Sat-based function-level source code vulnerability detection method

Abstract

The application discloses a SAT-based function-level source code vulnerability detection method, which comprises the following steps: source code preprocessing; PDG graph generation; PDG vector graph construction containing centrality information; using GNN structure to extract node k-hop range structure information; constructing and training a source code vulnerability detection model based on a Transformer; and performing vulnerability detection. The centrality information of nodes is added to the graph structure representation of the code, the k_subtree is used in the neural network to extract the structure information of the code, the RWPE is used to retain the sequence information of the code lines, the structure perception Transformer is used to predict whether the source code contains a vulnerability, and better false positive rate and false negative rate can be obtained in the function-level vulnerability detection compared with the traditional vulnerability detection method and the existing neural network-based vulnerability detection method.

Description

Technical Field

[0001] This invention belongs to the field of software vulnerability detection technology, and involves graph neural networks, PDG graphs, Transformers and intelligent vulnerability mining technologies, especially a function-level source code vulnerability detection method based on SAT. Background Technology

[0002] In recent years, with the increasing complexity of computer software systems, the number of potential security vulnerabilities has been on the rise. Although some disclosed software security vulnerabilities have been patched, this does not mean that the harm faced by computer users when using software systems has decreased.

[0003] Software security vulnerabilities are not only increasing in number year by year, but their forms are also becoming more complex and diverse, posing a serious challenge to the normal operation of software systems. Software security vulnerabilities exist covertly at every stage of the software lifecycle, and in response to this increasingly serious situation, security researchers have devoted considerable effort to vulnerability detection.

[0004] Traditional source code vulnerability detection methods can be divided into similarity-based and pattern-learning-based methods. Similarity-based methods are very effective for scenarios involving code duplication and reuse, but they cannot detect newly emerging vulnerabilities, resulting in a relatively high false negative rate. Pattern-learning-based methods require experts to pre-define vulnerability features and then match them, which relies too heavily on expert knowledge and has low accuracy. Current deep learning-based vulnerability detection methods do not fully utilize structural and sequential information, resulting in high false negative and false positive rates. Therefore, a more advanced source code vulnerability detection method is urgently needed. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a general C / C++ source code vulnerability detection method based on SAT (Structure Aware Transformer). By training PDG graphs of normal and vulnerable code, a model is built to determine whether the source code contains vulnerabilities. This method, based on graph neural networks and Transformer neural networks, can simultaneously utilize the structural information in the PDG graph and the sequential information in the code line sequence. Compared to traditional vulnerability detection methods and deep learning detection methods, it has a lower false positive rate and a lower false negative rate.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] A function-level source code vulnerability detection method based on SAT includes the following steps:

[0008] Step 1, Source Code Preprocessing

[0009] Collect vulnerability source code data and standardize the source code;

[0010] Step 2, PDG diagram generation

[0011] Generate a graph structure representation of the PDG graph based on code data dependencies and control dependencies;

[0012] Step 3: Construction of PDG vector graph containing centrality information and dataset partitioning

[0013] All nodes in the PDG graph are vectorized using sentence embedding, and Katz centrality information is added to each node.

[0014] Step 4: Use the GNN structure to extract the k-hop range structure information of the nodes.

[0015] Graph neural networks are used to extract structural information within a k-hop range around each node in the PDG graph and aggregate it into that node.

[0016] Step 5: Construction and Training of a Transformer-Based Source Code Vulnerability Detection Model

[0017] The nodes are located using RWPE, trained using a Transformer neural network to obtain a vulnerability detection model, and then vulnerability detection is performed.

[0018] Furthermore, step 1 includes the following sub-steps:

[0019] Step 1-1: Collect the SARD source code vulnerability dataset. The collected code dataset contains several vulnerable functions and several functions without vulnerabilities.

