Vulnerability Detection Method and System Based on Neural Network and Expert Rules

Abstract

This invention relates to a vulnerability detection method based on a combination of neural networks and expert rules, comprising: Step 1, converting source code into code fragments using expert rules and code execution trees, and then extracting execution logic features using BiLSTM; Step 2, extracting control operations and data operation semantics from the code fragments in Step 1, and constructing operation graph features using 1D-CNN; Step 3, combining the two features from Step 1 and Step 2 for combined detection. Corresponding to this method, this invention also provides a vulnerability detection system based on a combination of neural networks and expert rules, including a feature extraction and detection module based on expert rules and a BiLSTM model, a vulnerability feature extraction and detection module based on code operation semantics and a CNN model, and a vulnerability detection module based on two-dimensional feature fusion. This invention significantly improves the detection performance and scenario adaptability robustness in both smart contract and software security scenarios.

Description

Technical Field

[0001] This invention belongs to the field of network information security technology, and relates to the construction of static code vulnerability databases and deep learning feature engineering and vulnerability detection technology. In particular, it relates to a detection system that extracts personalized vulnerability pattern features based on code execution logic and expert rules, and combines expert rules and statistical rules. Background Technology

[0002] During the development of the internet, a large number of software programs are produced every year, bringing with them a multitude of security vulnerabilities. These vulnerabilities are often overlooked by developers and appear insidiously, such as zero-day vulnerabilities, buffer overflow vulnerabilities, and stack overflow vulnerabilities. Software vulnerabilities cause serious harm and incalculable losses to social stability, the economy, and the personal interests of citizens.

[0003] As cyberattack methods become increasingly sophisticated, many attacks no longer exploit a single vulnerability, but rather multiple vulnerabilities. However, the emergence of vulnerabilities is unpredictable, making vulnerability detection a worthy area of ​​research.

[0004] Initially, the most popular method was vulnerability detection based on manually defined patterns, but this approach had many limitations. For example, basic symbolic execution vulnerability detection was costly and unsuitable for large programs; rule-based vulnerability detection relied heavily on subjectively defined vulnerability rules by experts, which led to a relatively high false positive rate. The emergence of manually defined pattern detection technology propelled the development of the vulnerability detection field, but also introduced relatively cumbersome work. Therefore, finding a more convenient and accurate detection method became the next goal.

[0005] Therefore, machine learning has been proposed as a viable method for building tools and models to identify common software vulnerabilities. It works by first learning potential patterns that reveal vulnerabilities in programs from training samples. The machine learning model can then be applied to new software projects to identify potentially vulnerable code that resembles the patterns of those vulnerable samples in the training data. There is now sufficient evidence to suggest that machine learning techniques can outperform expert rules in detecting common code vulnerabilities or bugs. This solution reduces the workload for experts, as they only need to roughly define the characteristics of the machine learning-based model they are learning, rather than manually defining vulnerability patterns.

[0006] However, compared to traditional machine learning techniques, researchers have begun using deep learning to detect vulnerabilities. Traditional machine learning for vulnerability detection still requires experts to define features, which largely depends on their experience, expertise, and depth of domain knowledge. With deep learning, code snippets can be directly used for learning without manually extracting features, thus freeing experts from time-consuming and potentially error-prone feature engineering tasks.

[0007] While deep learning can reduce expert intervention, alleviate some manual costs, and increase the likelihood of detecting potential vulnerabilities, it still has unresolved weaknesses. First, expert rule-based vulnerability detection often results in false negatives, although it is relatively direct and accurate in filtering vulnerabilities. Known and classic vulnerabilities may not be detected as accurately as expert rule-based methods. Second, single deep learning vulnerability detection methods are data-driven, and the results are greatly influenced by the training data, leading to inadequate samples or poor performance on known vulnerabilities with unclear features. Therefore, in advancing vulnerability discovery and efficient vulnerability detection, it is worthwhile to explore how to automatically supplement and construct expert rules from existing datasets, combining the direct accuracy of expert rules with the automation and discovery of potential patterns in deep learning, to achieve rapid model convergence and better detection results with a small number of training epochs. Summary of the Invention

[0008] The technical problem to be solved by this invention is to provide a vulnerability detection method and system based on the combination of neural networks and expert rules. This method addresses the problems of information loss, low detection accuracy, and poor scalability caused by the inability to utilize program structure semantics when extracting features manually. It also addresses the problems of existing vulnerability detection technologies based on deep learning models, which have limited recognition capabilities and are difficult for network administrators to trust and understand because feature construction depends on training data and black-box characteristics.

