A source code vulnerability detection method based on a multi-relationship graph

Abstract

A source code vulnerability detection method based on a multi-relation graph, which first cuts the C language source code data set from the standard vulnerability database SARD and the NVD data set, generates an AST and obtains its program slice by means of Joern; secondly, in order to capture the additional syntax information of the AST, the AST is expanded by using a compiler to add edges carrying additional information to enhance its structure and connectivity, and then the enhanced AST is converted into a multi-relation graph; finally, a multi-relation graph attention network is constructed to learn an embedding vector. A plurality of code relations are extracted from the source code by using the graph attention network, and a global embedding vector is learned by using the adjacency matrix and the initial node representation of the multi-relation graph, and the global embedding vector is normalized and fed into a softmax layer for processing. By means of the newly designed representation mode and the multi-relation graph aggregation learning, the application can provide a better code representation for the downstream software vulnerability detection task, so as to realize an accurate, efficient and more applicable vulnerability detection method.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of source code vulnerability detection, and mainly refers to a source code vulnerability detection method based on a multi-relation graph. BACKGROUND

[0002] Traditional vulnerability detection mainly includes static, dynamic and static-dynamic combined methods. Static detection is based on the pre-learned pattern recognition in the training sample to identify possible problems in the new project. Before the program is compiled and run, potential vulnerabilities are detected through lexical, syntactic and other analysis techniques. Early static detection often uses rule analysis, code similarity comparison and symbolic execution, etc. such as Flawfinder, RATS, ITS4, etc. However, the false positive rate of static detection is high, and it is highly dependent on expert experience, making it difficult to meet the needs of code vulnerability detection. In order to make up for the shortcomings of static detection, dynamic detection emerged. It relies on the actual running of the program code and the input data, monitors the behavior characteristics of the program during running, and uses abnormal behavior analysis technology to accurately identify potential vulnerabilities, achieving high detection accuracy. However, dynamic detection is difficult to cover all code paths of the target program, and has certain limitations. By combining static detection with dynamic detection, the accuracy and practicality of vulnerability detection are improved, but they usually rely on known vulnerability syntax or behavior patterns, and there are still challenges for new vulnerability detection.

[0003] In recent years, researchers have begun to explore new intelligent vulnerability detection methods, and a large number of practices have shown that machine learning technology can surpass expert-established rules in detecting common code vulnerabilities or bugs. However, the code representation of machine learning-based vulnerability detection methods is usually based on the structure and statistical information of the code, making full use of the syntax and semantic information of the source code, and using tree, graph and other data structures to represent the syntax structure, data flow control dependency and function call relationship of the source code. With the continuous increase of software size, the traditional code representation method has been unable to meet the needs of large-scale vulnerability detection, and more and more research has begun to focus on the improvement and optimization of code representation methods. Compared with traditional machine learning techniques, deep learning has great advantages. In the machine learning stage, code representation mainly relies on manual feature engineering (Gu Mianxue, Sun Hongyu, Han Dan, etc. Software security vulnerability mining based on deep learning [J]. Computer Research and Development, 2021), and researchers need to select and extract features based on experience and domain knowledge. In the deep learning stage, neural networks can automatically learn high-level abstract representations without manual design. Patent CN202010747186.2 processes software source code into corresponding intermediate code representation and uses deep learning technology to implement a fine-grained code vulnerability detection method, effectively improving the vulnerability detection rate. In addition, machine learning usually only focuses on code text, but deep learning begins to integrate multiple modalities (Yang Hongyu, Ma Jianhui, Hou Min, Shen Shuanghong, Chen Enhong. Code representation enhancement pre-training method based on multi-modal contrast learning. Journal of Software, 2024) of code, such as text, structure and annotation, to perform representation learning with multi-modal input, complete code classification or regression tasks through layer-by-layer abstraction, and show that good code representation can reduce feature information loss. Code representation is divided into text-level features, semantic-level features, functional-level features, and structural-level features from low to high according to the abstraction level. Since the higher the abstraction level, the more information extracted, researchers pay more attention to the structural-level features of the code. In recent years, the analysis of code structure has mainly focused on AST, as AST contains complete code structure information. Patent CN115935367A is mainly based on graph neural networks, which first performs lexical and syntactic analysis on the source code of the target program, and then generates AST. Based on AST, control flow graph, control dependency graph and data dependency graph are combined to construct code attribute graph. In source code analysis, syntax and semantic information is usually represented by AST, but the structure of AST and the association between its nodes are different from graph structure data, which makes it difficult to perform message passing and aggregation operations directly on AST nodes and edges, and further makes it difficult to fully capture the deep structure information and semantic relationship of the code. Therefore, it is particularly important to design and process AST.

