indicates the software to be identified;

[0114] sampleX: represents the Xth software to be identified;

[0115] predict_results: Represents the scan results of the recognition rules.

[0116] sampleX_vulnerabilityN_ruleM: This indicates that the Xth piece of software to be identified has hit the Mth rule of the target software vulnerability.

[0117] A big data-based vulnerability preprocessing platform is used to verify the vulnerabilities of samples detected in the scan results and to analyze whether the vulnerability labels given in the scan results are correct.

[0118] acture_results=[sample1_vulnerability1,...,sampleX_vulnerabilityN] (Formula 13)

[0119] Formula explanation:

[0120] acture_results: Represents the actual results analyzed by the big data-based vulnerability preprocessing platform;

[0121] sampleX_vulnerabilityN: indicates that the Xth unknown sample actually belongs to the Nth type of software vulnerability.

[0122] Finally, based on the above analysis results, the number of correct and incorrect samples for each recognition rule are counted; a greedy algorithm is used to extract recognition rules with "low error rate and high accuracy" as the target recognition rule set. In each iteration, the extracted target recognition rules are output according to the agreed format.

[0123] The process of extracting target recognition rules using a greedy algorithm is as follows:

[0124] Define a sample set (i.e., the initial software set) to record the training samples that the target rule can recognize; and define a rule set (i.e., the initial rule set) to store the target rule.

[0125] Based on the analysis results, the number of correct samples and the number of incorrect samples matched for each recognition rule are counted.

[0126] The recognition rules are ranked by importance based on "low error rate and high accuracy rate";

[0127] The recognition rules are selected in descending order of importance. It is then determined whether all the training samples identified by each rule are already included in the sample set. If so, it means that the recognition capability of the rule has been fully covered by the previously selected rules, and the rule is skipped. If not, it means that the previously selected recognition rules have not fully covered the recognition capability of the rule, and the rule needs to be added to the rule set and the training samples identified by the rule are added to the sample set.

[0128] Repeat the above steps until enough recognition rules are selected to completely cover all target software. The resulting set of recognition rules is the target recognition rule set.

[0129] vulnerabilityN_rules_count=[(vulnerabilityN_rule1, right, wrong),..., (vulnerabilityN_ruleM, right, wrong)] (Formula 14)

[0130] best_vulnerabilityN_rules=[best_vulnerabilityN_rule1,...,best_vulnerabilityN_ruleM] (Formula 15)

[0131] Formula explanation:

[0132] vulnerabilityN_rules_count: Represents the count of correct and incorrect identification results for each rule of the Nth type of software vulnerability;

[0133] (vulnerabilityN_rule1, right, wrong): represents a triple (the first rule of the Nth software vulnerability, the number of correct rules, and the number of incorrect rules);

[0134] best_vulnerabilityN_rules: Represents the set of target identification rules for the Nth type of software vulnerability;

[0135] best_vulnerabilityN_ruleM: Represents the Mth rule in the set of rules for identifying the Nth type of software vulnerability.

[0136] If the target identification rule discovers a new target software vulnerability sample (i.e., the software to be identified contains the target software vulnerability but the sample software does not include the software to be identified), the new vulnerability sample is added to the sample software. Then, with the help of big data and artificial intelligence algorithms, the above acquisition, generation and optimization steps are repeated for iterative training, and finally the optimal identification rule set is generated. The identification effect of the optimal identification rule set is verified in a massive sample library.

[0137] raw_vulnerabilityN_samples′=[raw_vulnerabilityN_sample1,..., raw_vulnerabilityN_sampleM, new_vulnerabilityN_sample1,...new_vulnerabilityN_sampleX] (Formula 16)

[0138] Formula explanation:

[0139] raw_vulnerabilityN_samples′: Represents the updated sample software for the Nth type of software vulnerability;

[0140] raw_vulnerabilityN_sampleM: Represents the Mth sample software of the Nth type of software vulnerability;

[0141] new_vulnerabilityN_sampleX: Represents the Xth newly added target software vulnerability sample of the Nth type of software vulnerability.