[0009] The technical solution of this invention to solve the above-mentioned technical problems is as follows: a method for combining neural networks and expert rules for vulnerability detection, comprising:

[0010] Step 1: Extract code snippets from the source code using expert rules, and convert them into a code execution tree to extract execution logic. Use identifiable sequences as input to build a neural network model and output fusionable result features.

[0011] Step 2: Extract control operation and data operation semantics from the code snippet in Step 1, construct operation graph features, and based on the characteristics of statistical information, highlight and filter the structured features of key node information, construct a neural network model, and output fusionable result features.

[0012] Step 3: Combine the two features from Step 1 and Step 2 for combined detection, and use the test dataset for quantitative evaluation.

[0013] Furthermore, the process in step 1 of extracting code fragments from the source code using expert rules, converting them into a code execution tree to extract execution logic, using identifiable sequences as input, constructing a neural network model, and outputting fusionable result features specifically includes:

[0014] Step 11: Extract code snippets using expert rules;

[0015] Step 12: Extract the execution tree of the code snippet;

[0016] Step 13: Define the operation command dictionary using the language library and assign numerical values ​​to the commands;

[0017] Step 14: Traverse the root node of the tree to obtain the execution logic, path, and corresponding label;

[0018] Step 15: Construct a sequence-based neural network;

[0019] Step 15: Train the neural network constructed in step 15 using the execution logic and path from step 14.

[0020] Step 16: Output the neural network connection layer results.

[0021] Furthermore, step 2, which involves extracting control and data operation semantics from the code snippet in step 1, constructing operation graph features, highlighting and filtering key node information structured features based on the characteristics of statistical information, constructing a neural network model, and outputting fusionable result features, specifically includes:

[0022] Step 21: Construct different types of operation or call initiation nodes according to expert rules;

[0023] Step 22: Extract the semantic associations and operation sequences of different node types;

[0024] Step 23: Construct features by combining nodes and relationships;

[0025] Step 24: Based on the importance and correlation of statistical node types, filter key nodes;

[0026] Step 25: Merge and normalize the filtered nodes to obtain the structured operation graph features;

[0027] Step 26: Construct a 1D-CNN neural network.

[0028] Step 27: Use the 25 structured operation graph features to train the 26 neural networks.

[0029] Output the results of the neural network connection layers.

[0030] Furthermore, step 3, which combines the two features from steps 1 and 2 for combined detection and uses a test dataset for quantitative evaluation, specifically includes:

[0031] Step 31: Combine the expert rule execution logic features and operation diagram features;

[0032] Step 32: Pass the results to the feedforward neural network to obtain the detection results;

[0033] Step 33: Evaluate using the labels of the test set.

[0034] Based on the above method, the technical solution of the present invention also includes a vulnerability detection method and system based on neural networks and expert rule structures, comprising:

[0035] The feature extraction and detection module based on expert rules and BiLSTM model is used to extract code fragments from source code using expert rules, and convert them into code execution trees to extract execution logic. It uses identifiable sequences as input to build a neural network model and outputs fusionable result features.

[0036] The vulnerability feature extraction and detection module based on code operation semantics and CNN model is used to construct operation graph features, and based on the characteristics of statistical information, it highlights and filters the structured features of key node information, constructs a neural network model, and outputs fusionable result features.

[0037] The vulnerability detection module based on dual-dimensional feature fusion is used to combine expert rule execution logic features and code semantic operation graph features for combined detection.

