SAST vulnerability detection method, device and electronic equipment based on LLM

Abstract

This application provides an LLM-based SAST vulnerability detection method, apparatus, and electronic device. The LLM-based SAST vulnerability detection method includes: using the SAST tool to perform vulnerability detection on the program to be detected to obtain vulnerability information; wherein, the vulnerability information includes vulnerability context; using a pre-trained LLM model to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context; if the security verification function exists in the vulnerability context, using the SAST tool to verify whether the security verification function can protect against the vulnerability; if the security verification function does not exist in the vulnerability context or the security verification function cannot protect against the vulnerability, outputting the vulnerability information. This application embodiment can achieve the technical effect of improving the accuracy of SAST vulnerability detection.

Description

Technical Field

[0001] This application relates to the field of software testing technology, and more specifically, to a SAST vulnerability detection method, apparatus, and electronic device based on LLM. Background Technology

[0002] Static Application Security Testing (SAST), also known as white-box testing, is a software testing method primarily used to detect potential security vulnerabilities in a program under test.

[0003] In the process of using existing SAST tools to detect potential security vulnerabilities in programs, these tools primarily scan the program and use a large set of rules and static analysis strategies to detect the presence of security check functions. If a security check function is detected, it is assumed that the function can successfully resolve the vulnerability without being reported, leading to missed detections. Furthermore, the tools may directly report vulnerabilities after detecting dangerous functions in the program, failing to recognize the correlation between security check functions and vulnerabilities, resulting in false positives and missed detections. This ultimately reduces the accuracy of SAST vulnerability detection. Summary of the Invention

[0004] The purpose of this application is to provide a SAST vulnerability detection method, device, and electronic device based on LLM, so as to achieve the technical effect of improving the accuracy of SAST vulnerability detection.

[0005] In a first aspect, embodiments of this application provide a method for detecting vulnerabilities in static application security testing (SAST) based on Large Language Model (LLM), including:

[0006] The SAST tool is used to perform vulnerability detection on the program to be tested, and the vulnerability information is obtained; wherein, the vulnerability information includes the vulnerability context;

[0007] A pre-trained LLM model is used to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context;

[0008] If a security verification function corresponding to the vulnerability exists in the vulnerability context, the SAST tool is used to verify whether the security verification function corresponding to the vulnerability can protect against the vulnerability.

[0009] If there is no security verification function corresponding to the vulnerability in the vulnerability context, or if the security verification function corresponding to the vulnerability cannot protect against the vulnerability, the vulnerability information is output.

[0010] In the above implementation process, after obtaining vulnerability information by using the SAST tool to perform vulnerability detection on the program to be detected, a pre-trained LLM model is used to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context. If there is a security verification function corresponding to the vulnerability in the vulnerability context, the SAST tool is used to verify whether the security verification function corresponding to the vulnerability can protect against the vulnerability. Only when there is no security verification function corresponding to the vulnerability in the vulnerability context or the security verification function corresponding to the vulnerability cannot protect against the vulnerability is the vulnerability information output. This can effectively avoid the problem of false positives and false negatives and improve the accuracy of SAST vulnerability detection.

[0011] Furthermore, before determining whether a security verification function corresponding to the vulnerability exists in the vulnerability context using a pre-trained LLM model, the method further includes:

[0012] The LLM model is obtained by training an LLM model based on a knowledge graph of security verification functions.

[0013] In the above implementation process, the LLM model is trained based on the knowledge graph of security verification functions to obtain the pre-trained LLM model, which can ensure that the pre-trained LLM model can accurately determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context.

[0014] Furthermore, before training the LLM model based on the security verification function knowledge graph to obtain the pre-trained LLM model, the method further includes:

[0015] Multiple target programs are parsed to obtain multiple abstract syntax trees;

[0016] Extract the metadata of the security verification functions and the association relationships of the security verification functions from the multiple abstract syntax trees;

[0017] Using the security verification function as a node, the metadata of the security verification function as the attribute information of the node, and the association relationship of the security verification function as the edge of the node, a knowledge graph of the security verification function is constructed.

[0018] In the above implementation process, multiple abstract syntax trees are obtained by parsing multiple target programs. The metadata of security verification functions and the association relationships of security verification functions are extracted from multiple abstract syntax trees. With security verification functions as nodes, the metadata of security verification functions as the attribute information of nodes, and the association relationships of security verification functions as the edges of nodes, a security verification function knowledge graph is constructed, which can ensure the complete and accurate construction of the security verification function knowledge graph.

[0019] Furthermore, the step of training the LLM model based on the knowledge graph of the security verification function to obtain the pre-trained LLM model includes:

[0020] Convert the elements in the security verification function knowledge graph into triples;

[0021] The triples are vectorized, and training samples are constructed based on the resulting vectors;

[0022] The LLM model is trained using the training samples to obtain the pre-trained LLM model.

[0023] In the above implementation process, by converting the elements in the security verification function knowledge graph into triples and vectorizing the triples, training samples are constructed based on the obtained vectors. The LLM model is then trained using the training samples to obtain the pre-trained LLM model. This allows for the rapid and accurate acquisition of training samples from the security verification knowledge graph to train the LLM model.

[0024] Furthermore, the step of using a pre-trained LLM model to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context includes:

[0025] The vulnerability information is input into the pre-trained LLM model to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context.

