Code correction method, correction device and intelligent analysis system

Abstract

The present application provides a code correction method, correction device and intelligent analysis system, which includes: parsing source code to convert the source code into a syntax tree; performing pre-analysis based on a code blacklist and the syntax tree to obtain a first analysis result; if the first analysis result indicates that a vulnerability exists, inputting the first analysis result, the syntax tree and the source code into a code correction model to obtain a first correction code; if the first analysis result indicates that there is no vulnerability, performing control flow analysis on the control flow to obtain a second analysis result, and performing data flow analysis on the data flow to obtain a third analysis result; simulating the source code in a simulation environment to perform simulation analysis to obtain a fourth analysis result; and inputting the second analysis result, the third analysis result, the fourth analysis result, the syntax tree and the source code into the code correction model to obtain a second correction code. The present application solves the problem that the code detection method in the prior art has a high false alarm rate, resulting in low quality of the corrected code.

Description

Technical Field

[0001] The present invention relates to the field of data communication technology, and in particular to a code correction method, correction device, computer-readable storage medium and intelligent analysis system. Background Art

[0002] With the continuous development of computer technology and the application of new technologies such as "Big Data, Intelligence, Internet of Things, Mobility, and Cloud," the scale and number of systems and application software are enormous. During program development, design flaws and security vulnerabilities pose a serious threat to the secure and stable operation of systems. This is especially true in cloud applications, where software source code vulnerabilities can lead to a range of security issues, including data corruption, service outages, and system failures.

[0003] The code security scanning methods in the existing technology are not intelligent enough, the scanning methods are single, the false alarm rate is high, and the report results are difficult to interpret. There is a lack of a method that can link multiple code detection methods to obtain the results of comprehensive code analysis and improve the accuracy of code security risk detection and the readability of the results. Summary of the Invention

[0004] The main purpose of this application is to provide a code correction method, correction device, computer-readable storage medium and intelligent analysis system to at least solve the problem in the prior art that the code detection method in the prior art has a high false alarm rate, resulting in low quality of the corrected code.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a code correction method is provided, comprising: parsing the source code to obtain a header file and a definition file and converting the source code into a syntax tree according to the header file and the definition file; obtaining a code blacklist, performing a pre-analysis based on the code blacklist and the syntax tree to obtain a first analysis result, the first analysis result being used to characterize whether there is a vulnerability in the source code, the code blacklist including a plurality of first preset fields, one first preset field corresponding to one vulnerability; when the first analysis result indicates that there is a vulnerability, the first analysis result, the syntax tree and the source code are input into a code correction model to obtain a first correction code, the code correction model being trained based on a training data set, the training data set including a plurality of source codes, a plurality of analysis results corresponding to the source codes, and a plurality of analysis results corresponding to the source codes. The syntax tree and the correction code corresponding to the source code, the analysis result including at least the first analysis result; when the first analysis result shows that there is no vulnerability, the syntax tree is analyzed to obtain a control flow and a data flow, and a control flow analysis is performed on the control flow to obtain a second analysis result, and a data flow analysis is performed on the data flow to obtain a third analysis result, the second analysis result is used to characterize whether the structure of the source code needs to be adjusted, and the third analysis result is used to characterize whether there is redundant code that can be deleted in the source code; the source code is simulated and run in a simulation environment for simulation analysis to obtain a fourth analysis result, and the fourth analysis result is used to characterize whether there is an attack behavior in the source code; the second analysis result, the third analysis result, the fourth analysis result, the syntax tree and the source code are input into the code correction model to obtain a second correction code.

[0006] Optionally, a code blacklist is obtained, and a pre-analysis is performed based on the code blacklist and the syntax tree, including: matching a current field in the source code with the first preset field in the code blacklist; when there is a field consistent with the first preset field in the current field, determining that the first analysis result is that there is a vulnerability in the source code; when there is no field consistent with the first preset field in the current field, determining that the first analysis result is that there is no vulnerability in the source code.

[0007] Optionally, the syntax tree is analyzed to obtain a control flow and a data flow, and a control flow analysis is performed on the control flow to obtain a second analysis result, including: obtaining a second preset field, searching the source code according to the second preset field to obtain a target control field; performing semantic analysis on the source code, determining a target controlled field according to the target control field, where one target control field corresponds to at least one target controlled field, and one target controlled field corresponds to one target control field; performing a recursive operation based on the target control field and the target controlled field to determine a control relationship in the source code to obtain the control flow; and constructing a control flow graph based on the control flow, the target control field, the target controlled field, and the source code to obtain the second analysis result, where the control flow graph is used to characterize the control relationship between the fields of the source code.

[0008] Optionally, performing data flow analysis on the data flow to obtain a third analysis result includes: obtaining a third preset field, searching the source code according to the third preset field to determine the variable parameters in the source code and the operation functions corresponding to the variable parameters to obtain the data flow; representing the source code in the form of a data flow graph according to the data flow to obtain a target data flow graph, where a point in the data flow graph represents a statement, and an edge represents a data flow; determining a target edge according to the variable parameter, marking the target edge to obtain a target point group, where the target edge is the edge corresponding to the data flow to which the variable parameter belongs, and the target point group is used to record the parameter changes of the variable parameter in the data flow before and after the assignment field, and the target point group includes an input node and an output node, the input node includes the parameters of the variable parameter before the assignment field is assigned, and the output node includes the parameters of the variable parameter after the assignment field is assigned; When the parameters are inconsistent, a first mark is added to the assignment field; when the parameters of the output node and the input node are consistent, a second mark is added to the assignment field to obtain a first analysis sub-result, wherein the first mark is used to indicate that the assignment field corresponding to the target point group is the redundant code, and the second mark is used to indicate that the assignment field corresponding to the target point group is not the redundant code; a fourth preset field is obtained, and the source code is retrieved according to the fourth preset field to obtain a pointer field, wherein the pointer field is used to determine the storage location of the variable parameter; when the storage locations corresponding to any two pointer fields are the same, it is determined that the pointer fields are aliases of each other; a third mark is added to a fifth preset field in the field to which the pointers that are aliases belong to obtain a second analysis sub-result, wherein the third mark is used to indicate that the fifth preset field is the redundant code; and the third analysis result is determined according to the first analysis sub-result and the second analysis sub-result.

[0009] Optionally, the source code is simulated and analyzed in a simulation environment to obtain a fourth analysis result, including: obtaining a sixth preset field, retrieving the source code according to the sixth preset field to obtain a location field, where the location field is used to characterize an object of the source code; constructing the simulation environment according to the object of action, and performing a simulation on the source code in the simulation environment to determine a storage location that is rewritten during the execution of the source code to obtain a target storage location; determining whether the code has an attack behavior based on a change in a checksum value in the source code before and after the simulation and a preset range to obtain a third analysis sub-result; determining whether the source code has an attack behavior based on matching the target storage location with a preset storage location to obtain the fourth analysis sub-result; and determining the fourth analysis result based on the third analysis sub-result and the fourth analysis sub-result.

[0010] Optionally, after constructing the simulation environment according to the action object, the method further includes: obtaining a first check value and a second check value, the first check value being the check value in the source code before the simulation run, and the second check value being the check value in the source code after the simulation run; determining a check value deviation according to the first check value and the second check value, and determining that the attack behavior exists in the source code if the check value deviation is greater than the preset range, and determining that the attack behavior does not exist in the source code if the check value deviation is less than the preset range.

[0011] Optionally, after retrieving the source code according to the sixth preset field to obtain the location field, the method further includes: determining that the source code contains the attack behavior if a preset action object exists among the action objects; and determining that the source code contains the attack behavior if the preset action object does not exist among the action objects.

[0012] According to another aspect of the present application, a code correction device is provided, the device comprising: a first analysis unit, configured to parse source code to obtain a header file and a definition file and convert the source code into a syntax tree according to the header file and the definition file; a first acquisition unit, configured to obtain a code blacklist, perform pre-analysis according to the code blacklist and the syntax tree, and obtain a first analysis result, the first analysis result being used to characterize whether there is a vulnerability in the source code, the code blacklist comprising a plurality of first preset fields, one first preset field corresponding to one vulnerability; a first input unit, configured to input the first analysis result, the syntax tree, and the source code into a code correction model when the first analysis result indicates that a vulnerability exists, to obtain a first correction code, the code correction model being trained based on a training data set, the training data set comprising a plurality of source codes, a plurality of analysis results corresponding to the source codes, and all the analysis results corresponding to the source codes. The syntax tree and the correction code corresponding to the source code, the analysis result including at least the first analysis result; a second analysis unit, configured to, when the first analysis result indicates that there is no vulnerability, analyze the syntax tree to obtain a control flow and a data flow, perform a control flow analysis on the control flow to obtain a second analysis result, and perform a data flow analysis on the data flow to obtain a third analysis result, the second analysis result being used to characterize whether the structure of the source code needs to be adjusted, and the third analysis result being used to characterize whether there is redundant code that can be deleted in the source code; a simulation unit, configured to simulate the running of the source code in a simulation environment for simulation analysis to obtain a fourth analysis result, the fourth analysis result being used to characterize whether there is an attack behavior in the source code; and a second input unit, configured to input the second analysis result, the third analysis result, the fourth analysis result, the syntax tree, and the source code into the code correction model to obtain a second correction code.

