Method and system for identifying and correlating operating system kernel security interface semantics

Abstract

The application provides a kind of operating system kernel security interface semantics identification and correlation analysis method and system.The method comprises: generating security function interface graph database according to the information of security function interface of operating system kernel code;Obtain hierarchical function relationship graph using security function interface correlation relationship analysis and clustering neural network model;The logical association between different security function interfaces and security function requirements is analyzed and the support relationship is divided using security function interface and security function requirement support logic relationship detection algorithm;The traceability principle of security function interface and security function requirement is analyzed using security function interface and security function requirement traceability logic analysis algorithm.The application can be applied to the process of writing security function implementation principle and security function interface logic support in operating system kernel security evaluation, and can solve the problems of unclear function interface relationship, difficult principle tracing, missing, incorrect support relationship or unclear logic when writing manually.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a method and system for semantic recognition and correlation analysis of operating system kernel security interfaces. Background Technology

[0002] The Common Criteria (CC) is one of the most widely recognized international information technology security assessment standards. The corresponding standard in China is the GB / T 18336 series. The CC standard defines the basic criteria for assessing the security of information technology products and systems, and proposes an internationally accepted structure for describing information technology security.

[0003] As one of the highest-privilege code execution methods running on hardware, the operating system kernel's security is fundamental to the overall security of both hardware and software. By conforming to the EAL (Ensure Availability) assessment level in the CC (Copyright Authentication and Assessment) standard, the operating system kernel used can be ensured to receive internationally recognized security guarantees. The assessment process revolves around the interfaces implementing security functions. Security functions are implemented by associating and combining security function interfaces, and each security function interface can be viewed as a specific security function detail being implemented.

[0004] In the process of compiling security assessment evidence, the analysis of security function interfaces is a crucial step. The purpose of this analysis is to obtain the relationships between security function interfaces, to analyze security function interfaces in groups to demonstrate the logical tracing relationship between security function interfaces and security function requirements, and to analyze the relationship between each security function interface and each security function requirement to demonstrate its logical association.

[0005] This analysis process requires analysts to perform many-to-many matching and analyze the relationships between interfaces. It demands a high level of familiarity with the project and assessment requirements. While manual analysis can yield accurate security assessment evidence, it is prone to the following problems: 1. There are difficulties or omissions in clarifying the relationship between the security function requirements and the implementation principles of the security function interfaces; 2. The relationships between security function interfaces are unclear or incomplete; 3. Difficulty or oversights in defining the boundaries of high-level abstraction capabilities for the relationships between security function interfaces; 4. Manually analyzing the relationship between security function interfaces and security function requirements is a many-to-many analysis, which will consume a lot of time and requires analysts to have a high degree of understanding of the operating system kernel project itself and the relevant evaluation requirements documents, making it difficult for non-professionals. Summary of the Invention

[0006] (a) Technical problems to be solved 1. To address the difficulties in analyzing the mapping and relationships between security function interfaces implemented in the code during manual analysis of code function interfaces, and the numerous errors and omissions in the analysis, this invention innovatively proposes to combine a security function interface database, interface relationship analysis, and a clustering neural network model to automatically extract database node content and perform security function interface capability parsing and interface relationship analysis. 2. In response to the problems of unclear or incorrect mapping between interfaces and requirements, and lack of good evidence to support the implementation relationship between interfaces and requirements, which exist in the process of manually analyzing code function interfaces and security function requirements, this invention innovatively proposes an algorithm for detecting the supporting logical relationship between interfaces and requirements. It can match the mapping relationship between security assessment document requirements and code function interface information, and provide supporting logical evidence for implementation. 3. To address the problem of time-consuming and labor-intensive one-to-many analysis in the process of manually analyzing the source code interface capabilities, this invention proposes an interface and requirement source tracing logic analysis algorithm. By utilizing code function interface information and security assessment requirement document information, it provides source tracing principle evidence that the joint source tracing of code function interfaces supports security function requirements.

