A method and apparatus for patch existence detection based on subgraph isomorphism

Abstract

This invention provides a patch existence detection method and apparatus based on subgraph isomorphism. It identifies the CPG subgraphs of the patch source code and the target code, then optimizes the CPG subgraph of the target code using an optimization method to refine its fine-grained structural information, reduce the structural information of irrelevant nodes, and decrease noise. Finally, the subgraphs of the patch source code and the target code are input into a detection network of a contrastive learning network for similarity determination. Even when the target code undergoes customized modifications that alter its contextual semantics, the subgraph structural information of similar lines in the target code is largely preserved. Therefore, this invention is highly resistant to customized modifications and provides vulnerability analysts with a reliable and accurate patch detection method.

Description

Technical Field

[0001] This invention belongs to the field of source code-level vulnerability detection technology, specifically relating to a patch existence detection method and apparatus based on subgraph isomorphism. Background Technology

[0002] With the rise of open-source software, numerous upstream open-source projects are widely used in downstream software development within the software supply chain. For example, various software programs frequently reference third-party libraries and make customized modifications during development; Android phone manufacturers and device manufacturers borrow from the upstream open-source Linux kernel and perform customized development. As code reuse becomes commonplace and security vulnerabilities increase, many security vulnerabilities in upstream software propagate along the software supply chain to downstream software. Unpatched vulnerabilities in downstream software are highly vulnerable to hacker attacks, posing a significant threat to their security. While upstream open-source software can promptly release patches and disclose impact information, downstream software vendors need to promptly assess the scope of the vulnerabilities' impact on their software. In this context, patch presence detection of downstream open-source software programs can help security analysts assess software security in a timely manner.

[0003] Existing detection methods for determining patch status can be mainly divided into five categories: The first is attack sample testing. This method first constructs or collects a Proof of Concept (PoC) for a specific vulnerability, then inputs it into the target binary program for dynamic execution, and observes whether the target code triggers the corresponding vulnerability. The second is matching using patch signature characteristics. This method first selects a suitable part of the patch to generate a binary signature, and then searches the target binary file for the corresponding binary signature. The third is matching using patch path digests. This method first collects the paths affected by the patch in functions before and after the patch, generates a semantic digest of the affected paths through symbolic execution, then merges the semantic digests of the paths before and after the patch, and finally determines the presence status of the patch in the target code by comparing the distance between the target code and the path digests before and after the patch. The fourth is matching using the patching history of the target code. This method first compares the subject information of the original patch, and then compares the modified lines of the original patch and their context information. The fifth method is to use the low-dimensional embedding of patch blocks to perform matching in the target code. This method first collects a certain number of patch functions and patch modification lines, and determines the patch block in the patch function. Then, it uses the machine learning CBOW model to learn the semantic embedding of the patch block. Then, it uses the SIF method to generate the semantic embedding of the patch block and the target code block. Finally, it compares whether the semantic embedding of the target code block and the patch block is less than a given threshold.

[0004] However, downstream software often customizes the open-source code of upstream software, posing significant challenges to the aforementioned methods. First, PoC programs are typically designed for specific vulnerabilities. When the target code is customized, the context of the vulnerability changes. When testing the target code using a PoC program, the specific vulnerability may not be triggered, but this does not mean the vulnerability has been patched. Second, when the target code undergoes customized modifications, different compilation configurations, or optimizations, the generated binary programs will differ significantly, meaning the patch's binary signature may not exist in the target code. Third, according to recent research, downstream software, when porting upstream patches, will customize the patches to adapt to the context based on the downstream software's semantics. When the patch's repair logic or semantics are significantly modified, methods based on patch path digests may fail. Fourth, when faced with customized modifications to the target code, the original patch's repair semantics within the target code may change, making string matching ineffective for patches with similar repair logic but different semantics. Finally, embedding representations based on CBOW and SIF cannot clearly represent the linear relationships between patch embeddings, potentially losing some semantic information and reducing matching accuracy. Summary of the Invention

[0005] To address the aforementioned problems in the prior art, this invention provides a method and apparatus for patch existence detection based on subgraph isomorphism.

[0006] In a first aspect, the present invention provides a patch existence detection method based on subgraph isomorphism, comprising:

[0007] Step 1: Obtain the target code to be detected and the patch source file that needs to be verified to exist in the target code;

[0008] The patch source file includes the patch source code and the patch text used to describe the effect of the patch.