[0020] Steps 1-2: Extract vulnerability code tags from the dataset;

[0021] Steps 1-3: Delete all comments in the code;

[0022] Steps 1-4 map manually defined variable names one-to-one to normalized variable names;

[0023] Steps 1-5 map manually defined function names one-to-one to standardized function names.

[0024] Furthermore, step 2 includes the following sub-steps:

[0025] Step 2-1: Use the joern tool to generate a program control flow graph (CFG) from the preprocessed source code.

[0026] Step 2-2: Combining the CFG diagram, use Python's networkx library and joern to analyze and extract data dependencies and control dependencies from the source code;

[0027] Steps 2-3: Generate a PDG graph based on data dependencies and control dependencies, and save it in .dot format.

[0028] Furthermore, step 3 includes the following sub-steps:

[0029] Step 3-1: Calculate the Katz centrality of each node in the PDG graph;

[0030] Step 3-2: Extract the code content of each node from the PDG graph, and use the send2vec algorithm to convert the code in the node into a vector representation;

[0031] Step 3-3: Multiply the vector representation result by its Katz centrality, and use the result as a node in the PDG vector graph;

[0032] The Katz centrality of all nodes in a PDG graph can be represented in matrix form as follows:

[0033]

[0034] α is a constant. Let A be a vector containing the Katz centrality of all nodes, A be the adjacency matrix of the PDG graph, β be a constant vector, and I be the identity matrix.

[0035] Furthermore, step 4 includes the following sub-steps:

[0036] Step 4-1: Divide the code dataset into a training set, a validation set, and a test set;

[0037] Step 4-2: For each node in the PDG vector graph, extract its subgraph within the k-hop range as the root node;

[0038] Step 4-3: For the subgraph, use GNN to extract the subgraph structure information.

[0039] Furthermore, step 4-3 specifically includes the following process:

[0040] Methods for extracting subgraph structure information using GNN include: employing a k_subtree extractor and a k_subgraph extractor; the k_subtree extractor, for a node u in the PDG graph G, extracts its k-hop subtree with u as the root node, and applies the GNN model to this subtree, using the output corresponding to node u as the vector representation at u, where G represents the PDG graph:

[0041]

[0042] The k-subgraph extractor, based on the k-subtree, adjusts the GNN to utilize the entire k-subgraph, using a pooling function to aggregate the updated node representations of all nodes within the k-hop neighborhood; formally, if using... If node u includes its own k-hop neighborhood, then node u is represented as:

[0043]

[0044] Essentially, the k-subgraph GNN extractor is equivalent to using the k-subtree GNN extractor for each node within the k-hop range of node u, and using the pooling function aggregation result as a new vector representation for that node.

[0045] Furthermore, step 5 includes the following sub-steps:

[0046] Step 5-1: Encode the code line positions using the RWPE algorithm;

[0047] Step 5-2, Transformer architecture construction and training;

[0048] Step 5-3: Use the trained model to detect the source code to be tested and predict whether the program to be tested contains vulnerabilities.

[0049] Furthermore, the Transformer structure in step 5-2 is as follows:

[0050] The Transformer architecture comprises a self-attention structure and a feedforward neural network structure; the feedforward neural network is a simple MLP; in the self-attention structure, the input node feature set X is first mapped to query(Q), key(K), and value(V); where , , Self-attention computation can be expressed as:

[0051]

[0052] in Indicates the dimension of Q. , , These are three weights that need to be trained; the Transformer uses a multi-head attention mechanism, which maps the input node features to a low dimension using different weights according to the above formula, and finally concatenates multiple instances of the above formula.

[0053] For each node in the PDG graph Its self-attention calculation process is represented by the following three formulas, where, This represents the dot product between the two. Let exp(x) represent the set of nodes in the PDG graph. e is the natural constant. and This represents two nodes in the PDG graph.

