A fragile code segment search method for generating adversarial samples

Abstract

The present invention relates to a vulnerable code segment search method for generating adversarial samples, and relates to the field of adversarial attacks for pre-trained programming language models. The method first assigns an initial search priority to each method according to its position in a call chain; then, based on the vulnerable code behavior identified during the search, a code behavior graph is used to guide the adjustment of the call priority of each method. The method uses a code call chain and a behavior graph to visualize the code behavior and the calling relationship between methods, and dynamically adjusts the priority of each method in the traversal by acquiring knowledge from the traversal process, so that functions that are more likely to contain vulnerable code segments are searched first, thereby reducing the number of model accesses during the replacement point search process and reducing the time overhead of the search.

Description

Technical Field

[0001] The present invention relates to the field of adversarial attacks on pre-trained programming language models, and in particular to a fragile code segment search method for generating adversarial samples. Background Art

[0002] In recent years, programming language models have developed rapidly. These models can capture the relationship between natural language and source code and automatically complete a series of software engineering development tasks, involving various forms such as code understanding and code generation, including clone detection, anomaly detection, code translation, summary generation and other downstream tasks.

[0003] Like deep learning models in other fields, the adversarial robustness of programming language models is extremely important. Adversarial samples are the main tool for testing the adversarial robustness of models. They reveal possible defects in the model by comparing the differences between the model's output of the original sample and the adversarial sample. In addition, adversarial samples can also be used to improve the adversarial robustness of the model. By adding adversarial samples to the training set, the model can perform more fine-grained processing when facing similar easily confused samples, thereby reducing the possibility of being attacked by adversarial attacks.

[0004] Based on the above important functions, adversarial sample generation methods for pre-trained programming language models are gradually emerging. The current mainstream adversarial sample generation methods can be summarized into three major modules, namely, search for replacement points, search for replacement space, and maintenance of code semantics. Existing solutions have conducted extensive research on search methods for replacement spaces and code segment replacement methods, and have achieved good results.

[0005] However, for the search method of replacement points, the existing scheme only searches by traversing all code segments in the code sample. This traversal idea may not have too much impact on the time cost when facing a code sample composed of a single method, but when dealing with a code sample composed of multiple methods, its search space will increase exponentially. It should be noted that the process of measuring whether a replacement point is valuable requires the introduction of model access, which means that when the search space increases, the time cost of the adversarial sample generation scheme will increase significantly, greatly reducing the efficiency of robustness evaluation. There is a lack of effective solutions to this situation. Therefore, there is an urgent need for a replacement point search method for code samples composed of multiple methods, which can reduce the number of model accesses under the premise of a large original search space to assist in the generation of adversarial samples. Summary of the invention

[0006] The main purpose of the present invention is to overcome the shortcomings and deficiencies of the prior art and to provide a vulnerable code segment search method for generating adversarial samples. The method uses code call chains and behavior graphs to visualize code behaviors and calling relationships between methods. By acquiring knowledge from the traversal process, the priority of each method in the traversal is dynamically adjusted, so that functions that are more likely to contain vulnerable code segments are searched first, thereby reducing the number of model accesses during the replacement point search process and reducing the time overhead of the search.

[0007] The present invention provides a vulnerable code segment search method for generating adversarial samples, the method comprising the following steps:

[0008] S1. Generate a corresponding code behavior graph for the code sample to be processed, and abstract the call chain between methods from the code behavior graph; wherein the code behavior graph is a code representation form that describes the execution process and behavior of the code sample, and includes the code behavior of the code sample, and the code behavior is the dynamic behavior displayed by the code during operation; the method is the code used to perform a specific task or operation in the code, and there is a call relationship between them, and the call chain is a chain composed of a series of method calls, which represents the control flow when the code is executed;

[0009] S2. Allocate different initial value coefficients to any current method in the code sample according to the call chain, the number of times the current method is called, and the level of the current method in the call chain;

[0010] S3, calculating the method value coefficient according to the initial value coefficient, the first adjustment value of the value coefficient and the second adjustment value of the value coefficient of each current method, and normalizing it using the softmax function to generate the traversal priority of the current method;