[0038] Furthermore, the vulnerability feature extraction and detection module based on expert rules and sequence models includes:

[0039] The execution logic feature generation module is used to extract source code fragments from expert rules and construct sequence model features.

[0040] The BiLSTM neural network training and detection module is used to adjust and improve the optimal parameter configuration of the sequence model and train the model.

[0041] The structured operation graph feature generation module is used to construct node and association semantics and operation order using expert rules, and to generate structured operation graph features based on statistical characteristics.

[0042] The 1D-CNN neural network training and detection module is used to improve the optimal parameter configuration of CNN neural network models through experiments and to train the model.

[0043] Furthermore, the vulnerability detection module based on dual-dimensional feature fusion includes:

[0044] The dual-dimensional feature fusion module is used to combine the features of expert rule execution logic with the features of code semantic operation graph results.

[0045] The vulnerability detection and evaluation module is used for processing and outputting the characteristics of the fusion results.

[0046] The beneficial effects of this invention are:

[0047] I. This invention utilizes expert rules to segment and extract code snippets, automatically constructing the required features from the code snippets. This effectively reduces the complexity and overhead of traditional manual feature extraction and increases scalability.

[0048] Second, this invention constructs features from two dimensions, taking into account both the execution logic and sequential relationship of the code, as well as the endogenous relationship in different types of operation flows. Furthermore, by combining the two features through the result hidden layer, the reduction in model accuracy caused by information loss is reduced.

[0049] Third, this invention integrates the feature extraction method of expert rules with the black-box detection capability of neural networks. Expert rules provide the true and specific semantic meaning of code operations and execution in the feature extraction method, thereby helping the neural network make decisions on code anomalies and vulnerabilities. Practice has proven that the system has a high detection accuracy and recall rate. Attached Figure Description

[0050] Figure 1 This is a flowchart illustrating the vulnerability detection method based on neural networks and expert rules as described in this invention.

[0051] Figure 2 This is a flowchart illustrating the process of using expert rules to extract execution logic from code snippets and train output result features in Embodiment 1 of the present invention.

[0052] Figure 3 This is a schematic diagram of the process of extracting control operation and data operation semantics, constructing operation graph features, and training output result features in Embodiment 1 of the present invention.

[0053] Figure 4 This is a schematic diagram of the process of combining execution logic features and operation graph features and performing quantitative evaluation using a test dataset in Embodiment 1 of the present invention. Detailed Implementation

[0054] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0055] Example 1

[0056] like Figure 1 As shown, Example 1 is a vulnerability detection method based on a combination of neural networks and expert rules. This method consists of three steps: extracting code snippets and constructing execution logic features, extracting related semantics and constructing structured operation graph features, and fusing dual-dimensional features for combined detection. The specific details are described below:

[0057] Step 1: Extract code snippets from the source code using expert rules, and convert them into a code execution tree to extract execution logic. Use identifiable sequences as input to build a neural network model and output fusionable result features.

[0058] Step 2: Extract control and data operation semantics from the code snippets in Step 1, construct operation graph features, and based on the characteristics of statistical information, highlight and filter the structured features of key node information, construct a neural network model, and output fusionable result features.

[0059] Step 3: Combine the two features from Step 1 and Step 2 for combined detection, and use the test dataset for quantitative evaluation.

[0060] like Figure 2 As shown, the source code is extracted using expert rules, and the execution logic is extracted from the code execution tree. A neural network model is constructed using a recognizable sequence as input, and the specific content of the output fusionable result features is described below:

[0061] Step 11, Extracting Code Snippets Using Expert Rules: In this process, the code program is segmented by expert rules based on vulnerabilities, such as buffer overflow vulnerabilities, which may correspond to key points like libraries, interface calls, arrays, and pointers. The entire program is represented by one or more snippets containing these key points. These program snippets do not necessarily correspond to consecutive lines of code, but they contain hidden continuity relationships. The code snippets are combined with their corresponding tags to form code snippets that can be input for analysis.