[0007] In summary, to address the shortcomings of existing technologies, this invention provides a method and system for semantic recognition and correlation analysis of operating system kernel security interfaces, solving the problems mentioned in the background section.

[0008] (II) Technical Solution To achieve the above objectives, the present invention provides the following technical solution: In a first aspect, this invention provides a method for semantic recognition and correlation analysis of operating system kernel security interfaces, including a security function interface graph database, a security function interface correlation analysis and clustering neural network model, an algorithm for detecting the logical relationship between security function interfaces and security function requirements, and an algorithm for tracing the logical relationship between security function interfaces and security function requirements. The method includes the following steps: Step 1: Input the security function interface information of the operating system kernel code, including input and output parameters, interface capabilities, usage methods, and interface call information, and generate a security function interface graph database; Step 2: Analyze the relationship between security function interfaces using security function interface association analysis and clustering neural network model. Establish association edges for interfaces with associated call relationships, and cluster security function interfaces that jointly perform similar tasks into one category. Multiple clusters form a cluster set to describe hierarchical functional relationships, and finally obtain a hierarchical functional relationship graph consisting of security function interfaces, inter-interface associations, and clustering relationships between multiple interfaces. Step 3: Utilize the security function interface and security function requirement support logic relationship detection algorithm to analyze the logical association between different security function interfaces and security function requirements based on the security function interfaces and the hierarchical function relationship diagram generated in Step 2, and divide the support relationship between security function interfaces and security function requirements. Step 4: Using the source tracing logic analysis algorithm of security function interfaces and security function requirements, combined with the supporting relationship obtained in Step 3, and combined with the description and analysis of security function interface capabilities and security function requirements, the source tracing principle of security function interfaces and security function requirements is given.

[0009] Furthermore, the security function interface graph database includes security function interface information from the operating system kernel code or other function interface information that is not explicitly analyzed as a security function. Its organization is a graph database, and the relationships between security function interfaces are all set to empty when the database is initialized.

[0010] Furthermore, the functional interface information includes the interface name, interface input parameters, interface output parameters, interface capability description, interface usage method description, interface error message pattern, and interface call information.

[0011] Furthermore, the security function interface association analysis and clustering neural network model includes a natural language understanding model for analyzing interface information and a graph convolutional neural network model for analyzing the association relationship of clustered graph node databases.

[0012] Furthermore, the natural language understanding model is a model pre-trained on a general large-scale natural language corpus dataset; in order to apply it to the workflow of this invention, the natural language understanding model is subjected to a targeted fine-tuning process before application.

[0013] Furthermore, the dataset used in the fine-tuning process consists of pairs of security function interface information and the corresponding standardized description of the security function. During use, the input of the natural language understanding model is the interface information, and the output is the standardized description of the security function interface.

[0014] Furthermore, the standardized description of the security-oriented interface refers to a security function description with a fixed description format, consisting of a limited number of security keywords and a limited number of descriptive words.

[0015] Furthermore, the graph convolutional neural network model is a model method that can accommodate multi-dimensional structured information of analysis nodes. In this invention, the clustering method in this type of model is used to perform analysis and clustering of nodes with multi-dimensional structured information contained in the security function interface graph database in accordance with security function requirements.

[0016] Preferably, the graph convolutional neural network model is fine-tuned based on a pre-trained model on a general dataset to meet security function requirements. The dataset used in this fine-tuning process is a pairwise combination of a security function interface information node database and the clustering results of corresponding manually classified hierarchical security function requirements. During use, the input of the graph convolutional neural network model is the security function interface node database, and the output is a hierarchical functional relationship graph oriented towards security function requirements.

[0017] Furthermore, the hierarchical functional relationship diagram refers to a diagram that describes the functional relationships between security function interface nodes in a hierarchical manner, consisting of security function interface nodes, the relationships between security function interface nodes, and high-level security function relationships achieved by joint clustering of multiple security function interface nodes.