[0026] In the above implementation process, by inputting the vulnerability information into a pre-trained LLM model to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context, it is possible to quickly determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context.

[0027] Furthermore, the method also includes:

[0028] If the security verification function corresponding to the vulnerability cannot protect against the vulnerability, the pre-trained LLM model is optimized based on the vulnerability information.

[0029] In the above implementation process, by optimizing the pre-trained LLM model based on the vulnerability information when the security verification function corresponding to the vulnerability cannot protect against the vulnerability, it can be ensured that the subsequent pre-trained LLM model can more accurately determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context.

[0030] Furthermore, the method also includes:

[0031] If the security verification function corresponding to the vulnerability can protect against the vulnerability, the security verification function knowledge graph is updated according to the vulnerability information of the vulnerability and the security verification function corresponding to the vulnerability to obtain a new security verification function knowledge graph;

[0032] The pre-trained LLM model is optimized based on the new security verification function knowledge graph.

[0033] In the above implementation process, by updating the security verification function knowledge graph based on the vulnerability information and the corresponding security verification function when the security verification function corresponding to the vulnerability can protect against the vulnerability, and optimizing the pre-trained LLM model based on the new security verification function knowledge graph, it can be ensured that the subsequent pre-trained LLM model can more accurately determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context.

[0034] Secondly, embodiments of this application provide an LLM-based SAST vulnerability detection device, including:

[0035] A primary detection module is used to perform vulnerability detection on the program to be detected using the SAST tool to obtain vulnerability information; wherein, the vulnerability information includes vulnerability context;

[0036] The function identification module is used to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context using a pre-trained LLM model;

[0037] The secondary verification module is used to verify, using the SAST tool, whether the security verification function corresponding to the vulnerability can protect against the vulnerability when there is a security verification function corresponding to the vulnerability in the vulnerability context.

[0038] The result output module is used to output vulnerability information when there is no security verification function corresponding to the vulnerability in the vulnerability context or when the security verification function corresponding to the vulnerability cannot protect the vulnerability.

[0039] Thirdly, embodiments of this application provide an electronic device including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; the memory is coupled to the processor, and the processor implements the method described above when executing the computer program.

[0040] Fourthly, embodiments of this application provide a computer program product, the computer program product including instructions, which, when executed by a computer, cause the computer to perform the method described above.

[0041] Fifthly, embodiments of this application provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program; wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the method described above. Attached Figure Description

[0042] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 A flowchart illustrating a SAST vulnerability detection method based on LLM provided in the first embodiment of this application;

[0044] Figure 2 This is a flowchart illustrating an LLM-based SAST vulnerability detection method as an example of the first embodiment of this application.

[0045] Figure 3 A schematic diagram of the structure of a SAST vulnerability detection device based on LLM provided in the second embodiment of this application;

[0046] Figure 4 This is a schematic diagram of the structure of an electronic device provided in the third embodiment of this application. Detailed Implementation

[0047] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0048] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0049] Static Application Security Testing (SAST), also known as white-box testing, is a software testing methodology primarily used to detect potential security vulnerabilities in a program under test. SAST tools do not require actually running the program; they only need to analyze the program's source code or compiled binaries to discover potential security issues.

[0050] In related technologies, the SAST tool performs vulnerability detection on the source code of the program to be tested. It usually scans the source code of the program to be tested and matches the currently scanned code segment with the characteristics of each vulnerability in the rule set. If the currently scanned code segment matches the characteristics of any vulnerability, it is marked as a potential security vulnerability.

[0051] Security validation functions include functions that sanitize, escape, or format-validate input data. They can check and clean input data to prevent malicious code execution, such as SQL injection attacks, cross-site scripting (XSS) attacks, or other types of data corruption.

[0052] In the process of using existing SAST tools to detect potential security vulnerabilities in programs, these tools primarily scan the program and use a large set of rules and static analysis strategies to detect the presence of security check functions. If a security check function is detected, it is assumed to successfully resolve the vulnerability without being reported, leading to missed detections. Furthermore, it may directly report vulnerabilities after detecting dangerous functions in the program, failing to recognize the correlation between security check functions and vulnerabilities, resulting in false positives and missed detections. This ultimately leads to low accuracy for SAST tools.

[0053] To address this, this application proposes an LLM-based SAST vulnerability detection method. After obtaining vulnerability information by using the SAST tool to perform vulnerability detection on the program to be tested, a pre-trained LLM model is used to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context. If there is a security verification function corresponding to the vulnerability in the vulnerability context, the SAST tool is used to verify whether the security verification function corresponding to the vulnerability can protect against the vulnerability. Only when there is no security verification function corresponding to the vulnerability in the vulnerability context or the security verification function corresponding to the vulnerability cannot protect against the vulnerability is the vulnerability information output. This method can effectively avoid false positives and false negatives and improve the accuracy of SAST vulnerability detection.

[0054] The technical solutions of the embodiments of this application will be described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0055] The following is combined Figure 1-2 This application describes a SAST vulnerability detection method based on LLM. The method provided in this application can be executed by relevant terminal devices, and the following description uses a user terminal as the execution subject.