[0013] According to another aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute any one of the methods described.

[0014] According to another aspect of the present application, an intelligent analysis system is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include means for executing any one of the methods described.

[0015] Applying the technical solution of the present application, in the method for correcting the above-mentioned code, first, the source code is parsed to obtain a header file and a definition file, and the above-mentioned source code is converted into a syntax tree according to the above-mentioned header file and the above-mentioned definition file; then, a code blacklist is obtained, and a pre-analysis is performed according to the above-mentioned code blacklist and the above-mentioned syntax tree to obtain a first analysis result, and the above-mentioned first analysis result is used to characterize whether there is a vulnerability in the above-mentioned source code, and the above-mentioned code blacklist includes multiple first preset fields, and one of the above-mentioned first preset fields corresponds to one of the above-mentioned vulnerabilities; thereafter, when the above-mentioned first analysis result is that there is a vulnerability, the above-mentioned first analysis result, the above-mentioned syntax tree and the above-mentioned source code are input into a code correction model to obtain a first corrected code, and the above-mentioned code correction model is trained according to a training data set, and the above-mentioned training data set includes multiple source codes, multiple analysis results corresponding to the above-mentioned source codes, the above-mentioned syntax trees corresponding to the above-mentioned source codes and The above-mentioned correction code corresponding to the above-mentioned source code, the above-mentioned analysis results at least include the above-mentioned first analysis results; then, when the above-mentioned first analysis result is that there is no vulnerability, the above-mentioned syntax tree is analyzed to obtain control flow and data flow, and the above-mentioned control flow is subjected to control flow analysis to obtain a second analysis result, and the above-mentioned data flow is subjected to data flow analysis to obtain a third analysis result, the above-mentioned second analysis result is used to indicate whether the structure of the above-mentioned source code needs to be adjusted, and the above-mentioned third analysis result is used to indicate whether there is redundant code that can be deleted in the above-mentioned source code; then, the above-mentioned source code is simulated and run in a simulation environment for simulation analysis to obtain a fourth analysis result, and the above-mentioned fourth analysis result is used to indicate whether there is an attack behavior in the above-mentioned source code; finally, the above-mentioned second analysis result, the above-mentioned third analysis result, the above-mentioned fourth analysis result, the above-mentioned syntax tree and the above-mentioned source code are input into the above-mentioned code correction model to obtain the second correction code. The present application filters the fields in the source code according to a blacklist, and determines that there is a vulnerability in the source code when a field in the blacklist exists in the meta-code. Then, if there is no vulnerability in the source code, the source code is subjected to data flow analysis and control flow analysis, and the structure and content of the source code are analyzed to evaluate the redundancy and unnecessary structure of the source code. The code is then trial-run in a simulation environment to determine whether the code has potential hazards. A code correction model is input based on the multiple analysis results, and the code is automatically corrected by the model. The code is detected through multiple dimensions, thereby solving the problem of high false alarm rate of code detection methods in the prior art, resulting in low quality of the corrected code. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 The following is a block diagram showing a hardware structure of a mobile terminal according to a code modification provided in an embodiment of the present application;

[0017] Figure 2 A schematic flow chart of a code correction method according to an embodiment of the present application is shown;

[0018] Figure 3 A flowchart of a specific code correction method provided according to an embodiment of the present application is shown;

[0019] Figure 4 The figure shows a structural block diagram of a code correction device provided according to an embodiment of the present application.

[0020] The above drawings include the following reference numerals:

[0021] 102. Processor; 104. Memory; 106. Transmission device; 108. Input / output device. DETAILED DESCRIPTION

[0022] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0023] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] For ease of description, some nouns or terms involved in the embodiments of the present application are explained below:

[0026] Header file: A carrier file containing function and data connection port declarations, mainly used to protect program declarations.

[0027] Source file: refers to the code written in assembly language or high-level language.

[0028] Syntax tree: also known as syntax tree, refers to an abstract representation of the grammatical structure of the source code.

[0029] Control flow: refers to the order in which program elements are arranged to determine the execution order of the program.

[0030] Data stream: refers to a set of ordered byte data sequences with a starting point and an end point. It includes input streams and output streams.

[0031] Control flow analysis: CFA for short, is a static code analysis technique that confirms the execution flow of a program.

[0032] Data flow analysis: A code analysis technique that collects semantic information about a program from its code and algebraically determines the definitions and uses of variables at compile time.

[0033] As introduced in the background technology, the detection method for code detection in the prior art is relatively simple and has a high false alarm rate. In order to solve the problem that the code detection method in the prior art has a high false alarm rate, resulting in low quality of the corrected code, the embodiments of the present application provide a code correction method, correction device, computer-readable storage medium and intelligent analysis system.

[0034] The technical solutions in the embodiments of the present invention will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present invention.

[0035] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure diagram of a mobile terminal of a code correction method according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown) a processor 102 (the processor 102 may include but is not limited to a microprocessor MCU or a programmable logic device FPGA and other processing devices) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input and output device 108 for communication functions. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0036] The memory 104 can be used to store computer programs, such as software programs and modules of application software, such as the computer program corresponding to the device information display method in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, implementing the above-mentioned method. The memory 104 may include a high-speed random access memory and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned networks include but are not limited to the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The transmission device 106 is used to receive or send data via a network. Specific examples of the above-mentioned network may include a wireless network provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, abbreviated as NIC), which can be connected to other network devices via a base station to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0037] In this embodiment, a method for correcting code running on a mobile terminal, a computer terminal or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0038] Figure 2 Flowchart of the code correction method according to the embodiment of the present application. Figure 2 As shown, the method includes the following steps:

[0039] Step S201: Parse the source code to obtain a header file and a definition file and convert the source code into a syntax tree according to the header file and the definition file;

[0040] Specifically, the source code is parsed to obtain the header file and definition file corresponding to the source code, the code's running environment and execution code are determined, and then a syntax tree is constructed according to the code's grammatical structure to facilitate analysis of structural errors in the code.

[0041] Step S202: Obtain a code blacklist, perform a pre-analysis based on the code blacklist and the syntax tree to obtain a first analysis result, wherein the first analysis result is used to indicate whether there is a vulnerability in the source code. The code blacklist includes a plurality of first preset fields, each of which corresponds to one vulnerability.

[0042] Specifically, security specifications for code writing are collected online, and fields that should not appear in the writing process are analyzed and integrated to obtain the above-mentioned code blacklist. The code blacklist is then compared with the syntax tree generated according to the source code to determine whether there is code in the syntax tree that causes the vulnerability, thereby obtaining the above-mentioned first analysis result.

[0043] Step S203: If the first analysis result indicates a vulnerability, the first analysis result, the syntax tree, and the source code are input into a code correction model to obtain a first corrected code, wherein the code correction model is trained based on a training dataset, the training dataset including a plurality of source codes, a plurality of analysis results corresponding to the source codes, the syntax trees corresponding to the source codes, and the corrected code corresponding to the source codes, the analysis results including at least the first analysis result.

[0044] Specifically, when the first analysis result indicates that there is a field corresponding to a vulnerability in the source code, it is determined that the code needs to be repaired, and then the first analysis result, the syntax tree and the source code are input into the code correction model. The code correction model modifies the source code accordingly based on the vulnerability field indicated in the first analysis result and the syntax structure in the syntax tree to obtain the code after the vulnerability is repaired, that is, the first corrected code.

[0045] Step S204: If the first analysis result indicates that there is no vulnerability, the syntax tree is analyzed to obtain a control flow and a data flow, and a control flow analysis is performed on the control flow to obtain a second analysis result, and a data flow analysis is performed on the data flow to obtain a third analysis result. The second analysis result is used to indicate whether the structure of the source code needs to be adjusted, and the third analysis result is used to indicate whether there is redundant code in the source code that can be deleted.

[0046] Specifically, when the first analysis result is that there are no vulnerabilities in the source code, the standardization and complexity of the code are analyzed. First, a control flow analysis is performed on the grammatical number, that is, according to the grammatical structure of the syntax tree, the grammatical structure is represented as a control flow graph that is more conducive to model recognition, and then a data flow graph is generated based on the control flow graph. Then, a data flow analysis is performed on the data flow graph to determine whether there is any meaningless code that can be deleted, so as to reduce the complexity of the code.