[0142] Software vulnerabilities often arise from sloppy coding, such as calling functions or code containing vulnerabilities. These vulnerable functions or code often lack internal security checks, leading to various vulnerability risks in the caller's program. In this invention, a software gene is a binary segment within the software body that possesses functionality or carries information, achieving a unity of materiality and informationality and exhibiting consistent execution characteristics. By collecting and analyzing a large amount of vulnerable software, a massive vulnerability code library is constructed. Converting vulnerable code into software genes and labeling them as vulnerability genes can effectively describe the causes of software vulnerabilities. Furthermore, combining multiple vulnerability genes to form vulnerability gene sequences allows for the rapid and accurate identification of numerous similar vulnerability samples.

[0143] Since the vulnerability genes of this type of vulnerability software are not unique, and the contribution of each vulnerability gene to triggering the vulnerability is different, this invention proposes a method for iteratively generating optimal identification rules for vulnerabilities using a self-feedback learning algorithm: using a greedy algorithm to extract the vulnerability gene sequence of this type of vulnerability, continuously selecting the optimal vulnerability gene, updating the vulnerability genome of this type of vulnerability, and gradually generating the optimal set of identification rules, so as to achieve the goal of covering the most samples of this type of vulnerability with the fewest identification rules.

[0144] In summary, the embodiments of this invention propose a software vulnerability identification method based on software genes: it simplifies the complexity of traditional methods, shortens training time, reduces the size of the identification rule set, improves identification accuracy, expands application scenarios, and greatly promotes the development of software vulnerability identification technology.

[0145] Example 2:

[0146] This invention also provides a software vulnerability identification device based on software genes. This software vulnerability identification device based on software genes is used to execute the software vulnerability identification method based on software genes provided in the above-described embodiments of this invention. The following is a detailed description of the device provided in the embodiments of this invention.

[0147] like Figure 2 As shown, Figure 2 This is a schematic diagram of the software vulnerability identification device based on software genes, which includes:

[0148] The acquisition unit 10 is used to acquire sample software containing the target software vulnerability and extract the vulnerability code of the target software vulnerability from the sample software, wherein the target software vulnerability is any type of software vulnerability;

[0149] The generation unit 20 is used to convert the vulnerability code into a vulnerability gene and generate a vulnerability identification rule set based on the vulnerability gene;

[0150] The optimization unit 30 is used to optimize the identification rule set using the software to be identified and a greedy algorithm after obtaining the software to be identified, so as to obtain the target identification rule set.

[0151] The execution unit 40 is configured to add the software to be identified to the sample software when the software to be identified contains the vulnerability of the target software and the software to be identified is not included in the sample software, and to control the acquisition unit, the generation unit and the optimization unit to work repeatedly.

[0152] In this embodiment of the invention, the acquisition step involves acquiring sample software containing the target software vulnerability and extracting the vulnerability code of the target software vulnerability from the sample software, wherein the target software vulnerability can be any type of software vulnerability; the generation step involves converting the vulnerability code into a vulnerability gene and generating a vulnerability identification rule set based on the vulnerability gene; the optimization step involves optimizing the identification rule set using the software to be identified and a greedy algorithm after acquiring the software to be identified, to obtain the target identification rule set; if the software to be identified contains the target software vulnerability but the sample software does not contain the software to be identified, then the software to be identified is added to the sample software, and the acquisition step, generation step, and optimization step are repeated, thereby achieving the goal of identifying software vulnerabilities using software genes, thus solving the technical problem of low efficiency and accuracy of software vulnerability identification in the prior art, and achieving the technical effect of efficient and accurate identification of software vulnerabilities.

[0153] Example 3:

[0154] This invention also provides an electronic device, including a memory and a processor. The memory is used to store a program that supports the processor in executing the method described in Embodiment 1 above, and the processor is configured to execute the program stored in the memory.

[0155] See Figure 3 The present invention also provides an electronic device 100, including: a processor 50, a memory 51, a bus 52 and a communication interface 53, wherein the processor 50, the communication interface 53 and the memory 51 are connected through the bus 52; the processor 50 is used to execute executable modules, such as computer programs, stored in the memory 51.