[0011] S4. For the untraversed method with the highest current priority, identify a vulnerable code segment list and a common code segment list therein, and for each vulnerable code segment, generate a replacement code segment to replace the vulnerable code segment in the code sample;

[0012] S5. According to the behavior graph, determine the code behavior corresponding to each vulnerable code segment, search for other methods that contain this code behavior and have not been traversed, and calculate a first adjustment value of the value coefficient of the untraversed method; according to the call chain, determine the relationship between the untraversed method and the current method, and calculate a second adjustment value of the value coefficient of the untraversed method;

[0013] S6. Loop through the above steps S3-S5 until the code sample is successfully converted into an adversarial sample or all methods have been traversed.

[0014] S7. If all methods have been traversed and the code sample has not been converted into an adversarial sample, the ordinary code segment lists of all methods are merged and sorted according to the influence factors of the code segments to generate a secondary processing code segment list, and the code segments in the secondary processing code segment list are replaced in sequence until the code sample is converted into an adversarial sample, or all code segments are replaced.

[0015] Preferably, in step S1, for the code sample to be processed, generating a corresponding code behavior graph, and abstracting the call chain between methods from the code behavior graph includes:

[0016] The code behavior diagram of the code sample is as follows:

[0017]

[0018] For the code behavior graph, identify the method calling behavior and generate the calling relationship L ij ;

[0019] L ij =(F i , F j )

[0020] Where G represents the code behavior graph of the code sample, n is the number of methods contained in the code sample, and BL i Represents a list of code actions for any method, F i F is the initiating method of the identified method call behavior. j The method being called.

[0021] Preferably, the allocating different initial value coefficients in step S2 includes:

[0022] For any method F i , identify the call chain level l according to the call chain i , the call chain level l i To satisfy the following formula i The minimum value of

[0023]

[0024] Identify calling method F based on calling chain i The number of methods is recorded as the number of calls n i ; According to its corresponding call chain level l i and the number of calls n i , assigning its initial value coefficient

[0025]

[0026] Among them,a and l b Respectively represent method F a and F b The call chain level, K is the call chain, L is the ij is the calling relationship; n i , l i Method F i The number of times it is called and the call chain level it is in, ∑n represents the number of times it is called and the call chain level it is in, and ... i The sum of the number of times all methods at the same call chain level are called, and α is the adjustment parameter.

[0027] Preferably, the step S3 of generating the calculation method value coefficient and the traversal priority of the current method includes:

[0028] For any method F i , the value coefficient V is obtained according to the following formula i ;

[0029]

[0030] Value coefficient V i Use the softmax function for normalization and generate method F i The traversal priority P i ;

[0031]

[0032] in For method F i The initial value coefficient, γ i and δ i are the first adjustment value and the second adjustment value of its value coefficient, V i For method F i The value coefficient of n is the number of methods contained in the code sample, V j is the value coefficient of any method.

[0033] Preferably, the step S4 of generating a replacement code segment to replace the vulnerable code segment in the code sample includes:

[0034] The similarity between the target code segment and all code segments in the replacement space is calculated according to the following formula, and the code segment with the highest similarity is selected as the replacement code segment;

[0035]

[0036] For any method F i , calculation method F i The total amount of confidence change in the model Δ i ;

[0037]

[0038] Among them, ||·|| is the distance norm, l is the length of the replacement space, c i is the target code segment, s k is any code segment in the replacement space; l is the length of the replacement space, Δ ij Replace any vulnerable code segment c in the space ij The amount of change in confidence caused.

[0039] Preferably, the step S5 of calculating the first adjustment value of the value coefficient of the untraversed method and calculating the second adjustment value of the value coefficient of the untraversed method comprises:

[0040] For the current traversal method F i Any vulnerable code segment c ij , and the corresponding vulnerable code behavior is recorded as b ij ; Search the behavior graph for the untraversed method F that contains the vulnerable code behavior k , calculate the first adjustment value of its value coefficient γ k ;

[0041]

[0042] According to the call chain, identify the method F that is currently traversed i Untraversed method F in the same call chain l , calculate the second adjustment value of its value coefficient δ l ;

[0043] δ l =ω·Δ i

[0044] Among them, q is the untraversed method F k In the method F that contains the current traversal i Searched vulnerable code behavior b ij The number of ij is the confidence change caused by the jth vulnerable code behavior, ω is the weight coefficient, Δ i The method F currently being traversed i The total change in confidence in the model.