[0009] Step 2: Perform data augmentation on the patch source code and the target code respectively to generate equivalent programs, and obtain a first equivalent program that is equivalent to the patch source code and a second equivalent program that is equivalent to the target code;

[0010] Step 3: Extract the CPG subgraphs of the first equivalent program and the second equivalent program respectively to obtain the CPG subgraphs of the patch source code and the target code.

[0011] Step 4: Optimize the CPG subgraph of the target code using the CPG subgraph of the patch source code to prune irrelevant nodes and edges in the CPG subgraph of the target code.

[0012] Step 5: Input the CPG subgraph of the patched source code and the CPG subgraph of the optimized target code into the same trained detection model to obtain the output results of the two identical detection models.

[0013] Step 6: Based on the similarity between the output results of two identical detection models, confirm whether the patch source file exists in the target code.

[0014] Secondly, the present invention provides a patch existence detection device based on subgraph isomorphism, comprising:

[0015] The unlabeled program sample acquisition module is used for:

[0016] Obtain the target code to be detected and the patch source file that needs to be verified to exist in the target code;

[0017] The patch source file includes the patch source code and the patch text used to describe the effect of the patch.

[0018] The data augmentation module is used for:

[0019] Data augmentation is performed on the patch source code and the target code respectively to generate equivalent programs, resulting in a first equivalent program that is equivalent to the patch source code and a second equivalent program that is equivalent to the target code;

[0020] The subgraph extraction and optimization module is used for:

[0021] Extract the CPG subgraphs of the first equivalent program and the second equivalent program respectively to obtain the CPG subgraphs of the patch source code and the target code.

[0022] The CPG subgraph of the target code is optimized using the CPG subgraph of the patch source code to prune irrelevant nodes and edges in the CPG subgraph of the target code.

[0023] The subgraph comparison learning module is used for:

[0024] The CPG subgraphs of the patched source code and the optimized target code are input into the same trained detection model to obtain the output results of the two identical detection models.

[0025] Based on the similarity between the outputs of two identical detection models, it is determined whether the patch source file exists in the target code.

[0026] The beneficial effects of this invention are:

[0027] This invention provides a patch existence detection method and apparatus based on subgraph isomorphism. It identifies the CPG subgraphs of the patch source code and the target code, then optimizes the CPG subgraph of the target code using an optimization method to refine its fine-grained structural information, reduce the structural information of irrelevant nodes, and decrease noise. Finally, the subgraphs of the patch source code and the target code are input into a detection network of a contrastive learning network for similarity determination. Even when the target code undergoes customized modifications that alter its contextual semantics, the subgraph structural information of similar lines in the target code is largely preserved. Therefore, this invention is highly resistant to customized modifications and provides vulnerability analysts with a reliable and accurate patch detection method.

[0028] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0029] Figure 1 This is a schematic diagram of a patch detection existence detection method based on subgraph isomorphism;

[0030] Figure 2 Example diagram of the CPG subgraph extraction and optimization process for target code;

[0031] Figure 3 A comparative learning example diagram of the CPG subgraphs for patch source code and target code;

[0032] Figure 4 Example diagram of generating functionally equivalent programs using data augmentation techniques. Detailed Implementation

[0033] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0034] like Figure 1 As shown, the patch existence detection method based on subgraph isomorphism provided by the present invention includes:

[0035] Step 1: Obtain the target code to be detected and the patch source file that needs to be verified to exist in the target code;

[0036] The patch source file includes the patch source code and the patch text used to describe the effect of the patch.

[0037] Step 2: Perform data augmentation on the patch source code and the target code respectively to generate equivalent programs, and obtain a first equivalent program that is equivalent to the patch source code and a second equivalent program that is equivalent to the target code;

[0038] In one specific embodiment, step 2 includes:

[0039] Step 21: Parse the patch source code and the target code into abstract syntax trees respectively;

[0040] Step 22: Using automatic traversal conversion technology, the abstract syntax trees corresponding to the patch source code and the target code are converted respectively to obtain a first equivalent program that is functionally and semantically equivalent to the patch source code and a second equivalent program that is functionally and semantically equivalent to the target code.