[0056] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating a SAST vulnerability detection method based on LLM, provided in the first embodiment of this application. The first embodiment of this application provides a SAST vulnerability detection method based on LLM, including steps S101-S104:

[0057] S101. Use the SAST tool to perform vulnerability detection on the program to be tested and obtain vulnerability information; the vulnerability information includes the vulnerability context.

[0058] S102. Use a pre-trained LLM model to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context;

[0059] S103. If there is a security verification function corresponding to the vulnerability in the vulnerability context, use the SAST tool to verify whether the security verification function corresponding to the vulnerability can protect against the vulnerability.

[0060] S104. If there is no security verification function corresponding to the vulnerability in the vulnerability context, or if the security verification function corresponding to the vulnerability cannot protect against the vulnerability, output the vulnerability information.

[0061] As an example, based on actual application requirements, the SAST tool is used to perform vulnerability detection on the program to be tested to obtain vulnerability information, which includes vulnerability context.

[0062] Vulnerability context refers to the code context of the vulnerable function in the program to be tested that triggers the vulnerability, such as the function call chain, variable state, and control flow path involved in the vulnerable function.

[0063] In practical applications, vulnerability information also includes the program name of the program to be tested, the file path of the program to be tested, the vulnerable function corresponding to the vulnerability, the line number of the code where the vulnerability is located, the vulnerability type, the vulnerability description, the data flow diagram of the vulnerability, and the attack principle of the vulnerability.

[0064] After obtaining the vulnerability information, considering that the security verification function applicable to resolving this vulnerability usually appears in the vulnerability context, a pre-trained LLM model is invoked to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context.

[0065] LLM (Large Language Model) is a deep learning model trained on massive amounts of text data. It can not only generate natural language text, but also deeply understand the meaning of text and handle various natural language tasks, such as text summarization, question answering, and translation.

[0066] Understandably, using a pre-trained LLM model to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context can provide in-depth analysis of the vulnerability context, comprehensively identify security verification functions in the vulnerability context that are suitable for resolving the vulnerability, and thus accurately determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context.

[0067] If the pre-trained LLM model determines that there is a security verification function corresponding to the vulnerability in the vulnerability context, it is assumed that the program to be tested has a security verification function suitable for resolving this vulnerability. The SAST tool is then used to verify whether the security verification function corresponding to the vulnerability can protect against the vulnerability.

[0068] In practical applications, the SAST tool inserts the corresponding security verification function into the program to be tested based on the code logic and expected results of the security verification function corresponding to the vulnerability, and performs a simulation run. Based on the simulation run results of the program to be tested, it confirms whether the security verification function corresponding to the vulnerability can prevent or mitigate the previously detected vulnerability.

[0069] If the pre-trained LLM model determines that there is no security verification function corresponding to the vulnerability in the vulnerability context, it assumes that there is no security verification function in the program to be detected suitable for resolving the vulnerability, and directly outputs the vulnerability information so that the user can fix the vulnerability in a timely manner.

[0070] If the SAST tool determines that the security verification function corresponding to a vulnerability cannot protect against the vulnerability, it is assumed that the security verification function in the program to be tested, which is intended to resolve the vulnerability, cannot actually resolve the vulnerability. The vulnerability information is then directly output so that the user can fix the vulnerability in a timely manner.

[0071] If the SAST tool determines that the security verification function corresponding to the vulnerability can protect against the vulnerability, it is assumed that the security verification function in the program to be tested that is suitable for solving the vulnerability can actually successfully solve the vulnerability, and in this case, the vulnerability information will not be output.

[0072] During the vulnerability detection process of the SAST tool, it may fail to report a vulnerability after detecting a security check function (unrelated to the vulnerability) and directly assume that the function can successfully resolve the vulnerability. This can lead to missed detections. Conversely, it may report a vulnerability directly after scanning for a dangerous function in the program without recognizing the association between the security check function and the vulnerability, resulting in false positives and false negatives. Therefore, after obtaining vulnerability information from the vulnerability detection in the program using the SAST tool, a pre-trained LLM model is used to determine whether there is a corresponding security check function in the vulnerability context. This allows the detection of the corresponding security check function in the program, effectively avoiding missed or false positives. Furthermore, if the pre-trained LLM model determines that there is a corresponding security check function in the vulnerability context, the SAST tool is used to verify whether the corresponding security check function can protect against the vulnerability. Vulnerability information is only output when the pre-trained LLM model determines that there is no corresponding security check function in the vulnerability context or the SAST tool determines that the corresponding security check function cannot protect against the vulnerability. This effectively avoids missed detections.

[0073] It is understandable that performing a first detection operation with the SAST tool, a function identification operation with a pre-trained LLM model, and a second verification operation with the SAST tool on the program to be detected can effectively avoid false positives and false negatives, and improve the accuracy of SAST vulnerability detection.

[0074] In this embodiment, after obtaining vulnerability information by using the SAST tool to perform vulnerability detection on the program to be detected, a pre-trained LLM model is used to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context. If there is a security verification function corresponding to the vulnerability in the vulnerability context, the SAST tool is used to verify whether the security verification function corresponding to the vulnerability can protect against the vulnerability. Only if there is no security verification function corresponding to the vulnerability in the vulnerability context or the security verification function corresponding to the vulnerability cannot protect against the vulnerability is the vulnerability information output. This can effectively avoid the problems of false positives and false negatives and improve the accuracy of SAST vulnerability detection.