[0045] Preferably, the step S7 of sorting the code segments according to their impact factors to generate a secondary processing code segment list includes:

[0046] The masked element x is calculated by the following formula i Impact Factor I i :

[0047]

[0048] Merge all methods F in the code sample i Corresponding common code segment list N i , sort the code segments according to the impact factors and generate a secondary processing code segment list N total ;

[0049]

[0050] Among them, among them ||O|| and Represent the output sequence O and The distance paradigm, O and For the original input sequence X and the masked input sequence After inputting the model, the model output sequence is obtained respectively; N i Represents any method F i The corresponding list of common code segments, n represents the number of methods contained in the code sample.

[0051] Beneficial effect: The present invention uses code call chains and behavior graphs to visualize code behaviors and calling relationships between methods, and dynamically adjusts the priority of each method in the traversal by acquiring knowledge from the traversal process, so that functions that are more likely to contain vulnerable code segments are searched first, thereby reducing the number of model accesses during the replacement point search process and reducing the time overhead of the search.

[0052] The features and advantages of the present invention will become clear through reference to the following drawings and detailed description of specific embodiments of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is a flow chart of the vulnerable code segment search method for generating adversarial samples;

[0054] Figure 2 This is a flowchart of another vulnerable code segment search method for generating adversarial samples. DETAILED DESCRIPTION

[0055] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] Example 1

[0057] Figure 1 This is a flow chart of the vulnerable code segment search method used to generate adversarial samples. Figure 1As shown, the present invention provides a vulnerable code segment search method for generating adversarial samples, the method comprising the following steps:

[0058] S1. Generate a corresponding code behavior graph for the code sample to be processed, and abstract the call chain between methods from the code behavior graph; wherein the code behavior graph is a code representation that describes the execution process and behavior of the code sample, which includes the code behavior of the code sample, and the code behavior is the dynamic behavior exhibited by the code during operation; the method is the code used to perform a specific task or operation in the code, and there is a calling relationship between them, and the call chain is a chain composed of a series of method calls, which represents the control flow when the code is executed.

[0059] Specifically, for the code sample to be processed, a static analysis method is used to generate its corresponding code behavior graph. The code behavior graph represents a code representation form used to describe the execution process and behavior of the code sample, which includes the code behavior of the code sample. The code behavior refers to the dynamic behavior displayed by the code during operation, including various operations, function calls, data flow, etc. Then, the call chain between methods is abstracted from the behavior graph. The method refers to a section of code in the code used to perform a specific task or operation. There is a calling relationship between them. The call chain refers to a chain composed of a series of method calls, which shows the control flow when the code is executed.

[0060] S2. Allocate different initial value coefficients to any current method in the code sample according to the call chain, the number of times the current method is called, and the level of the current method in the call chain;

[0061] S3, calculating the method value coefficient according to the initial value coefficient, the first adjustment value of the value coefficient and the second adjustment value of the value coefficient of each current method, and normalizing it using the softmax function to generate the traversal priority of the current method;

[0062] S4. For the untraversed method with the highest current priority, identify a vulnerable code segment list and a common code segment list therein, and for each vulnerable code segment, generate a replacement code segment to replace the vulnerable code segment in the code sample;

[0063] S5. According to the behavior graph, determine the code behavior corresponding to each vulnerable code segment, search for other methods that contain this code behavior and have not been traversed, and calculate a first adjustment value of the value coefficient of the untraversed method; according to the call chain, determine the relationship between the untraversed method and the current method, and calculate a second adjustment value of the value coefficient of the untraversed method;

[0064] S6. Loop through the above steps S3-S5 until the code sample is successfully converted into an adversarial sample or all methods have been traversed.

[0065] S7. If all methods have been traversed and the code sample has not been converted into an adversarial sample, the ordinary code segment lists of all methods are merged and sorted according to the influence factors of the code segments to generate a secondary processing code segment list, and the code segments in the secondary processing code segment list are replaced in sequence until the code sample is converted into an adversarial sample, or all code segments are replaced.