[0054]

[0055]

[0056]

[0057] Using the node vector representation obtained from the structure extraction as the input to Q and W of the transformer structure, and the word embedding vector of each node as the input to V, the self-attention calculation formula for each node can be obtained as follows:

[0058]

[0059] in This represents the node vector extracted from node v during the structure extraction stage after position encoding.

[0060] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0061] 1. This invention, by training PDG graphs of normal and vulnerable code, can build a model to determine whether source code contains vulnerabilities. This improves the accuracy and false positive rate of vulnerability detection.

[0062] 2. This invention incorporates node centrality information into the graph structure representation of code, uses k_subtree in the neural network to extract structural information of the code, uses RWPE to preserve the order information of code lines, and uses a structure-aware Transformer to predict whether the source code contains vulnerabilities. It can achieve better false positive and false negative rates in function-level vulnerability detection compared to traditional vulnerability detection methods and existing neural network-based vulnerability detection methods.

[0063] 3. This invention standardizes the source code, reducing the impact of programmers' programming habits on the effectiveness of vulnerability detection.

[0064] 4. This invention is based on graph neural networks and Transformer neural networks, which can simultaneously make full use of the structural information in the PDG graph and the sequential information in the code line sequence. Attached Figure Description

[0065] Figure 1This is a schematic diagram of the function-level source code vulnerability detection method based on SAT provided by the present invention. Detailed Implementation

[0066] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0067] The function-level source code vulnerability detection method based on SAT provided by this invention has the following process: Figure 1 As shown, it includes the following steps:

[0068] Step 1, Source Code Preprocessing

[0069] Collect vulnerability source code data and standardize the source code, including the following sub-steps:

[0070] Step 1-1: Collect the SARD source code vulnerability dataset. The collected dataset contains 12,303 vulnerable functions and 21,057 functions without vulnerabilities.

[0071] Steps 1-2: Extract vulnerability code tags from the dataset.

[0072] Steps 1-3: Remove all comments from the code, as they do not express any syntactic or semantic information.

[0073] Steps 1-4 map manually defined variable names one-to-one to normalized variable names (e.g., abc1 is mapped to VAR1).

[0074] Steps 1-5 map manually defined function names one-to-one to normalized function names (e.g., fun_tmp is mapped to FUN1).

[0075] Step 2, PDG diagram generation

[0076] Generating a graph structure representation of the PDG graph based on code data dependencies and control dependencies includes the following sub-steps:

[0077] Step 2-1: Use the joern tool to generate a program control flow graph (CFG) from the preprocessed source code.

[0078] Step 2-2: Combining the CFG diagram, use Python's NetworkX library and Joern to analyze and extract data dependencies and control dependencies from the source code.

[0079] Steps 2-3: Generate a PDG graph based on data dependencies and control dependencies, and save it in .dot format.

[0080] Step 3: Constructing the PDG vector graph containing centrality information

[0081] All nodes in the PDG graph are vectorized using sentence embedding, and Katz centrality information is added to each node; this includes the following sub-steps:

[0082] Step 3-1: Calculate the Katz centrality of each node in the PDG graph.

[0083] Step 3-2: Extract the code content of each node from the PDG graph and use the send2vec algorithm to convert the code in the node into a vector representation.

[0084] Step 3-3: Multiply the vector representation result by its Katz centrality, and use the result as a node in the PDG vector graph.

[0085] The Katz centrality of all nodes in a graph can be represented in matrix form as follows:

[0086]

[0087] α is a constant. Let A be a vector representing the Katz centrality of all nodes, A be the adjacency matrix of the PDG graph, β be a constant vector, and I be the identity matrix.

[0088] Step 4: Use the GNN structure to extract the k-hop range structure information of the nodes.

[0089] The structural information within a k-hop range around each node in the PDG graph is extracted using a graph neural network and aggregated into that node, including the following sub-steps:

[0090] Step 4-1: Divide the code dataset into a training set, a validation set, and a test set in a ratio of 8:1:1.

