Semi-supervised vulnerability assessment method based on code lexical and structural information fusion

Abstract

The application provides a semi-supervised software vulnerability evaluation method fusing code word morphology and structure information, and belongs to the technical field of computers; solves the problems of few marked data and lack of code structure information in the field of software vulnerability evaluation; and has the technical scheme that comprises the following steps: S1, collecting vulnerability evaluation related data; S2, generating a code attribute graph and extracting code structure information by using a Joern tool; S3, fusing the morphology information and the structure information; S4, randomly selecting a small amount of vulnerability codes; S5, constructing an optimal vulnerability evaluation model; and S6, loading the above model and completing evaluation for the vulnerability codes to be evaluated.The application has the beneficial effects that by means of a semi-supervised learning method and fusing code morphology and structure information, only a small amount of data marked by experts is needed, and the training of a high-quality vulnerability evaluation model can be completed.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a semi-supervised software vulnerability assessment method that integrates code lexical and structural information. Background Technology

[0002] In actual software development, vulnerabilities are a very common phenomenon. However, due to the complexity of software and the limitations of software quality assurance resources, it is impossible to fix all vulnerabilities in a software. Therefore, it is necessary to identify high-risk vulnerabilities and fix them with high priority.

[0003] In recent years, data-driven approaches have become popular for software vulnerability assessment. However, these methods require large amounts of labeled software vulnerability assessment data to build high-quality vulnerability assessment models. This process demands security expertise for accurate labeling, resulting in significant costs and introducing potential errors. Therefore, collecting high-quality training datasets for vulnerability assessment can be a challenging task.

[0004] Previous work primarily relied on the lexical information of vulnerable code to construct software vulnerability assessment models, without incorporating structural information, which could negatively impact the performance of these models. Therefore, there is a need to investigate a software vulnerability assessment method that can utilize a limited number of labels and integrate lexical and structural information from the code to better address the software vulnerability assessment problem.

[0005] How to solve the above-mentioned technical problems is the challenge facing this invention. Summary of the Invention

[0006] The purpose of this invention is to provide a semi-supervised software vulnerability assessment method that integrates code lexical and structural information. This method can assess the severity of software vulnerabilities.

[0007] The core idea of ​​this invention is as follows: This invention proposes a semi-supervised software vulnerability assessment method that integrates code lexical and structural information. Specifically, it uses Joern to obtain code structural information and constructs a bimodal input with code lexical information. The pre-trained model GraphCodeBERT is used to perform representation learning on the bimodal input, thereby obtaining a feature representation that integrates code lexical and structural information. Then, a self-trained semi-supervised algorithm is used to construct the optimal vulnerability assessment model, thereby performing software vulnerability assessment more accurately and efficiently.

[0008] This invention is achieved through the following measures: a semi-supervised software vulnerability assessment method that integrates code lexical and structural information, comprising the following steps:

[0009] (1) By mining open-source software repositories GitHub and vulnerability exposure databases (CVEs), code before and after vulnerability patching, vulnerability assessment metrics, and vulnerability patches are collected, and then preprocessed to obtain dataset D. The format of the dataset is set as <commit ID, vulnerability assessment metrics, code before vulnerability patching, code after vulnerability patching, vulnerability patch>, which includes the following steps:

[0010] (1-1) Obtain the vulnerability's commit ID and vulnerability assessment metrics from the CVE, and then search for the corresponding commit ID's source code, vulnerability patch, and other information on GitHub.

[0011] (1-2) The source code is preprocessed, including removing comments and blank lines, and finally the vulnerability dataset D is formed.