[0004] However, the application of deep learning technology also has some problems, such as incomplete feature extraction, lack of rich syntax and semantic information, etc. At present, the program modeling method based on deep learning usually uses long short-term memory (LSTM) or gate recurrent unit (GRU). LSTM is mainly suitable for processing sequence data, and is not ideal for modeling program structures with control flow and data flow. Therefore, the current LSTM-based method is not good for processing complex code structures and relationships, and can only capture the shallow surface structure of the source code text, and cannot capture the rich deep semantics of the source code. In addition, the deep learning method usually only considers specific functions or methods in the code as independent subgraphs for detection and classification, which ignores other syntax and semantic information in the code, such as variables, control flow, data flow, etc., which may lead to incomplete feature extraction and inability to cover all syntax and semantic information in the code. Code structure graph is a solution to these problems, which usually contains complex hierarchical information (D. Guo, S. Ren, S. Lu, et al.“Graphcodebert: Pre-training code representations with data flow,” in 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021.), in order to effectively learn the representation of code structure graph, most studies use graph neural network (Z. Wu, S. Pan, F. Chen, G. Long, C. Zhang, and S. Y. Philip, “A comprehensive survey on graph neural networks,” IEEE Trans. Neural Netw. Learn. Syst., early access, 2020.) as an advanced technology for artificial intelligence vulnerability detection, which has the advantages of being able to directly process graph structure data and having the ability to learn and aggregate multiple code relationships, thereby preserving the syntax and semantic relationships of source code components.

[0005] To more comprehensively reveal the inherent information of a program, program analysis relies not only on Abstract Syntax (AST) but also on various program representation methods such as Control Flow Graph (CFG) and Data Flow Graph (DFG). In fact, vulnerability discovery often requires a deep understanding of the semantics of complex code. For example, using AST alone can help identify vulnerabilities related to insecure parameters, but combining AST with CFG can detect more complex resource leaks and post-release issues. Further integrating AST, CFG, and DFG allows for the comprehensive detection of various types of vulnerabilities, ensuring the security and stability of the program. For example, Zhuang et al. (R. Russell et al. "Automated Vulnerability Detection in Source Code Using Deep Representation Learning," 2018 17th IEEE International Conference on Machine Learning and Applications (ICMLA), Orlando, FL, USA, 2018) used a three-channel graph neural network (3GNN) with shared weights to fuse one or more graphs together. The 3GNN operates on different representations of the source code graphs (AST, CFG, DFG) separately. By focusing on the characteristics of each graph, the model is able to learn more deeply the vulnerability patterns revealed by each graph. After processing each graph individually, the information from these graphs is aggregated to form a complete program representation for subsequent classification tasks. Gu et al. (Gu Shouke, Chen Wen. A Function-Level Code Vulnerability Detection Method Based on Enhanced AST Graph Neural Network [J]. Computer Science, 2023) used a graph neural network model with GRU for code vulnerability detection. They added control edges, data dependency edges, and semantic edges to the graph structure and integrated the nodes to obtain a joint graph structure. They used a regular graph neural network to learn the graph representation of AST or the graph representations of CFG and DFG, proving that new code representation methods such as CFG and DFG can better describe the execution flow of code. Although multiple code relationships may exist between any given pair of nodes, these methods keep the graph edges untyped. Therefore, they cannot determine whether the connection between two nodes is a dependency relationship between AST nodes, a data flow edge, or a control flow edge, nor can they distinguish other relationships. The graph neural networks used in these methods can effectively learn and integrate information between nodes through their built-in message passing and neighborhood aggregation mechanisms, thereby generating a more comprehensive and accurate global graph representation. However, when performing aggregation operations, graph neural networks typically use fixed weights for weighted summation, which limits the model's ability to adaptively adjust the weights of neighboring nodes.Therefore, although most current research has made significant contributions to the problem of software vulnerability discovery, these methods still lack sufficient consideration of all contextual information of the program and are difficult to capture the structural information and semantic relationships of the code, which directly affects the detection performance of vulnerability detection models. Summary of the Invention