[0091] Step 4-2: For each node in the PDG vector graph, extract its subgraph within k hops as the root node. The value of k is set to 3.

[0092] Step 4-3: For the subgraph, use GNN to extract the subgraph structure information.

[0093] There are two main ways to extract subgraph structure information using GNN: the k_subtree extractor and the k_subgraph extractor. The k_subtree extractor takes a node u in the PDG graph G as the root node, extracts its k-hop subtree, applies the GNN model to the subtree, and uses the output corresponding to node u as the vector representation at u. G represents the PDG graph.

[0094]

[0095] k-subgraph, building upon k-subtree, adjusts the GNN to utilize the entire k-subgraph, using pooling functions (such as summation) to aggregate the updated node representations of all nodes within the k-hop neighborhood. Formally, if using... If node u includes its own k-hop neighborhood, then node u is represented as:

[0096]

[0097] Essentially, the k-subgraph GNN extractor is equivalent to using the k-subtree GNN extractor for each node within the k-hop range of node u, and using the pooling function aggregation result as a new vector representation for that node.

[0098] Step 5: Construction and Training of a Transformer-Based Source Code Vulnerability Detection Model

[0099] The node location is encoded using RWPE, and a vulnerability detection model is trained using a Transformer neural network; this includes the following sub-steps:

[0100] Step 5-1: Encode the code line positions using the RWPE algorithm.

[0101] Step 5-2, Transformer structure construction and training steps.

[0102] The Transformer architecture primarily comprises a self-attention structure and a feedforward neural network structure. The feedforward neural network is a simple MLP. In the self-attention structure, the input node feature set X is first mapped to query(Q), key(K), and value(V). , , Self-attention computation can be represented as follows.

[0103]

[0104] in Indicates the dimension of Q. , , These are three weights that need to be trained. Transformers typically use a multi-head attention mechanism, which maps the input node features to a low dimension using different weights according to the above formula, and finally concatenates multiple instances of the above formula.

[0105] For each node in the PDG graph Its self-attention calculation process is represented by the following three formulas, where, This represents the dot product between the two. Let exp(x) represent the set of nodes in the PDG graph. e is the natural constant. and This represents two nodes in the PDG graph.

[0106]

[0107]

[0108]

[0109] The node vectors extracted from the structure are used as inputs to Q and W of the transformer structure, and the word embedding vectors of each node are used as inputs to V. The self-attention calculation formula for each node can be obtained as follows.

[0110]

[0111] in This represents the node vector extracted from node v in the structure extraction stage of step 4-3.

[0112] Step 5-3: Use the trained model to detect the source code to be tested and predict whether the program to be tested contains vulnerabilities.

[0113] The technical means disclosed in this invention are not limited to those disclosed in the above embodiments, but also include technical solutions composed of any combination of the above technical features. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications are also considered within the scope of protection of this invention.

Claims

1. A SAT-based function-level source code vulnerability detection method, characterized in that, Includes the following steps: Step 1, Source Code Preprocessing Collect vulnerability source code data and standardize the source code; Step 2, PDG diagram generation Generate a graph structure representation of the PDG graph based on code data dependencies and control dependencies; Step 3: Constructing the PDG vector graph containing centrality information All nodes in the PDG graph are vectorized using sentence embedding, and Katz centrality information is added to each node. Step 4: Use the GNN structure to extract the k-hop range structure information of the nodes. Graph neural networks are used to extract structural information within a k-hop range around each node in the PDG graph and aggregate it into that node. Step 5: Construction and Training of a Transformer-Based Source Code Vulnerability Detection Model The nodes are located using RWPE, a Transformer neural network is trained to obtain a vulnerability detection model, and vulnerability detection is performed; step 5 includes the following sub-steps: Step 5-1: Encode the code line positions using the RWPE algorithm; Step 5-2, Transformer structure construction and training; The Transformer structure is as follows: The Transformer architecture comprises a self-attention structure and a feedforward neural network structure; the feedforward neural network is a simple MLP; in the self-attention structure, the input node feature set X is first mapped to Q, K, V; where , , Self-attention computation can be expressed as: in Indicates the dimension of Q. , , There are three weights that need to be trained; Transformer uses a multi-head attention mechanism, which maps the input node features to a low dimension using different weights according to the above formula, and finally concatenates multiple instances of the above formula. For each node in the PDG graph Its self-attention calculation process is represented by the following three formulas, where, This represents the dot product between the two. This represents the set of nodes in the PDG graph. and Representing two nodes in the PDG graph: Using the node vector representation obtained from the structure extraction as the input to Q and W of the Transformer structure, and the word embedding vector of each node as the input to V, the self-attention calculation formula for each node can be obtained as follows: in This represents the node vector extracted from node v during the structure extraction stage after position encoding; Step 5-3: Use the trained model to detect the source code to be tested and predict whether the program to be tested contains vulnerabilities.

