An interpretable vulnerability detection method and system based on double-view causal reasoning
Patent Information
- Application Number
- CN202311689060.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-12-08
- Publication Date
- 2026-09-18
- Estimated Expiration
- 2043-12-08
AI Technical Summary
然而通过这类方法提取的解释可能不够简洁，涵盖了许多冗余但与模型的预测高度相关的语句，导致仍然需要大量的人力对解释结果进行二次审计，简洁性并不强
[0024] Beneficial effects: This invention has the following significant effects: 1. Strong robustness: By using hybrid contrastive learning technology, the robustness of the vulnerability detection model to the perturbation mechanisms adopted by mainstream interpretable frameworks is enhanced, avoiding false interpretations by the model; 2. High accuracy and simplicity: A dual-attempt causal reasoning technique combining factual reasoning and counterfactual reasoning is proposed. Based on the model's prediction results, the code segment in the tested program that causes the vulnerability can be located simply and accurately, improving the interpretability of vulnerability detection.
Smart Images
Figure CN117763560B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of software security, and specifically to an interpretable vulnerability detection method and system based on dual-view causal reasoning. Background Technology
[0002] Software vulnerabilities can severely degrade computer software performance and even cause runtime crashes. Therefore, accurately and efficiently detecting potential security vulnerabilities in software has become a significant challenge. Thanks to the tremendous success of deep learning in code-centric software engineering tasks, an increasing number of learning-based vulnerability detection methods have been proposed. Compared to traditional methods that heavily rely on manually defined vulnerability specifications, deep learning-based methods focus on building complex neural network models to automatically learn implicit vulnerability patterns from vulnerable source code. However, due to the black-box nature of neural network models, these methods still have significant limitations in practical applications. Some works have used interpretability techniques to explain the decision logic of black-box vulnerability detection models. For example, the paper "Vulnerability Detection with Fine-Grained Interpretations" uses GNNExplainer to simplify target instances into minimal PDG subgraphs consisting of a set of key statements and program dependencies. However, these methods face two main challenges. First, the perturbation mechanisms employed by these methods assume that the deleted / retained code statements are consistent with basic facts. However, recent research indicates that simple code editing can easily alter model predictions, resulting in low robustness. Therefore, even if correct predictions are made, the weak robustness of the detection model can lead to false interpretations and low accuracy. Secondly, most existing methods focus on generating explanations from a factual reasoning perspective, i.e., providing a subset of the input program and having the model make the same predictions as the original program. However, explanations extracted through such methods may not be concise enough, containing many redundant but highly relevant statements to the model's predictions. This necessitates significant human effort to conduct secondary audits of the explanation results, thus compromising conciseness. Summary of the Invention
[0003] Purpose of the invention: The purpose of this invention is to provide a robust, accurate, and concise interpretable vulnerability detection method and system based on dual-view causal reasoning.
[0004] Technical solution: The explainable vulnerability detection method based on dual-view causal reasoning described in this invention includes the following steps:
[0005] S1. Obtain code samples, which include training samples and samples to be tested. The training samples are sequentially processed through data augmentation, static analysis, code attribute map construction, and feature extraction to obtain a training dataset. The samples to be tested are sequentially processed through static analysis, code attribute map construction, and feature extraction to obtain a dataset to be tested.
[0006] S2. Process the training dataset using a hybrid contrastive learning method to establish a vulnerability detection model; input the dataset to be detected into the vulnerability detection model and output the vulnerability code;
[0007] S3. Perform causal reasoning on the vulnerability code and output a vulnerability detection explanation.
[0008] Furthermore, in step S1, the data augmentation includes injection point location operation, mutation operator selection operation, and code transformation operation; after data augmentation, the training samples become unlabeled code corpus and labeled vulnerability dataset.
[0009] Furthermore, the static analysis outputs an abstract syntax tree, a control flow graph, and a program dependency graph.
[0010] Furthermore, the code attribute diagram includes several nodes, each of which has corresponding text information and type information.
