Source code vulnerability detection method, system, device and storage medium

Abstract

The present application discloses a source code vulnerability detection method, system, device and storage medium, which relates to the field of program security technology. The disclosed source code vulnerability detection method includes: statically analyzing the source code to be detected to obtain a first vulnerability set; inputting the source code to be detected into a preset machine learning model, and outputting a second vulnerability set, wherein the vulnerability set is a set of codes in which vulnerabilities are detected in the source code to be detected; inputting the first vulnerability set into the machine learning model, and outputting a third vulnerability set; and using the second vulnerability set and the third vulnerability set as target vulnerability sets corresponding to the source code to be detected. The present application aims to solve the technical problem of low vulnerability detection accuracy.

Description

Technical Field

[0001] The present application relates to the field of program security technology, and in particular to a source code vulnerability detection method, system, device and storage medium. Background Art

[0002] Source code vulnerabilities are security flaws or weaknesses in the source code of Web (World Wide Web) applications due to programming errors, design flaws, unsafe coding practices, or failure to update security patches in a timely manner. These flaws can be easily exploited by attackers to perform unauthorized operations, obtain sensitive information, or undermine the integrity of the system.

[0003] In order to detect source code vulnerabilities, the source code of the Web application can be processed through dynamic analysis. However, since dynamic analysis relies on actually running the code to discover vulnerabilities, and the actual running code cannot cover all code paths and input situations, it is easy to ignore vulnerabilities in uncovered code paths. Therefore, there is a technical problem of low vulnerability detection accuracy when detecting vulnerabilities in source code through dynamic analysis.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of this application is to provide a source code vulnerability detection method, system, device and storage medium, aiming to solve the technical problem of low vulnerability detection accuracy.

[0006] To achieve the above purpose, the present application proposes a source code vulnerability detection method, the method comprising:

[0007] Perform static analysis on the source code to be detected to obtain a first vulnerability set;

[0008] Inputting the source code to be detected into a preset machine learning model, and outputting a second vulnerability set, wherein the vulnerability set is a set of codes in which vulnerabilities are detected in the source code to be detected, wherein in the machine learning model, the source code to be detected is classified according to standard vulnerability rules to obtain a classification result, wherein if there is a sub-code matching at least one standard vulnerability rule in the source code to be detected, the sub-code is used as a vulnerability code, and a plurality of the vulnerability codes are grouped together to obtain a second vulnerability set;

[0009] Inputting the first vulnerability set into the machine learning model, and outputting a third vulnerability set;

[0010] The second vulnerability set and the third vulnerability set are used as target vulnerability sets corresponding to the source code to be detected.

[0011] In one embodiment, the step of performing static analysis on the source code to be detected to obtain the first vulnerability set includes:

[0012] Compile the source code to be tested to obtain the AST syntax tree;

[0013] Traversing the AST syntax tree according to at least one rule in a preset rule library to obtain a rule checking result, wherein the rule includes input verification rules, permission access rules and communication security rules;

[0014] Using the code test case as tainted data, and tracking the flow path of the tainted data in the AST syntax tree to obtain a taint check result;

[0015] The rule check result and the taint check result are integrated to obtain a first vulnerability set.

[0016] In one embodiment, the step of inputting the source code to be detected into a preset machine learning model and outputting a second vulnerability set includes:

[0017] Recursively apply the code test case as tainted data to the source code to be tested to obtain suspected vulnerability code;

[0018] The suspected vulnerability code is input into a preset machine learning model for training to obtain a second vulnerability set, wherein, in the machine learning model, the suspected vulnerability code is classified according to standard vulnerability rules to obtain a classification result, wherein, if there is a sub-code matching at least one standard vulnerability rule in the suspected vulnerability code, the sub-code is used as the vulnerability code, and multiple vulnerability codes are grouped together to obtain a second vulnerability set.

[0019] In one embodiment, after the step of inputting the source code to be detected into a preset machine learning model and outputting a second vulnerability set, the method further includes:

[0020] An intersection of the second vulnerability set and the first vulnerability set is calculated, and the intersection is used as a target vulnerability set corresponding to the source code to be detected.

[0021] In one embodiment, after the step of using the second vulnerability set and the third vulnerability set as the target vulnerability set corresponding to the source code to be detected, the method further includes:

[0022] In response to a user operation, determining a repair priority for each vulnerability in the target vulnerability set;

[0023] The vulnerabilities are traversed according to the repair priority, repair rules matching the traversed vulnerabilities in a preset repair rule library are determined, and the traversed vulnerabilities are repaired based on the repair rules matching the traversed vulnerabilities.

[0024] In one embodiment, before the step of inputting the source code to be detected into a preset machine learning model and outputting a second vulnerability set, the step further includes:

[0025] Searching for source code matching the rules in the preset rule base in a preset source code database to obtain the code required for training;

[0026] Obtaining a vulnerability context code, wherein the vulnerability context code refers to one or more code segments directly associated with a preset security vulnerability;

[0027] A training set is constructed according to the code required for training and the vulnerability context code, and the machine learning model to be trained is trained according to the training set to obtain a trained machine learning model.

[0028] In one embodiment, the step of training the machine learning model to be trained according to the training set to obtain a trained machine learning model includes:

[0029] Inputting the training set into the machine learning model to be trained to obtain a training vulnerability result;

[0030] Adjusting the parameters of the machine learning model to be trained based on the training vulnerability results and the manual vulnerability detection results of the training set;

[0031] Return to the step of inputting the training set into the machine learning model to be trained to obtain a training vulnerability result, until the similarity between the training vulnerability result and the manual vulnerability detection result is greater than or equal to a preset threshold, so as to obtain a trained machine learning model.