[0062] Step 12, Extract the execution tree of the code snippet: To obtain an understanding of the execution logic of the code snippet and extract the jump order, an execution tree is constructed for the code snippet obtained in Step 11 using a code AST tool. The root node of the execution tree contains operators, such as function identifiers, variable definitions, and calls.

[0063] Step 13: Define the operation command dictionary using the language library and assign numerical values ​​to the commands: It is necessary to use the language operation library to build the corresponding numerical dictionary and build it into a form that can be operated and analyzed by the neural network.

[0064] Step 14: Traverse the root node of the tree to obtain the execution logic, path and corresponding label: Traverse the root node of the tree according to the construction method of the execution tree, without traversing the leaf nodes to remove noise caused by different variable definitions in different programs, and use the operation command dictionary to obtain sequence features with execution logic and path that can be operated by the neural network.

[0065] Step 15, Constructing a Sequence-Based Neural Network: This invention constructs a Bidirectional Long Short-Term Memory (BiLSTM) network based on sequence features. The sequence neural network constructed in this invention consists of multiple BiLSTM layers, a dense layer, and a softmax layer. This invention reduces the dimensionality of the vectors received from the BiLSTM layers. The softmax layer takes the low-dimensional vectors received from the dense layer as input, is responsible for representing and formatting the classification results, and provides feedback for updating the neural network parameters during the learning phase. The output of the learning phase is a BiLSTM neural network with fine-tuned model parameters; the output of this phase is the output of the softmax layer.

[0066] Step 16, Output the neural network connection layer results: Using the methods from steps 11, 12, 13, and 14, process the code into operable sequence features, then train the model from step 15, outputting the neural network connection layer results as logistic features L. f .

[0067] like Figure 3 As shown, in step 2 above, control operations and data operation semantics are extracted from the code snippet in step 1, operation graph features are constructed, and based on the characteristics of statistical information, key node information structured features are highlighted and filtered to construct a neural network model. The specific content of the output fusionable result features is as follows:

[0068] Step 21: Construct different types of operation or call initiation nodes based on expert rules: In this step, existing expert rules are summarized and categorized into several main patterns, including function calls, variable calls, process calls, and loop exits. According to expert rules, different program elements within a function are not equally important when detecting vulnerabilities. This invention divides operation or call initiation nodes into three types: important node M. i (i∈n) represents the statements where frequent vulnerabilities occur, as proven by library function statements and expert rules, and ordinary node C. i (i∈n) represents variable call and modification statements and exit node F. i (i∈n) represents statements such as loop exits or function terminations, where n is the number of nodes. Some vulnerabilities with established expert rules have definitions of important nodes. For example, in an infinite loop vulnerability, all loop statements can be constructed as important nodes, as can loop condition variables and self-calls.

[0069] Step 22, Extracting the semantic relationships and operation order of different node types: To capture the rich semantic dependencies between nodes, this invention constructs three types of relationships: control flow relationships, data flow relationships, and exit relationships. Each relationship describes the path that the code snippet may traverse, while the timestamp of the relationship represents the order of operations within the function.

[0070] Specifically, control flow relations are constructed for conditional statements or safety handle statements (such as if, for, assert, and require statements). Data flow relations involve accessing or modifying variables, such as access and assignment statements. Exit relations are used to characterize specific exit mechanisms.

[0071] Step 23, construct features by combining nodes and relationships: the features of the relationships are extracted into a tuple:

[0072] Control flow relation feature tuple: r = (N start N end (Type, Order)

[0073] Where N start and N end It indicates the start and end nodes of the relationship, Type indicates the relationship type, and Order indicates its time order.

[0074] Step 24: Based on the importance and correlation of statistical node types, key nodes are selected: Because neural networks are fair to all features when propagating information, relationships related to ordinary nodes are deleted to highlight the effect of important nodes. Based on the different types of nodes obtained in Step 21, important nodes M... i (i∈n), ordinary node C i (i∈n), exit node F i (i∈n). In this invention, each starting and ending point will be deleted as a normal node C. i Or exit node F i The relationship between i (∈n). However, the starting point or ending point has one and only one non-significant node M. i The relational features of (i∈n) are passed to the nearest important node.