[0041] To extract and optimize the CPG subgraphs of the target code and the patch source code, data augmentation techniques are first needed to generate a certain number of functionally equivalent and semantically similar programs. Data augmentation generates equivalent programs by parsing a specific sequence of source code into a tree structure called an Abstract Syntax Tree (AST), and then using automatic traversal to transform the AST, converting the source code sequence into functionally equivalent and semantically similar source code.

[0042] Step 3: Extract the CPG subgraphs of the first equivalent program and the second equivalent program respectively to obtain the CPG subgraphs of the patch source code and the target code.

[0043] In one specific embodiment, reference is made to... Figure 2 Step 3 includes:

[0044] Step 31: Use static analysis tools to obtain the identifiers of the first equivalent program and the second equivalent program;

[0045] Step 32: Determine the functions and variables in the first and second equivalent programs based on the identifiers;

[0046] Step 33: Map the functions and variables of the first and second equivalent programs to predetermined symbol names;

[0047] Step 34: Use the joern tool to extract the functions and variables for building the first and second equivalent programs by predefined symbol names, thereby constructing the CPG diagram of the target code and the CPG diagram of the patch source code.

[0048] Step 35: For the CPG graph of the patch source code and the target code, starting from the modified behavior, traverse backward along the variable edge dependency relationship and function call relationship until the initial definition position of the relevant variable is reached, so as to obtain the nodes and edges of each CPG subgraph in the CPG graph.

[0049] Step 36: Connect the nodes and edges of each CPG subgraph according to their corresponding positions in the CPG subgraph to obtain the CPG subgraph of the patch source code and the CPG subgraph of the target code.

[0050] To ensure the accuracy of the extracted CPG subgraphs and to be flexible in the face of minor semantic differences between codes, this invention first standardizes the function names and variable names in the code sequence.

[0051] This invention first uses static analysis tools to obtain identifiers for the source code sequence. Then, function and variable names in the code sequence are mapped to specific symbolic names (e.g., "FUNC", "VAR") to prevent them from interfering with the subgraph optimization process, as user-defined function and variable names contain program-specific naming characteristics. Next, the Joern tool is used to construct CPG graphs for both the patch source code and the target code, and the graph construction results are stored in the graph database Neo4j. Then, based on the modification behavior of the patch source code, starting from this modification behavior in the patch source code's CPG graph, the process traverses backward along variable edge dependencies and function call relationships until the initial definition position of the relevant variables is reached, extracting the edge set and vertex set of the patch source code subgraph during this process.

[0052] Step 4: Optimize the CPG subgraph of the target code using the CPG subgraph of the patch source code to prune irrelevant nodes and edges in the CPG subgraph of the target code.

[0053] As an optional embodiment of the present invention, step 4 includes:

[0054] Step 41: Match the features of each node in the CPG subgraph of the patch source code and the target code according to the preset matching rules. If the match is successful, retain the successfully matched nodes in the CPG subgraph of the target code. If the match fails, delete the unmatched nodes in the CPG subgraph of the target code.

[0055] The matching rules include:

[0056] Rules corresponding to node identifier characteristics, node type characteristics, control flow characteristics, operator characteristics, and function call characteristics;

[0057] Among them, the comparison rule corresponding to the identifier feature is to check whether the naming conventions of the variables in the nodes are the same;

[0058] The comparison rule corresponding to the node type feature is to check whether the variable definition types of the nodes are the same;

[0059] The comparison rule corresponding to the control flow feature is to check whether the node's control flow feature is present. If it is, then check whether the control flow features are consistent.

[0060] The comparison rule corresponding to the operator feature is to check whether the node contains the operator feature; if it does, then check whether the operator features are consistent.

[0061] The comparison rule corresponding to the function call feature is to check whether the node contains the function call feature. If it does, then check whether the function call features are consistent.

[0062] See Table 1 below. Table 1 shows the matching rules for node features during the subgraph extraction and optimization process. Node matching can be assisted by matching keywords.

[0063] Table 1. Matching rules for node features during subgraph extraction and optimization.

[0064]

[0065]

[0066] In step 41, if the rules corresponding to the node identifier feature and node type feature are true, and any of the rules corresponding to the control flow feature, operator feature, and function call feature are true, then it is confirmed that the node features in the CPG subgraph of the patch source code and the target code are successfully matched.