[0018] Furthermore, the algorithm for detecting the logical relationship between security function interfaces and security function requirements is an algorithm for analyzing the implementation relationship between security function interfaces or clustered security function interfaces and security function requirements; preferably, the algorithm includes the following steps: S1. Traverse all input security function interfaces, and perform word segmentation and decomposition on the standardized description of the implementation function of each security function interface to obtain atomic security function interface description keywords. S2. Traverse all security function requirements, including function families, function classes, function components, and function elements, and decompose their descriptions into words to obtain atomic security function requirement description keywords. S3. Perform fuzzy matching on the obtained security function interface keywords and security function requirement keywords. The matching process refers to matching combinations of keywords that have inheritance, inclusion, consistency, or opposition relationships. Fuzzy matching means that synonyms or near-synonyms can be matched. Fuzzy matching is used to avoid matching omissions caused by subtle inconsistencies in description. S4. For successfully matched security function interfaces and security function requirements, determine the supporting relationship between them and the security function requirements based on the interface usage instructions, capability annotations, and corresponding standardized descriptions in the interface information. Provide the supporting relationship as evidence for the security assessment in the form of a security function requirement supporting relationship table. The security function requirement supporting implementation relationship table refers to a table showing the corresponding implementation support relationship between security function requirements and security function interfaces, with the horizontal and vertical axes representing the respective implementations of the security function requirements and security function interfaces.

[0019] Furthermore, the security function interface and security function requirement tracing logic analysis algorithm is an algorithm for performing coverage analysis on security function points associated with security function interfaces; preferably, the algorithm includes the following steps: P1. Based on the relationship between the successfully matched security function interfaces and security function requirements, analyze the security function points contained in the security function requirements. P2. Use a natural language processing model to extract the function summary information of the security function interface to obtain the security function points that the interface can implement; P3. Based on the results of P1 and P2, establish a traceability principle table for security function interfaces and security function requirements based on security function points. The traceability principle means that for each security function point involved in the security assessment process, it must be traced and covered by at least one security function interface. The correspondence between security function points and security function interface implementations can represent the traceability principle of security function implementation logic. This implementation relationship table is the traceability principle table.

[0020] Secondly, the present invention provides an intelligent recognition and correlation analysis system for the semantics of operating system kernel security interfaces, comprising: The security function interface graph database generation module is used to input information about the security function interfaces of the operating system kernel code, including input and output parameters, interface capabilities, usage methods, and interface call information, and generate a security function interface graph database. The Security Function Interface Association Analysis and Clustering Neural Network Model Module is used to analyze the association relationships of security function interfaces. It establishes association edges for interfaces with associated call relationships and clusters security function interfaces that jointly perform similar tasks into one category. Multiple clusters form a cluster set to describe hierarchical functional relationships, and finally obtains a hierarchical functional relationship graph consisting of security function interfaces, inter-interface association relationships, and multi-interface cluster relationships. The algorithm module for detecting the logical relationship between security function interfaces and security function requirements is used to analyze the logical association between different security function interfaces and security function requirements based on the security function interface and hierarchical function relationship diagram, and to classify the support relationship between security function interfaces and security function requirements. The security function interface and security function requirement tracing logic analysis algorithm module is used to provide the tracing principle of security function interfaces and security function requirements based on the derived supporting relationships and the description and analysis of security function interface capabilities and security function requirements.