[0075] Step 25: Merge and normalize the filtered nodes to obtain the structured operation graph features: After filtering nodes in step 24, important nodes M i The feature consists of three parts: important nodes M i Its own characteristics, merged into M i And has from C i To M i The characteristics of the relationship; and merging into M i And has from M iThe characteristics of the relationship to Ci. The characteristics of the operation graph after aggregation are R = {r1, r2, ..., n}, where r k This indicates the relationship of the k-th order.

[0076] Step 26, constructing a 1D-CNN neural network: CNNs are good at identifying simple patterns in data, and then using these patterns to form more complex patterns in higher layers. The 1D-CNN model has proven effective when latent features are obtained from short segments of the overall dataset, and the positional correlation of the features within the segments is low. This invention utilizes the 1D-CNN model from the Keras library, which consists of three 1D-CNN layers, pooling layers, activation layers, and a softmax layer. The input data consists of the features obtained in step 25 and the classification labels predicted by the model for the samples.

[0077] Step 27: Using the structured operation graph features from step 25, train the neural network from step 26, and output the neural network connection layer results. Similarly, using the methods from steps 21, 22, 23, 24, and 25, process the code into operable features, and then train the model from step 26, outputting the neural network connection layer results as operation graph features R. f .

[0078] like Figure 4 As shown, the specific details of combining the two features from steps 1 and 2 for combined detection in step 3 above, and using the test dataset for quantitative evaluation, are as follows:

[0079] Step 31, combine the expert rule execution logic features and operation diagram features: after obtaining the expert rule execution logic feature L f and operation diagram features R f Subsequently, this invention combines the two-dimensional features:

[0080] Combined features:

[0081] Step 32, pass the detection results to the feedforward neural network: Based on the combined features from step 31, the results are passed to a feedforward network consisting of two fully connected (FC) layers and one sigmoid layer. The process is expressed as follows:

[0082]

[0083] Step 33: Evaluation using the labels of the test set: By comparing the calculated final predicted labels with the actual labels, it is determined whether the tested code segment has a specific vulnerability, and the results are used to evaluate the indicators.

[0084] Based on the aforementioned vulnerability detection method using neural networks and expert rule structures, this example also presents a corresponding vulnerability detection system based on neural networks and expert rule structures. The specific description of this system is as follows:

[0085] The feature extraction and detection module based on expert rules and BiLSTM model is used to extract code fragments from source code using expert rules, and convert them into code execution trees to extract execution logic. It uses identifiable sequences as input to build a neural network model and outputs fusionable result features.

[0086] The vulnerability feature extraction and detection module based on code operation semantics and CNN model is used to construct operation graph features, and based on the characteristics of statistical information, it highlights and filters the structured features of key node information, constructs a neural network model, and outputs fusionable result features.

[0087] The vulnerability detection module based on dual-dimensional feature fusion is used to combine expert rule execution logic features and code semantic operation graph features for combined detection.

[0088] The described vulnerability feature extraction and detection module based on expert rules and sequence models includes: an execution logic feature generation module, which is used to extract source code fragments from expert rules and construct sequence model features; and a BiLSTM neural network training and detection module, which is used to adjust and improve the sequence model by adding experimentally optimal parameter configurations and to train the model.

[0089] The described vulnerability feature extraction and detection module based on code operation semantics and CNN model includes: a structured operation graph feature generation module, which is used to construct node and association semantics and operation order using expert rules, and to generate structured operation graph features based on statistical characteristics; and a 1D-CNN neural network training and detection module, which is used to adjust and improve the CNN neural network model by adding experimental optimal parameter configuration, and to train the model.

[0090] The described vulnerability detection module based on dual-dimensional feature fusion includes: a dual-dimensional feature fusion module, which combines expert rule execution logic features with code semantic operation graph result features; and a vulnerability detection evaluation module, which processes and outputs the fused result features.