[0067] Step 42: Based on the minimum number of nodes in the CPG subgraph of the patch source code, decompose the CPG subgraph of the target code into multiple candidate subgraphs.

[0068] As an optional embodiment of the present invention, step 42 includes:

[0069] Step 421: Count the number of nodes in the CPG subgraph of the target code;

[0070] Step 422: Select the node that appears least frequently in the CPG subgraph of the patch source code. This node is then used as the basis for decomposing the target code into a CPG subgraph.

[0071] Step 423, calculate the CPG subgraph in the patched source code. Starting from a given point, the maximum distance d from any other node. b ;

[0072] Step 424, extract from the CPG subgraph of the target code Let d be the origin. bFind an isolated subgraph with radius and identify that isolated subgraph as a candidate subgraph.

[0073] Step 43: Eliminate isolated candidate subgraphs to obtain the CPG subgraph optimized for the target code.

[0074] The purpose of step 4 is to prune irrelevant nodes and edges from the CPG subgraph of the target code, thereby reducing the search space in the subgraph contrastive learning phase. The optimization algorithm steps are as follows:

[0075] Irrelevant nodes and edges in the target code are excluded. In this step, the node features of the patch source code and the target code CPG subgraph are matched using the matching rules described in Table 1. If a node in the target code's CPG subgraph contains the corresponding patch source code CPG node features, the relevant node is retained. Otherwise, the relevant node is deleted from the target code's CPG subgraph.

[0076] The CPG graph of the equivalent program of the target code is decomposed into multiple subgraph candidates.

[0077] ① Count the number of nodes in the CPG subgraph of the target code.

[0078] ② Select the node that appears least frequently in the CPG subgraph of the patch source code. As a benchmark for decomposing the target code.

[0079] ③ Calculate the CPG subgraph in the patch source code. Starting from a point, the maximum distance d between the patch source code subgraph and any other node. b .

[0080] ④ Extract the target code from the following: Let d be the origin. b Candidate subgraphs with radius .

[0081] Exclude isolated subgraphs in the target code. In the target code, the number of corresponding nodes in the isolated subgraph must be greater than or equal to the number of nodes in the patch source code subgraph; otherwise, exclude the isolated subgraph.

[0082] Step 5: Input the CPG subgraph of the patched source code and the CPG subgraph of the optimized target code into the same trained detection model to obtain the output results of the two identical detection models.

[0083] refer to Figure 1 As shown, for ease of representation Figure 1 A fully trained detection model is represented as f q Another representation is f k The two detection models are the same.

[0084] Step 6: Based on the similarity between the output results of two identical detection models, confirm whether the patch source file exists in the target code.

[0085] Subgraph contrastive learning involves inputting the CPG subgraph of the target code and the CPG subgraph of the patch source code into a contrastive learning network to determine whether the two subgraphs belong to the same category. Figure 1 As shown in steps C and D, step C generates a CPG subgraph of the target code and patch source code after subgraph extraction and optimization, and then inputs the subgraph into a... Figure 3 In the model architecture shown, it determines whether two types of subgraphs belong to the same class. The model uses the InfoNCE loss function to minimize the distance between positive samples and maximize the distance between positive and negative samples. The InfoNCE loss function is calculated as follows:

[0086]

[0087] Among them, q and k + For the output of positive samples, k - The output is for negative samples. This invention sets the output between positive sample pairs to 1 and the output between positive and negative sample pairs to 0. If the comparison learning result of the CPG subgraph of the target code and the CPG subgraph of the patched source code is 1, then this invention considers the target code to have been patched. Thus, it can be known that the target code has been patched.

[0088] As an optional embodiment of the present invention, the training process of the detection model in step 5 is as follows:

[0089] a. Obtain multiple patch files and use each patch file as a training sample;

[0090] Each patch file includes patch code and patch text describing the effect of the patch;

[0091] b. Parse the patch code for each training sample into an abstract syntax tree;

[0092] c. Based on two different equivalent types, the abstract syntax tree corresponding to the patch code is transformed using automatic traversal transformation technology to obtain sample programs of two equivalent types; the sample programs are semantically and functionally equivalent to the patch code.

[0093] Among them, there are two equivalent programs: code compression type and identifier modification type. The equivalent program of code compression type changes the syntax structure of the original code, and the equivalent program of identifier modification type replaces the names of functions and variables in the original code by random substitution to mask the readable information in the program, but ensures that the function functionality does not change.