[0066] This method dynamically adjusts the priority of each method in the traversal so that functions that are more likely to contain vulnerable code segments are searched first, thereby reducing the number of model accesses during the replacement point search process and reducing the time overhead of the search.

[0067] Preferably, in step S1, for the code sample to be processed, generating a corresponding code behavior graph, and abstracting the call chain between methods from the code behavior graph includes:

[0068] The code behavior diagram of the code sample is as follows:

[0069]

[0070] For the code behavior graph, identify the method calling behavior and generate the calling relationship L ij ;

[0071] L ij =(F i , F j )

[0072] Where G represents the code behavior graph of the code sample, n is the number of methods contained in the code sample, and BL i Represents a list of code actions for any method, F i F is the initiating method of the identified method call behavior. j The method being called.

[0073] Specifically, suppose the code sample contains n different methods F i . For any method F i , define a lexical analyzer to perform lexical analysis on it, decomposing the source code into a lexical sequence T consisting of two tuples (category code, symbol) i ;

[0074] In this embodiment, the lexical sequence corresponding to the code sample to be processed is as follows:

[0075] [(3,int),(24,func1),(3,int),(34,var1),..,(7,if),(43,x),...]

[0076] Among them, symbols such as "int" and "func1" respectively represent symbols such as variable types, variable names, and operators in the code sample, which are extracted and classified by the lexical analyzer for subsequent operations.

[0077] For the lexical sequence T i , define a syntax analyzer that groups the tuples in the sequence into code lines and identifies the code behaviors that may be contained in each code line, including but not limited to references to a global variable and calls to other methods. i All code behaviors identified in , using two-tuple (line number, code behavior) to store them as code behavior list BL i . List the code behaviors corresponding to all methods BL i Add together to get the code behavior graph of the code sample;

[0078]

[0079] In the above formula, G represents the code behavior graph of the code sample, n is the number of methods contained in the code sample, and BL i Represents a list of code actions for any method.

[0080] In this embodiment, the lexical sequence of the code sample is converted into the following list according to the above method:

[0081] [(1, library function call), (2, global variable reference), ..., (24, global variable reference), ...]

[0082] For the code behavior graph, identify the method calling behavior and generate the calling relationship L ij ;

[0083] L ij =(F i , F j )

[0084] Among them, F i F is the initiating method of the identified method call behavior. j is the called method. The call chain corresponding to the code sample is all the call relationships L generated by the code behavior graph. ij A collection of .

[0085] In this embodiment, the generated call chain is shown in Table 1 below:

[0086] Table 1

[0087]

[0088]

[0089] Preferably, the allocating different initial value coefficients in step S2 includes:

[0090] For any method F i , identify the call chain level l according to the call chain i , the call chain level l i To satisfy the following formula i The minimum value of

[0091]

[0092] Identify calling method F based on calling chain i The number of methods is recorded as the number of calls n i ; According to its corresponding call chain level l i and the number of calls n i , assigning its initial value coefficient

[0093]

[0094] Among them, a and l b Respectively represent method F a and F b The call chain level, K is the call chain, L is the ij is the calling relationship; n i , l i Method F i The number of times it is called and the call chain level it is in, ∑n represents the number of times it is called and the call chain level it is in, and ... i The sum of the number of times all methods at the same call chain level are called, and α is the adjustment parameter.

[0095] Specifically, for any method F in the code sample i According to the call chain, different initial value coefficients are assigned according to the number of times the method is called and the level of the method in the call chain.

[0096] For any method F i , identify the call chain level l according to the call chain i , the call chain level l i When the following formula is satisfied, i The minimum value of

[0097]

[0098] Among them l a and l b Respectively represent method F a and F b The call chain level, K is the call chain, L is the ij This formula ensures that there is only a call relationship between a high-level call chain method and a low-level call chain method.

[0099] For any method F i , identify the number of methods that call the method according to the call chain, and record it as the number of calls n i The number of times n is called i Indicates calling method F i The number of methods, not the called method F i the number of occurrences in these methods;

[0100] For any method F i , according to its corresponding call chain level l i and the number of calls n i , assigning its initial value coefficient

[0101]

[0102] where n i , l i Method F i The number of times it is called and the call chain level it is in, ∑n represents the number of times it is called and the call chain level it is in, and ... i The sum of the number of times all methods at the same call chain level are called, and α is the adjustment parameter.