[0006] This invention provides a source code vulnerability detection method, Mul-VD, based on multiple relationship graphs, which aims to improve the ability to characterize code vulnerability features, thereby achieving accurate and efficient vulnerability detection.

[0007] The technical solution adopted in this invention is as follows:

[0008] A source code vulnerability detection method based on multiple relationship graphs mainly includes the following steps:

[0009] Step A: Generate program slices. C language source code datasets are obtained by segmenting from the Software Assurance Reference Dataset (SARD) and the National Vulnerability Database (NVD). Joern is used to parse and extract the source code. By specifying the starting point of the slice, Joern can extract relevant code and dependencies, generating corresponding Abstract Syntax Trees (ASTs). The code is then sliced ​​based on vulnerability rules to obtain the final program slices. These vulnerability rules include API / library function calls (FC), array usage (AU), pointer usage (PU), and arithmetic expressions (AE).

[0010] Step B: Generate an extended AST. The compiler adds edges carrying additional information to the AST generated in Step A to expand and optimize it, resulting in an extended AST.

[0011] Step C: Encode the extended AST into a multi-relation graph. Use the multi-relation graph to store the extended AST relations. Each edge corresponds to a relation graph, thus forming a multi-relation graph. The multi-relation graph is a directed graph composed of nodes and edges. Nodes represent nodes of the AST or intermediate representation (IR). Edges represent a relationship between two nodes. The edges of each relation graph are re-encoded using an adjacency matrix.

[0012] Step D: Construct a multi-relationship graph attention network. Pass the adjacency matrix and initial vertex embeddings obtained in step C to the graph attention network GAT. The graph attention networks perform aggregation operations on all neighbor nodes to learn the global embedding vector of the multi-relationship graph. The initial vertex embeddings are obtained by vectorization using Word2Vec, which maps each vertex to a vector representation.

[0013] Step E: The graph embedding module embeds the graph vectors output by the multi-relation graph attention network into a normalized form, and feeds the normalized feature vectors into the softmax layer for processing to obtain the prediction results.

[0014] Furthermore: Step B is implemented as follows:

[0015] Based on the AST formed in step A, the compiler is used to add additional edges connect, passing, invoke, and unexchange to extend it. During the compilation and construction process, standard data flow analysis and optimization techniques are applied to generate the intermediate representation IR of the program. Based on the IR, a control data flow graph CDFG is constructed. The CDFG captures semantic information reflecting the transformation of the standard compiler, and then extracts data flow, control flow, and NextToken from the CDFG to generate an extended AST with eight edges: children, connect, passing, invoke, unexchange, data flow, control flow, and NextToken.

[0016] Step C is implemented as follows: The eight edges mentioned in step B, i.e., the eight code relationships, reflect the connection between the program graph matrices; for each relationship graph, an adjacency matrix is ​​used to represent the connection relationship between the nodes in the graph, thereby constructing eight adjacency matrices; in the adjacency matrix, two neighboring nodes with a direct relationship are marked as 1, and those without a direct relationship are marked as 0.

[0017] Step D is implemented as follows: The initialized vertex uses its current state as information and passes the message to each neighbor in the graph to exchange information; at each vertex, its own embedding vector is passed as information to all neighbors. After the message is gathered and integrated, it is used for the next round of embedding layer update of the relevant vertex representation. After multiple state updates, each vertex will eventually get a new set of embeddings.