[0075] In an optional embodiment, before determining whether there is a security verification function corresponding to a vulnerability in the vulnerability context using a pre-trained LLM model, the method further includes: training an LLM model based on a security verification function knowledge graph to obtain a pre-trained LLM model.

[0076] As an example, depending on the actual application requirements, a security verification function knowledge graph can be directly obtained or pre-constructed. An LLM model is trained based on this knowledge graph, enabling the LLM model to learn the vulnerabilities that various security verification functions can resolve, thereby predicting and identifying the security verification functions corresponding to different vulnerabilities, resulting in a pre-trained LLM model.

[0077] This application embodiment obtains a pre-trained LLM model by training an LLM model based on a security verification function knowledge graph, which can ensure that the pre-trained LLM model accurately determines whether there is a security verification function corresponding to the vulnerability in the vulnerability context.

[0078] In an optional embodiment, before training the LLM model based on the security verification function knowledge graph to obtain the pre-trained LLM model, the method further includes: parsing multiple collected target programs to obtain multiple abstract syntax trees; extracting metadata of security verification functions and the association relationships of security verification functions from the multiple abstract syntax trees; and constructing a security verification function knowledge graph by using security verification functions as nodes, using the metadata of security verification functions as attribute information of nodes, and using the association relationships of security verification functions as edges of nodes.

[0079] As an example, depending on the actual application requirements, multiple target programs can be collected by means of code crawling, API (Application Programming Interface) acquisition, or acquisition from databases (such as cloning or downloading from version control systems such as Git).

[0080] For each target program, based on its programming language, a parsing tool suitable for parsing the source code of the target program is selected, such as ANTLR, JavaCC, LLVM, or Roslyn. This parsing tool is then used to parse the target program, transforming it into an abstract syntax tree, thereby obtaining multiple abstract syntax trees.

[0081] In practical applications, the programming language of the target program can be determined based on the file extension of the target program's source code file.

[0082] For each abstract syntax tree (API), function entities are identified and extracted from it. Because different programming languages ​​use different APIs, the structures of the corresponding APIs also differ, and therefore the methods for identifying and extracting function entities from the APIs also vary.

[0083] For example, assuming the target program is programmed in C or C++, in C or C++, the definition of a function entity typically includes a return type, function name, parameter list, and function body, such as:

[0084] "ReturnType functionName(ArgType1 arg1, ArgType2 arg2, ...)

[0085] {

[0086] / / Function body

[0087] }

[0088] This requires writing a lexical analyzer and a syntax analyzer, or directly using existing analysis tools such as GCC's libclang API, and employing text processing techniques such as regular expressions to identify and extract function entities from the abstract syntax tree corresponding to the target program.

[0089] Assuming the target program is programmed in Java, in Java, the definition of function entities (called methods) is placed inside the class definition, for example:

[0090] "public ReturnType functionName(ArgType1 arg1, ArgType2 arg2, ...)

[0091] {

[0092] / / Function body...

[0093] }”

[0094] Then it is necessary to use a Java parsing tool to parse the abstract syntax tree corresponding to the target program, and identify and extract function entities from it.

[0095] After identifying and extracting function entities from any abstract syntax tree, the code snippets of the function entities are cleaned. Data cleaning includes removing irrelevant characters, word segmentation, and removing stop words.

[0096] The process involves several steps: First, removing irrelevant characters involves replacing non-code text such as comments and markers in the code snippet of a function entity with empty strings to preserve the code text. In practice, text processing techniques such as regular expressions can be used to match and replace irrelevant characters. Second, word segmentation involves dividing the code snippet of the function entity into words. In practice, this can be done simply by using spaces and punctuation marks, or by using more sophisticated natural language processing techniques to identify identifiers and keywords. Third, removing stop words involves deleting words that frequently appear in the code snippet of the function entity but do not carry specific semantic information, such as "if," "else," and "for." In practice, the segmentation results can be filtered based on a pre-stored stop word list to remove stop words from the code snippet of the function entity, reducing data dimensionality and highlighting the core logic of the function.

[0097] After obtaining the code snippets of the preprocessed function entities, the security verification functions are identified and labeled from the code snippets of the preprocessed function entities.

[0098] In practical applications, methods such as keyword search, regular expression matching, and call stack analysis can be used to identify security verification functions. The process of identifying security verification functions is as follows:

[0099] (1) Check whether the function name of the function entity contains specific keywords, such as "check", "validate", "sanitize", "escape" and other keywords that usually appear in the function name of the security verification function.

[0100] (2) Check whether the string constants or string variables in the function body of the function entity contain regular expressions used for security checks, specific error message prompts, etc.

[0101] For example, the following Python code is used to ensure that a secure filename is generated, preventing path traversal attacks, code execution, and other potential security issues:

[0102] "def secure_filename(filename):

[0103] if isinstance(filename, str):

[0104] from unicodedata import normalize

[0105] filename=normalize('NFKD',filename).encode('ascii','ignore').decode('ascii')

[0106] for sep in os.path.sep, os.path.altsep:

[0107] if sep:

[0108] filename = filename.replace(sep, '_')

[0109] filename=filename_ascii_strip_re.sub('','_'.join(filename.split('.'))).strip('_')

[0110] if os.name=='nt' and filename.split('.')[0].upper() in _windows_device_files:

[0111] filename = '_' + filename

[0112] "return filename".