[0103] In this embodiment, the adjustment coefficient α is assumed to be 1, and the initial value coefficients of all methods are shown in Table 2 below:

[0104] Table 2

[0105] Method 1 Method 2 Method 3 ... Method 13 0.3 0.2 0.05 ... 0.133

[0106] Preferably, the step S3 of generating the calculation method value coefficient and the traversal priority of the current method includes:

[0107] For any method F i , the value coefficient V is obtained according to the following formula i ;

[0108]

[0109] Value coefficient V i Use the softmax function for normalization and generate method F iThe traversal priority P i ;

[0110]

[0111] in For method F i The initial value coefficient, γ i and δ i are the first adjustment value and the second adjustment value of its value coefficient, V i For method F i The value coefficient of n is the number of methods contained in the code sample, V j is the value coefficient of any method.

[0112] Specifically, see Figure 2 , according to the initial value coefficients of the current methods The first adjustment value of the value coefficient γ i and the second adjustment value of the value coefficient δ i , calculation method value coefficient V i , and normalize it using the softmax function to generate the traversal priority P of the method i ;

[0113] For any method F i , the value coefficient V is obtained according to the following formula i ;

[0114]

[0115] in For method F i The initial value coefficient, γ i and δ i They are the first and second adjustment values ​​of their value coefficients respectively, and the initial values ​​of the first and second adjustment values ​​are 0 and 1 respectively, and are calculated and updated in step S5.

[0116] Value coefficient V i Use the softmax function for normalization and generate method F i The traversal priority P i ;

[0117]

[0118] Where V i For method F i The value coefficient of n is the number of methods contained in the code sample Sample, V j is the value coefficient of any method.

[0119] Preferably, the step S4 of generating a replacement code segment to replace the vulnerable code segment in the code sample includes:

[0120] The similarity between the target code segment and all code segments in the replacement space is calculated according to the following formula, and the code segment with the highest similarity is selected as the replacement code segment;

[0121]

[0122] For any method F i , calculation method F i The total amount of confidence change in the model Δ i ;

[0123]

[0124] Among them, ||-|| is the distance norm, l is the length of the replacement space, c i is the target code segment, s k is any code segment in the replacement space; l is the length of the replacement space, Δ ij Replace any vulnerable code segment c in the space ij The amount of change in confidence caused.

[0125] Specifically, for the currently highest priority untraversed method F i , identify the vulnerable code segment list C and the normal code segment list N, and for each vulnerable code segment c i , generate a replacement code segment s i Replace c in the code sample i ;

[0126] Define an untuned pre-trained programming language model M to identify vulnerable code segments in code samples. The vulnerable code segments refer to code segments whose changes in their representation will cause significant changes in the output of the target model of the adversarial attack;

[0127] For the current priority P i The highest untraversed method F i , through transformations such as word segmentation and standardization, the original input sequence X = [x1, ..., x i , ..., x n ], the element x in the sequence i Indicates the legal model input corresponding to a certain code segment;

[0128] For the original input sequence X, use a mask [MASK] to replace any element x i , generates a masked input sequence The elements x replaced by the mask iare called masked elements; the original input sequence X and the mask input sequence Input model M, and get the corresponding model output sequence O and

[0129]

[0130] Among them i and o′ i They respectively represent the confidence of the model M for a certain prediction result of the original input sequence and the masked input sequence.