[0091] Example 2

[0092] Example 2 demonstrates the verification experiments conducted on the method and system proposed in this invention. The experiments utilize publicly available code snippets and smart contract code data to quantitatively evaluate the robustness of the method across different types of code and vulnerability detection. The proposed method is compared with existing expert rule-based vulnerability detection methods and single neural network detection methods, proving the improved detection performance of the proposed method.

[0093] To evaluate the detection performance of the vulnerability detection model, we first need to define the following four sample sets:

[0094] 1)TP: The set of positive samples in the dataset that are classified as positive by the model.

[0095] 2)FP: The set of negative samples in the dataset that are classified as positive by the model.

[0096] 3)TN: The set of negative samples in the dataset that are classified as negative by the model.

[0097] 4) FN: The set of positive samples in the dataset that are classified as negative by the model.

[0098] Based on the above four sample sets, this invention uses four evaluation metrics commonly used in the field of vulnerability detection to evaluate the detection performance of the vulnerability detection model in this invention.

[0099] Model detection performance evaluation metrics include: accuracy, precision, recall, and F1-Measure. Accuracy and recall describe two aspects of system performance, respectively.

[0100] The specific definitions of these metrics are shown below, starting with the model detection performance evaluation metrics:

[0101]

[0102]

[0103]

[0104]

[0105] Table 1 shows the experimental comparison results between the present invention and the expert rule-dependent method in smart contract scenarios.

[0106]

[0107] Table 1 shows that, in experiments on code datasets for smart contract scenarios, compared to static code analysis tools like Smartcheck and security analysis methods that solely rely on expert rules, this invention demonstrates a significant improvement in performance. Whether comparing the four indicators of reentrancy vulnerabilities, timestamp vulnerabilities, and loop vulnerabilities, or comprehensively examining the entire set of smart contract data, this invention exhibits substantial performance improvements. This proves that static code detection based on expert knowledge is insufficient to handle ever-changing vulnerabilities, and that deep learning-based vulnerability detection methods have great potential to rapidly improve detection capabilities.

[0108] Table 2 shows the experimental comparison results between the present invention and deep learning methods in smart contract scenarios.

[0109]

[0110] Table 2 shows that, compared with static code detection using expert rules, all deep learning methods improved performance across all four vulnerability detection metrics in experiments on smart contract code datasets. This further demonstrates the effectiveness of deep learning for vulnerability detection. It can be observed that the BiLSTM model performs best in vulnerability detection, and this invention also uses the BiLSTM model as the training model for execution logic features. This invention outperforms existing deep learning methods in all four vulnerability detection metrics. This proves that adding expert rules to a deep learning-based vulnerability detection method plays a positive guiding role.

[0111] Table 3 shows the experimental comparison results between the present invention and the expert rule-dependent method in software security scenarios.

[0112]

[0113] Table 3 shows that in experiments using code datasets of software security vulnerabilities, compared to static code recognition tools like Flawfinder and Checkmark that rely on expert rules, this invention demonstrates a significant improvement in performance. Whether comparing the four metrics for identifying critical vulnerability buffer vulnerabilities and resource management error vulnerabilities, or performing comprehensive testing on a full dataset of software security vulnerabilities, this invention exhibits substantial performance improvements. This further proves the effectiveness of this invention and vulnerability detection combined with deep learning.

[0114] Table 4 shows the experimental comparison results between the present invention and deep learning methods in software security scenarios.

[0115]

[0116] As shown in Table 4, compared with static code detection using expert rules, all deep learning methods improved performance across all four vulnerability detection metrics in experiments on the code dataset of software security vulnerabilities. This invention outperforms existing deep learning methods in all four vulnerability detection metrics. This further demonstrates that adding expert rules to a deep learning-based vulnerability detection method plays a positive guiding role. Furthermore, based on the above analysis, this invention exhibits good scalability and robustness, achieving excellent results in diverse vulnerability and detection scenarios.