[0113] (3) Check whether the function entity calls the security verification methods provided by known security libraries or frameworks, such as the methods provided by OWASP Java Encoder, Spring Security, Haskell's safe library, etc.

[0114] For example, the following Java code is used to detect if a file path poses a path traversal risk, ensuring the safety of the passed-in file path:

[0115] " public String validate_path(String filePath)

[0116] {

[0117] if(!filePath.startsWith(" / media / file / ") || filePath.contains(".. / "))

[0118] {

[0119] return "";

[0120] } else

[0121] {

[0122] return filePath;

[0123] }

[0124] }".

[0125] (4) Check whether there is logic inside the function entity to perform type conversion or boundary checks on the input data. For example, analyze the if conditional statements and switch or case branches in the function body of the function entity to find logic related to input validation, such as checking length, format, special characters, etc., and find exception handling code blocks, including code blocks that handle exceptions such as IllegalArgumentException and SQLException caused by illegal input.

[0126] For the marked security verification functions, extract the metadata of the security verification functions, such as the definition of the security verification function, the comment text, the code location, the input parameters and output parameters, etc. Extract the metadata of the related functional functions, such as the definition of the functional functions, the comment text, the code location, the input parameters and output parameters, etc., and extract the relationship between the security verification functions.

[0127] The relationships between security verification functions refer to: the calling relationship between security verification functions, i.e., one security verification function may call another security verification function; the dependency relationship between security verification functions and other functional functions, for example, a functional function may depend on a security verification function to ensure the security of the operation; and the relationship between security verification functions and data or processes, for example, input data may need to be processed by multiple security verification functions.

[0128] For example, the process of extracting metadata from the security verification function for the following source code is as follows:

[0129] package com.test;

[0130] public class PathCase1

[0131] {

[0132] public void file_delete(@RequestParam(value="path") String path)

[0133] {

[0134] String safe_path = validate_path(path);

[0135] File f = new File(safe_path);

[0136] f.delete();

[0137] }

[0138] public String validate_path(String filePath)

[0139] {

[0140] if(!filePath.startsWith(" / media / file / ") || filePath.contains(".. / "))

[0141] {

[0142] return "";

[0143] } else

[0144] {

[0145] return filePath;

[0146] }

[0147] }

[0148] }”。

[0149] This source code contains the function `file_delete` and the security validation function `validate_path`. The `file_delete` function is defined as "public void file_delete(@RequestParam(value="path") String path)", with no comments. It is located in the class "com.test.PathCase1", takes "path" as its input parameter (passed via request parameters), and outputs "nothing". The `validate_path` function is defined as "public String validate_path(String filePath)", with no comments. It is located somewhere within the class, takes "filePath" as its input parameter, and returns a string representing the validated file path. If the file path is invalid, it returns an empty string.

[0150] The process of extracting the correlation between security verification functions is as follows:

[0151] 1. Extract function call relationships: Analyze the call relationships of security verification functions in the source code, including calls made by other function calls to security verification functions, and mutual calls between different security verification functions, to clarify the call context of security verification functions in the source code. The function call relationship between the security verification function validate_path and the function file_delete can be represented as (file_delete, validate_path, call).

[0152] 2. Extract Input / Output Mapping: Identify the input parameters and return values ​​of security verification functions or functional functions. The function name, input parameters, and return type of the functional function `file_delete` can be represented as `(file_delete, path, void)`, and the function name, input parameters, and return type of the security verification function `validate_path` can be represented as `(validate_path, filePath, String)`.

[0153] 3. Extract Security Features: Analyze the specific implementation of the security validation function, and label its security features. These features include input validation types (e.g., length limits, format validation, and content filtering), the security algorithms used, and the security standards followed. The input validation type and security standards followed by the `validate_path` function can be represented as: `(validate_path, file path security validation, "Input validation type: Checks if the file path starts with a specified prefix and does not contain .. / to prevent path traversal attacks.")`

[0154] 4. Extract exception handling logic: Analyze how the security verification function handles possible exceptions and errors, and infer the functional description of the security verification function.

[0155] In practical applications, natural language processing tools or source code analysis tools can be used to automatically identify and extract the metadata of security verification functions and the relationships between security verification functions.

[0156] After extracting the metadata and relationships of security verification functions from multiple abstract syntax trees, the metadata and relationships of security verification functions are transformed into structured data. Using security verification functions as nodes, the metadata of security verification functions as the attribute information of the nodes, and the relationships of security verification functions as the edges of the nodes, a knowledge graph of security verification functions is constructed.

[0157] In practical applications, the edges of nodes can also have attribute information added, such as the input and output parameter information of other security verification functions or functional functions that call the security verification function, and the context information of function execution.

[0158] After constructing the security verification function knowledge graph, it can be compared and linked with the existing security verification function knowledge base to update the security verification function knowledge graph, thereby improving its coverage and accuracy.

