A software vulnerability detection method based on fuzz testing

Abstract

The present invention discloses a software vulnerability detection method based on fuzzy testing, which relates to the technical field of software vulnerability detection, and includes the following steps: S1: obtaining software source code, and preprocessing the obtained software source code, so that the preprocessed source code has generalization, thereby improving the accuracy of the detection result when the source code is subsequently detected for vulnerabilities. The present invention proposes a software vulnerability detection method based on fuzzy testing, which normalizes the source code file to eliminate the deviation caused by the programming habits of the code writers in the software source code file when the software source code is subsequently detected for vulnerabilities, and performs feature representation processing on the source code file through an abstract syntax tree and a program dependency graph, so as to more comprehensively characterize the semantic features of the source code, and enable the constructed software vulnerability detection model to set different noise thresholds based on the noise content in different input source code files.

Description

Technical Field

[0001] The present invention relates to the technical field of software vulnerability detection, and in particular to a software vulnerability detection method based on fuzzy testing. Background Art

[0002] In the new information environment, the scale of software is getting larger and larger, the complexity of software is getting higher and higher, and the impact of software-related security issues on individuals, organizations and society is increasing day by day. Software vulnerability mining, as the core of software security issues, has received more and more attention from researchers. In the Chinese patent application number 202010211259.6, "a software vulnerability fuzz testing method based on human-computer collaboration is disclosed. The service automatic matching and assembly technology is used to provide the cognitive ability of software security analysts as cognitive services to the software vulnerability fuzz testing process. The present invention uses the cognitive ability of people participating in software vulnerability fuzz testing as a component of the system, namely cognitive services, and "immerses" them in the entire software vulnerability fuzz testing task solution. The present invention integrates software services and cognitive services into a unified framework to achieve human-computer collaboration. The method can realize flexible switching between software services and cognitive services, and can achieve the purpose of improving the efficiency of software vulnerability fuzz testing. The present invention solidifies human experience as a service form in the test sample generation link, which to a certain extent overcomes the extremely time-consuming problem of manually generating test cases in the previous fuzz testing process, and greatly improves the efficiency of the entire fuzz testing. ";

[0003] This existing technology only solves the current problem of solving problems mainly relying on data from a technical level, and ignores non-technical factors that cannot be fully modeled. As non-technical factors, people are an important component of software fuzz testing tasks. Their advanced thinking and fuzz testing experience and art cannot be replaced by software services. These existing problems seriously affect the use value of software fuzz testing systems and users' enthusiasm for use. It does not take into account that when processing source code files, multiple methods should be combined to comprehensively characterize the semantic features of the source code, and it is often necessary to perform noise removal operations on the source code files, resulting in low detection efficiency. In addition, when performing vulnerability detection, the accuracy of the detection results cannot be ensured through a single feature input. Summary of the invention

[0004] The purpose of the present invention is to provide a software vulnerability detection method based on fuzzy testing to solve the problems raised in the above background technology.

[0005] To achieve the above object, the present invention provides the following technical solution: a software vulnerability detection method based on fuzzy testing, comprising the following steps:

[0006] S1: Acquire the software source code and preprocess the acquired software source code so that the preprocessed source code has generalization, thereby improving the accuracy of the detection results when performing vulnerability detection on the source code later;

[0007] S2: Use multiple methods to perform feature representation processing on the processed source code, so as to more comprehensively represent the semantic features of the source code;

[0008] S3: Build a software vulnerability detection model and a software vulnerability dataset. Use the constructed software vulnerability dataset to train the software vulnerability detection model and verify its accuracy to ensure that the performance of the software vulnerability detection model meets the use requirements. Use the software vulnerability detection model that meets the use requirements to detect the source code.

[0009] S4: Collect and record the detection results of the software vulnerability detection model on the source code, and pass the source code and the detection results as sample data into the software vulnerability dataset to expand the software vulnerability dataset.