[0047] Step S205: simulating and analyzing the source code in a simulation environment to obtain a fourth analysis result, which is used to indicate whether the source code contains any attack behavior.

[0048] Specifically, in order to avoid omissions caused by analyzing code hazards based solely on blacklists, in one embodiment of the present application, after data flow analysis and control flow analysis, the code needs to be simulated to determine whether there is any supply behavior in the code, thereby further ensuring the security of the code.

[0049] Step S206: input the second analysis result, the third analysis result, the fourth analysis result, the syntax tree, and the source code into the code correction model to obtain a second corrected code.

[0050] Specifically, after completing the above analysis, the above second analysis result, the above third analysis result, the above fourth analysis result, the above syntax tree and the above source code are input into the code correction model. The code correction model adjusts the code according to the control flow graph, and deletes redundant code according to the above third analysis result, streamlines the code complexity, and finally deletes the code field with attack behavior according to the fourth analysis result to obtain the corrected code, namely the above second corrected code.

[0051] According to this embodiment, first, the source code is parsed to obtain a header file and a definition file, and the source code is converted into a syntax tree according to the header file and the definition file; then, a code blacklist is obtained, and a pre-analysis is performed according to the code blacklist and the syntax tree to obtain a first analysis result, and the first analysis result is used to characterize whether there is a vulnerability in the source code, and the code blacklist includes multiple first preset fields, and one first preset field corresponds to one vulnerability; thereafter, when the first analysis result is that there is a vulnerability, the first analysis result, the syntax tree and the source code are input into a code correction model to obtain a first correction code, and the code correction model is trained according to a training data set, and the training data set includes multiple source codes, multiple analysis results corresponding to the source codes, the syntax trees corresponding to the source codes and the syntax trees corresponding to the source codes. The above-mentioned corrected code, the above-mentioned analysis result at least includes the above-mentioned first analysis result; then, when the above-mentioned first analysis result is that there is no vulnerability, the above-mentioned syntax tree is analyzed to obtain control flow and data flow, and the above-mentioned control flow is subjected to control flow analysis to obtain a second analysis result, and the above-mentioned data flow is subjected to data flow analysis to obtain a third analysis result, the above-mentioned second analysis result is used to characterize whether the structure of the above-mentioned source code needs to be adjusted, and the above-mentioned third analysis result is used to characterize whether there is redundant code that can be deleted in the above-mentioned source code; then, the above-mentioned source code is simulated and run in a simulation environment for simulation analysis to obtain a fourth analysis result, and the above-mentioned fourth analysis result is used to characterize whether there is an attack behavior in the above-mentioned source code; finally, the above-mentioned second analysis result, the above-mentioned third analysis result, the above-mentioned fourth analysis result, the above-mentioned syntax tree and the above-mentioned source code are input into the above-mentioned code correction model to obtain the second corrected code. The present application filters the fields in the source code according to a blacklist, and determines that there is a vulnerability in the source code when a field in the blacklist exists in the meta-code. Then, if there is no vulnerability in the source code, the source code is subjected to data flow analysis and control flow analysis, and the structure and content of the source code are analyzed to evaluate the redundancy and unnecessary structure of the source code. The code is then trial-run in a simulation environment to determine whether the code has potential hazards. A code correction model is input based on the multiple analysis results, and the code is automatically corrected by the model. The code is detected through multiple dimensions, thereby solving the problem of high false alarm rate of code detection methods in the prior art, resulting in low quality of the corrected code.

[0052] In order to eliminate the vulnerability fields in the source code, in an optional implementation, step S202 includes:

[0053] Step S2021, matching the current field in the source code with the first preset field in the code blacklist;

[0054] Specifically, the fields in the source code are traversed and matched with the fields in the code blacklist to determine whether all the fields in the source code are in the blacklist.

[0055] Step S2022: If there is a field in the current field that is consistent with the first preset field, determining that the first analysis result is that there is a vulnerability in the source code;

[0056] Specifically, when a field in the source code exists in the above-mentioned code blacklist, it means that there is a vulnerability field in the source code, and then the above-mentioned first analysis result is determined to be that there is a vulnerability in the above-mentioned source code, and the vulnerability field is recorded in the above-mentioned first analysis result to facilitate correction by the code correction model.

[0057] Step S2023: When the current field does not contain the field that is consistent with the first preset field, it is determined that the first analysis result is that there is no vulnerability in the source code.

[0058] Specifically, when a field in the source code does not exist in the above code blacklist, it means that there is no vulnerability field in the source code, and the next analysis process is performed.

[0059] In order to determine whether the code structure is correct, in an optional implementation, the above step S204 includes:

[0060] Step S20401: Obtain a second preset field, search the source code according to the second preset field, and obtain a target control field;

[0061] Specifically, preset control-related statements are obtained, including if, while, for, switch, etc., the source code is searched, and the same field in the source code is determined as the target control field.

[0062] Step S20402: performing semantic analysis on the source code, and determining a target controlled field according to the target control field. One target control field corresponds to at least one target controlled field, and one target controlled field corresponds to one target control field.

[0063] Specifically, semantic analysis is performed on the corresponding code block according to the target control field to determine the corresponding field controlled by the target control field, which is determined to be the target controlled field.

[0064] Step S20403, performing a recursive algorithm based on the target control field and the target controlled field to determine the control relationship in the source code and obtain the control flow;

[0065] Specifically, the target control field, the target controlled field and the code block are operated according to a recursive algorithm to determine the control relationship therein and extract the control flow.

[0066] Step S20404: construct a control flow graph based on the control flow, the target control field, the target controlled field, and the source code to obtain the second analysis result. The control flow graph is used to represent the control relationship between the fields of the source code.

[0067] Specifically, the source code is represented in the form of a control flow graph according to the control flow, thereby obtaining the second analysis result.

[0068] In order to reduce the complexity of the source code, in an optional implementation, the step S204 further includes:

[0069] Step S20405: Obtain a third preset field, search the source code according to the third preset field to determine variable parameters in the source code and operation functions corresponding to the variable parameters, and obtain the data stream;

[0070] Specifically, the source code is searched according to preset variable definitions or assignment fields, the variable parameters and the operation functions in the source code are determined, and the data stream is obtained.

[0071] Step S20406: Represent the source code in the form of a data flow graph according to the data flow to obtain a target data flow graph, where a point in the data flow graph represents a statement and an edge represents a data flow;

[0072] Specifically, according to the statements corresponding to the variable parameters and operation functions in the source code and the corresponding data flows, the statements are represented by points, and the data flow transformations between the statements are represented by edges to construct a data flow graph.

[0073] Step S20407: Determine a target edge based on the variable parameter, mark the target edge to obtain a target point group, the target edge being the edge corresponding to the data stream to which the variable parameter belongs, the target point group being used to record parameter changes of the variable parameter in the data stream before and after the value assignment field, the target point group including input nodes and output nodes, the input nodes including parameters of the variable parameter before the value assignment field is assigned, and the output nodes including parameters of the variable parameter after the value assignment field is assigned;

[0074] Specifically, the entry and exit of any variable parameter in the code block, ie the target point group, are determined based on any variable parameter, and whether the parameter values ​​contained in the variable parameter at the entry and exit change.

[0075] Step S20408: If the parameters of the output node and the input node are inconsistent, a first mark is added to the assignment field; if the parameters of the output node and the input node are consistent, a second mark is added to the assignment field, thereby obtaining a first analysis sub-result, wherein the first mark is used to indicate that the assignment field corresponding to the target point group is the redundant code, and the second mark is used to indicate that the assignment field corresponding to the target point group is not the redundant code.

[0076] Specifically, if there is no change, it means that the assignment and operation statements in the code block have not actually changed the variable parameters, and it can be inferred that the corresponding statements have no practical meaning, and deletion has no actual effect on the variable parameters; if there is a change, it means that the assignment statements and operation statements in the code block have changed the variable parameters, and deletion will cause the parameter values ​​of the variable parameters to change. Therefore, the statements whose variable parameters have changed are marked with the above first mark, and the statements whose parameter variables have not changed are marked with the above second mark, so that the code correction model can streamline the code.

[0077] Step S20409: Obtain a fourth preset field, and retrieve the source code according to the fourth preset field to obtain a pointer field, wherein the pointer field is used to determine the storage location of the variable parameter;

[0078] Specifically, the source code is searched according to a preset field for marking a storage location, and the field for marking a storage location in the source code is determined to be a pointer field.