[0159] This application embodiment obtains multiple abstract syntax trees by parsing multiple target programs, extracts the metadata of security verification functions and the association relationships of security verification functions from multiple abstract syntax trees, uses security verification functions as nodes, uses the metadata of security verification functions as the attribute information of nodes, and uses the association relationships of security verification functions as the edges of nodes to construct a security verification function knowledge graph, which can ensure the complete and accurate construction of the security verification function knowledge graph.

[0160] In an optional embodiment, training the LLM model based on the security verification function knowledge graph to obtain a pre-trained LLM model includes: converting the elements in the security verification function knowledge graph into triples; vectorizing the triples and constructing training samples based on the obtained vectors; and training the LLM model using the training samples to obtain a pre-trained LLM model.

[0161] As an example, after obtaining or constructing a security verification function knowledge graph, the security verification function knowledge graph is structured, and the elements in the security verification function knowledge graph are converted into triples to obtain multiple triples.

[0162] In practical applications, the elements in the security verification function knowledge graph are organized, including nodes, node attribute information, node edges, and edge attribute information. The elements in the security verification function knowledge graph are then converted into triples, such as (Subject, Predicate, Object).

[0163] After obtaining multiple triples, for each triple, the triple is vectorized to convert the triple into a vector. Training samples are then constructed based on the obtained vectors to obtain multiple training samples.

[0164] In practical applications, triples can be vectorized by encoding or embedding them. For example, all three data points in a triple can be encoded into vectors, or word embedding techniques such as Word2Vec, FastText, or BERT can be used to convert all three data points in a triple into fixed-length vectors. The resulting three encoded or embedded vectors are then organized into continuous training samples to ensure that the training samples reflect the complete information of the security check function.

[0165] After obtaining multiple training samples, the LLM model is trained using these samples. This allows the LLM model to learn the vulnerabilities that can be resolved by various security verification functions, thereby predicting and identifying the security verification functions corresponding to different vulnerabilities and obtaining a pre-trained LLM model.

[0166] In practical applications, after obtaining a pre-trained LLM model, it can be fine-tuned. For example, labeled sample data can be input into the pre-trained LLM model, and the model parameters can be adjusted based on the model output to improve the model's accuracy.

[0167] This application embodiment converts elements in the security verification function knowledge graph into triples and vectorizes the triples. Training samples are constructed based on the obtained vectors, and the LLM model is trained using the training samples to obtain a pre-trained LLM model. This allows for the rapid and accurate acquisition of training samples from the security verification knowledge graph to train the LLM model.

[0168] In an optional embodiment, the step of using a pre-trained LLM model to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context includes: inputting the vulnerability information of the vulnerability into the pre-trained LLM model to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context.

[0169] As an example, after obtaining the vulnerability information, considering that a security verification function suitable for resolving this vulnerability usually appears in the vulnerability context, the vulnerability information is input into a pre-trained LLM model. The pre-trained LLM model will predict a security verification function suitable for resolving this vulnerability based on the vulnerability information, such as the program name of the program to be detected, the file path of the program to be detected, the vulnerability function corresponding to the vulnerability, the line number of the code where the vulnerability is located, the vulnerability type, the vulnerability description, the data flow graph of the vulnerability, and the attack principle of the vulnerability. It will then search for a security verification function suitable for resolving this vulnerability in the vulnerability context, thereby determining whether there is a security verification function corresponding to the vulnerability in the vulnerability context.

[0170] In practical applications, the vulnerability information is converted into data of the corresponding format according to the input data format requirements of the pre-trained LLM model, such as text data, fragments of abstract syntax trees, or input vectors.

[0171] This application embodiment determines whether there is a security verification function corresponding to the vulnerability in the vulnerability context by inputting the vulnerability information into a pre-trained LLM model. This enables the rapid determination of whether there is a security verification function corresponding to the vulnerability in the vulnerability context.

[0172] In an optional embodiment, the method further includes step S105:

[0173] S105. If the security verification function corresponding to the vulnerability cannot protect against the vulnerability, optimize the pre-trained LLM model based on the vulnerability information.

[0174] As an example, if the SAST tool determines that the security verification function corresponding to the vulnerability cannot protect against the vulnerability, the vulnerability information can be fed back as labeled sample data to the pre-trained LLM model, and the model parameters can be adjusted according to the model output to optimize the pre-trained LLM model.

[0175] This application embodiment optimizes the pre-trained LLM model based on the vulnerability information when the security verification function corresponding to the vulnerability cannot protect against the vulnerability. This ensures that the subsequent pre-trained LLM model can more accurately determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context.

[0176] In an optional embodiment, the method further includes steps S106-S107:

[0177] S106. If the security verification function corresponding to the vulnerability can protect against the vulnerability, update the security verification function knowledge graph according to the vulnerability information and the security verification function corresponding to the vulnerability to obtain a new security verification function knowledge graph.

[0178] S107. Optimize the pre-trained LLM model based on the new security verification function knowledge graph.

[0179] As an example, if the SAST tool determines that the security verification function corresponding to the vulnerability can protect against the vulnerability, it can also obtain a security verification function knowledge graph or call a pre-built security verification function knowledge graph, and update the security verification function knowledge graph according to the vulnerability information and the security verification function corresponding to the vulnerability.

[0180] In practical applications, the security verification function corresponding to the vulnerability can be used as a node, and an edge can be added to the node, with the vulnerability information as the attribute information of the edge.