[0156] The memory 51 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one communication interface 53 (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc.

[0157] Bus 52 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 3 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0158] The memory 51 is used to store programs. After receiving an execution instruction, the processor 50 executes the programs. The method executed by the device for defining the flow process disclosed in any of the foregoing embodiments of the present invention can be applied to the processor 50 or implemented by the processor 50.

[0159] Processor 50 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of processor 50 or by software instructions. Processor 50 can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this invention can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 51. The processor 50 reads the information in memory 51 and, in conjunction with its hardware, completes the steps of the above method.

[0160] Example 4:

[0161] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the method described in Embodiment 1 above.

[0162] Furthermore, in the description of the embodiments of the present invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in the present invention based on the specific circumstances.

[0163] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0164] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the shown or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0165] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0166] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0167] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A software vulnerability identification method based on software genes, characterized in that, include: The acquisition steps involve acquiring sample software containing the target software vulnerability and extracting the vulnerability code of the target software vulnerability from the sample software, wherein the target software vulnerability is any type of software vulnerability; the vulnerability preprocessing platform based on big data automatically analyzes the cause of the vulnerability in the sample software, locates the code segment in the sample software that triggers the vulnerability, and constructs a vulnerability code library of the target software vulnerability; The generation step involves converting the vulnerability code into a vulnerability gene and generating a vulnerability identification rule set based on the vulnerability gene. Converting the vulnerability code into a vulnerability gene includes: performing a second preprocessing on the vulnerability code to obtain target vulnerability code, wherein the second preprocessing includes: deduplication, sorting, and integration; converting the target vulnerability code into a standard format file; and using a software gene engine to parse the standard format file to obtain the vulnerability gene. The optimization steps involve, after obtaining the software to be identified, optimizing the identification rule set using the software to be identified and a greedy algorithm to obtain a target identification rule set. Specifically, this includes: using the identification rule set to identify vulnerabilities in the software to be identified and determining the target software in the software to be identified, wherein the target software is the software to be identified that contains the vulnerability of the target software. The recognition rate of each recognition rule in the recognition rule set is determined, wherein the recognition rate includes the correct recognition rate and the incorrect recognition rate; Based on the recognition rate, the recognition rules in the recognition rule set are ranked by importance to obtain a target sequence, wherein the target sequence contains the correct recognition rate and the incorrect recognition rate of each recognition rule; the target software corresponding to each recognition rule in the recognition rule set is determined, wherein the corresponding target software is the software to be identified that contains the vulnerability of the target software based on the recognition rule; Add the first identification rule that is the first element in the target sequence to the initial rule set, and add the target software corresponding to the first identification rule to the initial software set; The final software in the target software corresponding to each identification rule in the target sequence is determined sequentially, wherein the final software is software not included in the initial software set; The identification rules corresponding to the final software are added to the initial rule set, and the final software is added to the initial software set until the initial software set completely contains the target software. The initial rule set corresponding to when the initial software set completely contains the target software is determined as the target identification rule set. The method further includes optimizing the identification rule set using the software to be identified and a greedy algorithm to obtain a target identification rule set. This includes: extracting the vulnerability gene sequence of the target software vulnerability using a greedy algorithm, updating the vulnerability genome of the target software vulnerability by continuously selecting the optimal vulnerability gene, and gradually generating an optimal identification rule set to obtain the target identification rule set; and using a big data-based vulnerability preprocessing platform to verify the vulnerabilities of the samples hit in the scan results and analyzing whether the vulnerability labels given by the scan results are correct. If the software to be identified contains the vulnerability of the target software and the software to be identified is not included in the sample software, then the software to be identified is added to the sample software, and the acquisition step, the generation step and the optimization step are repeated.