[0032] In addition, to achieve the above purpose, the present application also proposes a source code vulnerability detection system, the system comprising:

[0033] A static analysis module, used for performing static analysis on the source code to be detected to obtain a first vulnerability set;

[0034] a machine learning analysis module, configured to input the source code to be detected into a preset machine learning model, and output a second vulnerability set, wherein the vulnerability set is a set of codes in which vulnerabilities are detected in the source code to be detected, wherein in the machine learning model, the source code to be detected is classified according to standard vulnerability rules to obtain a classification result, wherein if there is a subcode matching at least one standard vulnerability rule in the source code to be detected, the subcode is used as a vulnerability code, and a plurality of the vulnerability codes are grouped together to obtain a second vulnerability set;

[0035] A cross module, used for inputting the first vulnerability set into the machine learning model, and outputting a third vulnerability set;

[0036] The vulnerability combination module is used to use the second vulnerability set and the third vulnerability set as target vulnerability sets corresponding to the source code to be detected.

[0037] In addition, to achieve the above-mentioned purpose, the present application also proposes a source code vulnerability detection device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the source code vulnerability detection method as described above.

[0038] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the source code vulnerability detection method described above are implemented.

[0039] One or more technical solutions proposed in this application have at least the following technical effects:

[0040] In the present application, a first vulnerability set is obtained by performing static analysis on the source code to be detected, and the code with vulnerabilities in the source code to be detected can be obtained through static analysis; then the source code to be detected is input into a preset machine learning model, and a second vulnerability set is output, wherein the vulnerability set is a set of codes in which vulnerabilities are detected in the source code to be detected, and the code with vulnerabilities in the source code to be detected can be analyzed by the machine learning model; then the first vulnerability set is input into the machine learning model, and a third vulnerability set is output, and the vulnerabilities in the first vulnerability set can be verified by the machine learning model; then the second vulnerability set and the third vulnerability set are used as the target vulnerability sets corresponding to the source code to be detected, and the code with vulnerabilities detected by the static analysis and the machine learning model can be combined, so that the vulnerabilities in the source code to be detected can be detected more comprehensively and accurately.

[0041] Compared with the traditional method of detecting source code vulnerabilities based only on dynamic analysis, the method of detecting source code vulnerabilities through machine learning models in this application can automatically identify the characteristics of vulnerabilities through trained machine learning models, thereby identifying unknown vulnerabilities, making up for the defect of low dynamic analysis coverage. Then, this application inputs the first vulnerability set into the machine learning model, and outputs the third vulnerability set, which can verify the vulnerabilities obtained by static analysis with the machine learning model, thereby improving the accuracy of source code vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0043] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0044] Figure 1 A schematic diagram of a process flow provided for the first embodiment of the source code vulnerability detection method of the present application;

[0045] Figure 2 This is a scenario diagram of an embodiment of a source code vulnerability detection method of the present application;

[0046] Figure 3 A brief flowchart of an embodiment of a source code vulnerability detection method of the present application;

[0047] Figure 4 This is a schematic diagram of the module structure of the source code vulnerability detection system of the embodiment of the present application;

[0048] Figure 5 Schematic diagram of the device structure of the hardware operating environment involved in the source code vulnerability detection method in the embodiment of the present application.

[0049] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0050] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0051] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0052] The main solution of the embodiment of the present application is: static analysis is performed on the source code to be detected to obtain a first vulnerability set; the source code to be detected is input into a preset machine learning model, and a second vulnerability set is output, wherein the vulnerability set is a set of codes in which vulnerabilities are detected in the source code to be detected, wherein, in the machine learning model, the source code to be detected is classified according to standard vulnerability rules to obtain a classification result, wherein, if there is a sub-code matching at least one standard vulnerability rule in the source code to be detected, the sub-code is used as the vulnerability code, and multiple vulnerability codes are grouped together to obtain a second vulnerability set; the first vulnerability set is input into the machine learning model, and a third vulnerability set is output; the second vulnerability set and the third vulnerability set are used as target vulnerability sets corresponding to the source code to be detected.

[0053] The existing technology processes the source code of the Web application through dynamic analysis. However, dynamic analysis relies on actually running the code to find vulnerabilities, but the actual running code cannot cover all code paths and input conditions, so it is easy to ignore vulnerabilities in uncovered code paths. Therefore, there is a technical problem of low vulnerability detection accuracy when detecting vulnerabilities in source code through dynamic analysis.

[0054] The present application provides a solution that enables the present application to automatically identify the characteristics of vulnerabilities through a trained machine learning model, thereby identifying unknown vulnerabilities and making up for the defect of low dynamic analysis coverage. Then, the present application cross-analyzes the detection results of static analysis by the machine learning model, so that the vulnerability detection results of the source code are consistent with both the detection results of the machine learning model and the detection results of static analysis, thereby improving the accuracy of source code vulnerability detection.

[0055] It should be noted that the execution subject of the present application can be a source code vulnerability detection device with data processing, network communication and program running functions, and the source code vulnerability detection device can be a tablet computer, a personal computer, a mobile phone, etc., or an electronic device that can realize the above functions. In particular, the source code vulnerability detection device can also be a module of host security, which can be deployed on the server as an agent. The following takes the source code vulnerability detection device as an example to illustrate this embodiment and the following embodiments.

[0056] Based on this, the present application embodiment provides a source code vulnerability detection method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the source code vulnerability detection method of the present application.

[0057] In this embodiment, the source code vulnerability detection method includes steps S10 to S40:

[0058] Step S10, performing static analysis on the source code to be detected to obtain a first vulnerability set;

[0059] It is understandable that the source code to be detected refers to the source code that needs to be tested for vulnerabilities. The source code is a series of instructions and statements written in a specific programming language to implement software functions. When vulnerability detection is required, the source code vulnerability detection device can receive instructions issued by the host security system. The instructions may include information such as the language type of the source code to be detected and the path of the source code. In this way, the source code to be detected can be flexibly selected according to needs, which improves the efficiency and applicability of vulnerability mining.