[0117] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A vulnerability detection method based on a combination of neural networks and expert rules, characterized in that, include: Step 1: Extract code snippets from the source code using expert rules, convert them into a code execution tree to extract execution logic, use identifiable sequences as input to build a neural network model, and output fusionable result features. Step 2: Extract control operation and data operation semantics from the code snippet in Step 1, construct operation graph features, and based on the characteristics of statistical information, highlight and filter the structured features of key node information, construct a neural network model, and output fusionable result features. Step 3: Combine the two features from Step 1 and Step 2 for combined detection, and use the test dataset for quantitative evaluation; Step 1, which involves extracting code snippets from the source code using expert rules and converting them into a code execution tree to extract execution logic, specifically includes: Step 11, Extract code snippets using expert rules: In this process, the code program is exploited by expert rules to represent the entire program through one or more snippets containing key points; the program snippets do not necessarily correspond to consecutive lines of code, but contain hidden continuous relationships. The code snippets are combined with corresponding tags to form code snippets that can be input for analysis. Step 12, Extract the execution tree of the code snippet: In order to obtain the execution logic of the code snippet that can be understood, the execution jump order is extracted. Using the code AST tool, an execution tree is constructed for the code snippet obtained in Step 11. The root node of the execution tree contains the operator. Step 13, use the language library to define the operation command dictionary and assign numerical values ​​to the commands: It is necessary to use the language operation library to build the corresponding numerical dictionary and build it into a form that can be operated and analyzed by the neural network; Step 14: Traverse the root node of the tree to obtain the execution logic, path and corresponding label: Traverse the root node of the tree according to the construction method of the execution tree, without traversing the leaf nodes to remove noise caused by different variable definitions in different programs, and use the operation command dictionary to obtain sequence features with execution logic and path that can be operated by the neural network. Step 2 involves extracting control operations and data operation semantics from the code snippet in Step 1 and constructing operation graph features, specifically including: Step 21: Construct different types of operation or call initiation nodes based on expert rules: In this step, existing expert rules will be summarized into several main patterns, including function calls, variable calls, process calls, and loop exits. According to expert rules, different program elements of a function are not equally important when detecting vulnerabilities, and are divided into three types of operation or call initiation nodes: important nodes. ordinary nodes and exit node , The number of nodes; for infinite loop vulnerabilities, all loop statements are constructed as critical nodes, loop condition variables and self-calls are constructed as critical nodes; Step 22, extract the semantic relationships and operation order of different types of nodes: In order to capture the rich semantic dependencies between nodes, three types of relationships are constructed, namely control flow relationships, data flow relationships and exit relationships; each relationship describes the path that the code snippet may traverse, and the time number of the relationship represents the order of the operations in the function; Control flow relations are constructed for conditional statements or safety handle statements; data flow relations involve access to or modification of variables; exit relations are used to characterize specific exit mechanisms. Step 23, construct features by combining nodes and relationships: the features of the relationships are extracted into a tuple: Control flow relation feature tuples: in and Indicates the start and end nodes of the relationship, Type indicates the relationship type, and Order indicates its chronological order; Step 2, based on the characteristics of statistical information, specifically includes highlighting the structured features of key node information for screening, including: Step 24: Based on the importance and correlation of statistical node types, key nodes are selected: Because neural networks are fair to all features when propagating information, relationships related to ordinary nodes are deleted to highlight the effect of important nodes; based on the different types of nodes obtained in Step 21, important nodes... ordinary nodes Exit node The middle section will delete each start and end point as a normal node. Or exit the node The relationship; but the starting point or the ending point has one and only one non-significant node. Relationship characteristics are passed to the nearest important node; Step 25: Merge and normalize the filtered nodes to obtain the structured operation graph features: After filtering nodes in step 24, important nodes... Its features consist of three parts: important nodes Its own characteristics, merged into And has from arrive The characteristics of the relationship; and merging into And has from Features of the relationship to Ci; aggregated features are ,in Indicates the relationship of the k-th order; The specific features of the neural network model constructed in step 2, which output fusionable result features, include: Step 26, Construct a 1D-CNN neural network: Build a model using the 1D-CNN library in Keras. The model consists of three layers of 1D-CNN, pooling layers, activation layers, and Softmax. The input data are the features obtained in Step 25 and the classification labels predicted by the model for the samples. Step 27: Using the structured operation graph features from Step 25, train the neural network in Step 26 and output the neural network connection layer results. Similarly, using the methods in Steps 21, 22, 23, 24, and 25, process the code into operable features, then train the model in Step 26, and output the neural network connection layer results to form the operation graph features. .