2. The function-level source code vulnerability detection method based on SAT according to claim 1, characterized in that, Step 1 includes the following sub-steps: Step 1-1: Collect the SARD source code vulnerability dataset. The collected code dataset contains several vulnerable functions and several functions without vulnerabilities. Steps 1-2: Extract vulnerability code tags from the dataset; Steps 1-3: Delete all comments in the code; Steps 1-4 map manually defined variable names one-to-one to normalized variable names; Steps 1-5 map manually defined function names one-to-one to standardized function names.

3. The function-level source code vulnerability detection method based on SAT according to claim 1, characterized in that, Step 2 includes the following sub-steps: Step 2-1: Use the joern tool to generate a program control flow graph (CFG) from the preprocessed source code. Step 2-2: Combining the CFG diagram, use Python's networkx library and joern to analyze and extract data dependencies and control dependencies from the source code; Steps 2-3: Generate a PDG graph based on data dependencies and control dependencies, and save it in .dot format.

4. The function-level source code vulnerability detection method based on SAT according to claim 1, characterized in that, Step 3 includes the following sub-steps: Step 3-1: Calculate the Katz centrality of each node in the PDG graph; Step 3-2: Extract the code content of each node from the PDG graph, and use the send2vec algorithm to convert the code in the node into a vector representation; Step 3-3: Multiply the vector representation result by its Katz centrality, and use the result as a node in the PDG vector graph; The Katz centrality of all nodes in a graph can be represented in matrix form as follows: α is a constant. Let A be a vector representing the Katz centrality of all nodes, A be the adjacency matrix of the PDG graph, β be a constant vector, and I be the identity matrix.

5. The SAT-based function-level source code vulnerability detection method according to claim 1, characterized in that, Step 4 includes the following sub-steps: Step 4-1: Divide the code dataset into a training set, a validation set, and a test set; Step 4-2: For each node in the PDG vector graph, extract its subgraph within the k-hop range as the root node; Step 4-3: For the subgraph, use GNN to extract the subgraph structure information.

6. The SAT-based function-level source code vulnerability detection method according to claim 5, characterized in that, Step 4-3 specifically includes the following process: Methods for extracting subgraph structure information using GNN include: employing a k_subtree extractor and a k_subgraph extractor; the k_subtree extractor, for a node u in the PDG graph G, extracts its k-hop subtree with u as the root node, and applies the GNN model to this subtree, using the output corresponding to node u as the vector representation at u, where G represents the PDG graph: The k_subgraph extractor, based on the k_subtree, adjusts the GNN to utilize the entire k-subgraph, using a pooling function to aggregate the updated node representations of all nodes within the k-hop neighborhood; formally, if using If node u includes its own k-hop neighborhood, then node u is represented as: Essentially, the k_subgraph extractor is equivalent to using the k_subtree extractor on each node within the k-hop range of node u, and using the pooling function aggregation result as a new vector representation of that node.

Images