[0060] When performing static analysis on the source code to be detected, one static analysis method may be used or multiple static analysis methods may be used.

[0061] In this way, static analysis can identify typical code patterns of security vulnerabilities, such as SQL injection (a vulnerability), cross-site scripting, and cross-site request forgery, which are in the OWASP TOP 10 (a broad consensus of the most important security risks for web applications).

[0062] In a feasible implementation manner, the above step S10 includes steps S101 to S104.

[0063] Step S101, compile the source code to be tested to obtain an AST syntax tree;

[0064] It should be noted that the AST syntax tree is a data structure that uses a tree-like form to represent the structured syntax elements of the source code. Each node in the tree represents a syntax unit in the source code (such as variable declaration, function call, control flow statement, etc.), and the parent-child relationship between nodes reflects the nesting and dependency relationships in the source code.

[0065] In this embodiment, after obtaining the source code to be detected, the source code character stream is read, and the source code character stream is divided into multiple symbol units, called lexical units (Token). Lexical units include keywords, identifiers (variable names, function names, etc.), literals (numbers, strings), operators, separators, etc. Then, through a parser (Parser), according to the grammatical rules of the programming language (such as BNF grammar, EBNF grammar or LL, LR and other parsing algorithms) to identify the legal grammatical structure composed of the lexical unit sequence. Then, the AST is gradually constructed according to the grammatical rules by the parser, that is, when a grammatical structure that conforms to the rules is detected, the corresponding node is created in the AST, and the parent-child relationship between the nodes is established.

[0066] Exemplarily, when a function definition is detected in the detection source code, a function node is created, which includes a parameter list node, a return type node, and a function body (which may include more child nodes).

[0067] While or after building the AST, a semantic check is performed to ensure that the code is not only syntactically correct but also semantically reasonable. Among them, semantic detection includes but is not limited to type checking, scope analysis, renaming elimination (eliminating variable name conflicts), constant folding, and type inference. Secondly, semantic analysis can modify or improve the AST, such as adding type information to nodes, processing types that are not explicitly specified but can be inferred from the context, and verifying parameter type matching of function calls. After semantic analysis, the AST syntax tree is obtained.

[0068] Step S102, traversing the AST syntax tree according to at least one rule in a preset rule library to obtain a rule checking result, wherein the rule includes input verification rules, permission access rules and communication security rules;

[0069] It should be noted that the preset rule base refers to a series of detection rules designed for specific programming languages ​​and security issues. These rules define unsafe programming patterns, common vulnerability types or best practice standards. The rule base can contain general rules (applicable to multiple programming languages) and language-specific rules (specific to the characteristics of a specific programming language). Input validation rules refer to the security validation principles that should be followed when the program receives external input (such as user input, network request parameters, file content, etc.), such as checking whether the input length, type, and format meet expectations, and preventing injection attacks (such as SQL injection, XSS attacks). Permission access rules refer to rules related to program access control, which are used to detect problems such as improper privilege escalation, privilege abuse, and unauthorized access to sensitive resources. These rules can focus on code snippets involving privilege operations such as function calls, object attribute access, and system calls. Communication security rules refer to rules on network communication and data transmission security, including but not limited to the use of encryption algorithms, certificate verification, protocol version checking, anti-replay attack mechanisms, error message processing, etc., to ensure that the communication process does not leak sensitive information or be attacked by man-in-the-middle.

[0070] In this embodiment, starting from the root node of AST, the entire tree structure is traversed according to strategies such as depth-first search (DFS) or breadth-first search (BFS). For each node detected, its type, attributes, child nodes and other information are extracted to obtain the specific grammatical structure and semantics in the source code. For the currently traversed node, the rules in the preset rule library are applied in sequence. The rules usually include two parts: trigger conditions (determine whether the rule is applicable to the current node) and check logic (if applicable, check whether the node and its context meet the rule requirements). The trigger condition can be information such as node type, node attribute, node position in the tree, other associated nodes, etc. The check logic will be further executed on the nodes that meet the trigger condition to determine whether there are potential vulnerabilities. When the rule check finds a violation of the rule, a vulnerability is recorded. After the AST traversal is completed, the set of all recorded vulnerabilities is used as the rule detection result.

[0071] Step S103, taking the code test case as tainted data, and tracing the flow path of the tainted data in the AST syntax tree to obtain a taint check result;

[0072] It should be noted that code test cases refer to data used to verify code logic. Test cases can cover the expected input space, that is, test cases should include normal cases and boundary cases. Tainted data refers to specific parts of test cases (such as user input, environment variables, file contents).

[0073] In this embodiment, according to the tainted data identified in the test case, the tainted source node (usually the node of the function parameter, variable assignment, file reading and other operations, which represent the entry point of the tainted data into the program) is marked at the corresponding position in the AST. Then the preset taint propagation rule is obtained (the taint propagation rule is set in advance for different types of AST nodes. For example, when a tainted data is assigned to another variable, or passed as a parameter to a function, the taint should follow the data flow to the corresponding node; when the tainted data participates in the calculation or is cleaned (such as processed by a security filtering function), the taint mark can be updated or cleared). Then, starting from the node marked with the tainted source, the entire tree can be traversed according to the structure of the AST. During the traversal process, according to the pre-defined taint propagation rules, the taint mark is recursively propagated to the subsequent nodes that have data dependencies with the tainted data. When it is detected that the taint mark propagates to a new node, the complete path from the taint source to the node is recorded, which constitutes the flow path of the tainted data in the AST. Then, based on the taint flow path, check whether the tainted data has reached sensitive operation points (such as SQL query construction, command line execution, output to web pages, and other locations that may cause security vulnerabilities). If it has reached a sensitive operation point, the risk is determined based on the context. Finally, summarize the flow paths of all tainted data, the sensitive locations touched, and their risk assessments to form the taint check results. Among them, in a feasible implementation, the taint check results may include (vulnerability type, impact range, trigger conditions, and repair measures).