[0021] (III) Beneficial Effects This invention provides a method and system for intelligent identification and correlation analysis of interface semantics based on the implementation principles of operating system kernel security functions, which has the following beneficial effects: 1. Automated hierarchical clustering of security function interface capabilities based on security function requirements can link interfaces at different levels to jointly support the realization of security function requirements, avoiding problems such as unclear hierarchy, omissions, and unclear correspondences caused by manual sorting; 2. By combining expert database information and analysis algorithms, automated logic checks are provided to support security function interfaces and requirements, avoiding omissions. 3. Automated analysis of the source tracing principle of security function interfaces and security function requirements, providing the implementation logic of the source tracing principle, and solving the difficulty of writing source tracing relationships. Attached Figure Description

[0022] Figure 1 This is a flowchart of the working process of the operating system kernel security interface semantic intelligent recognition and correlation analysis method and system of the present invention; Figure 2 This is a flowchart of the algorithm for detecting the logical relationship between the security function interface and the security function requirement support described in this invention; Figure 3 This is a flowchart of the security function interface and security function requirement tracing logic analysis algorithm described in this invention. Detailed Implementation

[0023] The present invention will be further described below with reference to the accompanying drawings and embodiments, but this does not limit the scope of the invention in any way.

[0024] This invention provides a method and system for intelligent semantic recognition and correlation analysis of operating system kernel security interfaces. The workflow is as follows: Figure 1 As shown, it includes a security function interface database, a security function interface association analysis and clustering neural network model, a security function interface and security function requirement support logic relationship detection algorithm, and a security function interface and security function requirement traceability logic analysis algorithm.

[0025] The security function interface database includes security function interface information from the operating system kernel code or other interface information that is not explicitly analyzed as a security function. It is organized as a graph database, and the relationships between security function interfaces are all set to empty when the database is initialized.

[0026] Furthermore, the functional interface information includes the interface name, interface input parameters, interface output parameters, interface capability description, interface usage method description, interface error message pattern, and interface call information.

[0027] In this example, the graph database is implemented using ArangoDB, which can create graph databases and relational databases, is easy to use and supports interface calls in multiple languages, and can be used as the supporting database for this invention.

[0028] The security function interface association analysis and clustering neural network model includes a natural language understanding model for analyzing interface information and a graph convolutional neural network model for analyzing the association relationship of clustered graph node databases.

[0029] Furthermore, the natural language understanding model is a model pre-trained on a general large-scale natural language corpus dataset; in order to apply it to the workflow of this invention, the model is subjected to a targeted fine-tuning process before application.

[0030] Furthermore, the dataset used in the fine-tuning process consists of pairs of security function interface information and corresponding standardized descriptions of security functions; during use, the input of the natural language understanding model is interface information, and the output is a standardized description of the interface oriented towards security functions.

[0031] Furthermore, the standardized description for security functions refers to a security function description with a fixed description format, consisting of a limited number of security keywords and a limited number of descriptive words. In this example, the natural language understanding model is implemented using the open-source large-scale model "LLaMA". It calls the open-source model pre-trained on a large-scale natural language corpus dataset, and performs the operations required by this invention based on the weights of this open-source model after fine-tuning with the aforementioned domain dataset.

[0032] Furthermore, the graph convolutional neural network model is a model method that can accommodate multi-dimensional structured information of analysis nodes. In this invention, the clustering method in this type of model is used to perform security function-oriented analysis and clustering on nodes with multi-dimensional structured information contained in the interface information graph database.

[0033] Preferably, the graph convolutional neural network model used is fine-tuned based on a model pre-trained on a general dataset to meet security function requirements. The dataset used for fine-tuning consists of a database of security function interface information nodes and a pairwise combination of the clustering results of the corresponding manually classified hierarchical security function requirements. During use, the input of the graph convolutional neural network model is the database of security function interface nodes, and the output is a graph of hierarchical functional relationship clustering results oriented towards security function requirements.

[0034] Furthermore, the hierarchical functional relationship diagram refers to a diagram that describes the functional relationships between security function interface nodes in a hierarchical manner, consisting of security function interface nodes, the relationships between security function interface nodes, and high-level security function relationships achieved by joint clustering of multiple security function interface nodes.