[0018] The normalization described in step E is implemented as follows:

[0019] The graph embedding vectors obtained in step D are normalized using a Normalization Layer. The Normalization Layer normalizes the embedding vectors so that the mean of each vector is 0 and the variance is 1. In addition, the parameters in the Normalization Layer are updated according to the backpropagation algorithm. The parameters typically include the mean and variance of each dimension and are continuously adjusted during training to adapt to the distribution of the data.

[0020] By leveraging a newly designed representation method and multi-relation graph aggregation learning, this invention enables Mul-VD to provide higher-quality code representations for downstream software vulnerability detection tasks, thereby achieving an accurate, efficient, and more applicable vulnerability detection method. Attached Figure Description

[0021] Figure 1 This forms the framework of the present invention;

[0022] Figure 2 This is a schematic diagram of the extended AST of the present invention;

[0023] Figure 3 This is a schematic diagram of the feature extraction model of the present invention. Detailed Implementation

[0024] The implementation steps of the present invention will be described in detail below based on the accompanying drawings. In order to better represent the program flow and semantic relationships in the source code through the dynamic interaction between nodes and edges, the present invention adopts a multi-relation graph to represent it, introduces a graph attention network to learn the multi-relation graph, and finally validates it on datasets such as SARD and NVD. The details are described below.

[0025] A source code vulnerability detection method based on multi-relationship graphs (Mul-VD) mainly includes the following steps:

[0026] Step A: Generate program slices. C language source code datasets are obtained by segmenting from the Software Assurance Reference Dataset (SARD) and the National Vulnerability Database (NVD). Joern is used to parse and extract the source code. By specifying the starting point of the slice, Joern can extract relevant code and dependencies, generating corresponding Abstract Syntax Trees (ASTs). The code is then sliced ​​based on vulnerability rules to obtain the final program slices. These vulnerability rules include API / library function calls (FC), array usage (AU), pointer usage (PU), and arithmetic expressions (AE).

[0027] Step B: Generate an extended AST. The compiler adds edges carrying additional information to the AST generated in Step A to expand and optimize it, resulting in an extended AST. The specific implementation is as follows:

[0028] Standard ASTs only contain dependency relationships, including only child edges between child and parent nodes. To more comprehensively express the semantics and syntactic structure of the code, the compiler adds additional edges (connect, passing, invoke, unexchange) to the AST formed in step A, enabling it to carry more syntactic and semantic information. The extended edges are described below; for details of the relationship graph, please refer to [reference needed]. Figure 2 .

[0029] 1. connect: Connects the variable to the assignment statement within each assignment statement. For example... Figure 2 In the source code statement `return num = (char*)(a + b)`, both `a` and `b` point to `num`. This invention, by adding a connect edge to the AST, can trace the path of data transmission. This edge precisely locks the usage scenario of the variable or buffer, and has significant and practical value in revealing security risks such as "null pointer dereferencing".

[0030] 2. Passing: During the passing of arguments from actual parameters to formal parameters, add an edge pointing from the actual parameter to the formal parameter. For example... Figure 2In the source code, 3 points to 'a' and 5 points to 'b'. `passing` directly relates to the flow and sharing of data between functions. By precisely capturing the method and process of parameter passing, the flow of data parameters can be tracked, preventing errors in parameter passing and detecting parameter pollution vulnerabilities.

[0031] 3. invokeking: Redirects the caller function to the called function. For example... Figure 2 In the source code, `check_enen` points to `add_two_numbers` to prevent recursive call errors. By tracing the invoke, we can analyze how data flows between different functions, which helps to discover cross-function data flow problems, such as uninitialized variables, dirty data propagation, etc.

[0032] 4. unexchange: A pointer from the first argument to the second argument. For example... Figure 2 In the source code, parameters a and b are referenced. This invention adds an edge pointing from a to b to prevent a and b from being swapped. While a and b are indistinguishable in the AST, the order of tokens is crucial in the token sequence; swapping the two parameters would disrupt the original order. This edge can detect potential parameter order errors, which helps reduce the risk of logical errors, functional failures, and security vulnerabilities.