[0011] Furthermore, the feature extraction includes the following steps:
[0012] S11. The text information and type information of each node are vector-encoded to obtain the initial node features;
[0013] S12. Input the initial node features into the graph feature encoder to update the features and obtain the node feature embedding.
[0014] Furthermore, in the contrastive learning method, the unsupervised contrastive loss of the feature embeddings corresponding to the unlabeled code corpus and the supervised contrastive loss of the feature embeddings corresponding to the labeled vulnerability dataset are calculated and merged to train and generate a vulnerability detection model.
[0015] Furthermore, step S3 specifically includes the following steps:
[0016] S31, Computational factual explanation subgraph, counterfactual explanation subgraph;
[0017] S32. The scaling-based constraint solving strategy processes the fact interpretation subgraph and the counterfactual interpretation subgraph to generate the optimal interpretation subgraph as the vulnerability detection interpretation.
[0018] Technical solution: The explainable vulnerability detection system based on dual-view causal reasoning described in this invention includes:
[0019] The code sample processing module is used to obtain code samples, which include training samples and samples to be detected. The training samples are processed sequentially through data augmentation, static analysis, code attribute map construction, and feature extraction to obtain a training dataset. The samples to be detected are processed sequentially through static analysis, code attribute map construction, and feature extraction to obtain a dataset to be detected.
[0020] The module outputs vulnerability code to process the training dataset based on a hybrid contrastive learning method and establish a vulnerability detection model; it inputs the dataset to be detected into the vulnerability detection model and outputs vulnerability code.
[0021] The vulnerability explanation module is used to perform causal reasoning on the vulnerable code and output a vulnerability detection explanation.
[0022] The computer device of the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method.
[0023] The computer-readable storage medium of the present invention stores a computer program thereon, which, when executed by a processor, implements the steps of the method described herein.
[0024] Beneficial effects: This invention has the following significant effects: 1. Strong robustness: By using hybrid contrastive learning technology, the robustness of the vulnerability detection model to the perturbation mechanisms adopted by mainstream interpretable frameworks is enhanced, avoiding false interpretations by the model; 2. High accuracy and simplicity: A dual-attempt causal reasoning technique combining factual reasoning and counterfactual reasoning is proposed. Based on the model's prediction results, the code segment in the tested program that causes the vulnerability can be located simply and accurately, improving the interpretability of vulnerability detection. Attached Figure Description
[0025] Figure 1 This is a schematic diagram of the vulnerability detection method of the present invention;
[0026] Figure 2 This is a schematic diagram of the code attribute graph for a training sample. Detailed Implementation
[0027] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments.
[0028] Please see Figures 1 to 2 As shown, this invention discloses an interpretable vulnerability detection method and system based on dual-view causal reasoning.
[0029] One interpretable vulnerability detection method based on dual-view causal reasoning includes the following steps:
[0030] S1. Obtain code samples, which include training samples and samples to be tested. The training samples are sequentially processed through data augmentation, static analysis, code attribute map construction, and feature extraction to obtain a training dataset. The samples to be tested are sequentially processed through static analysis, code attribute map construction, and feature extraction to obtain a dataset to be tested.
[0031] S2. Process the training dataset using a hybrid contrastive learning method to establish a vulnerability detection model; input the dataset to be detected into the vulnerability detection model and output the vulnerability code;
[0032] S3. Perform causal reasoning on the vulnerability code and output a vulnerability detection explanation.
[0033] An interpretable vulnerability detection system based on dual-view causal reasoning includes:
[0034] The code sample processing module is used to obtain code samples, which include training samples and samples to be detected. The training samples are processed sequentially through data augmentation, static analysis, code attribute map construction, and feature extraction to obtain a training dataset. The samples to be detected are processed sequentially through static analysis, code attribute map construction, and feature extraction to obtain a dataset to be detected.