[0074] Step S104: Integrate the rule check result and the stain check result to obtain a first vulnerability set.

[0075] In this embodiment, after the rule check result and the taint check result are obtained, the union of the rule check result and the taint check result can be used as the first vulnerability set.

[0076] In this embodiment, the embodiment of the present application can detect the source code more comprehensively by converting the source code to be detected into an AST syntax tree and determining the first vulnerability set through rule detection and taint analysis, thereby avoiding the problem of incomplete dynamic analysis.

[0077] Step S20, inputting the source code to be detected into a preset machine learning model, and outputting a second vulnerability set, wherein the vulnerability set is a set of codes in which vulnerabilities are detected in the source code to be detected, wherein in the machine learning model, the source code to be detected is classified according to standard vulnerability rules to obtain a classification result, wherein if there is a subcode matching at least one standard vulnerability rule in the source code to be detected, the subcode is used as a vulnerability code, and a plurality of the vulnerability codes are grouped together to obtain a second vulnerability set;

[0078] It can be understood that the second vulnerability set refers to the code with vulnerabilities in the source code detected by the machine learning model, and correspondingly, the first vulnerability set refers to the code with vulnerabilities in the source code detected by static analysis.

[0079] It should be noted that the type of machine learning module is not limited in this application. The subcode refers to the code in the source code to be detected that matches the standard vulnerability rules, and the standard vulnerability rules refer to the classification rules of common vulnerabilities. Before the source code to be detected is input into the preset machine learning model, the machine learning model needs to be trained. This enables the machine learning model to identify the characteristics of the vulnerability and classify the vulnerability, and then after the source code to be detected is input, the vulnerability in the source code can be identified.

[0080] In a feasible implementation manner, the above step S20 further includes:

[0081] Step S201, recursively applying the code test case as tainted data to the source code to be tested to obtain suspected vulnerability code;

[0082] Step S202: input the suspected vulnerability code into a preset machine learning model for training to obtain a second vulnerability set, wherein, in the machine learning model, the suspected vulnerability code is classified according to standard vulnerability rules to obtain a classification result, wherein, if there is a sub-code matching at least one standard vulnerability rule in the suspected vulnerability code, the sub-code is used as the vulnerability code, and multiple vulnerability codes are grouped together to obtain a second vulnerability set.

[0083] It should be noted that suspected vulnerability code refers to the code involved in tainted data that will cause security issues.

[0084] In this embodiment, after determining the tainted data, the tainted data can be recursively propagated along the execution path of the source code to be detected based on the taint analysis technology to track its flow process in the program. When it is detected that the tainted data is involved in the operation that causes the security problem, the code currently involved in the tainted data is used as the suspected vulnerability code. Then the identified suspected vulnerability code is used as training data and input into the pre-built machine learning model. Inside the machine learning model, the suspected vulnerability code is classified according to the standard vulnerability rules (such as CWE, CVE classification system, OWASP Top 10, etc.). For each suspected vulnerability code, check whether there is a sub-code fragment that matches at least one standard vulnerability rule inside it. If there is a match, the sub-code is determined to be a real "vulnerability code", and finally all the identified vulnerability codes are collected to form a "second vulnerability set". In other words, the second vulnerability set contains code fragments that are more likely to be real vulnerabilities after further screening and classification by the machine learning model.

[0085] In this embodiment, the present application can reduce the amount of data processing of the machine learning model by first performing taint analysis and then performing machine learning model analysis, thereby being able to obtain a vulnerability set more quickly. In addition, in this embodiment, the vulnerabilities in the second vulnerability set also conform to the rules of taint analysis and the vulnerability characteristics in the machine learning model at the same time, thereby also increasing the probability of accurately identifying vulnerabilities.

[0086] Step S30, inputting the first vulnerability set into the machine learning model, and outputting a third vulnerability set;

[0087] Step S40: taking the second vulnerability set and the third vulnerability set as target vulnerability sets corresponding to the source code to be detected.

[0088] It should be noted that the target vulnerability set refers to the vulnerability detection results detected after the source code to be tested has been statically analyzed and the machine learning model has been used.

[0089] It should also be noted that, since static analysis is based on rule base matching, when the rules in the rule base are set more strictly, there will be some misjudged vulnerabilities in the first vulnerability set obtained based on static analysis, that is, the code that does not have vulnerabilities will be mistakenly identified as having vulnerabilities. In order to further screen out the code that actually has vulnerabilities in the first vulnerability set obtained by static analysis, this application inputs each code in the first vulnerability set into the machine learning model, thereby using the code set with vulnerabilities output by the machine learning model as the third vulnerability set. In this way, based on the advantage that the machine learning model can judge vulnerabilities based on context, the misidentified vulnerabilities in the first vulnerability set can be screened out, thereby further improving the accuracy of vulnerability detection in the source code.

[0090] Then, the second vulnerability set and the third vulnerability set can be used as target vulnerability sets corresponding to the source code to be detected. In a feasible implementation, vulnerability reports corresponding to the second vulnerability set and the third vulnerability set can also be generated respectively. The vulnerability report can include the code file path involved in the vulnerability, the function call process, the cause of the vulnerability, the vulnerability repair solution and the external vulnerability information reference link. Thus, it is convenient for users to view the vulnerability information.