[0010] Preferably, step S1 also includes acquiring software source code, specifically including generating it by forward slicing and backward slicing, and preprocessing the acquired software source code, specifically including normalizing and vectorizing the software source code, wherein the operation of normalizing the software source code specifically includes keeping the C language keywords and library functions appearing in the software source code file unchanged, deleting related source code comments and ASCII characters, and uniformly replacing the function names and variable names of the code writers to eliminate the deviation in the software source code file due to the programming habits of the code writers when performing vulnerability detection on the software source code in the subsequent process, so that the software source code after normalization has generalization, thereby improving the accuracy of the detection results when performing vulnerability detection on the source code in the subsequent process.

[0011] Preferably, the step S1 also includes the operation of vectorizing the software source code, specifically including establishing a mapping vocabulary from words in the software source code to indexes, traversing the normalized software source code file, adding it to the vocabulary in units of tokens, thereby obtaining a token sequence, and detecting and processing the token sequence by artificially setting a source code length threshold. When the software source code length is greater than the threshold, if the software source code is generated by forward slicing, the tail of the software source code is truncated, otherwise the beginning of the software source code is truncated. When the software source code length is not greater than the threshold, if the software source code is generated by forward slicing, the tail of the software source code is filled with 0 vectors, otherwise the beginning of the software source code is filled with 0 vectors, and finally the token sequence is mapped into a vector sequence through the Word2vec tool to realize vectorization of the software source code.

[0012] Preferably, step S2 also includes performing feature representation processing on the processed source code in a variety of ways, specifically including performing feature representation processing through an abstract syntax tree and a program dependency graph, wherein the operation of performing feature representation processing through an abstract syntax tree specifically includes generating an abstract syntax tree from the processed source code file through the open source software Joern, thereby intuitively displaying a graphic representation of the abstract syntax tree of the source code file, and generating a file containing node information and structural information of the abstract syntax tree of the source code file, and based on the generated file, converting the tree structure data of the abstract syntax tree into data in sequence form through the SBT algorithm, and implementing feature representation processing of the source code file through the abstract syntax tree by replacing the code token with the index number in the mapping vocabulary, and saving the processing result.

[0013] Preferably, the step S2 also includes the operation of performing feature representation processing through a program dependency graph, specifically including generating a program dependency graph from the processed source code file through the open source software Joern, and generating a file containing node information and edge information of the program dependency graph of the source code file, specifically including node ID, node type, node value and edge type, and the edge type specifically includes two types of data dependency and control dependency, extracting the information in the file, and performing feature representation processing on the source code file through the program dependency graph by replacing the token in the node in the extracted information with the index number in the mapping vocabulary, and saving the processing results.

[0014] Preferably, step S3 further includes constructing a software vulnerability detection model, specifically constructing a software vulnerability detection model based on a neural network, including an input layer, a preprocessing layer, a feature processing layer, and an output layer, wherein the input layer is used to receive the processed source code file input into the software vulnerability detection model, wherein the preprocessing layer is used to enable the software vulnerability detection model to set different noise thresholds based on the noise content in different input source code files, specifically by performing global average aggregation processing on the noise in the input processed source code file to obtain a one-dimensional vector, and its specific expression is as follows:

[0015]

[0016] Where T represents the total number of tokens in the input source code file, |X i | represents the absolute value of each noise value in the i-th line of the source code file, and before the processed source code file is transmitted to the feature processing layer through the transmission channel, the noise threshold coefficient range of the transmission channel is limited to between 0 and 1 through the sigmoid activation function, and the threshold coefficient of the transmission channel is calculated through the threshold coefficient algorithm. The specific calculation formula is as follows:

[0017]

[0018] In the formula, Z represents the output of the preprocessing layer, and based on the calculation result of the threshold coefficient of the transmission channel, it is multiplied with the obtained one-dimensional vector by the vector element product operation, so as to obtain the final noise threshold of the transmission channel, so that the software vulnerability detection model generates a corresponding noise threshold for each processed source code file input, so that the software vulnerability detection model can adapt to the situation where the noise content in different processed source code files is different.