[0012] (2) Use the Joern tool to generate corresponding code attribute maps for the code;

[0013] (3) The lexical and structural information of the code is fused and used as a bimodal input. This input is then fed into the GraphCodeBERT pre-trained code model for code representation learning to extract feature representations that fuse the lexical and structural information of the code. The specific steps include the following:

[0014] (3-1) Treat the vulnerability code as a text representation and extract lexical information from it based on the text representation;

[0015] (3-2) Extract the structural information of the code by using the code attribute map generated in step (2);

[0016] (3-3) Insert special identifiers before lexical information and structural information respectively. <code>and <graph>To distinguish between lexical and structural information in the code and to form a bimodal input;

[0017] (3-4) The constructed bimodal model is input into the code pre-trained model GraphCodeBERT for code representation learning, and finally a feature representation that integrates code lexical and structural information can be generated.

[0018] (4) For the dataset collected in step (1), a small number of vulnerability codes are randomly selected and evaluated by security experts. A portion of the labeled data is used for model verification, and the remaining labeled and unlabeled data is used for training the software vulnerability assessment model.

[0019] (5) Using a semi-supervised learning method, combining a small amount of labeled data and a large amount of unlabeled data in the training set, as well as the validation set, and combining the feature representation learned in step (3), an optimal vulnerability assessment model is constructed, which specifically includes the following steps:

[0020] (5-1) Using a small amount of labeled data and a large amount of unlabeled training data and feature representations, pseudo-labels are first generated by assigning random weights to the unlabeled data through a self-training-based semi-supervised learning algorithm.

[0021] (5-2) Then, any vulnerability function in the labeled training vulnerability function dataset X is denoted as x. l The corresponding label is y. xl The predicted label obtained after the input vulnerability function is processed by a weak enhancement method is p. xl Then input the vulnerable function x l The loss function of the weak enhancement method is

[0022] (5-3) Next, let x be any one of the unlabeled training vulnerability function datasets X. u The corresponding label is y. xu A strong augmentation method will be used for the unlabeled data q. u The maximum value of the obtained prediction result is denoted as max(q). u Then input the vulnerable function x. u The loss function of the weak enhancement method is

[0023] (5-4) Finally, calculate the overall loss function: l total =l s +μ×l u Then, a semi-supervised software vulnerability assessment model is trained using the backpropagation algorithm, where μ is the weight;

[0024] (5-5) The performance of the semi-supervised vulnerability assessment model trained above is evaluated using the validation set. Finally, the optimal model M is selected by comprehensively considering the F1 score and Matthews coefficient of the model.

[0025] (6) For the vulnerability code that needs to be evaluated, the lexical and structural information of the vulnerability code can be extracted and a feature representation that integrates the lexical and structural information of the code can be formed. Finally, the vulnerability evaluation model constructed above is loaded into the vulnerability evaluation model to complete the evaluation of the vulnerability code.

[0026] Compared with existing technologies, the beneficial effects of this invention are as follows: The semi-supervised software vulnerability assessment method proposed in this invention, which integrates code lexical and structural information, considers not only the lexical information of the code but also its structural information. It uses the pre-trained model GraphCodeBERT, which can better integrate lexical and structural information, for code representation learning. Furthermore, it employs a self-trained semi-supervised learning algorithm, which can effectively utilize both labeled and unlabeled data and fully combine the learned feature representations, making software vulnerability assessment more comprehensive and accurate. Attached Figure Description

[0027] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof.

[0028] Figure 1 This invention provides a system framework diagram for a semi-supervised software vulnerability assessment method that integrates code lexical and structural information. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. Of course, the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0030] Example 1

[0031] See Figure 1 As shown, this invention provides a semi-supervised software vulnerability assessment method that integrates code lexical and structural information, specifically including the following:

[0032] (1) By mining open-source software repositories GitHub and vulnerability exposure databases (CVEs), code before and after vulnerability patching, vulnerability assessment metrics, and vulnerability patches are collected, and then preprocessed to obtain dataset D. The format of the dataset is set as <commit ID, vulnerability assessment metrics, code before vulnerability patching, code after vulnerability patching, vulnerability patch>, which includes the following steps:

[0033] (1-1) Obtain the vulnerability's commit ID and vulnerability assessment metrics from the CVE, and then search for the corresponding commit ID's source code, vulnerability patch, and other information on GitHub.