[0091] Optionally, in a feasible implementation manner, after the above step S20, the method further includes:

[0092] Step S50: Calculate the intersection of the second vulnerability set and the first vulnerability set, and use the intersection as the target vulnerability set corresponding to the source code to be detected.

[0093] In this embodiment, the present application can obtain vulnerabilities that meet both the vulnerability characteristics in the machine learning model and the vulnerability rules in the static analysis through the intersection of the first vulnerability set and the second vulnerability set, thereby improving the accuracy of detecting vulnerabilities.

[0094] In the present application, a first vulnerability set is obtained by performing static analysis on the source code to be detected, and the code with vulnerabilities in the source code to be detected can be obtained through static analysis; then the source code to be detected is input into a preset machine learning model, and a second vulnerability set is output, wherein the vulnerability set is a set of codes in which vulnerabilities are detected in the source code to be detected, and the code with vulnerabilities in the source code to be detected can be analyzed by the machine learning model; then the first vulnerability set is input into the machine learning model, and a third vulnerability set is output, and the vulnerabilities in the first vulnerability set can be verified by the machine learning model; then the second vulnerability set and the third vulnerability set are used as the target vulnerability sets corresponding to the source code to be detected, and the code with vulnerabilities detected by the static analysis and the machine learning model can be combined, so that the vulnerabilities in the source code to be detected can be detected more comprehensively and accurately.

[0095] Furthermore, based on the above-mentioned first embodiment of the source code vulnerability detection method of the present application, a second embodiment of the source code vulnerability detection method of the present application is proposed.

[0096] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those of the first embodiment can be referred to the above description, and will not be described in detail later. On this basis, the above step S20 also includes steps S60 to S80.

[0097] Step S60, searching a preset source code database for source code that matches the rules in the preset rule library to obtain the code required for training;

[0098] Step S70, obtaining a vulnerability context code, wherein the vulnerability context code refers to one or more code segments directly associated with a preset security vulnerability;

[0099] Step S80, constructing a training set according to the code required for training and the vulnerability context code, and training the machine learning model to be trained according to the training set to obtain a trained machine learning model.

[0100] It should be noted that the preset rule base refers to the rule base for static analysis. It is understandable that it takes a lot of time to train the machine learning model directly through the code with and without vulnerabilities. Therefore, in order to synchronize the static analysis rules to the machine learning model and reduce the training time of the machine learning model, the source code matching the rules can be searched in the preset source code database to obtain the code required for training.

[0101] In addition, in order to speed up the machine learning model to learn vulnerability context features, the code directly related to the preset security vulnerabilities can also be used as part of the model training set to facilitate rapid model learning.

[0102] Therefore, after obtaining the code required for training and the vulnerability context code, the union of the code required for training and the vulnerability context code can be used as a training set, and then the machine learning model to be trained can be trained based on the training set.

[0103] In a feasible implementation manner, the above step S80 further includes steps S801 to S803:

[0104] Step S801, inputting the training set into the machine learning model to be trained to obtain a training vulnerability result;

[0105] Step S802: adjusting the parameters of the machine learning model to be trained based on the training vulnerability result and the manual vulnerability detection result of the training set;

[0106] Step S803, return to the step of inputting the training set into the machine learning model to be trained to obtain the training vulnerability result, until the similarity between the training vulnerability result and the manual vulnerability detection result is greater than or equal to a preset threshold, so as to obtain a trained machine learning model.

[0107] It can be understood that the training vulnerability results refer to the vulnerabilities output by the machine learning model to be trained after the training set is input into the machine learning model to be trained. The manual vulnerability detection results refer to the vulnerabilities obtained by manually detecting the code in the training set.

[0108] In this embodiment, in order to train the machine learning model to accurately identify vulnerabilities, the manual detection results can be used as labels, and the similarity can be used as the loss to continuously optimize the parameters of the machine learning model to be trained until the machine learning model can accurately identify the characteristics of the vulnerability. Thus, a trained machine learning model is obtained.

[0109] It is worth mentioning that the machine learning model is different from the traditional dynamic analysis method. Dynamic analysis requires the execution of source code, but machine learning vulnerability detection does not require the execution of source code. It only needs to extract the features of the code during the code compilation stage (after compilation, it is the execution stage) and classify the features according to the classification rules to achieve the purpose of identifying vulnerabilities. Therefore, compared with dynamic analysis, this application does not need to execute code, and there will be no problem of low coverage in static analysis.

[0110] Based on the above-mentioned first embodiment and second embodiment of the present application, a third embodiment of the source code vulnerability detection method of the present application is proposed.

[0111] In this embodiment, after the above step S30, the method further includes steps S90 to S100.

[0112] Step S90, in response to a user operation, determining a repair priority of each vulnerability in the target vulnerability set;

[0113] Step S100, traversing the vulnerabilities according to the repair priority, determining the repair rules matching the traversed vulnerabilities in the preset repair rule library, and repairing the traversed vulnerabilities based on the repair rules matching the traversed vulnerabilities.

[0114] It should be noted that the repair priority refers to the urgency or order of repairing software defects or vulnerabilities. The repair rules at least include: repair steps, patch codes and preventive measures.

[0115] In this embodiment, after obtaining the target vulnerability set, the priority of each vulnerability can be determined based on the user operation, or the priority corresponding to the type of each vulnerability in the target vulnerability set can be used as the priority of each vulnerability. Then, each vulnerability is traversed according to the priority, and then the currently traversed vulnerability is repaired according to the repair rules matched with the currently traversed vulnerability in the preset repair rule library. Thus, automatic vulnerability repair is achieved.

[0116] It is understandable that the higher the priority, the more serious the impact of the vulnerability. Therefore, the vulnerabilities with serious impact should be repaired first to reduce the impact of the vulnerability.