[0019] Preferably, step S3 also includes a feature processing layer for performing feature learning on the processed source code file, specifically slicing the data in sequence form according to the order of forward slicing based on the processing result obtained by feature processing through the abstract syntax tree, extracting features from each slice using RNN, and then using a long short-term memory recursive neural network for capture learning, and learning the execution logic of code vulnerability detection by adding control flow edges based on the data dependency edges and control dependency edges contained in the processing result obtained by feature processing through the program dependency graph, and finally performing feature fusion by directly splicing features, wherein the output layer is used to obtain the final output result based on the fusion features obtained by the feature processing layer, and the original source code file corresponding to the processed source code file with a vulnerability as the output result is marked as "1", otherwise it is marked as "0".

[0020] Preferably, step S3 further includes constructing a software vulnerability data set, and the sample data in the software vulnerability data set is specifically obtained through a web crawler, and the sample data in the software vulnerability data set is preprocessed and feature represented, and the software vulnerability detection model is trained through the constructed software vulnerability data set, and the accuracy of the software vulnerability detection model is verified after the model training is completed, and when the accuracy of the software vulnerability detection model does not meet the use requirements, the model needs to be optimized, and the cross entropy loss function is specifically selected as the loss function for optimizing the software vulnerability detection model, and its specific expression is as follows:

[0021] L=-[y·log(p)+(1-y)·log(1-p)]

[0022] In the formula, y represents the label of the sample data, and p represents the probability that the sample data is detected correctly, so as to ensure the performance of the software vulnerability detection model. The processed source code file is detected by the software vulnerability detection model whose model accuracy meets the usage requirements.

[0023] Preferably, step S4 also includes collecting and recording the detection results of the software vulnerability detection model on the processed source code file, and passing the original source code file corresponding to the processed source code file and the detection result as sample data into the software vulnerability data set to expand the software vulnerability data set, and regularly training the software vulnerability detection model through the expanded software vulnerability data set to improve the performance of the software vulnerability detection model.

[0024] Compared with the prior art, the beneficial effects of the present invention include at least: the present invention proposes a software vulnerability detection method based on fuzzy testing, which normalizes the source code file to eliminate the deviation caused by the programming habits of the code writers in the software source code file when the software source code is subsequently detected. The source code file is feature represented by an abstract syntax tree and a program dependency graph, so as to more comprehensively characterize the semantic features of the source code, and enables the constructed software vulnerability detection model to set different noise thresholds based on the noise content in different input source code files, thereby reducing the steps of eliminating noise in the source code file and improving the vulnerability detection efficiency. The software vulnerability detection model is used to perform feature fusion on the processing results obtained by the two feature representation processing methods, thereby improving the accuracy of the software vulnerability detection model when detecting vulnerabilities in the source code file. The software vulnerability detection model is trained and the accuracy is verified to ensure that the accuracy of the software vulnerability detection model meets the use requirements, and the detection accuracy of the software vulnerability detection model is further improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1A flowchart of the overall method is provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] See also Figure 1 The present invention provides a technical solution: a software vulnerability detection method based on fuzzy testing, comprising the following steps:

[0028] S1: Acquire the software source code and preprocess the acquired software source code so that the preprocessed source code has generalization, thereby improving the accuracy of the detection results when performing vulnerability detection on the source code later;

[0029] S2: Use multiple methods to perform feature representation processing on the processed source code, so as to more comprehensively represent the semantic features of the source code;

[0030] S3: Build a software vulnerability detection model and a software vulnerability dataset. Use the constructed software vulnerability dataset to train the software vulnerability detection model and verify its accuracy to ensure that the performance of the software vulnerability detection model meets the use requirements. Use the software vulnerability detection model that meets the use requirements to detect the source code.

[0031] S4: Collect and record the detection results of the software vulnerability detection model on the source code, and pass the source code and the detection results as sample data into the software vulnerability dataset to expand the software vulnerability dataset.