[0079] Step S20410: if the storage locations corresponding to any two of the pointer fields are the same, determining that the pointer fields are aliases of each other;

[0080] Specifically, the storage location of each parameter is determined according to the address pointing to the storage location of each pointer, and the pointer fields pointing to the same storage location are determined to be aliases of each other.

[0081] Step S20411: Add a third tag to the fifth preset field in the fields to which the pointers belong that are aliases of each other, to obtain a second analysis sub-result, wherein the third tag is used to indicate that the fifth preset field is the redundant code;

[0082] Specifically, when two pointers are aliases of each other, the variable parameters will be changed during the data storage process. If the LORD statement is deleted, the variable parameters will not be changed. Therefore, a third mark is added to the corresponding LORD statement. The LORD statement with the third mark is not deleted. The LORD statement without the third mark indicates that the corresponding pointer fields are not aliases of each other, and their variable parameters are stored in different locations without interfering with each other. The LORD statement does not play a practical role and can be deleted.

[0083] Step S20412: Determine the third analysis result based on the first analysis sub-result and the second analysis sub-result.

[0084] Specifically, by combining the first analysis sub-result and the second analysis sub-result, the portion of the source code that can be deleted can be determined, that is, all the redundant codes in the source code can be obtained.

[0085] In order to further ensure the security of the source code, in an optional implementation, step S205 includes:

[0086] Step S2051: Obtain a sixth preset field, and retrieve the source code according to the sixth preset field to obtain a location field, where the location field is used to indicate an object of the source code.

[0087] Specifically, a comparison is performed based on preset fields to determine the object on which the source code acts, that is, to obtain the running environment of the source code.

[0088] Step S2052: constructing the simulation environment according to the action object, and performing a simulation operation on the source code in the simulation environment to determine the storage location rewritten during the operation of the source code to obtain the target storage location;

[0089] Specifically, adjustments are made in an isolated environment until the simulation environment reaches the code running environment of the above-mentioned target, the code is simulated and run in the simulation environment, and the storage location of the data actually changed in the source code is determined to obtain the above-mentioned target storage location.

[0090] Step S2053: determining whether the code contains attack behavior based on the change in the checksum value in the source code before and after the simulation and the preset range, thereby obtaining a third analysis sub-result;

[0091] Specifically, the encrypted fields of the code, such as MD5, will change before and after the code is run. The change in the MD5 value can be used to determine whether the code has attack behavior.

[0092] Step S2054: determining whether the source code contains any attack behavior based on matching the target storage location with the preset storage location, thereby obtaining the fourth analysis sub-result.

[0093] Specifically, based on the storage location of the data where the code is changed during the simulation, determine whether there are sensitive locations where the same type of code is not changed, that is, the above-mentioned preset storage locations. If so, it is determined that there is an attack behavior in the source code, and the field that generates the attack behavior is determined and recorded in the above-mentioned fourth analysis sub-result.

[0094] Step S2055: Determine the fourth analysis result according to the third analysis sub-result and the fourth analysis sub-result.

[0095] Specifically, by combining the third analysis sub-result and the fourth analysis sub-result, it can be determined whether the source code contains an attack behavior and the corresponding field that generates the attack behavior, which is the fourth analysis result.

[0096] In order to determine whether the source code contains attack behavior based on the check value, in an optional embodiment, after constructing the simulation environment based on the action object, the method further includes:

[0097] Step S301, obtaining a first check value and a second check value, wherein the first check value is the check value in the source code before the simulation run, and the second check value is the check value in the source code after the simulation run;

[0098] Specifically, the verification values ​​before and after the simulation are obtained to obtain the first verification value and the second verification value.

[0099] Step S302: determining a check value deviation based on the first check value and the second check value; if the check value deviation is greater than the preset range, determining that the source code contains the attack behavior; if the check value deviation is less than the preset range, determining that the source code does not contain the attack behavior.

[0100] Specifically, based on the type of code function, the range of checksum changes before and after the code is run can be determined, and then the actual checksum change range before and after the code is run can be compared with the preset checksum change range. If the range is exceeded, it indicates that the above source code contains attack behavior.

[0101] To determine whether the source code contains an attack, in an optional embodiment, after searching the source code according to the sixth preset field to obtain a location field, the method further includes:

[0102] Step S401: determining that the source code contains the attack behavior if a preset action object exists in the action object;

[0103] Specifically, the objects affected during the code execution process include preset sensitive objects, that is, it is determined that the source code contains attack behaviors.

[0104] Step S402: If the preset action object does not exist in the action objects, it is determined that the source code does not have the attack behavior.

[0105] Specifically, the objects acted upon during the code execution process do not include preset sensitive objects, which means that it is determined that no attack behavior exists in the source code.

[0106] In order to enable those skilled in the art to more clearly understand the technical solution of the present application, the implementation process of the code correction method of the present application will be described in detail below with reference to specific embodiments.

[0107] This embodiment relates to a specific code correction method, such as Figure 3 As shown, the following steps are included:

[0108] Step S1: Obtain source code and preprocess the source code to obtain header files and definition files (source files);

[0109] Step S2: Performing syntax analysis on the source code to obtain the grammatical structure and rule file of the source code, and comparing the rule file with the preset security rule file to determine whether there is a vulnerability in the source code;

[0110] Step S3: If there is a vulnerability in the source code, the code analysis is terminated, and the source code and the vulnerability analysis results are input into the code correction model to correct the code;

[0111] Step S4: If there are no vulnerabilities in the source code, control flow analysis is performed on the source code according to its grammatical structure to obtain a control flow graph, semantic analysis is performed on the source code to obtain a data flow, and a data flow graph is generated. Inlet and outlet are set for variable parameters according to the data flow in the data flow graph, and whether the corresponding assignment statement is redundant code is determined based on whether the parameter values ​​of the variable parameters at the inlet and outlet are equal;

[0112] Step S5: The source code is then run in a simulation environment. Based on the storage location of the data modified in the source code and the change in the checksum before and after the code is run, it is determined whether there is an attack in the source code, and the attack field that generates the attack is further determined.

[0113] Step S6: Input the control flow graph, redundant code list and attack field list into the code correction model. The code correction model corrects the structure and content of the source code, adjusts the code structure and deletes redundant code and attack fields.

[0114] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0115] The embodiments of the present application also provide a code correction device. It should be noted that the code correction device of the embodiments of the present application can be used to execute the code correction method provided in the embodiments of the present application. The device is used to implement the above-mentioned embodiments and preferred embodiments, and the details that have been described will not be repeated here. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0116] The following introduces the code correction device provided in the embodiment of the present application.

[0117] Figure 4 : is a structural block diagram of a code correction device according to an embodiment of the present application. Figure 4 As shown, the device includes:

[0118] A first analysis unit 10 is configured to parse the source code to obtain a header file and a definition file and convert the source code into a syntax tree according to the header file and the definition file;

[0119] Specifically, the source code is parsed to obtain the header file and definition file corresponding to the source code, the code's running environment and execution code are determined, and then a syntax tree is constructed according to the code's grammatical structure to facilitate analysis of structural errors in the code.

[0120] A first acquisition unit 20 is configured to acquire a code blacklist, perform a pre-analysis based on the code blacklist and the syntax tree to obtain a first analysis result, wherein the first analysis result is used to indicate whether there is a vulnerability in the source code. The code blacklist includes a plurality of first preset fields, each of which corresponds to one vulnerability.

[0121] Specifically, security specifications for code writing are collected online, and fields that should not appear in the writing process are analyzed and integrated to obtain the above-mentioned code blacklist. The code blacklist is then compared with the syntax tree generated according to the source code to determine whether there is code in the syntax tree that causes the vulnerability, thereby obtaining the above-mentioned first analysis result.

[0122] a first input unit 30 for inputting the first analysis result, the syntax tree, and the source code into a code correction model to obtain a first corrected code when the first analysis result indicates a vulnerability exists, wherein the code correction model is trained based on a training dataset, the training dataset including a plurality of source codes, a plurality of analysis results corresponding to the source codes, the syntax trees corresponding to the source codes, and the corrected code corresponding to the source codes, the analysis results including at least the first analysis result;

[0123] Specifically, when the first analysis result indicates that there is a field corresponding to a vulnerability in the source code, it is determined that the code needs to be repaired, and then the first analysis result, the syntax tree and the source code are input into the code correction model. The code correction model modifies the source code accordingly based on the vulnerability field indicated in the first analysis result and the syntax structure in the syntax tree to obtain the code after the vulnerability is repaired, that is, the first corrected code.