[0117] In this embodiment, the present application can determine the order in which each vulnerability is repaired by determining the repair priority, so that more serious vulnerabilities can be repaired first according to the repair priority, thereby reducing the negative impact caused by the vulnerabilities.

[0118] It is understandable that, compared with the traditional method of relying on manual analysis and writing of repair instructions, in order to generate accurate and effective repair instructions, this application generates repair instructions in an automated manner, which significantly improves the repair efficiency and response speed. In addition, this application can generate detailed and practical repair steps and preventive measures for each vulnerability by integrating multiple authoritative security databases and best practice information. This improves the efficiency of vulnerability repair.

[0119] In addition, in a feasible implementation, for repair rules, the present application can also provide users with the ability to customize rules and expand the rule base through plug-ins or APIs, so that the source code vulnerability detection device can be adjusted according to the specific needs of users, improving flexibility and applicability. In addition, the present application also uses machine learning and natural language processing technology to automatically extract and understand security information, reducing the workload of manual maintenance, thereby improving the intelligence and automation level of the rule base.

[0120] In a feasible embodiment, after the above step S40, the method further includes:

[0121] Step S110, after detecting that the source code to be detected is updated, returning to the step of performing static analysis on the source code to be detected to obtain a first vulnerability set.

[0122] In this embodiment, after detecting that the code that needs to be tested for vulnerabilities has been updated, the application will also perform static analysis on the updated code to obtain the target vulnerability set corresponding to the latest source code, so as to promptly repair the vulnerabilities generated after the code update.

[0123] Please refer to the scenario of the embodiment of this application Figure 2 ,exist Figure 2 In the example, the source code library is determined by the instructions received by the host security agent. The static analysis tool and the server running the machine learning model can identify vulnerabilities in the source code to be detected, and then compare the identified vulnerabilities with the vulnerabilities in the pre-set vulnerability database. Then, in response to user operations, the vulnerability can be repaired based on the device that stores the vulnerability repair rules, and the vulnerability database can be updated after the vulnerability is repaired.

[0124] In addition, please refer to Figure 3 , Figure 3 This is a flow chart of a specific embodiment of the vulnerability detection method of this application. The source code is the source code of the web application. Figure 3In the example, after receiving the instruction from the host security agent, the source code vulnerability detection device can initialize the relevant detection data and then preprocess the source code. After the source code is preprocessed, the source code can be simultaneously subjected to static analysis and machine learning model prediction. For example, when performing syntax analysis, the source code can be converted into a syntax tree during preprocessing, and then a taint analysis is performed based on the rule base to obtain a first set of vulnerabilities; when performing machine learning prediction, the training data used to train the model can be converted based on the rule base, and then the model can be trained based on recursive analysis, and then a taint analysis is performed based on the trained model to obtain a second set of vulnerabilities, and then the first set of vulnerabilities and the second set of vulnerabilities are compared (for example, to find the union or intersection), so that a target set of vulnerabilities can be generated, and then the target set of vulnerabilities can be uploaded to the host security for the host security to generate a vulnerability report.

[0125] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the source code vulnerability detection method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0126] This application also provides a source code vulnerability detection system, please refer to Figure 4 , the source code vulnerability detection system comprises:

[0127] A static analysis module 10, configured to perform static analysis on the source code to be detected to obtain a first vulnerability set;

[0128] The machine learning analysis module 20 is used to input the source code to be detected into a preset machine learning model, and output a second vulnerability set, wherein the vulnerability set is a set of codes in which vulnerabilities are detected in the source code to be detected, wherein in the machine learning model, the source code to be detected is classified according to standard vulnerability rules to obtain a classification result, wherein if there is a sub-code matching at least one standard vulnerability rule in the source code to be detected, the sub-code is used as a vulnerability code, and a plurality of the vulnerability codes are grouped together to obtain a second vulnerability set;

[0129] A cross module 30, configured to input the first vulnerability set into the machine learning model and output a third vulnerability set;

[0130] The vulnerability combination module 40 is used to use the second vulnerability set and the third vulnerability set as target vulnerability sets corresponding to the source code to be detected.

[0131] In one embodiment, the static analysis module 10 is further used to:

[0132] Compile the source code to be tested to obtain the AST syntax tree;

[0133] Traversing the AST syntax tree according to at least one rule in a preset rule library to obtain a rule checking result, wherein the rule includes input verification rules, permission access rules and communication security rules;

[0134] Using the code test case as tainted data, and tracking the flow path of the tainted data in the AST syntax tree to obtain a taint check result;

[0135] The rule check result and the taint check result are integrated to obtain a first vulnerability set.

[0136] In one embodiment, the machine learning analysis module 20 is further used to:

[0137] Recursively apply the code test case as tainted data to the source code to be tested to obtain suspected vulnerability code;

[0138] The suspected vulnerability code is input into a preset machine learning model for training to obtain a second vulnerability set, wherein, in the machine learning model, the suspected vulnerability code is classified according to standard vulnerability rules to obtain a classification result, wherein, if there is a sub-code matching at least one standard vulnerability rule in the suspected vulnerability code, the sub-code is used as the vulnerability code, and multiple vulnerability codes are grouped together to obtain a second vulnerability set.

[0139] In one embodiment, the source code vulnerability detection system further includes:

[0140] The intersection calculation module is used to calculate the intersection of the second vulnerability set and the first vulnerability set, and use the intersection as the target vulnerability set corresponding to the source code to be detected.

[0141] In one embodiment, the source code vulnerability detection system further includes:

[0142] A priority determination module, used to determine the repair priority of each vulnerability in the target vulnerability set in response to a user operation;

[0143] The repair module is used to traverse the vulnerabilities according to the repair priority, determine the repair rules matching the traversed vulnerabilities in the preset repair rule library, and repair the traversed vulnerabilities based on the repair rules matching the traversed vulnerabilities.