[0032] Step S1 also includes acquiring the software source code, specifically including generating it by forward slicing and backward slicing, and preprocessing the acquired software source code, specifically including normalizing and vectorizing the software source code, wherein the operation of normalizing the software source code specifically includes keeping the C language keywords and library functions appearing in the software source code file unchanged, deleting the relevant source code comments and ASCII characters, and uniformly replacing the function names and variable names of the code writers, so as to eliminate the deviation in the software source code file due to the programming habits of the code writers when the software source code is subsequently detected for vulnerabilities, so that the software source code after normalization has generalization, thereby improving the accuracy of the detection results when the source code is subsequently detected for vulnerabilities;

[0033] Step S1 also includes the operation of vectorizing the software source code, specifically including establishing a mapping vocabulary from words in the software source code to indexes, traversing the normalized software source code file, adding it to the vocabulary in units of tokens, thereby obtaining a token sequence, and detecting and processing the token sequence by artificially setting a source code length threshold. When the software source code length is greater than the threshold, if the software source code is generated by forward slicing, the tail of the software source code is truncated, otherwise the beginning of the software source code is truncated. When the software source code length is not greater than the threshold, if the software source code is generated by forward slicing, the tail of the software source code is filled with 0 vectors, otherwise the beginning of the software source code is filled with 0 vectors, and finally the token sequence is mapped into a vector sequence by the Word2vec tool to realize vectorization of the software source code.

[0034] Step S2 also includes performing feature representation processing on the processed source code in a variety of ways, specifically including performing feature representation processing through an abstract syntax tree and a program dependency graph, wherein the operation of performing feature representation processing through an abstract syntax tree specifically includes generating an abstract syntax tree from the processed source code file through the open source software Joern, thereby intuitively displaying the image representation of the abstract syntax tree of the source code file, and generating a file containing node information and structural information of the abstract syntax tree of the source code file, and converting the tree structure data of the abstract syntax tree into data in a sequence form based on the generated file through the SBT algorithm, and performing feature representation processing on the source code file through the abstract syntax tree by replacing the code token with the index number in the mapping vocabulary, and saving the processing result;

[0035] Step S2 also includes the operation of performing feature representation processing through a program dependency graph, specifically including generating a program dependency graph from the processed source code file through the open source software Joern, and generating a file containing node information and edge information of the program dependency graph of the source code file, specifically including node ID, node type, node value and edge type, and the edge type specifically includes two types of data dependency and control dependency, extracting information from the file, and replacing the token in the node in the extracted information with the index number in the mapping vocabulary to realize feature representation processing of the source code file through the program dependency graph, and saving the processing result;

[0036] Step S3 also includes constructing a software vulnerability detection model, specifically constructing a software vulnerability detection model based on a neural network, including an input layer, a preprocessing layer, a feature processing layer, and an output layer, wherein the input layer is used to receive the processed source code file input into the software vulnerability detection model, wherein the preprocessing layer is used to enable the software vulnerability detection model to set different noise thresholds based on the noise content in different input source code files, specifically by performing global average aggregation processing on the noise in the input processed source code file to obtain a one-dimensional vector, and its specific expression is as follows:

[0037]

[0038] Where T represents the total number of tokens in the input source code file, |X i | represents the absolute value of each noise value in the i-th line of the source code file, and before the processed source code file is transmitted to the feature processing layer through the transmission channel, the noise threshold coefficient range of the transmission channel is limited to between 0 and 1 through the sigmoid activation function, and the threshold coefficient of the transmission channel is calculated through the threshold coefficient algorithm. The specific calculation formula is as follows:

[0039]

[0040] Wherein, Z represents the output of the preprocessing layer, and based on the calculation result of the threshold coefficient of the transmission channel, it is multiplied with the obtained one-dimensional vector by the vector element product operation, so as to obtain the final noise threshold of the transmission channel, thereby enabling the software vulnerability detection model to generate a corresponding noise threshold for each processed source code file input, so that the software vulnerability detection model can adapt to the situation where the noise content in different processed source code files is different;

[0041] Step S3 also includes a feature processing layer for feature learning of the processed source code file, specifically slicing the sequence data in the order of forward slicing based on the processing result obtained by feature processing through the abstract syntax tree, extracting features for each slice using RNN, and then using long short-term memory recursive neural network for capture learning, learning the execution logic of code vulnerability detection by adding control flow edges based on the data dependency edges and control dependency edges contained in the processing result obtained by feature processing through the program dependency graph, and finally performing feature fusion by directly splicing features, wherein the output layer is used to obtain the final output result based on the fusion features obtained by the feature processing layer, and sequentially passes through the fully connected layer and the softmax layer contained in the output layer, and marks the original source code file corresponding to the processed source code file with a vulnerability as "1", otherwise it is marked as "0";