[0035] In this example, the graph convolutional neural network model selected from the paper (Liu Y, Tu W, Zhou S, et al. Deep graph clustering via dual correlation reduction[C] / / Proceedings of the AAAI Conference on Artificial Intelligence. 2022, 36(7): 7603-7611.) is used to perform the operation. After being trained on a general dataset and fine-tuned with the aforementioned domain dataset, it is used to perform the clustering operation in this invention.

[0036] Furthermore, the algorithm for detecting the logical relationship between security function interfaces and security function requirements is an algorithm for analyzing the implementation relationship between security function interfaces or data-based security function interfaces and security function requirements; this process can be as follows: Figure 2 As shown, specifically, the algorithm includes the following steps: S1. Traverse all input security function interfaces, and perform word segmentation and decomposition on the implementation function and standardized description of each security function interface to obtain atomic security function interface description keywords. S2. Traverse all security function requirements, including function families, function classes, function components, and function elements, and decompose their descriptions into words to obtain atomic security function requirement description keywords. S3. Perform fuzzy matching on the obtained security function interface keywords and security function requirement keywords. The matching process refers to matching combinations of keywords that have inheritance, inclusion, consistency, or opposition relationships. Fuzzy matching means that synonyms or near-synonyms can be matched. Fuzzy matching is used to avoid matching omissions caused by subtle inconsistencies in description. S4. For successfully matched security function interfaces and security function requirements, determine the supporting relationship between them and the security function requirements based on the interface usage instructions, capability annotations, and corresponding standardized descriptions in the interface information. Provide the supporting relationship as evidence for the security assessment in the form of a security function requirement supporting relationship table. The security function requirement supporting implementation relationship table refers to a table where the horizontal and vertical axes represent the implementation supporting relationship between the security function requirements and the security function interfaces, respectively.

[0037] Furthermore, in the security assessment process, the supporting relationships between security function interfaces and security function requirements include: R1, Security Function Requirements - Interface Implementation R2, Security Function Requirements - Supporting Interfaces R3, Security Function Requirements - Irrelevant Interfaces Furthermore, in the process of determining the support relationship, if the functional points of the security function requirements are implemented by the associated security function interfaces, then these security function interfaces are defined as "security function requirements-implementation interfaces".

[0038] Furthermore, if the relationship determined based on the security function interface relationship confirms that the implementation of a certain "security function as required - implementation interface" requires the implementation of another security function interface for support, then such a security function interface is defined as a "security function requirement - support interface".

[0039] Furthermore, if there are no security function requirements related to the security function interface in the relationship being determined, then the security function interface is defined as "security function requirement - irrelevant interface".

[0040] Furthermore, the security function interface and security function requirement tracing logic analysis algorithm is an algorithm for performing coverage analysis on security function points associated with security function interfaces; preferably, the algorithm includes the following steps: P1. Based on the relationship between the successfully matched security function interfaces and security function requirements, analyze the functional points contained in the security function requirements. P2. Use a natural language processing model to extract the function summary information of the security function interface to obtain the security function points that the interface can implement; P3. Based on the results of P1 and P2, establish a traceability principle relationship table between security function interfaces and security function requirements based on security function points. The traceability principle refers to the requirement that for each security function point involved in the security assessment process, it must be traced and covered by at least one security function interface. The correspondence between security function points and security function interface implementations represents the traceability principle of security function implementation logic. This implementation relationship table is the traceability principle table. The obtained relationship table can be, for example... Figure 3 As shown.

[0041] Furthermore, for the security function interface of clustering, the traceability table is displayed as a direct support traceability rather than a function point format.

[0042] A method and system for intelligent identification and correlation analysis of interface semantics based on the implementation principles of operating system kernel security functions includes the following steps: Step 1: Input the security function interface information of the operating system kernel code, including input and output parameters, interface capabilities, usage methods, and interface call information, and generate a security function interface graph database; Step 2: Use the security function interface association analysis and clustering neural network model to cluster the interface association relationships to obtain a hierarchical functional relationship diagram and an interface interaction relationship diagram; Step 3: Based on the logical relationships of security function interfaces and cluster sets, classify the support relationship between interfaces and security function requirements; Step 4: Based on the results of Step 3, analyze and provide the principle of traceability for security function interfaces and security function requirements.