[0094] Data augmentation techniques generate equivalent programs: a specific sequence of source code is parsed into a tree structure called an Abstract Syntax Tree (AST), and then the source code sequence is transformed into functionally equivalent and semantically similar source code using automatic traversal of the AST. The generated source code can be broadly categorized into two types:

[0095] Code compression: This type removes some useless information from the source code, such as spaces and comments, but it changes the syntax structure of the code to some extent.

[0096] Identifier modification: This type replaces the names of functions and variables with random substitutions, masking readable information in the program, but ensuring that the function's functionality remains unchanged.

[0097] By generating equivalent procedures of the two types mentioned above through data augmentation, the number of training samples for contrastive learning can be supplemented to some extent.

[0098] d. Convert the sample programs of the two equivalent types into CPG subgraphs respectively to obtain the CPG subgraphs of the two equivalent types;

[0099] It is worth noting that the next step is to train the model, which is divided into a pre-training phase and a fine-tuning phase.

[0100] e. In the pre-training phase, the sample program of the first equivalence type and the corresponding patch text are first input into the GraphPatchBERT model so that the model outputs the first predicted keyword of the sample program of the first equivalence type. Then, the sample program of the second equivalence type and the corresponding patch text are input into the GraphPatchBERT model so that the model outputs the second predicted keyword of the sample program of the second equivalence type.

[0101] f, During the model fine-tuning stage, the CPG subgraph of the first equivalence type, the corresponding patch text, and the patch code are first input into the GraphPatchBERT model so that the model outputs the first prediction result; and the CPG subgraph of the second equivalence type, the corresponding patch text, and the patch code are then input into the GraphPatchBERT model so that the model outputs the second prediction result.

[0102] exist Figure 3 In the model architecture, the model simultaneously takes the patch's text information, the patch's source code information, and the subgraph's sequence information as input, because these three types of information are different modalities of the same patch and have certain complementary characteristics. Next, all three types of information are input into the model simultaneously, and the model uses an attention mechanism to comprehensively consider the semantic relationships among them. The calculation method of the attention mechanism is as follows:

[0103]

[0104] Here, Q is called the query, K is called the key, and V is called the value. The attention mechanism uses the Softmax function to divide the product of Q and K. The result is transformed into the corresponding weight distribution, and the result is multiplied by V as the output of the attention mechanism.

[0105] g, If the first prediction result is not similar to the second prediction result, adjust the internal parameters of the GraphPatchBERT model, reacquire training pairs and return f, until the number of iterations is reached and the training ends;

[0106] The training pair consists of a CPG subgraph of the first equivalence type, the corresponding patch text, and the patch code of another training sample; and a CPG subgraph of the second equivalence type, the corresponding patch text, and the patch code.

[0107] h, the GraphPatchBERT model obtained after training is used as the detection model after training is completed.

[0108] This invention provides a patch existence detection device based on subgraph isomorphism, comprising:

[0109] The unlabeled program sample acquisition module is used for:

[0110] Obtain the target code to be detected and the patch source file that needs to be verified to exist in the target code;

[0111] The patch source file includes the patch source code and the patch text used to describe the effect of the patch.

[0112] The data augmentation module is used for:

[0113] Data augmentation is performed on the patch source code and the target code respectively to generate equivalent programs, resulting in a first equivalent program that is equivalent to the patch source code and a second equivalent program that is equivalent to the target code;

[0114] The subgraph extraction and optimization module is used for:

[0115] Extract the CPG subgraphs of the first equivalent program and the second equivalent program respectively to obtain the CPG subgraphs of the patch source code and the target code.

[0116] The CPG subgraph of the target code is optimized using the CPG subgraph of the patch source code to remove irrelevant nodes and edges from the CPG subgraph of the target code.

[0117] The subgraph comparison learning module is used for:

[0118] The CPG subgraphs of the patched source code and the optimized target code are input into the same trained detection model to obtain the output results of the two identical detection models.

[0119] Based on the similarity between the outputs of two identical detection models, it is determined whether the patch source file exists in the target code.

[0120] The following examples illustrate the specific process of the conversion of this invention.