[0042] Step S3 also includes constructing a software vulnerability data set, and the sample data in the software vulnerability data set is specifically obtained through a web crawler, and the sample data in the software vulnerability data set is preprocessed and feature represented, and the software vulnerability detection model is trained through the constructed software vulnerability data set, and the accuracy of the software vulnerability detection model is verified after the model training is completed, and when the accuracy of the software vulnerability detection model does not meet the use requirements, the model needs to be optimized, and the cross entropy loss function is specifically selected as the loss function for optimizing the software vulnerability detection model, and its specific expression is as follows:

[0043] L=-[y·log(p)+(1-y)·log(1-p)]

[0044] In the formula, y represents the label of the sample data, and p represents the probability that the sample data is detected correctly, so as to ensure the performance of the software vulnerability detection model. The processed source code file is detected by the software vulnerability detection model whose model accuracy meets the use requirements;

[0045] Step S4 also includes collecting and recording the detection results of the software vulnerability detection model on the processed source code file, and passing the original source code file corresponding to the processed source code file and the detection result as sample data into the software vulnerability data set to expand the software vulnerability data set, and regularly training the software vulnerability detection model through the expanded software vulnerability data set to improve the performance of the software vulnerability detection model.

[0046] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0047] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A software vulnerability detection method based on fuzz testing, characterized in that The following steps are involved: S1: Acquire the software source code and preprocess the acquired software source code so that the preprocessed source code has generalization, thereby improving the accuracy of the detection results when performing vulnerability detection on the source code later; The step S1 also includes acquiring the software source code, specifically including generating it by forward slicing and backward slicing, and preprocessing the acquired software source code, specifically including normalizing and vectorizing the software source code, wherein the operation of normalizing the software source code specifically includes keeping the C language keywords and library functions appearing in the software source code file unchanged, deleting the relevant source code comments and ASCII characters, and uniformly replacing the function names and variable names of the code writers, so as to eliminate the deviation in the software source code file due to the programming habits of the code writers when the software source code is subsequently detected for vulnerabilities, so that the software source code after normalization has generalization, thereby improving the accuracy of the detection results when the source code is subsequently detected for vulnerabilities; The step S1 also includes the operation of vectorizing the software source code, specifically including establishing a mapping vocabulary from words in the software source code to indexes, traversing the normalized software source code file, adding it to the vocabulary in units of tokens, thereby obtaining a token sequence, and detecting and processing the token sequence by artificially setting a source code length threshold. When the software source code length is greater than the threshold, if the software source code is generated by forward slicing, the tail of the software source code is truncated, otherwise the beginning of the software source code is truncated. When the software source code length is not greater than the threshold, if the software source code is generated by forward slicing, the tail of the software source code is filled with a 0 vector, otherwise the beginning of the software source code is filled with a 0 vector, and finally the token sequence is mapped into a vector sequence by the Word2vec tool to realize vectorization of the software source code. S2: Use multiple methods to perform feature representation processing on the processed source code, so as to more comprehensively represent the semantic features of the source code; The step S2 also includes performing feature representation processing on the processed source code in a variety of ways, specifically including performing feature representation processing through an abstract syntax tree and a program dependency graph, wherein the operation of performing feature representation processing through an abstract syntax tree specifically includes generating an abstract syntax tree from the processed source code file through the open source software Joern, thereby intuitively displaying a graphic representation of the abstract syntax tree of the source code file, and generating a file containing node information and structural information of the abstract syntax tree of the source code file, and converting the tree structure data of the abstract syntax tree into data in a sequence form based on the generated file through the SBT algorithm, and performing feature representation processing on the source code file through the abstract syntax tree by replacing the code token with the index number in the mapping vocabulary, and saving the processing result; The step S2 also includes an operation of performing feature representation processing through a program dependency graph, specifically including generating a program dependency graph from the processed source code file through the open source software Joern, and generating a file containing node information and edge information of the program dependency graph of the source code file, specifically including node ID, node type, node value and edge type, and the edge type specifically includes two types of data dependency and control dependency, extracting information from the file, and performing feature representation processing on the source code file through the program dependency graph by replacing the token in the node in the extracted information with the index number in the mapping vocabulary, and saving the processing result; S3: Build a software vulnerability detection model and a software vulnerability dataset. Use the constructed software vulnerability dataset to train the software vulnerability detection model and verify its accuracy to ensure that the performance of the software vulnerability detection model meets the use requirements. Use the software vulnerability detection model that meets the use requirements to detect the source code. S4: Collect and record the detection results of the software vulnerability detection model on the source code, and pass the source code and the detection results as sample data into the software vulnerability dataset to expand the software vulnerability dataset.