[0034] (1-2) The source code is preprocessed, including removing comments and blank lines, and finally the vulnerability dataset D is formed.

[0035] (2) Use the Joern tool to generate corresponding code attribute maps for the code;

[0036] (3) The lexical and structural information of the code is fused and used as a bimodal input. This input is then fed into the GraphCodeBERT pre-trained code model for code representation learning to extract feature representations that fuse the lexical and structural information of the code. The specific steps include the following:

[0037] (3-1) Treat the vulnerability code as a text representation and extract lexical information from it based on the text representation;

[0038] (3-2) Extract the structural information of the code by using the code attribute map generated in step (2);

[0039] (3-3) Insert special identifiers before lexical information and structural information respectively. <code>and <graph>To distinguish between lexical and structural information in the code and to form a bimodal input;

[0040] (3-4) The constructed bimodal model is input into the code pre-trained model GraphCodeBERT for code representation learning, and finally a feature representation that integrates code lexical and structural information can be generated.

[0041] (4) For the dataset collected in step (1), a small number of vulnerability codes are randomly selected and evaluated by security experts. A portion of the labeled data is used for model verification, and the remaining labeled and unlabeled data is used for training the software vulnerability assessment model.

[0042] (5) Using a semi-supervised learning method, combining a small amount of labeled data and a large amount of unlabeled data in the training set, as well as the validation set, and combining the feature representation learned in step (3), an optimal vulnerability assessment model is constructed, which specifically includes the following steps:

[0043] (5-1) Using a small amount of labeled data and a large amount of unlabeled training data and feature representations, pseudo-labels are first generated by assigning random weights to the unlabeled data through a self-training-based semi-supervised learning algorithm.

[0044] (5-2) Then, any vulnerability function in the labeled training vulnerability function dataset X is denoted as x. l The corresponding label is y. xl The predicted label obtained after the input vulnerability function is processed by a weak enhancement method is p. xl Then input the vulnerable function x l The loss function of the weak enhancement method is

[0045] (5-3) Next, let x be any one of the unlabeled training vulnerability function datasets X. u The corresponding label is y. xu A strong augmentation method will be used for the unlabeled data q. u The maximum value of the obtained prediction result is denoted as max(q). u Then input the vulnerable function x. u The loss function of the weak enhancement method is

[0046] (5-4) Finally, calculate the overall loss function: l total =l s +μ×l u Then, a semi-supervised software vulnerability assessment model is trained using the backpropagation algorithm, where μ is the weight;

[0047] (5-5) The performance of the semi-supervised vulnerability assessment model trained above is evaluated using the validation set. Finally, the optimal model M is selected by comprehensively considering the F1 score and Matthews coefficient of the model.

[0048] (6) For the vulnerability code that needs to be evaluated, the lexical and structural information of the vulnerability code can be extracted and a feature representation that integrates the lexical and structural information of the code can be formed. Finally, the vulnerability evaluation model constructed above is loaded into the vulnerability evaluation model to complete the evaluation of the vulnerability code.

[0049] (7) The method of this invention and existing software vulnerability assessment methods are evaluated on the same dataset. Five performance metrics from the field of software vulnerability assessment research (i.e., Accuracy, Precision, Recall, F1 source, and MCC) are used to automatically evaluate the quality of the model:

[0050] Table 1 Comparison of Results between the Method of the Present Invention and Other Methods

[0051]

[0052] Experiments show that the semi-supervised software vulnerability assessment method proposed in this invention, which integrates code lexical and structural information, provides more reliable software vulnerability assessment compared to baseline methods. Specifically, the method integrates code lexical and structural information, and can outperform these baseline methods using only a small amount of labeled data. Specifically, for Accuracy, the method improves performance by at least 1.1%; for Precision, by at least 29.8%; for Recall, by at least 9.8%; for F1 source, by at least 11.1%; and for MCC, by at least 22.2%. These results demonstrate the competitiveness of the proposed method.