2. The method according to claim 1, characterized in that, Extract the vulnerability code of the target software vulnerability from the sample software, including: The sample software is subjected to a first preprocessing to obtain the processed sample software, wherein the first preprocessing includes: decompression, unpacking, positioning, cleaning and deduplication; Vulnerability localization is performed on the sample software to determine the location information of the vulnerability code corresponding to the vulnerability in the target software; Based on the location information, the vulnerability code of the target software vulnerability in the sample software is extracted.

3. The method according to claim 1, characterized in that, A set of vulnerability identification rules is generated based on the aforementioned vulnerability genes, including: The vulnerability gene is subjected to a third preprocessing to obtain an intermediate vulnerability gene, wherein the third preprocessing includes: reduction processing, sorting processing and similar integration processing; Add formatted data to the intermediate vulnerability gene to obtain the target vulnerability gene; The target vulnerability gene is converted into the identification rule set.

4. A software vulnerability identification device based on software genes, characterized in that, include: The acquisition unit is used to acquire sample software containing target software vulnerabilities and extract the vulnerability code of the target software vulnerabilities from the sample software, wherein the target software vulnerabilities are any type of software vulnerabilities; the vulnerability preprocessing platform based on big data automatically analyzes the causes of vulnerabilities in the sample software, locates the code segments in the sample software that trigger the vulnerabilities, and constructs a vulnerability code library of the target software vulnerabilities; A generation unit is configured to convert the vulnerability code into a vulnerability gene and generate a vulnerability identification rule set based on the vulnerability gene; converting the vulnerability code into a vulnerability gene includes: performing a second preprocessing on the vulnerability code to obtain target vulnerability code, wherein the second preprocessing includes: deduplication, sorting, and integration; converting the target vulnerability code into a standard format file; and using a software gene engine to parse the standard format file to obtain the vulnerability gene; The optimization unit is used to optimize the identification rule set using the software to be identified and a greedy algorithm after obtaining the software to be identified, to obtain a target identification rule set. Specifically, it includes: using the identification rule set to identify vulnerabilities in the software to be identified, and determining the target software in the software to be identified, wherein the target software is the software to be identified that contains the vulnerability of the target software. The recognition rate of each recognition rule in the recognition rule set is determined, wherein the recognition rate includes the correct recognition rate and the incorrect recognition rate; Based on the recognition rate, the recognition rules in the recognition rule set are ranked by importance to obtain a target sequence, wherein the target sequence contains the correct recognition rate and the incorrect recognition rate of each recognition rule; the target software corresponding to each recognition rule in the recognition rule set is determined, wherein the corresponding target software is the software to be identified that contains the vulnerability of the target software based on the recognition rule; Add the first identification rule that is the first element in the target sequence to the initial rule set, and add the target software corresponding to the first identification rule to the initial software set; The final software in the target software corresponding to each identification rule in the target sequence is determined sequentially, wherein the final software is software not included in the initial software set; The identification rules corresponding to the final software are added to the initial rule set, and the final software is added to the initial software set until the initial software set completely contains the target software. The initial rule set corresponding to when the initial software set completely contains the target software is determined as the target identification rule set. The method further includes optimizing the identification rule set using the software to be identified and a greedy algorithm to obtain a target identification rule set. This includes: extracting the vulnerability gene sequence of the target software vulnerability using a greedy algorithm, updating the vulnerability genome of the target software vulnerability by continuously selecting the optimal vulnerability gene, and gradually generating an optimal identification rule set to obtain the target identification rule set; and using a big data-based vulnerability preprocessing platform to verify the vulnerabilities of the samples hit in the scan results and analyzing whether the vulnerability labels given by the scan results are correct. An execution unit is configured to add the software to be identified to the sample software when the software to be identified contains the vulnerability of the target software and the software to be identified is not included in the sample software, and to control the acquisition unit, the generation unit and the optimization unit to work repeatedly.

5. An electronic device, characterized in that, The device includes a memory and a processor, the memory being used to store a program that enables the processor to execute the method of any one of claims 1 to 3, and the processor being configured to execute the program stored in the memory.

6. A computer-readable storage medium storing a computer program thereon, characterized in that, When a computer program is run by a processor, it performs the steps of the method described in any one of claims 1 to 3.

Images