[0124] A second analysis unit 40 is configured to, when the first analysis result indicates that no vulnerability exists, analyze the syntax tree to obtain a control flow and a data flow, perform a control flow analysis on the control flow to obtain a second analysis result, and perform a data flow analysis on the data flow to obtain a third analysis result, wherein the second analysis result is used to indicate whether the structure of the source code needs to be adjusted, and the third analysis result is used to indicate whether there is redundant code in the source code that can be deleted;

[0125] Specifically, when the first analysis result is that there are no vulnerabilities in the source code, the standardization and complexity of the code are analyzed. First, a control flow analysis is performed on the grammatical number, that is, according to the grammatical structure of the syntax tree, the grammatical structure is represented as a control flow graph that is more conducive to model recognition, and then a data flow graph is generated based on the control flow graph. Then, a data flow analysis is performed on the data flow graph to determine whether there is any meaningless code that can be deleted, so as to reduce the complexity of the code.

[0126] A simulation unit 50 is configured to simulate and analyze the source code in a simulation environment to obtain a fourth analysis result, wherein the fourth analysis result is used to indicate whether the source code contains an attack behavior;

[0127] Specifically, in order to avoid omissions caused by analyzing code hazards based solely on blacklists, in one embodiment of the present application, after data flow analysis and control flow analysis, the code needs to be simulated to determine whether there is any supply behavior in the code, thereby further ensuring the security of the code.

[0128] The second input unit 60 is configured to input the second analysis result, the third analysis result, the fourth analysis result, the syntax tree, and the source code into the code correction model to obtain a second corrected code.

[0129] Specifically, after completing the above analysis, the above second analysis result, the above third analysis result, the above fourth analysis result, the above syntax tree and the above source code are input into the code correction model. The code correction model adjusts the code according to the control flow graph, and deletes redundant code according to the above third analysis result, streamlines the code complexity, and finally deletes the code field with attack behavior according to the fourth analysis result to obtain the corrected code, namely the above second corrected code.

[0130] Through this embodiment, the first analysis unit parses the source code to obtain a header file and a definition file and converts the source code into a syntax tree according to the header file and the definition file; the first acquisition unit obtains a code blacklist, performs pre-analysis according to the code blacklist and the syntax tree, and obtains a first analysis result, and the first analysis result is used to characterize whether there is a vulnerability in the source code, and the code blacklist includes multiple first preset fields, and one first preset field corresponds to one vulnerability; when the first analysis result is that there is a vulnerability, the first input unit inputs the first analysis result, the syntax tree and the source code into a code correction model to obtain a first correction code, and the code correction model is trained according to a training data set, and the training data set includes multiple source codes, multiple analysis results corresponding to the source codes, the syntax tree corresponding to the source codes and the syntax tree corresponding to the source codes. The above-mentioned corrected code, the above-mentioned analysis result at least includes the above-mentioned first analysis result; the second analysis unit analyzes the above-mentioned syntax tree to obtain control flow and data flow when the above-mentioned first analysis result is that there is no vulnerability, and performs control flow analysis on the above-mentioned control flow to obtain a second analysis result, and performs data flow analysis on the above-mentioned data flow to obtain a third analysis result, the above-mentioned second analysis result is used to characterize whether the structure of the above-mentioned source code needs to be adjusted, and the above-mentioned third analysis result is used to characterize whether there is redundant code that can be deleted in the above-mentioned source code; the simulation unit simulates the operation of the above-mentioned source code in a simulation environment for simulation analysis to obtain a fourth analysis result, and the above-mentioned fourth analysis result is used to characterize whether there is an attack behavior in the above-mentioned source code; the second input unit inputs the above-mentioned second analysis result, the above-mentioned third analysis result, the above-mentioned fourth analysis result, the above-mentioned syntax tree and the above-mentioned source code into the above-mentioned code correction model to obtain a second corrected code. The present application filters the fields in the source code according to a blacklist, and determines that there is a vulnerability in the source code when a field in the blacklist exists in the meta-code. Then, if there is no vulnerability in the source code, the source code is subjected to data flow analysis and control flow analysis, and the structure and content of the source code are analyzed to evaluate the redundancy and unnecessary structure of the source code. The code is then trial-run in a simulation environment to determine whether the code has potential hazards. A code correction model is input based on the multiple analysis results, and the code is automatically corrected by the model. The code is detected through multiple dimensions, thereby solving the problem of high false alarm rate of code detection methods in the prior art, resulting in low quality of the corrected code.

[0131] In order to eliminate the vulnerability fields in the source code, in an optional implementation, the first obtaining unit includes:

[0132] A first matching module, configured to match the current field in the source code with the first preset field in the code blacklist;

[0133] Specifically, the fields in the source code are traversed and matched with the fields in the code blacklist to determine whether all the fields in the source code are in the blacklist.

[0134] a first determining module configured to determine, when the current field contains a field that is consistent with the first preset field, that the first analysis result indicates that a vulnerability exists in the source code;

[0135] Specifically, when a field in the source code exists in the above-mentioned code blacklist, it means that there is a vulnerability field in the source code, and then the above-mentioned first analysis result is determined to be that there is a vulnerability in the above-mentioned source code, and the vulnerability field is recorded in the above-mentioned first analysis result to facilitate correction by the code correction model.

[0136] The second determining module is configured to determine that the first analysis result is that there is no vulnerability in the source code when the field consistent with the first preset field does not exist in the current field.

[0137] Specifically, when a field in the source code does not exist in the above code blacklist, it means that there is no vulnerability field in the source code, and the next analysis process is performed.

[0138] In order to determine whether the code structure is correct, in an optional embodiment, the second analysis unit includes:

[0139] A first acquisition module is configured to acquire a second preset field, and search the source code according to the second preset field to obtain a target control field;

[0140] Specifically, preset control-related statements are obtained, including if, while, for, switch, etc., the source code is searched, and the same field in the source code is determined as the target control field.

[0141] a first analysis module configured to perform semantic analysis on the source code and determine a target controlled field based on the target control field, wherein one target control field corresponds to at least one target controlled field, and one target controlled field corresponds to one target control field;

[0142] Specifically, semantic analysis is performed on the corresponding code block according to the target control field to determine the corresponding field controlled by the target control field, which is determined to be the target controlled field.

[0143] a calculation module, configured to perform calculations using a recursive algorithm based on the target control field and the target controlled field to determine the control relationship in the source code and obtain the control flow;

[0144] Specifically, the target control field, the target controlled field and the code block are operated according to a recursive algorithm to determine the control relationship therein and extract the control flow.

[0145] The first generation module is used to construct a control flow graph based on the above control flow, the above target control field, the above target controlled field and the above source code to obtain the above second analysis result. The above control flow graph is used to represent the above control relationship between the fields of the above source code.

[0146] Specifically, the source code is represented in the form of a control flow graph according to the control flow, thereby obtaining the second analysis result.

[0147] In order to reduce the complexity of the source code, in an optional embodiment, the second analysis unit further includes:

[0148] a second acquisition module, configured to acquire a third preset field, search the source code according to the third preset field to determine variable parameters in the source code and operation functions corresponding to the variable parameters, and obtain the data stream;

[0149] Specifically, the source code is searched according to preset variable definitions or assignment fields, the variable parameters and the operation functions in the source code are determined, and the data stream is obtained.

[0150] A second generating module is configured to represent the source code in the form of a data flow graph according to the data flow to obtain a target data flow graph, wherein a point in the data flow graph represents a statement, and an edge represents one of the data flows;

[0151] Specifically, according to the statements corresponding to the variable parameters and operation functions in the source code and the corresponding data flows, the statements are represented by points, and the data flow transformations between the statements are represented by edges to construct a data flow graph.

[0152] A third determination module is configured to determine a target edge based on the variable parameter, mark the target edge to obtain a target point group, the target edge being the edge corresponding to the data stream to which the variable parameter belongs, the target point group being configured to record parameter changes of the variable parameter in the data stream before and after the value assignment field, the target point group including an input node and an output node, the input node including the parameter of the variable parameter before the value assignment field is assigned, and the output node including the parameter of the variable parameter after the value assignment field is assigned;

[0153] Specifically, the entry and exit of any variable parameter in the code block, ie the target point group, are determined based on any variable parameter, and whether the parameter values ​​contained in the variable parameter at the entry and exit change.

[0154] a first marking module configured to add a first mark to the value assignment field when the parameters of the output node and the input node are inconsistent, and to add a second mark to the value assignment field when the parameters of the output node and the input node are consistent, to obtain a first analysis sub-result, wherein the first mark is used to indicate that the value assignment field corresponding to the target point group is the redundant code, and the second mark is used to indicate that the value assignment field corresponding to the target point group is not the redundant code;

[0155] Specifically, if there is no change, it means that the assignment and operation statements in the code block have not actually changed the variable parameters, and it can be inferred that the corresponding statements have no practical meaning, and deletion has no actual effect on the variable parameters; if there is a change, it means that the assignment statements and operation statements in the code block have changed the variable parameters, and deletion will cause the parameter values ​​of the variable parameters to change. Therefore, the statements whose variable parameters have changed are marked with the above first mark, and the statements whose parameter variables have not changed are marked with the above second mark, so that the code correction model can streamline the code.