[0035] The module outputs vulnerability code to process the training dataset based on a hybrid contrastive learning method and establish a vulnerability detection model; it inputs the dataset to be detected into the vulnerability detection model and outputs vulnerability code.
[0036] The vulnerability explanation module is used to perform causal reasoning on the vulnerable code and output a vulnerability detection explanation.
[0037] Step S1, in the code sample processing module, the data augmentation includes injection point localization, mutation operator selection, and code transformation. After data augmentation, the training samples become unlabeled code corpus and labeled vulnerability datasets. This data augmentation specifically includes the following steps:
[0038] 1) Injection point localization operation: Analyze the unlabeled samples of the training samples to locate the mutation operator injection point that can perform semantically preserved code transformation.
[0039] 2) Mutation operator selection operation: Construct an operator library (preset mutation operator library in Table 1), and randomly select and apply one or more mutation operators adapted to the injection point based on the located mutation operator injection point from the operator library.
[0040] Table 1 Pre-built Mutation Operator Library
[0041] 1 Identifier renaming Replace function names or variable names in the program with random tokens. 2 Operator inversion Invert the operators of binary logic operations 3 Statement perturbation Randomly replace two lines of statements that have no program dependencies. 4 Circular exchange Swap the while loop and the for loop. 5 Block replacement Replace the `then` block corresponding to the `If` statement with the corresponding `else` block. 6 If statement conversion Replace the switch statement with an equivalent if statement.
[0042] 3) Code Transformation Operation: Perform code transformation on the mutation operators selected from the operator library to construct semantically equivalent mutated code. This results in an unlabeled code corpus (containing unlabeled samples and their semantically equivalent mutated code) corresponding to the training samples and a labeled vulnerability dataset (containing vulnerable code and non-vulnerable code).
[0043] The static analysis outputs an abstract syntax tree (AST), a control flow graph (CFB), and a program dependency graph. In this embodiment, static analysis is performed using a program compiler. Specifically, the static analysis of training samples outputs ASTs, CFBs, and program dependency graphs for both unlabeled code corpora and labeled vulnerability datasets. The static analysis of samples to be detected outputs ASTs, CFBs, and program dependency graphs for those samples.
[0044] The Code Attribute Graph (CPG) is constructed based on the Abstract Syntax Tree (AST), Control Flow Graph (CFG), and Program Dependency Graph (PDG) output from static analysis. The CPG includes several nodes, each with corresponding text and type information. Specifically, the CPG for training samples contains nodes describing unlabeled code corpora and labeled vulnerability datasets. The CPG for samples to be detected contains nodes describing the samples themselves.
[0045] The feature extraction includes the following steps:
[0046] S11. Vector encode the text and type information of each node to obtain initial node features. CodeBERT and label encoding are then used to encode each node in the code attribute graph (CPG). The text information and type information are vector-encoded to obtain the text feature vector C. v and type feature vector T v The initial node features of the nodes are obtained by using feature concatenation operations.
[0047]
[0048] In the formula, || represents the concatenation operator.
[0049] S12, and embed the initial node features into the code attribute graph (CPG) of step S11, and input them together into the graph feature encoder (GAT) for feature update to obtain the node feature embedding. The formula is as follows:
[0050]
[0051]
[0052] In the formula, This represents the feature embedding of node v after iteratively updating the time step t; The set of edge types in the CPG is represented by |·|; the size of the set is represented by |·|; and σ represents the LeakyReLU activation function used. W represents the first-order neighbor of node v under edge r. r The weight matrix of edge r; α v,u This represents the attention weight of node v and its neighbor node u on edge r; This represents the feature embedding of neighbor node u at time step t; This represents the feature vector of node u after weight correction.
[0053]
[0054]
[0055] In the formula, The first line represents the transpose of the learnable weight vector; the second line represents the concatenation operator. and Let represent the degree of association between node v and its arbitrary neighbor nodes u and p at time step t, respectively. This represents the feature vector of node v after weight correction.