[0181] After obtaining the new security verification function knowledge graph, the pre-trained LLM model is retrained based on the new security verification function knowledge graph to optimize the pre-trained LLM model.

[0182] This application embodiment, by updating the security verification function knowledge graph based on the vulnerability information and the corresponding security verification function when the security verification function corresponding to the vulnerability can protect against the vulnerability, and optimizing the pre-trained LLM model based on the new security verification function knowledge graph, can ensure that the subsequent pre-trained LLM model can more accurately determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context.

[0183] To more clearly illustrate the LLM-based SAST vulnerability detection method provided in the first embodiment of this application, the flowchart of the LLM-based SAST vulnerability detection method is as follows: Figure 2 As shown.

[0184] Please refer to Figure 3 , Figure 3This is a schematic diagram of a SAST vulnerability detection device based on LLM provided in the second embodiment of this application. The second embodiment of this application provides an LLM-based SAST vulnerability detection device, comprising: a primary detection module 201, used to perform vulnerability detection on the program to be detected using the SAST tool to obtain vulnerability information; wherein the vulnerability information includes vulnerability context; a function identification module 202, used to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context using a pre-trained LLM model; a secondary verification module 203, used to verify whether the security verification function corresponding to the vulnerability can protect against the vulnerability when there is a security verification function corresponding to the vulnerability in the vulnerability context; and a result output module 204, used to output vulnerability information when there is no security verification function corresponding to the vulnerability in the vulnerability context or when the security verification function corresponding to the vulnerability cannot protect against the vulnerability.

[0185] In an optional embodiment, the function identification module 202 is further configured to train an LLM model based on a security verification function knowledge graph before determining whether there is a security verification function corresponding to a vulnerability in the vulnerability context using a pre-trained LLM model, thereby obtaining a pre-trained LLM model.

[0186] In an optional embodiment, the function identification module 202 is further configured to, before training the LLM model based on the security verification function knowledge graph to obtain the pre-trained LLM model, parse the collected multiple target programs to obtain multiple abstract syntax trees; extract the metadata of the security verification functions and the association relationships of the security verification functions from the multiple abstract syntax trees; and construct a security verification function knowledge graph by using the security verification functions as nodes, using the metadata of the security verification functions as the attribute information of the nodes, and using the association relationships of the security verification functions as the edges of the nodes.

[0187] In an optional embodiment, training the LLM model based on the security verification function knowledge graph to obtain a pre-trained LLM model includes: converting the elements in the security verification function knowledge graph into triples; vectorizing the triples and constructing training samples based on the obtained vectors; and training the LLM model using the training samples to obtain a pre-trained LLM model.

[0188] In an optional embodiment, the step of using a pre-trained LLM model to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context includes: inputting the vulnerability information of the vulnerability into the pre-trained LLM model to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context.

[0189] In an optional embodiment, the apparatus further includes a model optimization module, used to optimize a pre-trained LLM model based on vulnerability information when the security verification function corresponding to the vulnerability cannot protect against the vulnerability.

[0190] In an optional embodiment, the apparatus further includes: a model optimization module, configured to: update the security verification function knowledge graph based on the vulnerability information and the corresponding security verification function when the security verification function corresponding to the vulnerability can protect against the vulnerability, thereby obtaining a new security verification function knowledge graph; and optimize the pre-trained LLM model based on the new security verification function knowledge graph.

[0191] The specific implementation process of the functions and roles of each module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0192] Please refer to Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in the third embodiment of this application. The third embodiment of this application provides an electronic device 30, including a processor 301, a memory 302, and a computer program stored in the memory 302 and configured to be executed by the processor 301; the memory 302 is coupled to the processor 301, and when the processor 301 executes the computer program, it implements the method described in the first embodiment of this application and can achieve the same beneficial effects.

[0193] When the processor 301 reads a computer program from the memory 302 via the bus 303 and executes the computer program, it can implement the method described in the first embodiment of this application.

[0194] Processor 301 can process digital signals and may include various computing architectures. For example, it may be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 301 may be a microprocessor.

[0195] The memory 302 can be used to store instructions executed by the processor 301 or data related to the execution of instructions. These instructions and / or data may include code used to implement some or all of the functions of one or more modules described in the embodiments of this application. The processor 301 of this embodiment can be used to execute the instructions in the memory 302 to implement the method described in the first embodiment of this application. The memory 302 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0196] The fourth embodiment of this application provides a computer program product, which includes instructions that, when executed by a computer, cause the computer to perform the method described in the first embodiment of this application and achieve the same beneficial effects.

[0197] The method described in the first embodiment of this application can be implemented, in whole or in part, by software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in the first embodiment of this application are executed, in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user equipment, a core network device, an OAM (Open Application Model), or other programmable devices.

[0198] The computer program or instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer program or instructions may be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium may be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, hard disk, or magnetic tape; or an optical medium, such as a digital video optical disc; or a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0199] The fifth embodiment of this application provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to perform the method described in the first embodiment of this application, and can achieve the same beneficial effects.