[0156] a third acquisition module, configured to acquire a fourth preset field, and retrieve the source code according to the fourth preset field to obtain a pointer field, wherein the pointer field is used to determine a storage location of the variable parameter;

[0157] Specifically, the source code is searched according to a preset field for marking a storage location, and the field for marking a storage location in the source code is determined to be a pointer field.

[0158] A fourth determining module, configured to determine that the pointer fields are aliases of each other when the storage locations corresponding to any two of the pointer fields are the same;

[0159] Specifically, the storage location of each parameter is determined according to the address pointing to the storage location of each pointer, and the pointer fields pointing to the same storage location are determined to be aliases of each other.

[0160] a second marking module, configured to add a third mark to a fifth preset field in the fields to which the pointers belong that are aliases of each other, to obtain a second analysis sub-result, wherein the third mark is used to indicate that the fifth preset field is the redundant code;

[0161] Specifically, when two pointers are aliases of each other, the variable parameters will be changed during the data storage process. If the LORD statement is deleted, the variable parameters will not be changed. Therefore, a third mark is added to the corresponding LORD statement. The LORD statement with the third mark is not deleted. The LORD statement without the third mark indicates that the corresponding pointer fields are not aliases of each other, and their variable parameters are stored in different locations without interfering with each other. The LORD statement does not play a practical role and can be deleted.

[0162] The second analysis module is configured to determine the third analysis result based on the first analysis sub-result and the second analysis sub-result.

[0163] Specifically, by combining the first analysis sub-result and the second analysis sub-result, the portion of the source code that can be deleted can be determined, that is, all the redundant codes in the source code can be obtained.

[0164] In order to further ensure the security of the source code, in an optional embodiment, the simulation unit includes:

[0165] a fourth acquisition module, configured to acquire a sixth preset field, and retrieve the source code according to the sixth preset field to obtain a location field, wherein the location field is used to represent an object of the source code;

[0166] Specifically, a comparison is performed based on preset fields to determine the object on which the source code acts, that is, to obtain the running environment of the source code.

[0167] A construction module is used to construct the simulation environment according to the action object, and simulate the operation of the source code in the simulation environment to determine the storage location rewritten during the operation of the source code to obtain the target storage location;

[0168] Specifically, adjustments are made in an isolated environment until the simulation environment reaches the code running environment of the above-mentioned target, the code is simulated and run in the simulation environment, and the storage location of the data actually changed in the source code is determined to obtain the above-mentioned target storage location.

[0169] a fifth determination module, configured to determine whether the code contains attack behavior based on a change in a checksum value in the source code before and after the simulation and within a preset range, thereby obtaining a third analysis sub-result;

[0170] Specifically, the encrypted fields of the code, such as MD5, will change before and after the code is run. The change in the MD5 value can be used to determine whether the code has attack behavior.

[0171] a second matching module, matching the target storage location with a preset storage location to determine whether the source code contains an attack, thereby obtaining the fourth analysis sub-result;

[0172] Specifically, based on the storage location of the data where the code is changed during the simulation, determine whether there are sensitive locations where the same type of code is not changed, that is, the above-mentioned preset storage locations. If so, it is determined that there is an attack behavior in the source code, and the field that generates the attack behavior is determined and recorded in the above-mentioned fourth analysis sub-result.

[0173] The third analysis module is configured to determine the fourth analysis result based on the third analysis sub-result and the fourth analysis sub-result.

[0174] Specifically, by combining the third analysis sub-result and the fourth analysis sub-result, it can be determined whether the source code contains an attack behavior and the corresponding field that generates the attack behavior, which is the fourth analysis result.

[0175] In order to determine whether the source code contains an attack behavior based on the checksum, the apparatus further includes:

[0176] A second obtaining unit is configured to, in an optional embodiment, obtain a first check value and a second check value after constructing the simulation environment according to the action object, wherein the first check value is the check value in the source code before the simulation is run, and the second check value is the check value in the source code after the simulation is run;

[0177] Specifically, the verification values ​​before and after the simulation are obtained to obtain the first verification value and the second verification value.

[0178] The first determination unit is configured to determine a check value deviation based on the first check value and the second check value, and to determine that the source code contains the attack behavior if the check value deviation is greater than the preset range; and to determine that the source code does not contain the attack behavior if the check value deviation is less than the preset range.

[0179] Specifically, based on the type of code function, the range of checksum changes before and after the code is run can be determined, and then the actual checksum change range before and after the code is run can be compared with the preset checksum change range. If the range is exceeded, it indicates that the above source code contains attack behavior.

[0180] To determine whether the source code contains any attack behavior, in an optional embodiment, the apparatus further includes:

[0181] a second determining unit configured to, after retrieving the source code according to the sixth preset field to obtain a location field, determine that the source code contains the attack behavior if a preset action object exists in the action object;

[0182] Specifically, the objects affected during the code execution process include preset sensitive objects, that is, it is determined that the source code contains attack behaviors.

[0183] The third determining unit is configured to determine that the source code does not have the attack behavior if the preset action object does not exist in the action objects.

[0184] Specifically, the objects acted upon during the code execution process do not include preset sensitive objects, which means that it is determined that no attack behavior exists in the source code.

[0185] The code correction device includes a processor and a memory. The first analysis unit, first acquisition unit, first input unit, second analysis unit, simulation unit, and second input unit are all stored as program units in the memory. The processor executes the program units stored in the memory to implement the corresponding functions. The modules are all located in the same processor; alternatively, the modules can be located in different processors in any combination.

[0186] The processor contains a kernel, which retrieves the corresponding program unit from memory. One or more kernels can be configured, and kernel parameters can be adjusted to reduce the false positive rate of code analysis and improve the quality of code corrections.

[0187] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0188] An embodiment of the present invention provides a computer-readable storage medium, which includes a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute a correction method for the code.

[0189] Specifically, the code correction method includes:

[0190] Step S201: Parse the source code to obtain a header file and a definition file and convert the source code into a syntax tree according to the header file and the definition file;

[0191] Step S202: Obtain a code blacklist, perform a pre-analysis based on the code blacklist and the syntax tree to obtain a first analysis result, wherein the first analysis result is used to indicate whether there is a vulnerability in the source code. The code blacklist includes a plurality of first preset fields, each of which corresponds to one vulnerability.

[0192] Step S203: If the first analysis result indicates a vulnerability, the first analysis result, the syntax tree, and the source code are input into a code correction model to obtain a first corrected code, wherein the code correction model is trained based on a training dataset, the training dataset including a plurality of source codes, a plurality of analysis results corresponding to the source codes, the syntax trees corresponding to the source codes, and the corrected code corresponding to the source codes, the analysis results including at least the first analysis result.

[0193] Step S204: If the first analysis result indicates that there is no vulnerability, the syntax tree is analyzed to obtain a control flow and a data flow, and a control flow analysis is performed on the control flow to obtain a second analysis result, and a data flow analysis is performed on the data flow to obtain a third analysis result. The second analysis result is used to indicate whether the structure of the source code needs to be adjusted, and the third analysis result is used to indicate whether there is redundant code in the source code that can be deleted.

[0194] Step S205: simulating and analyzing the source code in a simulation environment to obtain a fourth analysis result, which is used to indicate whether the source code contains any attack behavior.

[0195] Step S206: input the second analysis result, the third analysis result, the fourth analysis result, the syntax tree, and the source code into the code correction model to obtain a second corrected code.

[0196] An embodiment of the present invention provides a processor, which is used to run a program, wherein the code correction method is executed when the program is running.

[0197] Specifically, the code correction method includes:

[0198] Step S201: Parse the source code to obtain a header file and a definition file and convert the source code into a syntax tree according to the header file and the definition file;

[0199] Step S202: Obtain a code blacklist, perform a pre-analysis based on the code blacklist and the syntax tree to obtain a first analysis result, wherein the first analysis result is used to indicate whether there is a vulnerability in the source code. The code blacklist includes a plurality of first preset fields, each of which corresponds to one vulnerability.

[0200] Step S203: If the first analysis result indicates a vulnerability, the first analysis result, the syntax tree, and the source code are input into a code correction model to obtain a first corrected code, wherein the code correction model is trained based on a training dataset, the training dataset including a plurality of source codes, a plurality of analysis results corresponding to the source codes, the syntax trees corresponding to the source codes, and the corrected code corresponding to the source codes, the analysis results including at least the first analysis result.