[0056] In step S2, the vulnerability code output module, within the contrastive learning method, calculates the unsupervised contrastive loss of the feature embeddings corresponding to the unlabeled code corpus and the supervised contrastive loss of the feature embeddings corresponding to the labeled vulnerability dataset, and merges these losses to train and generate a vulnerability detection model. For the feature embeddings of the unlabeled code corpus, unsupervised loss is calculated using noise contrastive estimation.
[0057]
[0058] In the formula, H′ i Represents the graph-level feature representation of any (original or enhanced) sample i after T iterations; The low-dimensional embedding obtained after passing through an MLP mapping layer; j(i) represents the embedding obtained in the same training batch. Another view of sample i; τ is the temperature coefficient; Indicates training batch Other samples besides sample i; H' a This represents the graph-level feature representation of other sample a after T iterations.
[0059] For the feature embeddings of a labeled vulnerability dataset, calculate the supervised contrastive loss.
[0060]
[0061] In the formula, Indicates the training batch of the vulnerability dataset; H' represents a sample whose label matches the anchor sample i; q This represents the graph-level feature representation of other samples q that have the same label as the anchor sample i after T iterations.
[0062] A graph feature encoder is trained by combining unsupervised and supervised contrastive loss. The trained graph feature encoder is then used to optimize the feature embeddings of vulnerable and non-vulnerable code in the vulnerability dataset, and fed into a multilayer perceptron (MLP)-based classifier. Cross-entropy loss is then used to train and generate a vulnerability detection model. The graph feature encoder is trained using the following formula:
[0063]
[0064] In the formula, λ represents the weighting coefficient that balances the unsupervised contrastive loss and the supervised contrastive loss.
[0065] The process of inputting the dataset to be detected into the vulnerability detection model and outputting the vulnerable code includes the following steps: The dataset to be detected is obtained by sequentially performing static analysis, constructing a code attribute graph, and extracting features from the samples to be detected. Static analysis is performed on the code to be tested to obtain an Abstract Syntax Tree (AST), a Control Flow Graph (CFG), and a Program Dependency Graph (PDG), and a Code Attribute Graph (CPG) is constructed based on these. CodeBERT and label encoding are then used to encode each node in the CPG. The text information and type information are vector-encoded to obtain the text feature vector C. v and type feature vector T v The system uses feature concatenation to obtain initial feature embeddings for nodes, establishing a dataset to be detected as input to the vulnerability detection model. After processing by the vulnerability detection model, it outputs functions that may contain vulnerabilities.
[0066] Step S3, the vulnerability explanation module, specifically includes the following steps:
[0067] S31. Calculate the factual explanation subgraph and the counterfactual explanation subgraph. Calculate the factual explanation and counterfactual explanation subgraphs consistent with the model predictions using graph masks:
[0068]
[0069]
[0070] In the formula, S f With S c M represents the strength of factual explanation and the strength of non-factual explanation, respectively; k The adjacency matrix A represents the vulnerability code CPG. k The edge mask; Fk Represents the node feature matrix X k The feature mask; ⊙ represents the mask operator; The label represents the predicted label of the vulnerability detection model; P represents the probability calculation.
[0071] S32. A scaling-based constraint-solving strategy processes the factual interpretation subgraph and the counterfactual interpretation subgraph to generate the optimal interpretation subgraph, which serves as the vulnerability detection interpretation. First, the effectiveness and simplicity of the interpretation subgraph are balanced by combining factual and counterfactual interpretations:
[0072] minimize C(M k ,F k )
[0073]
[0074]
[0075] In the formula, C(M) k ,F k () indicates the number of nodes and edges used to generate the interpretive subgraph; Including the original predicted label The label with the highest predicted probability in the external vulnerability detection model; minimize means minimization operation.