[0144] In one embodiment, the source code vulnerability detection system further includes:

[0145] A first code extraction module is used to search a preset source code database for source code that matches a rule in the preset rule library to obtain code required for training;

[0146] A second code extraction module, used to obtain vulnerability context code, wherein the vulnerability context code refers to one or more code segments directly associated with a preset security vulnerability;

[0147] The training module is used to construct a training set according to the code required for training and the vulnerability context code, and train the machine learning model to be trained according to the training set to obtain a trained machine learning model.

[0148] In one embodiment, the training module is further configured to:

[0149] Inputting the training set into the machine learning model to be trained to obtain a training vulnerability result;

[0150] Adjusting the parameters of the machine learning model to be trained based on the training vulnerability results and the manual vulnerability detection results of the training set;

[0151] Return to the step of inputting the training set into the machine learning model to be trained to obtain a training vulnerability result, until the similarity between the training vulnerability result and the manual vulnerability detection result is greater than or equal to a preset threshold, so as to obtain a trained machine learning model.

[0152] The source code vulnerability detection system provided by the present application adopts the source code vulnerability detection method in the above embodiment, which can solve the technical problem of low accuracy of source code vulnerability detection. Compared with the prior art, the beneficial effects of the source code vulnerability detection system provided by the present application are the same as the beneficial effects of the source code vulnerability detection method provided by the above embodiment, and other technical features of the source code vulnerability detection system are the same as the features disclosed in the above embodiment method, which will not be described in detail here.

[0153] The present application provides a source code vulnerability detection device, which includes: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the source code vulnerability detection method in the above-mentioned embodiment 1.

[0154] Reference below Figure 5, which shows a schematic diagram of the structure of a source code vulnerability detection device suitable for implementing the embodiment of the present application. The source code vulnerability detection device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The source code vulnerability detection device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0155] like Figure 5 As shown, the source code vulnerability detection device may include a processing system 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage system 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the source code vulnerability detection device are also stored. The processing system 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input system 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output system 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage system 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication system 1009. The communication system 1009 can allow the source code vulnerability detection device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows a source code vulnerability detection device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or provided instead.

[0156] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication system, or installed from a storage system 1003, or installed from a ROM 1002. When the computer program is executed by the processing system 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0157] The source code vulnerability detection device provided by the present application adopts the source code vulnerability detection method in the above embodiment, which can solve the technical problem of low accuracy of source code vulnerability detection. Compared with the prior art, the beneficial effects of the source code vulnerability detection device provided by the present application are the same as the beneficial effects of the source code vulnerability detection method provided by the above embodiment, and other technical features in the source code vulnerability detection device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0158] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0159] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0160] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the source code vulnerability detection method in the above-mentioned embodiment.

[0161] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0162] The computer-readable storage medium may be included in the source code vulnerability detection device; or may exist independently without being assembled into the source code vulnerability detection device.

[0163] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the source code vulnerability detection device, the source code vulnerability detection device: performs static analysis on the source code to be detected to obtain a first vulnerability set; inputs the source code to be detected into a preset machine learning model, and outputs a second vulnerability set, wherein the vulnerability set is a set of codes in which vulnerabilities are detected in the source code to be detected, wherein in the machine learning model, the source code to be detected is classified according to standard vulnerability rules to obtain a classification result, wherein if there is a sub-code matching at least one standard vulnerability rule in the source code to be detected, the sub-code is used as the vulnerability code, and multiple vulnerability codes are grouped to obtain a second vulnerability set; the first vulnerability set is input into the machine learning model, and the third vulnerability set is output; the second vulnerability set and the third vulnerability set are used as target vulnerability sets corresponding to the source code to be detected.

[0164] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0165] The flow chart and block diagram in the accompanying drawings illustrate the system architecture, function and operation that can be realized according to the system, method and computer program product of various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0166] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0167] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned source code vulnerability detection method, and can solve the technical problem of low accuracy of source code vulnerability detection. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the source code vulnerability detection method provided by the above-mentioned embodiment, and will not be elaborated here.

[0168] The present application also provides a computer program product, including a computer program, which implements the steps of the source code vulnerability detection method as described above when executed by a processor.

[0169] The computer program product provided by the present application can solve the technical problem of low accuracy in source code vulnerability detection. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the source code vulnerability detection method provided by the above embodiment, which will not be described in detail here.

[0170] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A source code vulnerability detection method, characterized in that: The method includes: Perform static analysis on the source code to be detected to obtain a first vulnerability set; Inputting the source code to be detected into a preset machine learning model, and outputting a second vulnerability set, wherein the vulnerability set is a set of codes in which vulnerabilities are detected in the source code to be detected, wherein in the machine learning model, the source code to be detected is classified according to standard vulnerability rules to obtain a classification result, wherein if there is a sub-code matching at least one standard vulnerability rule in the source code to be detected, the sub-code is used as a vulnerability code, and a plurality of the vulnerability codes are grouped together to obtain a second vulnerability set; Inputting the first vulnerability set into the machine learning model, and outputting a third vulnerability set; Using the second vulnerability set and the third vulnerability set as target vulnerability sets corresponding to the source code to be detected; The step of performing static analysis on the source code to be detected to obtain a first vulnerability set includes: Compile the source code to be tested to obtain the AST syntax tree; Taking the root node of the AST syntax tree as the starting point, traverse the AST syntax tree according to the depth-first search or breadth-first search; for each traversed node, extract the type, attribute, and child node information of the node to obtain the grammatical structure and semantics in the source code to be detected; for the currently traversed node, apply the rules in the preset rule library in sequence; wherein the rules include: trigger conditions and check logic, the trigger condition is: determine whether the rule is applicable to the current node, and the check logic is: if the trigger condition is applicable, check whether the node and its context meet the rule requirements; the trigger conditions include: node type, node attribute, node position in the AST syntax tree, and other associated nodes; Execute the check logic on the nodes that meet the trigger condition to determine whether there is a potential vulnerability, and record a vulnerability when a violation of the rule is detected through the rule check; and after the AST syntax tree traversal is completed, take the set of all recorded vulnerabilities as the rule detection result; Using the code test case as tainted data, and tracking the flow path of the tainted data in the AST syntax tree to obtain a taint check result; Integrate the rule check result and the taint check result to obtain a first vulnerability set; The step of inputting the source code to be detected into a preset machine learning model and outputting a second vulnerability set comprises: Recursively apply the code test case as tainted data to the source code to be tested to obtain suspected vulnerability code; The suspected vulnerability code is input into a preset machine learning model for training to obtain a second vulnerability set, wherein, in the machine learning model, the suspected vulnerability code is classified according to standard vulnerability rules to obtain a classification result, wherein, if there is a sub-code matching at least one standard vulnerability rule in the suspected vulnerability code, the sub-code is used as the vulnerability code, and multiple vulnerability codes are grouped together to obtain a second vulnerability set.