[0033] Furthermore, during the compilation and building process, after applying standard data flow analysis and optimization techniques, an intermediate representation (IR) of the program is generated. Based on the IR, a control data flow graph (CDFG) is constructed. The CDFG captures semantic information reflecting the transformations of the standard compiler. Then, data flow, control flow, and NextToken are extracted from the CDFG, and an extended AST with eight edges is generated: children, connect, passing, invoke, unexchange, data flow, control flow, and NextToken.

[0034] Step C: Encode the extended AST into a multi-relation graph. Use the multi-relation graph to store the extended AST relations. Each edge corresponds to a relation graph, thus forming a multi-relation graph. The multi-relation graph is a directed graph composed of nodes and edges. Nodes represent nodes of the AST or intermediate representation (IR). Edges represent a relationship between two nodes. The edges of each relation graph are re-encoded using an adjacency matrix.

[0035] Step C is implemented as follows:

[0036] Code Relationships: The eight edges mentioned in step B, representing eight code relationships, reflect the connections between the program graph matrices; each node in the multi-relationship graph represents a node in the AST or IR. For each pair of nodes, if a relationship exists between them, an edge is created between the two nodes, with each edge corresponding to a specific relationship.

[0037] Adjacency Matrix: Each edge in the multi-relationship graph is traversed, and its starting and ending points are marked in the adjacency matrix. This way, the adjacency matrix contains information about all edges in the multi-relationship graph, thus re-encoding the edges. For each relationship graph, an adjacency matrix is ​​used to represent the connections between nodes, constructing eight adjacency matrices. In the adjacency matrix, a direct relationship between two neighboring nodes is marked as 1, and no direct relationship is marked as 0.

[0038] Step D: Construct a multi-relationship graph attention network. Pass the adjacency matrix and initial vertex embeddings obtained in step C to the graph attention network GAT. The graph attention networks perform aggregation operations on all neighbor nodes to learn the global embedding vector of the multi-relationship graph. The initial vertex embeddings are obtained by vectorization using Word2Vec, which maps each vertex to a vector representation.

[0039] Step D is implemented as follows:

[0040] The node neighborhood aggregation process in graph attention networks primarily relies on the features of the node itself and its neighbors for information propagation and aggregation, without depending on the connections between nodes. During aggregation, each vertex typically has an embedding layer. Each embedding layer follows a neighborhood aggregation scheme. For the initial node, word2vec is used for vectorization to obtain the embedding. The initial vertex uses its current state as information and passes the message to each neighbor in the graph to exchange information. At each vertex, its own embedding vector is passed as information to all neighbors. After message aggregation and integration, this is used for the next round of embedding layer updates of the relevant vertex representations. After multiple state updates, each vertex will eventually receive a new set of embeddings. Specifically:

[0041] Multi-relation graph embedding: In graph attention networks, the multi-relation embedding layer aims to combine the features of nodes and relations to generate node embeddings rich in multi-relation information. It constructs a comprehensive representation for each node that reflects both its original characteristics and its interactions with other nodes by performing relation-specific transformations and feature fusion on the initial node embeddings.

[0042] GAT Layer: To progressively capture complex relationships within the graph structure across multiple network layers and allow the model to learn the relative importance of different nodes, the GAT layer is used to aggregate and update nodes. GAT performs information transfer, feature fusion, network structure learning, and dynamic updates based on node state and edge type. Each node aggregates information from its neighbors based on their attention coefficients, thereby updating its own state or representation. During aggregation, GAT considers not only node features but also edge type information. In each GAT layer, attention coefficients between the current node and its neighbors are dynamically calculated based on edge type, node state, and neighbor node features. Each neighbor node's feature vector is multiplied by its corresponding attention coefficient, and softmax is used to obtain normalized attention weights. These attention weights reflect the importance of neighbor nodes to the current node. Then, the features of neighbor nodes are weighted and aggregated based on these weights to obtain a new aggregated feature vector. Through a multi-layered GAT network structure, node representations are passed and updated layer by layer, achieving information sharing and state updates between nodes, thus making node representations more accurate and richer. Each GAT layer generates an embedding vector for the code relationships it is interested in. These embedding vectors each capture specific information and interaction patterns of the node within that relationship. Finally, the aggregated feature vector is combined with the original feature vector of the current node as input to the fully connected layer. This vector, containing multi-relationship information, is further processed and transformed using a linear transformation and the ReLU activation function to obtain the updated node representation. To prevent overfitting, dropout is used to randomly deactivate the representation of the current node.