2. The vulnerability detection method based on a combination of neural networks and expert rules according to claim 1, characterized in that, In step 1, a recognizable sequence is used as input to construct a neural network model, and the output fusionable result features specifically include: Step 15, Construct a sequence-based neural network: Construct a BiLSTM neural network based on sequence features; the constructed sequence neural network consists of multiple BiLSTM layers, a dense layer, and a softmax layer; this reduces the dimensionality of the vectors received from the BiLSTM layers; the softmax layer takes the low-dimensional vectors received from the dense layer as input, is responsible for representing and formatting the classification results, and provides feedback for updating the neural network parameters during the learning phase; the output of the learning phase is the BiLSTM neural network with fine-tuned model parameters, and the output of this phase is the output of the softmax layer; Step 16, Output the neural network connection layer results: Using the methods from steps 11, 12, 13, and 14, the code is processed into operable sequence features. Then, the model from step 15 is trained, and the output neural network connection layer results constitute the expert rule execution logic features. .

3. The vulnerability detection method based on a combination of neural networks and expert rules according to claim 1, characterized in that, Step 3, which combines the two features from steps 1 and 2 for combined detection and uses a test dataset for quantitative evaluation, specifically includes: Step 31, combine the expert rule execution logic features and operation diagram features: after obtaining the expert rule execution logic features and operation diagram features Then, the two-dimensional features are combined: Combined features: Step 32, pass the detection results to the feedforward neural network: Based on the combined features from step 31, the results are passed to a feedforward network consisting of two fully connected layers and one sigmoid layer. The process is expressed as follows: Step 33: Evaluation using the labels of the test set: By comparing the calculated final predicted labels with the actual labels, it is determined whether the tested code segment has a specific vulnerability, and the results are used to evaluate the indicators.

4. A vulnerability detection system using the method of claim 1, characterized in that, include: The feature extraction and detection module based on expert rules and BiLSTM model is used to extract code fragments from source code using expert rules, and convert them into code execution trees to extract execution logic. It uses identifiable sequences as input to build a neural network model and outputs fusionable result features. The vulnerability feature extraction and detection module based on code operation semantics and CNN model is used to construct operation graph features, and based on the characteristics of statistical information, it highlights and filters the structured features of key node information, constructs a neural network model, and outputs fusionable result features. The quantitative evaluation module based on semantic matching rate is used to calculate the semantic matching rate to give semantic meaning to the agent decision tree, and to use the matching rate to quantitatively evaluate the interpretation effect of the semantic decision tree. The vulnerability detection module based on dual-dimensional feature fusion is used to combine expert rule execution logic features with code semantic operation graph features for combined detection.

5. A vulnerability detection system based on a combination of neural networks and expert rules according to claim 4, characterized in that, The feature extraction and detection module based on expert rules and BiLSTM model includes: The line logic feature generation module is used to extract source code fragments from expert rules and construct sequence model features; The BiLSTM neural network training and detection module is used to add adaptive improvements to sequence models and train these models.

6. The vulnerability detection system based on a combination of neural networks and expert rules according to claim 4, characterized in that, The structured operation graph feature generation module is used to construct node and association semantics and operation order using expert rules, and to generate structured operation graph features based on statistical characteristics. The vulnerability detection module based on dual-dimensional feature fusion includes: The dual-dimensional feature fusion module is used to combine the features of expert rule execution logic with the features of code semantic operation graph results; The vulnerability detection and evaluation module is used for processing and outputting the characteristics of the fusion results.

Images