[0076] Then, a scaling-based constraint solving strategy is used to generate the optimal interpretation subgraph as the interpretation for vulnerability detection:
[0077]
[0078]
[0079]
[0080] In the formula, and These represent the paired contrast loss for factual explanations and non-factual explanations, respectively; and This indicates that by using the edge mask M k and feature mask F k Scaling to the L1 norm of a real-valued matrix; γ represents the weighting coefficient that balances the strength of factual and counterfactual interpretations.
[0081] The present invention also discloses a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method.
[0082] The present invention also discloses a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method described herein.
Claims
1. An interpretable vulnerability detection method based on dual-view causal reasoning, characterized in that, The vulnerability detection method includes the following steps: S1. Obtain code samples, which include training samples and samples to be tested. The training samples are sequentially processed through data augmentation, static analysis, code attribute map construction, and feature extraction to obtain a training dataset. The samples to be tested are sequentially processed through static analysis, code attribute map construction, and feature extraction to obtain a dataset to be tested. S2. Process the training dataset based on the hybrid contrastive learning method to establish a vulnerability detection model; input the dataset to be detected into the vulnerability detection model and output the vulnerability code; in the contrastive learning method, calculate the unsupervised contrastive loss of the feature embedding corresponding to the unlabeled code corpus and the supervised contrastive loss of the feature embedding corresponding to the labeled vulnerability dataset, and merge the losses to train and generate the vulnerability detection model. S3. Perform causal reasoning on the vulnerable code and output a vulnerability detection explanation; specifically including the following steps: S31, Computational factual explanation subgraph, counterfactual explanation subgraph; S32. The scaling-based constraint solving strategy processes the fact interpretation subgraph and the counterfactual interpretation subgraph to generate the optimal interpretation subgraph as the vulnerability detection interpretation.
2. The interpretable vulnerability detection method based on dual-view causal reasoning according to claim 1, characterized in that, In step S1, the data augmentation includes injection point location operation, mutation operator selection operation, and code conversion operation; After data augmentation, the training samples are transformed into unlabeled code corpora and labeled vulnerability datasets.
3. The interpretable vulnerability detection method based on dual-view causal reasoning according to claim 1, characterized in that, The static analysis outputs an abstract syntax tree, a control flow graph, and a program dependency graph.
4. The interpretable vulnerability detection method based on dual-view causal reasoning according to claim 2, characterized in that, The code attribute diagram includes several nodes, each of which has corresponding text information and type information.
5. The interpretable vulnerability detection method based on dual-view causal reasoning according to claim 4, characterized in that, The feature extraction includes the following steps: S11. The text information and type information of each node are vector-encoded to obtain the initial node features; S12. Input the initial node features into the graph feature encoder to update the features and obtain the node feature embedding.
6. An interpretable vulnerability detection system based on dual-view causal reasoning, characterized in that, include: The code sample processing module is used to obtain code samples, which include training samples and samples to be detected. The training samples are processed sequentially through data augmentation, static analysis, code attribute map construction, and feature extraction to obtain a training dataset. The samples to be detected are processed sequentially through static analysis, code attribute map construction, and feature extraction to obtain a dataset to be detected. The module outputs vulnerability code to process the training dataset based on a hybrid contrastive learning method and establish a vulnerability detection model; it inputs the dataset to be detected into the vulnerability detection model and outputs vulnerability code. In the contrastive learning method, an unsupervised contrastive loss of feature embeddings corresponding to unlabeled code corpora and supervised contrastive loss of feature embeddings corresponding to labeled vulnerability datasets are calculated and then merged to train and generate a vulnerability detection model. The vulnerability explanation module is used to perform causal reasoning on the vulnerability code and output vulnerability detection explanations; specifically, it includes: a computational fact explanation subgraph and a counterfactual explanation subgraph; The scaling-based constraint solving strategy processes the factual interpretation subgraph and the counterfactual interpretation subgraph to generate the optimal interpretation subgraph as the vulnerability detection interpretation.
7. A computer device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of the method according to any one of claims 1 to 5.
8. A computer-readable storage medium, characterized in that, It stores a computer program thereon, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 5.