[0121] This embodiment designs a data augmentation module that utilizes source-to-source code transformation technology to automatically traverse the AST (Abstract Syntax Tree) of the patch source code, generating two equivalent programs that are functionally and semantically similar to the patch source code. This embodiment also designs a subgraph extraction and optimization module. This module first extracts the CPG subgraphs of the patch source code and the target code, and then selects a suitable optimization algorithm to optimize the CPG subgraph of the target code.

[0122] Data Augmentation Module:

[0123] The data augmentation module takes as input the patch source code for patch repair. To generate functionally equivalent and semantically similar programs, the module first builds an AST (Abstract Syntax Tree) of the patch source code, and then modifies the patch source code in the AST to generate equivalent programs with identifier modification and code compression.

[0124] like Figure 4 As shown in the upper right corner, this program is an equivalent program generated through code compression. In the image, code compression removes characters such as spaces and newlines from the original C program, altering its syntax, but the program's functional semantics remain unchanged. Figure 4 As shown in the lower right corner, this program is an equivalent program generated after identifier modification. In the diagram, the identifier modification method alters the naming conventions of the original C language program variables, such as renaming the variable `section` to `n` and the variable `maxLine` to `t`. Although changing the naming conventions of the original program variables alters the semantics of the code, the functionality of the original program remains unchanged; that is, the program functions identically and has similar semantics before and after the modification.

[0125] Subgraph extraction and optimization module:

[0126] The subgraph extraction process first uses the modified lines in the patch as a reference, extracting the CPG subgraph from the patch's source code. For example... Figure 2 As shown, the CPG subgraph of the patch source code is abstracted as follows: Figure 4The top left corner is used to collect the set of vertices and edges from the patch source code during subgraph extraction. The vertex set is {A:2, B:2, C:1}, where the vertex C appears the fewest times. Let the set of edges be {B->B, B->A, B>C}, where the longest path has a length of 3, i.e., d. b =3.

[0127] The optimization process excludes irrelevant nodes and edges from the CPG subgraph of the target code. For example... Figure 2 As shown, in optimization 1, nodes D and E in the target code CPG subgraph are not included in the point set of the patch source code, so they are excluded.

[0128] Secondly, this step utilizes and d b The target code CPG subgraph is decomposed into multiple subgraph candidates. For example... Figure 2 As shown, in optimization 2, the target code CPG subgraph is decomposed into subgraphs ①, ②, and ③, where the longest distance starting from point C in each subgraph is greater than or equal to...

[0129] Finally, this step uses the corresponding number of nodes in the point set of the patched source code to exclude irrelevant subgraphs. For example... Figure 2 As shown, in optimization 3, since the number of A nodes in subgraph ③ is 1, which is less than the number of A nodes in the patch source code (2), subgraph ③ is excluded.

[0130] This invention demonstrates the use of CPG subgraphs of patch source code and target code to detect the existence of patches. Experimental results show that the subgraph isomorphism detection method of this invention can resist the influence of customized code modifications, providing an accurate and reliable detection method for detecting the existence of a large number of open-source C / C++ source code level patches.

[0131] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0132] Although this application has been described herein in conjunction with various embodiments, those skilled in the art will understand and implement other variations of the disclosed embodiments by reviewing the accompanying drawings, the disclosure, and the appended claims in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality.