[0201] Step S204: If the first analysis result indicates that there is no vulnerability, the syntax tree is analyzed to obtain a control flow and a data flow, and a control flow analysis is performed on the control flow to obtain a second analysis result, and a data flow analysis is performed on the data flow to obtain a third analysis result. The second analysis result is used to indicate whether the structure of the source code needs to be adjusted, and the third analysis result is used to indicate whether there is redundant code in the source code that can be deleted.

[0202] Step S205: simulating and analyzing the source code in a simulation environment to obtain a fourth analysis result, which is used to indicate whether the source code contains any attack behavior.

[0203] Step S206: input the second analysis result, the third analysis result, the fourth analysis result, the syntax tree, and the source code into the code correction model to obtain a second corrected code.

[0204] An embodiment of the present invention provides an intelligent analysis system. The intelligent analysis system includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, at least the following steps are performed:

[0205] Step S201: Parse the source code to obtain a header file and a definition file and convert the source code into a syntax tree according to the header file and the definition file;

[0206] Step S202: Obtain a code blacklist, perform a pre-analysis based on the code blacklist and the syntax tree to obtain a first analysis result, wherein the first analysis result is used to indicate whether there is a vulnerability in the source code. The code blacklist includes a plurality of first preset fields, each of which corresponds to one vulnerability.

[0207] Step S203: If the first analysis result indicates a vulnerability, the first analysis result, the syntax tree, and the source code are input into a code correction model to obtain a first corrected code, wherein the code correction model is trained based on a training dataset, the training dataset including a plurality of source codes, a plurality of analysis results corresponding to the source codes, the syntax trees corresponding to the source codes, and the corrected code corresponding to the source codes, the analysis results including at least the first analysis result.

[0208] Step S204: If the first analysis result indicates that there is no vulnerability, the syntax tree is analyzed to obtain a control flow and a data flow, and a control flow analysis is performed on the control flow to obtain a second analysis result, and a data flow analysis is performed on the data flow to obtain a third analysis result. The second analysis result is used to indicate whether the structure of the source code needs to be adjusted, and the third analysis result is used to indicate whether there is redundant code in the source code that can be deleted.

[0209] Step S205: simulating and analyzing the source code in a simulation environment to obtain a fourth analysis result, which is used to indicate whether the source code contains any attack behavior.

[0210] Step S206: input the second analysis result, the third analysis result, the fourth analysis result, the syntax tree, and the source code into the code correction model to obtain a second corrected code.

[0211] The present application also provides a computer program product, which, when executed on a data processing device, is adapted to execute a program for initializing at least the following method steps:

[0212] Step S201: Parse the source code to obtain a header file and a definition file and convert the source code into a syntax tree according to the header file and the definition file;

[0213] Step S202: Obtain a code blacklist, perform a pre-analysis based on the code blacklist and the syntax tree to obtain a first analysis result, wherein the first analysis result is used to indicate whether there is a vulnerability in the source code. The code blacklist includes a plurality of first preset fields, each of which corresponds to one vulnerability.

[0214] Step S203: If the first analysis result indicates a vulnerability, the first analysis result, the syntax tree, and the source code are input into a code correction model to obtain a first corrected code, wherein the code correction model is trained based on a training dataset, the training dataset including a plurality of source codes, a plurality of analysis results corresponding to the source codes, the syntax trees corresponding to the source codes, and the corrected code corresponding to the source codes, the analysis results including at least the first analysis result.

[0215] Step S204: If the first analysis result indicates that there is no vulnerability, the syntax tree is analyzed to obtain a control flow and a data flow, and a control flow analysis is performed on the control flow to obtain a second analysis result, and a data flow analysis is performed on the data flow to obtain a third analysis result. The second analysis result is used to indicate whether the structure of the source code needs to be adjusted, and the third analysis result is used to indicate whether there is redundant code in the source code that can be deleted.

[0216] Step S205: simulating and analyzing the source code in a simulation environment to obtain a fourth analysis result, which is used to indicate whether the source code contains any attack behavior.

[0217] Step S206: input the second analysis result, the third analysis result, the fourth analysis result, the syntax tree, and the source code into the code correction model to obtain a second corrected code.

[0218] Obviously, those skilled in the art will appreciate that the various modules or steps of the present invention described above can be implemented using a general-purpose computing device, can be centralized on a single computing device, or can be distributed across a network of multiple computing devices. They can be implemented using program code executable by the computing device, and thus, can be stored in a storage device and executed by the computing device. In some cases, the steps shown or described herein can be performed in a different order than that shown, or can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0219] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0220] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0221] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0222] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0223] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0224] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0225] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0226] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0227] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0228] 1) The code correction method of the present application, first, parses the source code to obtain a header file and a definition file and converts the source code into a syntax tree according to the header file and the definition file; then, obtains a code blacklist, performs pre-analysis according to the code blacklist and the syntax tree, and obtains a first analysis result, the first analysis result is used to characterize whether there is a vulnerability in the source code, the code blacklist includes multiple first preset fields, and one first preset field corresponds to one vulnerability; thereafter, when the first analysis result is that there is a vulnerability, the first analysis result, the syntax tree and the source code are input into a code correction model to obtain a first correction code, the code correction model is trained according to a training data set, and the training data set includes multiple source codes, multiple analysis results corresponding to the source codes, the syntax tree corresponding to the source codes and the syntax tree corresponding to the source codes. The above-mentioned corrected code corresponding to the code, the above-mentioned analysis result at least includes the above-mentioned first analysis result; then, when the above-mentioned first analysis result is that there is no vulnerability, the above-mentioned syntax tree is analyzed to obtain control flow and data flow, and the above-mentioned control flow is subjected to control flow analysis to obtain a second analysis result, and the above-mentioned data flow is subjected to data flow analysis to obtain a third analysis result, the above-mentioned second analysis result is used to characterize whether the structure of the above-mentioned source code needs to be adjusted, and the above-mentioned third analysis result is used to characterize whether there is redundant code that can be deleted in the above-mentioned source code; then, the above-mentioned source code is simulated and run in a simulation environment for simulation analysis to obtain a fourth analysis result, and the above-mentioned fourth analysis result is used to characterize whether there is an attack behavior in the above-mentioned source code; finally, the above-mentioned second analysis result, the above-mentioned third analysis result, the above-mentioned fourth analysis result, the above-mentioned syntax tree and the above-mentioned source code are input into the above-mentioned code correction model to obtain the second corrected code. The present application filters the fields in the source code according to a blacklist, and determines that there is a vulnerability in the source code when a field in the blacklist exists in the meta-code. Then, if there is no vulnerability in the source code, the source code is subjected to data flow analysis and control flow analysis, and the structure and content of the source code are analyzed to evaluate the redundancy and unnecessary structure of the source code. The code is then trial-run in a simulation environment to determine whether the code has potential hazards. A code correction model is input based on the multiple analysis results, and the code is automatically corrected by the model. The code is detected through multiple dimensions, thereby solving the problem of high false alarm rate of code detection methods in the prior art, resulting in low quality of the corrected code.

[0229] 2) The code correction device of the present application, the first analysis unit parses the source code to obtain a header file and a definition file and converts the source code into a syntax tree according to the header file and the definition file; the first acquisition unit obtains a code blacklist, performs pre-analysis according to the code blacklist and the syntax tree, and obtains a first analysis result, the first analysis result is used to characterize whether there is a vulnerability in the source code, the code blacklist includes multiple first preset fields, and one first preset field corresponds to one vulnerability; the first input unit inputs the first analysis result, the syntax tree and the source code into a code correction model when the first analysis result indicates that there is a vulnerability, to obtain a first correction code, the code correction model is trained according to a training data set, and the training data set includes multiple source codes, multiple analysis results corresponding to the source codes, the syntax tree corresponding to the source codes and the syntax tree corresponding to the source codes. The above-mentioned correction code corresponding to the source code, the above-mentioned analysis result at least includes the above-mentioned first analysis result; the second analysis unit analyzes the above-mentioned syntax tree to obtain control flow and data flow when the above-mentioned first analysis result is that there is no vulnerability, and performs control flow analysis on the above-mentioned control flow to obtain a second analysis result, and performs data flow analysis on the above-mentioned data flow to obtain a third analysis result. The above-mentioned second analysis result is used to characterize whether the structure of the above-mentioned source code needs to be adjusted, and the above-mentioned third analysis result is used to characterize whether there is redundant code that can be deleted in the above-mentioned source code; the simulation unit simulates the operation of the above-mentioned source code in a simulation environment for simulation analysis to obtain a fourth analysis result, and the above-mentioned fourth analysis result is used to characterize whether there is an attack behavior in the above-mentioned source code; the second input unit inputs the above-mentioned second analysis result, the above-mentioned third analysis result, the above-mentioned fourth analysis result, the above-mentioned syntax tree and the above-mentioned source code into the above-mentioned code correction model to obtain a second correction code. The present application filters the fields in the source code according to a blacklist, and determines that there is a vulnerability in the source code when a field in the blacklist exists in the meta-code. Then, if there is no vulnerability in the source code, the source code is subjected to data flow analysis and control flow analysis, and the structure and content of the source code are analyzed to evaluate the redundancy and unnecessary structure of the source code. The code is then trial-run in a simulation environment to determine whether the code has potential hazards. A code correction model is input based on the multiple analysis results, and the code is automatically corrected by the model. The code is detected through multiple dimensions, thereby solving the problem of high false alarm rate of code detection methods in the prior art, resulting in low quality of the corrected code.