[0043] Global Pooling Layer: This layer uses the output of the fully connected layer as input to the global average pooling layer, capturing information across the entire graph. Because this layer helps reduce the number of model parameters, it converts the feature map into a fixed-size representation vector, preventing overfitting. This layer aggregates the feature vectors of all nodes to obtain a global feature vector representing the entire graph, containing information about all nodes. This enhances the model's generalization ability, making it more robust to complex graph structures.

[0044] The normalization described in step E is implemented as follows:

[0045] In the graph embedding module, to prevent overfitting, the graph embedding vectors obtained in step D are normalized using a Normalization Layer. The Normalization Layer normalizes the embedding vectors so that the mean of each vector is 0 and the variance is 1. In addition, according to the backpropagation algorithm, the parameters in the Normalization Layer are updated. The parameters typically include the mean and variance of each dimension, and are continuously adjusted during training to adapt to the distribution of the data.

[0046] The verification results of Mul-VD in this invention are shown in Tables 1 and 2. The sample set selected for Mul-VD in this invention is precise and diverse, with exactly half being vulnerable code samples. This invention carefully screened data released by authoritative organizations such as SARD and NVD, and extensively collected relevant information from open-source projects on GitHub. To ensure the balance between positive and negative samples, referring to previous research, patch versions provided by SARD and audited code were used as vulnerability-free code samples to enhance the model's identification capabilities.

[0047] (1) This invention, Mul-VD, selects several representative vulnerability detection methods to comprehensively evaluate the performance of the proposed method. These include the slice-based method VulDeePecker, and several graph-based methods such as Devign, VDoTR, and Wang et al. These methods capture deep-level information and patterns in the code by constructing complex code graph structures. To verify the effectiveness of Mul-VD, the above-mentioned methods are selected as benchmarks for experimental comparison.

[0048] Referring to Table 1, the Mul-VD method of this invention achieves scores above 90% across all metrics, demonstrating the best performance compared to the baseline model. This is because the multi-relation graph in this paper not only incorporates hierarchical structure information from the AST but also enriches the graph's representational capabilities by introducing other types of edges, thereby capturing key information. In terms of overall detection performance, Devign is approximately 30% lower than this invention. This is because Devign operates on a graph representation without additional AST edge extensions. Although it considers various dependencies such as data dependencies and control dependencies, the captured syntactic and semantic information is not comprehensive enough. Even though Devign uses graph neural networks to aggregate node information, it does not distinguish the dynamic relationships and importance between different nodes and edges, resulting in weak generalization ability. Compared to the VDoTR method, Mul-VD is approximately 10% higher. The multi-relation graph used in Mul-VD not only incorporates hierarchical structure information from the AST but also enriches the graph's representational capabilities by introducing other types of edges, thus effectively representing complex dependencies and interactions in the code. In contrast, while tensor representation can integrate multiple types of information, it may have certain limitations in representing complex structures and relationships. Furthermore, compared to VulDeePecker, Mul-VD shows significant improvements across various metrics, thanks to its explicit modeling of different relationships within the code using multi-relation graphs, enabling more accurate capture of structural and semantic information. In contrast, the token-based method VulDeePecker employs multiple LSTMs to train the detection model. However, RNNs may overlook or mask some crucial features when processing data. Graph neural networks, in comparison, demonstrate higher efficiency in processing graph-based data. While token-based and RNN-based methods have some application value in code security detection, graph neural networks offer better handling of discontinuous features, stronger ability to capture contextual information, and greater generalization capabilities. Compared to Wang et al., this invention shows slight improvements across various metrics, indicating that multi-relation graphs can easily add new relationships and node types to adapt to different code analysis tasks.