[0133] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A patch existence detection method based on subgraph isomorphism, characterized in that, include: Step 1: Obtain the target code to be detected and the patch source file that needs to be verified to exist in the target code; The patch source file includes the patch source code and the patch text used to describe the effect of the patch. Step 2: Perform data augmentation on the patch source code and the target code respectively to generate equivalent programs, and obtain a first equivalent program that is equivalent to the patch source code and a second equivalent program that is equivalent to the target code; Step 3: Extract the CPG subgraphs of the first equivalent program and the second equivalent program respectively to obtain the CPG subgraphs of the patch source code and the target code. Step 4: Optimize the CPG subgraph of the target code using the CPG subgraph of the patch source code to prune irrelevant nodes and edges in the CPG subgraph of the target code. Step 5: Input the CPG subgraph of the patched source code and the CPG subgraph of the optimized target code into the same trained detection model to obtain the output results of the two identical detection models. Step 6: Based on the similarity between the outputs of two identical detection models, confirm whether the patch source file exists in the target code; the training process of the detection model in Step 5 is as follows: a. Obtain multiple patch files and use each patch file as a training sample; Each patch file includes patch code and patch text describing the effect of the patch; b. Parse the patch code for each training sample into an abstract syntax tree; c. Based on two different equivalent types, the abstract syntax tree corresponding to the patch code is transformed using automatic traversal transformation technology to obtain sample programs of two equivalent types; the sample programs are semantically and functionally equivalent to the patch code. d. Convert the sample programs of the two equivalent types into CPG subgraphs respectively to obtain the CPG subgraphs of the two equivalent types; e. In the pre-training phase, the sample program of the first equivalence type and the corresponding patch text are first input into the GraphPatchBERT model so that the model outputs the first predicted keyword of the sample program of the first equivalence type. Then, the sample program of the second equivalence type and the corresponding patch text are input into the GraphPatchBERT model so that the model outputs the second predicted keyword of the sample program of the second equivalence type. f, During the model fine-tuning stage, the CPG subgraph of the first equivalence type, the corresponding patch text, and the patch code are first input into the GraphPatchBERT model so that the model outputs the first prediction result; and the CPG subgraph of the second equivalence type, the corresponding patch text, and the patch code are then input into the GraphPatchBERT model so that the model outputs the second prediction result. g, If the first prediction result is not similar to the second prediction result, adjust the internal parameters of the GraphPatchBERT model, reacquire training pairs and return f, until the number of iterations is reached and the training ends; The training pair consists of a CPG subgraph of the first equivalence type, the corresponding patch text, and the patch code of another training sample; and a CPG subgraph of the second equivalence type, the corresponding patch text, and the patch code. h, the GraphPatchBERT model obtained after training is used as the detection model after training is completed.

2. The patch existence detection method based on subgraph isomorphism according to claim 1, characterized in that, Step 2 includes: Step 21: Parse the patch source code and the target code into abstract syntax trees respectively; Step 22: Using automatic traversal conversion technology, the abstract syntax trees corresponding to the patch source code and the target code are converted respectively to obtain a first equivalent program that is functionally and semantically equivalent to the patch source code and a second equivalent program that is functionally and semantically equivalent to the target code.

3. The patch existence detection method based on subgraph isomorphism according to claim 1, characterized in that, Step 3 includes: Step 31: Use static analysis tools to obtain the identifiers of the first equivalent program and the second equivalent program; Step 32: Determine the functions and variables in the first and second equivalent programs based on the identifiers; Step 33: Map the functions and variables of the first and second equivalent programs to predetermined symbol names; Step 34: Use the joern tool to extract the functions and variables for building the first and second equivalent programs by predefined symbol names, thereby constructing the CPG diagram of the target code and the CPG diagram of the patch source code. Step 35: For the CPG graph of the patch source code and the target code, starting from the modified behavior, traverse backward along the variable edge dependency relationship and function call relationship until the initial definition position of the relevant variable is reached, so as to obtain the nodes and edges of each CPG subgraph in the CPG graph. Step 36: Connect the nodes and edges of each CPG subgraph according to their corresponding positions in the CPG subgraph to obtain the CPG subgraph of the patch source code and the CPG subgraph of the target code.

4. The patch existence detection method based on subgraph isomorphism according to claim 1, characterized in that, Step 4 includes: Step 41: Match the features of each node in the CPG subgraph of the patch source code and the target code according to the preset matching rules. If the match is successful, retain the successfully matched nodes in the CPG subgraph of the target code. If the match fails, delete the unmatched nodes in the CPG subgraph of the target code. Step 42: Based on the minimum number of nodes in the CPG subgraph of the patch source code, decompose the CPG subgraph of the target code into multiple candidate subgraphs. Step 43: Eliminate isolated candidate subgraphs to obtain the CPG subgraph optimized for the target code.

5. The patch existence detection method based on subgraph isomorphism according to claim 4, characterized in that, The matching rules in step 41 include: Rules corresponding to node identifier characteristics, node type characteristics, control flow characteristics, operator characteristics, and function call characteristics; Among them, the comparison rule corresponding to the identifier feature is to check whether the naming conventions of the variables in the nodes are the same; The comparison rule corresponding to the node type feature is to check whether the variable definition types of the nodes are the same; The comparison rule corresponding to the control flow feature is to check whether the node's control flow feature is present. If it is, then check whether the control flow features are consistent. The comparison rule corresponding to the operator feature is to check whether the node contains the operator feature; if it does, then check whether the operator features are consistent. The comparison rule corresponding to the function call feature is to check whether the node contains the function call feature. If it does, then check whether the function call features are consistent.