[0043] Another embodiment of the present invention provides an intelligent recognition and correlation analysis system for the semantics of operating system kernel security interfaces, comprising: The security function interface graph database generation module is used to input information about the security function interfaces of the operating system kernel code, including input and output parameters, interface capabilities, usage methods, and interface call information, and generate a security function interface graph database. The Security Function Interface Association Analysis and Clustering Neural Network Model Module is used to analyze the association relationships of security function interfaces. It establishes association edges for interfaces with associated call relationships and clusters security function interfaces that jointly perform similar tasks into one category. Multiple clusters form a cluster set to describe hierarchical functional relationships, and finally obtains a hierarchical functional relationship graph consisting of security function interfaces, inter-interface association relationships, and multi-interface cluster relationships. The algorithm module for detecting the logical relationship between security function interfaces and security function requirements is used to analyze the logical association between different security function interfaces and security function requirements based on the security function interface and hierarchical function relationship diagram, and to classify the support relationship between security function interfaces and security function requirements. The security function interface and security function requirement tracing logic analysis algorithm module is used to provide the tracing principle of security function interfaces and security function requirements based on the derived supporting relationships and the description and analysis of security function interface capabilities and security function requirements.

[0044] For the specific implementation process of each module, please refer to the description of the method of the present invention above.

[0045] Another embodiment of the present invention provides a computer device (computer, server, smartphone, etc.) including a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the steps of the method of the present invention.

[0046] Another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, disk, optical disk) that stores a computer program, which, when executed by a computer, implements the various steps of the method of the present invention.

[0047] The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and to implement it accordingly. Those skilled in the art will understand that various substitutions, changes, and modifications are possible without departing from the spirit and scope of the present invention. The present invention should not be limited to the content disclosed in the embodiments of this specification; the scope of protection of the present invention is defined by the claims.

Claims

1. A method for semantic recognition and correlation analysis of operating system kernel security interfaces, characterized in that, Includes the following steps: Input information about the security function interfaces of the operating system kernel code, including input and output parameters, interface capabilities, usage methods, and interface call information, and generate a security function interface graph database; The association relationship of security function interfaces is analyzed by using security function interface association analysis and clustering neural network model. Association edges are established for interfaces with association call relationship, and security function interfaces that jointly perform similar tasks are clustered into one class. Multiple clusters form a cluster set to describe hierarchical functional relationship, and finally a hierarchical functional relationship graph is obtained, consisting of security function interfaces, inter-interface association relationship, and multi-interface cluster relationship. An algorithm for detecting the logical relationship between security function interfaces and security function requirements is used. Based on the security function interface and hierarchical function relationship diagram, the logical association between different security function interfaces and security function requirements is analyzed, and the support relationship between security function interfaces and security function requirements is divided. Using a source tracing logic analysis algorithm for security function interfaces and security function requirements, and based on the derived supporting relationships, combined with the descriptions and analyses of security function interface capabilities and security function requirements, the source tracing principle for security function interfaces and security function requirements is given. The algorithm for detecting the logical relationship between security function interfaces and security function requirements is an algorithm for analyzing the implementation relationship between security function interfaces or clustered security function interfaces and security function requirements. The algorithm includes the following steps: Iterate through all the input security function interfaces, and perform word segmentation and decomposition on the standardized description of the implementation function of each security function interface to obtain atomic security function interface description keywords; Traverse all security function requirements, including function families, function classes, function components, and function elements, and decompose their descriptions into atomic security function requirement description keywords; Fuzzy matching is performed on the obtained security function interface keywords and security function requirement keywords; For successfully matched security function interfaces and security function requirements, the supporting relationship between them and the security function requirements is determined based on the interface usage instructions, capability annotations, and corresponding standardized descriptions in the interface information. The supporting relationship is presented in the form of a table of supporting relationships for security function requirements as evidence for security assessment. The security function interface and security function requirement tracing logic analysis algorithm is an algorithm that performs coverage analysis on the security function points associated with the security function interface; the algorithm includes the following steps: Based on the relationship between the successfully matched security function interfaces and security function requirements, the security function points contained in the security function requirements are analyzed and disassembled. The interface information of the security function interface is extracted using a natural language processing model to obtain the security function points that the interface can implement; Establish a traceability principle table for security function interfaces and security function requirements based on security function points.