[0049] Table 1. Experimental results comparing the detection performance of this invention with other vulnerability detection methods.

[0050]

[0051] (2) To verify the contribution of extended edges to the performance of Mul-VD in this invention, Devign, VDoTR, and Wang et al. datasets of different vulnerability types, CWE-119, CWE-469, and CWE-120, were selected for verification. Referring to Table 2, compared with several graph-based methods, the method proposed by Mul-VD is obviously more advantageous. Methods such as Devign and VdoTR rely on a single composite graph to integrate different information in the code. This approach often overemphasizes the syntactic level and relatively ignores the importance of program semantics, thus limiting the comprehensiveness and depth of the model in code representation. However, by using a multi-relational structure graph, Mul-VD can more comprehensively cover the multi-dimensional representation of the program, thereby significantly improving classification performance. Although Wang et al. achieved good results, some edges may carry similar or repeated information, which may not be effectively utilized in subsequent analysis or model training, affecting the performance of the model. Mul-VD carefully selects edges that are significant and make substantial contributions to the actual vulnerability code when constructing multi-relationship graphs, ensuring accurate capture of key information while retaining important nodes and relationships and ignoring nodes and relationships that contribute little to the task. However, for the tensor representation in the VDoTR method, adding new information may require redesigning the tensor's structure and dimensions, which could increase the complexity and cost of implementation.

[0052] Table 2. Comparative experimental results of the present invention and other methods on the same dataset.

[0053]