[0200] In summary, this application provides an LLM-based SAST vulnerability detection method, apparatus, and electronic device. The LLM-based SAST vulnerability detection method includes: using the SAST tool to perform vulnerability detection on the program to be tested to obtain vulnerability information; wherein, the vulnerability information includes vulnerability context; using a pre-trained LLM model to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context; if there is a security verification function corresponding to the vulnerability in the vulnerability context, using the SAST tool to verify whether the security verification function corresponding to the vulnerability can protect against the vulnerability; if there is no security verification function corresponding to the vulnerability in the vulnerability context or the security verification function corresponding to the vulnerability cannot protect against the vulnerability, outputting the vulnerability information. This application, by using the SAST tool to perform vulnerability detection on the program to be tested to obtain vulnerability information, using a pre-trained LLM model to determine whether there is a security verification function corresponding to the vulnerability in the vulnerability context, continuing to use the SAST tool to verify whether the security verification function corresponding to the vulnerability can protect against the vulnerability if there is a security verification function corresponding to the vulnerability in the vulnerability context, and only outputting the vulnerability information if there is no security verification function corresponding to the vulnerability in the vulnerability context or the security verification function corresponding to the vulnerability cannot protect against the vulnerability, can effectively avoid false positives and negatives, and improve the accuracy of SAST vulnerability detection.

[0201] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0202] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0203] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0204] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0205] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0206] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A static application security testing (SAST) vulnerability detection method based on a large language model (LLM), characterized in that, The method comprises the following steps: adopting a SAST tool to detect a vulnerability of a program to be detected, and obtaining vulnerability information of the vulnerability; wherein the vulnerability information of the vulnerability comprises a vulnerability context; training an LLM model based on a security check function knowledge graph to obtain a pre-trained LLM model; adopting the pre-trained LLM model to determine whether there is a security check function corresponding to the vulnerability in the vulnerability context; wherein the security check function corresponding to the vulnerability comprises a function of purifying, escaping or format verifying input data; in the case that there is the security check function corresponding to the vulnerability in the vulnerability context, adopting the SAST tool to verify whether the security check function corresponding to the vulnerability can prevent the vulnerability; in the case that there is no security check function corresponding to the vulnerability in the vulnerability context or the security check function corresponding to the vulnerability cannot prevent the vulnerability, outputting the vulnerability information of the vulnerability.

2. The method of claim 1, wherein, Before the step of training the LLM model based on the security check function knowledge graph to obtain the pre-trained LLM model, the method further comprises the following steps: analyzing a plurality of target programs collected to obtain a plurality of abstract syntax trees; extracting metadata of security check functions and association relationships of the security check functions from the plurality of abstract syntax trees; constructing the security check function knowledge graph by taking the security check functions as nodes, taking the metadata of the security check functions as attribute information of the nodes, and taking the association relationships of the security check functions as edges of the nodes.

3. The method of claim 1, wherein, The step of training the LLM model based on the security check function knowledge graph to obtain the pre-trained LLM model comprises the following steps: converting elements in the security check function knowledge graph into triples; vectorizing the triples, and constructing training samples according to the obtained vectors; training the LLM model by using the training samples to obtain the pre-trained LLM model.

4. The method of claim 1, wherein, The step of adopting the pre-trained LLM model to determine whether there is the security check function corresponding to the vulnerability in the vulnerability context comprises the following step: inputting the vulnerability information of the vulnerability into the pre-trained LLM model to determine whether there is the security check function corresponding to the vulnerability in the vulnerability context.

5. The method according to any one of claims 1 to 4, characterized in that, The method further comprises the following steps: in the case that the security check function corresponding to the vulnerability cannot prevent the vulnerability, optimizing the pre-trained LLM model according to the vulnerability information of the vulnerability.

6. The method according to any one of claims 1 to 4, characterized in that, The method further comprises the following steps: in the case that the security check function corresponding to the vulnerability can prevent the vulnerability, updating a security check function knowledge graph according to the vulnerability information of the vulnerability and the security check function corresponding to the vulnerability to obtain a new security check function knowledge graph; optimizing the pre-trained LLM model based on the new security check function knowledge graph.

7. An LLM-based SAST vulnerability detection apparatus, characterized by, The method comprises the following steps: a first detection module is configured to adopt a SAST tool to detect a vulnerability of a program to be detected, and obtain vulnerability information of the vulnerability; wherein the vulnerability information of the vulnerability comprises a vulnerability context; a function identification module is configured to: train an LLM model based on a security check function knowledge graph to obtain a pre-trained LLM model; adopting a pre-trained LLM model to determine whether there is a security check function corresponding to the vulnerability in the vulnerability context; wherein the security check function corresponding to the vulnerability includes a function of purifying, escaping or format verifying input data; a secondary verification module, configured to, in the case that there is the security check function corresponding to the vulnerability in the vulnerability context, adopt the SAST tool to verify whether the security check function corresponding to the vulnerability can prevent the vulnerability; a result output module, configured to, in the case that there is no security check function corresponding to the vulnerability in the vulnerability context or the security check function corresponding to the vulnerability cannot prevent the vulnerability, output vulnerability information of the vulnerability.

8. An electronic device, comprising: The computer program product comprises instructions which, when executed by a computer, cause the computer to implement the method according to any one of claims 1 to 6.

9. A computer program product, characterised in that, The computer program product comprises instructions which, when executed by a computer, cause the computer to implement the method according to any one of claims 1 to 6.

Images