2. The method according to claim 1, characterized in that After the step of inputting the source code to be detected into a preset machine learning model and outputting a second vulnerability set, the method further includes: An intersection of the second vulnerability set and the first vulnerability set is calculated, and the intersection is used as a target vulnerability set corresponding to the source code to be detected.

3. The method according to claim 1, characterized in that After the step of using the second vulnerability set and the third vulnerability set as the target vulnerability set corresponding to the source code to be detected, the method further includes: In response to a user operation, determining a repair priority for each vulnerability in the target vulnerability set; The vulnerabilities are traversed according to the repair priority, repair rules matching the traversed vulnerabilities in a preset repair rule library are determined, and the traversed vulnerabilities are repaired based on the repair rules matching the traversed vulnerabilities.

4. The method according to claim 1, characterized in that Before the step of inputting the source code to be detected into a preset machine learning model and outputting a second vulnerability set, the method further includes: Searching for source code matching the rules in the preset rule base in a preset source code database to obtain the code required for training; Obtaining a vulnerability context code, wherein the vulnerability context code refers to one or more code segments directly associated with a preset security vulnerability; A training set is constructed according to the code required for training and the vulnerability context code, and the machine learning model to be trained is trained according to the training set to obtain a trained machine learning model.

5. The method according to claim 4, characterized in that The step of training the machine learning model to be trained according to the training set to obtain a trained machine learning model comprises: Inputting the training set into the machine learning model to be trained to obtain a training vulnerability result; Adjusting the parameters of the machine learning model to be trained based on the training vulnerability results and the manual vulnerability detection results of the training set; Return to the step of inputting the training set into the machine learning model to be trained to obtain a training vulnerability result, until the similarity between the training vulnerability result and the manual vulnerability detection result is greater than or equal to a preset threshold, so as to obtain a trained machine learning model.

6. A source code vulnerability detection system, characterized in that: The system comprises: A static analysis module, used for performing static analysis on the source code to be detected to obtain a first vulnerability set; a machine learning analysis module, configured to input the source code to be detected into a preset machine learning model, and output a second vulnerability set, wherein the vulnerability set is a set of codes in which vulnerabilities are detected in the source code to be detected, wherein in the machine learning model, the source code to be detected is classified according to standard vulnerability rules to obtain a classification result, wherein if there is a subcode matching at least one standard vulnerability rule in the source code to be detected, the subcode is used as a vulnerability code, and a plurality of the vulnerability codes are grouped together to obtain a second vulnerability set; A cross module, used for inputting the first vulnerability set into the machine learning model, and outputting a third vulnerability set; A vulnerability combination module, used for taking the second vulnerability set and the third vulnerability set as target vulnerability sets corresponding to the source code to be detected; The static analysis module is also used for: Compile the source code to be tested to obtain the AST syntax tree; Taking the root node of the AST syntax tree as the starting point, traverse the AST syntax tree according to the depth-first search or breadth-first search; for each traversed node, extract the type, attribute, and child node information of the node to obtain the grammatical structure and semantics in the source code to be detected; for the currently traversed node, apply the rules in the preset rule library in sequence; wherein the rules include: trigger conditions and check logic, the trigger condition is: determine whether the rule is applicable to the current node, and the check logic is: if the trigger condition is applicable, check whether the node and its context meet the rule requirements; the trigger conditions include: node type, node attribute, node position in the AST syntax tree, and other associated nodes; Execute the check logic on the nodes that meet the trigger condition to determine whether there is a potential vulnerability, and record a vulnerability when a violation of the rule is detected through the rule check; and after the AST syntax tree traversal is completed, take the set of all recorded vulnerabilities as the rule detection result; Using the code test case as tainted data, and tracking the flow path of the tainted data in the AST syntax tree to obtain a taint check result; Integrate the rule check result and the taint check result to obtain a first vulnerability set; The machine learning analysis module is also used to: Recursively apply the code test case as tainted data to the source code to be tested to obtain suspected vulnerability code; The suspected vulnerability code is input into a preset machine learning model for training to obtain a second vulnerability set, wherein, in the machine learning model, the suspected vulnerability code is classified according to standard vulnerability rules to obtain a classification result, wherein, if there is a sub-code matching at least one standard vulnerability rule in the suspected vulnerability code, the sub-code is used as the vulnerability code, and multiple vulnerability codes are grouped together to obtain a second vulnerability set.

7. A source code vulnerability detection device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the source code vulnerability detection method according to any one of claims 1 to 5.

8. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the source code vulnerability detection method according to any one of claims 1 to 5 are implemented.

Images