2. A software vulnerability detection method based on fuzz testing according to claim 1, characterized in that: The step S3 also includes constructing a software vulnerability detection model, specifically constructing a software vulnerability detection model based on a neural network, including an input layer, a preprocessing layer, a feature processing layer and an output layer, wherein the input layer is used to receive the processed source code file input into the software vulnerability detection model, wherein the preprocessing layer is used to enable the software vulnerability detection model to set different noise thresholds based on the noise content in different input source code files, specifically by performing global average aggregation processing on the noise in the input processed source code file to obtain a one-dimensional vector, and before the input processed source code file is transmitted to the feature processing layer through a transmission channel, the noise threshold coefficient range of the transmission channel is limited to between 0 and 1 through a sigmoid activation function, and the threshold coefficient of the transmission channel is calculated through a threshold coefficient algorithm, and based on the calculation result of the threshold coefficient of the transmission channel, the vector element product operation is performed between the threshold coefficient and the obtained one-dimensional vector, so as to obtain the final noise threshold of the transmission channel, so that the software vulnerability detection model generates a corresponding noise threshold for each processed source code file input, so that the software vulnerability detection model can adapt to the situation where the noise content in different processed source code files input is different.

3. The software vulnerability detection method based on fuzz testing according to claim 1 is characterized in that: The step S3 also includes a feature processing layer for performing feature learning on the processed source code file, specifically slicing the data in sequence form according to the order of forward slicing based on the processing result obtained by feature processing through the abstract syntax tree, using RNN to extract features for each slice, and then using a long short-term memory recursive neural network for capture learning, and learning the execution logic of code vulnerability detection by adding control flow edges on the basis of the data dependency edges and control dependency edges contained in the processing result obtained by feature processing through the program dependency graph, and finally performing feature fusion by directly splicing features, wherein the output layer is used to obtain the final output result based on the fusion features obtained by the feature processing layer, and passes through the fully connected layer and the softmax layer contained in the output layer in turn, and the original source code file corresponding to the processed source code file with a vulnerability as the output result is marked as "1", otherwise it is marked as "0".

4. The software vulnerability detection method based on fuzz testing according to claim 1, characterized in that: The step S3 also includes constructing a software vulnerability data set, and the sample data in the software vulnerability data set is specifically obtained through a web crawler, and the sample data in the software vulnerability data set is preprocessed and feature represented, and the software vulnerability detection model is trained through the constructed software vulnerability data set, and the accuracy of the software vulnerability detection model is verified after the model training is completed, and when the accuracy of the software vulnerability detection model does not meet the use requirements, the model needs to be optimized, and the cross entropy loss function is specifically selected as the loss function for optimizing the software vulnerability detection model to ensure the performance of the software vulnerability detection model, and the processed source code file is detected by the software vulnerability detection model whose model accuracy meets the use requirements.

5. The software vulnerability detection method based on fuzz testing according to claim 1, characterized in that: The step S4 also includes collecting and recording the detection results of the software vulnerability detection model on the processed source code file, and passing the original source code file corresponding to the processed source code file and the detection result as sample data into the software vulnerability data set to expand the software vulnerability data set, and regularly training the software vulnerability detection model through the expanded software vulnerability data set to improve the performance of the software vulnerability detection model.

Images