[0230] The above description is merely a preferred embodiment of the present application and is not intended to limit the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present application shall be included within the scope of protection of the present application.

Claims

1. A code correction method, characterized in that: include: Parsing the source code to obtain a header file and a definition file and converting the source code into a syntax tree according to the header file and the definition file; Obtaining a code blacklist, performing a pre-analysis based on the code blacklist and the syntax tree to obtain a first analysis result, wherein the first analysis result is used to indicate whether there is a vulnerability in the source code, the code blacklist including a plurality of first preset fields, each first preset field corresponding to one vulnerability; If the first analysis result indicates a vulnerability, inputting the first analysis result, the syntax tree, and the source code into a code correction model to obtain a first corrected code, wherein the code correction model is trained based on a training data set, the training data set including a plurality of source codes, a plurality of analysis results corresponding to the source codes, the syntax trees corresponding to the source codes, and the corrected code corresponding to the source codes, the analysis results including at least the first analysis result; If the first analysis result indicates that no vulnerability exists, the syntax tree is analyzed to obtain a control flow and a data flow, and a control flow analysis is performed on the control flow to obtain a second analysis result, and a data flow analysis is performed on the data flow to obtain a third analysis result, wherein the second analysis result is used to indicate whether the structure of the source code needs to be adjusted, and the third analysis result is used to indicate whether there is redundant code in the source code that can be deleted; Simulating and analyzing the source code in a simulation environment to obtain a fourth analysis result, wherein the fourth analysis result is used to indicate whether the source code contains an attack behavior; The second analysis result, the third analysis result, the fourth analysis result, the syntax tree, and the source code are input into the code correction model to obtain a second corrected code.

2. The method according to claim 1, characterized in that Obtain a code blacklist, and perform pre-analysis based on the code blacklist and the syntax tree, including: Matching the current field in the source code with the first preset field in the code blacklist; If there is a field in the current field that is consistent with the first preset field, determining that the first analysis result is that there is a vulnerability in the source code; In a case where the field consistent with the first preset field does not exist in the current field, it is determined that the first analysis result is that there is no vulnerability in the source code.

3. The method according to claim 1, characterized in that Analyzing the syntax tree to obtain a control flow and a data flow, and performing control flow analysis on the control flow to obtain a second analysis result, including: Obtaining a second preset field, searching the source code according to the second preset field to obtain a target control field; Performing semantic analysis on the source code, and determining a target controlled field according to the target control field, wherein one target control field corresponds to at least one target controlled field, and one target controlled field corresponds to one target control field; Performing a recursive operation on the target control field and the target controlled field to determine a control relationship in the source code and obtain the control flow; A control flow graph is constructed according to the control flow, the target control field, the target controlled field and the source code to obtain the second analysis result, where the control flow graph is used to characterize the control relationship between the fields of the source code.

4. The method according to claim 3, characterized in that Performing data flow analysis on the data flow to obtain a third analysis result includes: Obtaining a third preset field, searching the source code according to the third preset field to determine variable parameters in the source code and operation functions corresponding to the variable parameters, and obtaining the data stream; Representing the source code in the form of a data flow graph according to the data flow to obtain a target data flow graph, wherein a point in the data flow graph represents a statement, and an edge represents a data flow; Determine a target edge according to the variable parameter, mark the target edge to obtain a target point group, the target edge is the edge corresponding to the data stream to which the variable parameter belongs, the target point group is used to record parameter changes of the variable parameter in the data stream before and after the assignment field, the target point group includes an input node and an output node, the input node includes the parameter of the variable parameter before the assignment field is assigned a value, and the output node includes the parameter of the variable parameter after the assignment field is assigned a value; When the parameters of the output node and the input node are inconsistent, a first mark is added to the assignment field; when the parameters of the output node and the input node are consistent, a second mark is added to the assignment field, to obtain a first analysis sub-result, wherein the first mark is used to indicate that the assignment field corresponding to the target point group is the redundant code, and the second mark is used to indicate that the assignment field corresponding to the target point group is not the redundant code; Obtaining a fourth preset field, searching the source code according to the fourth preset field to obtain a pointer field, wherein the pointer field is used to determine a storage location of the variable parameter; In the case where the storage locations corresponding to any two of the pointer fields are the same, determining that the pointer fields are aliases of each other; adding a third tag to a fifth preset field in the fields to which the pointers that are aliases belong, to obtain a second analysis sub-result, wherein the third tag is used to indicate that the fifth preset field is the redundant code; The third analysis result is determined according to the first analysis sub-result and the second analysis sub-result.

5. The method according to claim 1, wherein The source code is simulated and run in a simulation environment to perform simulation analysis, and a fourth analysis result is obtained, including: Obtaining a sixth preset field, searching the source code according to the sixth preset field to obtain a location field, where the location field is used to represent an object to which the source code acts; Constructing the simulation environment according to the action object, and performing simulation operation on the source code in the simulation environment to determine the storage location rewritten during the source code operation to obtain the target storage location; determining whether the code contains attack behavior based on a change in a checksum value in the source code before and after the simulation and a preset range, thereby obtaining a third analysis sub-result; According to the matching of the target storage location with the preset storage location, determining whether the source code has an attack behavior, and obtaining a fourth analysis sub-result; The fourth analysis result is determined according to the third analysis sub-result and the fourth analysis sub-result.

6. The method according to claim 5, characterized in that After constructing the simulation environment according to the action object, the method further includes: Obtain a first check value and a second check value, wherein the first check value is the check value in the source code before simulation execution, and the second check value is the check value in the source code after simulation execution; A check value deviation is determined based on the first check value and the second check value. If the check value deviation is greater than the preset range, it is determined that the source code contains the attack behavior. If the check value deviation is less than the preset range, it is determined that the source code does not contain the attack behavior.

7. The method according to claim 5, characterized in that After retrieving the source code according to the sixth preset field to obtain a location field, the method further includes: determining that the source code contains the attack behavior if a preset action object exists in the action objects; When the preset action object does not exist in the action objects, it is determined that the source code does not have the attack behavior.

8. A code correction device, characterized in that: The device comprises: A first analysis unit is configured to parse the source code to obtain a header file and a definition file and convert the source code into a syntax tree according to the header file and the definition file; a first acquisition unit, configured to acquire a code blacklist, and perform a pre-analysis based on the code blacklist and the syntax tree to obtain a first analysis result, wherein the first analysis result is used to indicate whether there is a vulnerability in the source code, the code blacklist including a plurality of first preset fields, each of the first preset fields corresponding to one vulnerability; a first input unit configured to, if the first analysis result indicates a vulnerability, input the first analysis result, the syntax tree, and the source code into a code correction model to obtain a first corrected code, wherein the code correction model is trained based on a training dataset, the training dataset including a plurality of source codes, a plurality of analysis results corresponding to the source codes, the syntax trees corresponding to the source codes, and the corrected code corresponding to the source codes, the analysis results including at least the first analysis result; a second analysis unit configured to, when the first analysis result indicates that no vulnerability exists, analyze the syntax tree to obtain a control flow and a data flow, perform a control flow analysis on the control flow to obtain a second analysis result, and perform a data flow analysis on the data flow to obtain a third analysis result, wherein the second analysis result is used to indicate whether the structure of the source code needs to be adjusted, and the third analysis result is used to indicate whether there is redundant code in the source code that can be deleted; a simulation unit, configured to simulate and analyze the source code in a simulation environment to obtain a fourth analysis result, wherein the fourth analysis result is used to indicate whether the source code contains an attack behavior; The second input unit is configured to input the second analysis result, the third analysis result, the fourth analysis result, the syntax tree, and the source code into the code correction model to obtain a second corrected code.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the method according to any one of claims 1 to 7.

10. An intelligent analysis system, characterized in that: include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include instructions for executing the method of any one of claims 1 to 7.

Images