6. The patch existence detection method based on subgraph isomorphism according to claim 5, characterized in that, Step 41: If the rules corresponding to the node identifier feature and node type feature are true, and any of the rules corresponding to the control flow feature, operator feature, and function call feature are true, then it is confirmed that the node features in the CPG subgraph of the patch source code and the target code are successfully matched.

7. The patch existence detection method based on subgraph isomorphism according to claim 5, characterized in that, Step 42 includes: Step 421: Count the number of nodes in the CPG subgraph of the target code; Step 422: Select the node that appears least frequently in the CPG subgraph of the patch source code. This node is used as the basis for decomposing the target code into a CPG subgraph. Step 423, calculate the CPG subgraph in the patched source code. Starting from a given point, the maximum distance to any other node. ; Step 424, extract from the CPG subgraph of the target code With the origin as the point, Find an isolated subgraph with radius and identify that isolated subgraph as a candidate subgraph.

8. The patch existence detection method based on subgraph isomorphism according to claim 1, characterized in that, The two equivalent programs are: code compression type and identifier modification type. The equivalent program of code compression type changes the syntax structure of the original code, while the equivalent program of identifier modification type replaces the names of functions and variables in the original code with random substitution to mask readable information in the program, but ensures that the function functionality does not change.

9. A patch existence detection device based on subgraph isomorphism, characterized in that, include: The unlabeled program sample acquisition module is used for: Obtain the target code to be detected and the patch source file that needs to be verified to exist in the target code; The patch source file includes the patch source code and the patch text used to describe the effect of the patch. The data augmentation module is used for: Data augmentation is performed on the patch source code and the target code respectively to generate equivalent programs, resulting in a first equivalent program that is equivalent to the patch source code and a second equivalent program that is equivalent to the target code; The subgraph extraction and optimization module is used for: Extract the CPG subgraphs of the first equivalent program and the second equivalent program respectively to obtain the CPG subgraphs of the patch source code and the target code. The CPG subgraph of the target code is optimized using the CPG subgraph of the patch source code to prune irrelevant nodes and edges in the CPG subgraph of the target code. The subgraph comparison learning module is used for: The CPG subgraphs of the patched source code and the optimized target code are input into the same trained detection model to obtain the output results of the two identical detection models. Based on the similarity between the outputs of two identical detection models, it is determined whether the patch source file exists in the target code; the training process of the detection model is as follows: a. Obtain multiple patch files and use each patch file as a training sample; Each patch file includes patch code and patch text describing the effect of the patch; b. Parse the patch code for each training sample into an abstract syntax tree; c. Based on two different equivalent types, the abstract syntax tree corresponding to the patch code is transformed using automatic traversal transformation technology to obtain sample programs of two equivalent types; the sample programs are semantically and functionally equivalent to the patch code. d. Convert the sample programs of the two equivalent types into CPG subgraphs respectively to obtain the CPG subgraphs of the two equivalent types; e. In the pre-training phase, the sample program of the first equivalence type and the corresponding patch text are first input into the GraphPatchBERT model so that the model outputs the first predicted keyword of the sample program of the first equivalence type. Then, the sample program of the second equivalence type and the corresponding patch text are input into the GraphPatchBERT model so that the model outputs the second predicted keyword of the sample program of the second equivalence type. f, During the model fine-tuning stage, the CPG subgraph of the first equivalence type, the corresponding patch text, and the patch code are first input into the GraphPatchBERT model so that the model outputs the first prediction result; and the CPG subgraph of the second equivalence type, the corresponding patch text, and the patch code are then input into the GraphPatchBERT model so that the model outputs the second prediction result. g, If the first prediction result is not similar to the second prediction result, adjust the internal parameters of the GraphPatchBERT model, reacquire training pairs and return f, until the number of iterations is reached and the training ends; The training pair consists of a CPG subgraph of the first equivalence type, the corresponding patch text, and the patch code of another training sample; and a CPG subgraph of the second equivalence type, the corresponding patch text, and the patch code. h, the GraphPatchBERT model obtained after training is used as the detection model after training is completed.

Images