Claims

1. A method for source code vulnerability detection based on a multi-relationship graph, characterized in that, The method comprises the following steps: Step A: generating program slices, slicing C language source code data set from software assurance reference data set SARD and national vulnerability database NVD, and parsing and extracting the source code by using Joern, extracting relevant code and dependencies by specifying the slice starting point, generating corresponding abstract syntax tree AST, slicing the code based on vulnerability rules, and finally obtaining program slices; The vulnerability rules include API / library function call FC, array usage AU, pointer usage PU, and arithmetic expression AE; Step B: generating extended AST, adding edges carrying additional information to the AST generated in step A by using a compiler to extend and optimize the extended AST; the specific implementation is as follows: based on the AST formed in step A, additional edges connect, passing, invoking, and unexchange are added to the AST by using a compiler to extend the AST, so that the AST can carry more syntax semantic information; The extended edges are described as follows: connect: connecting variables to assignment statements in each assignment statement; by adding a connect edge in the AST, the path of data transmission can be tracked, and the use scenario of the variable or buffer is locked; passing: adding an edge from the actual parameter to the formal parameter in the process of actual parameter to formal parameter transmission; passing directly associates the data flow and sharing between functions, and by capturing the parameter transmission mode and process, the data parameter flow can be tracked, and whether there is a parameter pollution vulnerability can be detected; invoking: from the calling function to the called function; by tracking invoking, the flow of data between different functions can be analyzed; unexchange: from the first parameter to the second parameter; the unexchange edge can detect potential parameter order errors; Step C: encoding the extended AST into a multi-relation graph, storing the extended AST relationship by using a multi-relation graph, and each edge corresponds to a relation graph, thereby forming a multi-relation graph; The multi-relation graph is a directed graph composed of nodes and edges, the nodes represent AST or intermediate representation IR nodes, and the edges represent the relationship between two nodes, and each relation graph edge is re-encoded by using an adjacency matrix; The specific implementation of step C is as follows: Code relationship: reflecting the connection between program graph matrices; each node in the multi-relation graph represents an AST or IR node; for each pair of nodes, if there is a certain relationship between them, an edge is created between the two nodes, and each edge corresponds to a specific relationship; Adjacency matrix: traversing each edge in the multi-relation graph, and marking the corresponding position in the adjacency matrix according to the start and end points of the edge; The adjacency matrix contains all the edge information in the multi-relation graph, thereby realizing the re-encoding of the edges; For each relation graph, the connection relationship between the nodes in the graph is represented by using an adjacency matrix, thereby constructing eight adjacency matrices; In the adjacency matrix, the direct relationship between two adjacent nodes is recorded as 1, and no direct relationship is recorded as 0; Step D: Constructing a multi-relation graph attention network, the adjacency matrix and the initial vertex embedding obtained in step C are transmitted to the graph attention network GAT to perform aggregation operation on all adjacent nodes, and then the global embedding vector of the multi-relation graph is learned; Wherein the initial vertex embedding is obtained by word2Vec vectorization, and each vertex is mapped to a vector representation; Step D is implemented as follows: the node field aggregation process of the graph attention network propagates and aggregates information through the features of the nodes themselves and the features of the adjacent nodes, and does not depend on the connection relationship between the nodes; In the aggregation process, each vertex has an embedding layer; Each embedding layer follows a field aggregation scheme; For the initial node, word2Vec is used for vectorization to obtain an embedding vector, which represents the information of the current state, and then the embedding vector is transmitted to all neighbors in the graph to exchange information; On each vertex, the embedding vector of itself is transmitted to all neighbors as information, and after the convergence and integration of the messages, it is used to update the vertex representation related to the next round of embedding layer update, and after multiple state updates, each vertex will finally obtain a new set of embeddings; Specifically as follows: Multi-relation graph embedding: In the graph attention network, the multi-relation embedding layer aims to combine the features of nodes and relations to generate node embeddings rich in multi-relation information; It constructs a comprehensive representation for each node that reflects its original characteristics and interaction with other nodes by performing relation-specific transformation and feature fusion on the initial node embedding. GAT layer: in order to capture the complex relationships in the graph structure step by step in multiple network layers, and allow the model to learn the relative importance between different nodes, the GAT layer is used to realize the aggregation and update of nodes; GAT is based on node state and edge type for information transmission, feature fusion, network structure learning and dynamic update; each node aggregates the information of neighbor nodes according to the attention coefficient of neighbor nodes, so as to update its own state or representation; in the aggregation process, GAT not only considers the features of nodes, but also integrates the type information of edges; in each GAT, the attention coefficient between the current node and its neighbor nodes is dynamically calculated according to the edge type, node state and feature of neighbor nodes, the feature vector of each neighbor node is multiplied by the corresponding attention coefficient, and the normalized attention weight is obtained by using softmax; the attention weight reflects the importance of neighbor nodes to the current node; then, the features of neighbor nodes are weighted and aggregated according to the attention weight, and a new aggregated feature vector is obtained; through the multi-layer GAT network structure, the representation of nodes is transmitted and updated layer by layer, realizing information sharing and state updating between nodes; wherein, each GAT layer generates an embedding vector for the code relationship it focuses on; the embedding vector respectively captures the specific information and interaction mode of the node under the relationship; finally, the aggregated feature vector is combined with the original feature vector of the current node as the input of the full connection layer, and linear transformation and activation function ReLU are further applied to the feature vector containing multi-relation information to further process and convert the feature vector containing multi-relation information, to obtain the updated node representation; in order to prevent overfitting phenomenon, dropout technology is used to randomly inactivate the representation of the current node; Global pooling layer: the output of the full connection layer is taken as the input of the global average pooling layer, realizing the capture of information in the global range, because the layer itself helps to reduce the number of parameters of the model, it converts the feature map into a fixed size representation vector, preventing overfitting phenomenon; the layer aggregates the feature vectors of all nodes to obtain a global feature vector representing the whole graph, which contains the information of all nodes in the graph; The specific implementation of the normalization in step E is as follows: graph embedding module, in order to prevent overfitting phenomenon, the graph embedding vector obtained in step D is normalized by using normalization layer; the normalization layer normalizes the embedding vector, so that the mean of each vector is 0 and the variance is 1; according to the back propagation algorithm, the parameters in the normalization layer are updated, including the mean and variance of each dimension, which are continuously adjusted during the training process to adapt to the distribution of data.

Images