[0053] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.< / graph> < / code> < / graph> < / code>

Claims

1. A semi-supervised software vulnerability assessment method that integrates code lexical and structural information, characterized in that, Includes the following steps: (1) By mining the open-source software repository GitHub and the vulnerability exposure database CVE, we collect the code before and after the vulnerability is fixed, the vulnerability assessment index and the vulnerability patch, and then preprocess them to finally obtain the dataset D. The format of the dataset is set as <commit ID, vulnerability assessment index, code before vulnerability is fixed, code after vulnerability is fixed, vulnerability patch>. (2) Use the Joern tool to generate corresponding code attribute maps for the code; (3) The lexical and structural information of the code is fused and used as a bimodal input to the code pre-trained model GraphCodeBERT for code representation learning, so as to extract feature representations that fuse the lexical and structural information of the code; (4) For the dataset collected in step (1), a small number of vulnerability codes are randomly selected and evaluated by security experts. A portion of the labeled data is used for model verification, and the remaining labeled and unlabeled data is used for training the software vulnerability assessment model. (5) Using a semi-supervised learning method, combining a small amount of labeled data and a large amount of unlabeled data in the training set, as well as the validation set, and combining the feature representation learned in step (3), an optimal vulnerability assessment model is constructed. The construction of the optimal vulnerability assessment model in step (5) includes the following steps: (4-1) Using a small amount of labeled data and a large amount of unlabeled training data and feature representations, pseudo-labels are first generated by assigning random weights to the unlabeled data through a self-training-based semi-supervised learning algorithm; (4-2) Then, any vulnerability function in the labeled training vulnerability function dataset X is denoted as x. l The corresponding label is y. xl The predicted label obtained after the input vulnerability function is processed by a weak enhancement method is p. xl Then input the vulnerable function x l The loss function of the weak enhancement method is ; (4-3) Next, let x be any one of the vulnerability functions in the unlabeled training vulnerability function dataset X. u The corresponding label is y. xu A strong augmentation method will be used for the unlabeled data q. u The maximum value of the obtained prediction result is denoted as max(q). u Then input the vulnerable function x. u The loss function of the weak enhancement method is ; (4-4) Finally, calculate the overall loss function: Then, a semi-supervised software vulnerability assessment model is trained using the backpropagation algorithm, where... As weight; (4-5) The performance of the semi-supervised vulnerability assessment model trained above is evaluated using the validation set. Finally, the optimal model M is selected by comprehensively considering the F1 score and Matthews coefficient of the model. (6) For the vulnerability code that needs to be evaluated, extract the lexical and structural information of the vulnerability code, form a feature representation that integrates the lexical and structural information of the code, and finally load it into the vulnerability evaluation model constructed above to complete the evaluation of the vulnerability code.

2. The semi-supervised software vulnerability assessment method integrating code lexical and structural information according to claim 1, characterized in that, The collection and construction of the dataset in step (1) includes the following steps: (2-1) Obtain the vulnerability's commit ID and vulnerability assessment metrics from the CVE, and then search for the corresponding source code and vulnerability patch information on GitHub; (2-2) The source code is preprocessed, including removing comments and blank lines, and finally the vulnerability dataset D is formed.

3. The semi-supervised software vulnerability assessment method integrating code lexical and structural information according to claim 1, characterized in that, In step (3), the lexical and structural information of the code is used as a bimodal input for representation learning, including the following steps: (3-1) Treat the vulnerability code as a text representation and extract lexical information from it based on the text representation; (3-2) Extract the structural information of the code by using the code attribute map generated in step (2); (3-3) Insert special identifiers before the lexical information and structural information respectively. <code>and <graph> To distinguish between lexical and structural information in the code and to form a bimodal input;< / graph> < / code> <code> (3-4) The constructed bimodal model is input into the code pre-trained model GraphCodeBERT for code representation learning, and finally a feature representation that integrates code lexical and structural information is generated. < / code>

Images