2. The method according to claim 1, characterized in that, The security function interface graph database includes security function interface information from the operating system kernel code or information from other function interfaces that are not explicitly analyzed as security functions. It is organized as a graph database, and the relationships between security function interfaces are all set to empty when the database is initialized. The security function interface information includes interface name, interface input parameters, interface output parameters, interface capability description, interface usage method description, interface error message pattern, and interface call information.

3. The method according to claim 1, characterized in that, The security function interface association analysis and clustering neural network model includes a natural language understanding model for analyzing interface information and a graph convolutional neural network model for analyzing the association relationship of clustered graph node databases.

4. The method according to claim 3, characterized in that, The natural language understanding model is a model pre-trained on a general large-scale natural language corpus dataset, and the natural language understanding model undergoes a targeted fine-tuning process. The fine-tuning process uses a dataset consisting of pairs of security function interface information and the corresponding standardized description of the security function. During use, the input of this natural language understanding model is interface information, and the output is a standardized description of the interface for security functions; the standardized description of the interface for security functions refers to a security function description with a fixed description format, consisting of a limited number of security keywords and a limited number of descriptive words.

5. The method according to claim 3, characterized in that, The graph convolutional neural network model described above is capable of analyzing the multidimensional structured information of nodes. This model is used to perform security function requirement-oriented clustering analysis on nodes containing multidimensional structured information within the security function interface graph database. The graph convolutional neural network model is fine-tuned based on a pre-trained model on a general dataset, using a dataset consisting of pairs of the security function interface information node database and the corresponding manually classified hierarchical security function requirement clustering results. During use, the graph convolutional neural network model takes the security function interface node database as input and outputs a hierarchical functional relationship graph oriented towards security function requirements. This hierarchical functional relationship graph refers to a graph that describes the functional relationships between security function interface nodes in a hierarchical manner, consisting of security function interface nodes, the relationships between security function interface nodes, and the security function relationships achieved through joint clustering of multiple security function interface nodes.

6. A system for semantic recognition and correlation analysis of operating system kernel security interfaces using the method described in any one of claims 1 to 5, characterized in that, include: The security function interface graph database generation module is used to input information about the security function interfaces of the operating system kernel code, including input and output parameters, interface capabilities, usage methods, and interface call information, and generate a security function interface graph database. The Security Function Interface Association Analysis and Clustering Neural Network Model Module is used to analyze the association relationships of security function interfaces. It establishes association edges for interfaces with associated call relationships and clusters security function interfaces that jointly perform similar tasks into one category. Multiple clusters form a cluster set to describe hierarchical functional relationships, and finally obtains a hierarchical functional relationship graph consisting of security function interfaces, inter-interface association relationships, and multi-interface cluster relationships. The algorithm module for detecting the logical relationship between security function interfaces and security function requirements is used to analyze the logical association between different security function interfaces and security function requirements based on the security function interface and hierarchical function relationship diagram, and to classify the support relationship between security function interfaces and security function requirements. The security function interface and security function requirement tracing logic analysis algorithm module is used to provide the tracing principle of security function interfaces and security function requirements based on the derived supporting relationships and the description and analysis of security function interface capabilities and security function requirements.

7. A computer device, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the method of any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a computer, implements the method according to any one of claims 1 to 5.

Images