[0131] For the original input sequence X and the masked input sequence The corresponding output sequences O and The masked element x is calculated by the following formula i Impact Factor I i , the masked element refers to the element in the original input sequence that is replaced by the mask in step S4-3;

[0132]

[0133] where ||O|| and Represent the output sequence O and The distance paradigm;

[0134] Set an impact factor threshold I t , so that the code segment corresponding to the element with the impact factor greater than or equal to the threshold is a vulnerable code segment, otherwise it is a common code segment;

[0135]

[0136] where x i Representation method F i Corresponding to any element in the original input sequence, C represents method F i Corresponding vulnerable code segment list, N represents method F i The corresponding list of common code segments;

[0137] For the generated vulnerable code segment list C = [c1, ..., c i , ..., c n Each code segment in c i Perform word segmentation operation and generate the corresponding subword list H = [h1, ..., h i , ..., h q ], and input the subword list into the model M, so that the model generates a similar code segment list S = [s1, ..., s i , ..., s l ] as the replacement space and calculate the target code segment c iThe similarity with all code segments in the replacement space S, and the code segment with the highest similarity is selected as the replacement code segment;

[0138]

[0139] where ||·|| is the distance paradigm, l is the length of the replacement space, c i is the target code segment, s k Replace any code snippet in the space.

[0140] In this embodiment, taking the element "target_var" in the input sequence of method 1 as an example, its corresponding replacement list is shown in Table 3:

[0141] Table 3

[0142] Replace Space Similarity goal_var 0.87234 target_value 0.89654 dest_data 0.65302 ... ... mark_var 0.77439

[0143] The element "goal_var" with the highest similarity is used as a replacement for the corresponding element in the input sequence.

[0144] For any method F i , any code segment c in the vulnerable code segment list ij , respectively input the methods before and after being replaced into the model M, and use the formula for calculating the impact factor described in S4-4 to calculate the code segment c ij The change in the prediction confidence of model M is Δ ij ; Finally, add up the confidence changes caused by all vulnerable code segments to get method F i The total amount of confidence change in the model Δ i ;

[0145]

[0146] Where l is the length of the replacement space, Δ ij Replace any code segment c in the space ij The amount of change in confidence caused.

[0147] In this embodiment, the change in the model prediction confidence caused by each vulnerable code segment in method 1 and the total change in the confidence of the model caused by method 1 are shown in Table 4:

[0148] Table 4

[0149] Vulnerable code snippet Confidence change target_var 0.03630 tmp_count 0.06494 subList 0.03958 ... ... lineCount 0.05543 total 0.24536

[0150] Preferably, the step S5 of calculating the first adjustment value of the value coefficient of the untraversed method and calculating the second adjustment value of the value coefficient of the untraversed method comprises:

[0151] For the current traversal method F i Any vulnerable code segment cij , and the corresponding vulnerable code behavior is recorded as b ij ; Search the behavior graph for the untraversed method F that contains the vulnerable code behavior k , calculate the first adjustment value of its value coefficient γ k ;

[0152]

[0153] According to the call chain, identify the method F that is currently traversed i Untraversed method F in the same call chain l , calculate the second adjustment value of its value coefficient δ l ;

[0154] δ l =ω·Δ i

[0155] Among them, q is the untraversed method F k In the method F that contains the current traversal i Searched vulnerable code behavior b ij The number of ij is the confidence change caused by the jth vulnerable code behavior, ω is the weight coefficient, Δ i The method F currently being traversed i The total change in confidence in the model.

[0156] Specifically, according to the behavior graph, determine each vulnerable code segment c i Corresponding code behavior, search for other methods that contain this code behavior and have not been traversed, and calculate the first adjustment value γ of the value coefficient of these methods i ; In addition, according to the call chain, determine the untraversed method and the current method F i The relationship between these methods is used to calculate the value coefficient of the second adjustment value δ i ;

[0157] For the current traversal method F i Any vulnerable code segment c ij , and the corresponding vulnerable code behavior is recorded as b ij ; Search the behavior graph for the untraversed method F that contains the vulnerable code behavior k , calculate the first adjustment value of its value coefficient γ k ;

[0158]

[0159] Where q is the untraversed method F k In the method F that contains the current traversal i Searched vulnerable code behavior b ij The number ofij is the confidence change caused by the jth vulnerable code behavior.

[0160] In this embodiment, according to the change in the model prediction confidence by method 1 and the code behavior of each code segment, taking method 2 as an example, the first adjustment value of its value coefficient is obtained as shown in the following Table 5:

[0161] Table 5

[0162] Code Behavior Confidence change Value coefficient first adjustment value Reference the global variable subList 0.03958 1.4857 Call library function basefunc() 0.02359 1.2668

[0163] It is not difficult to find that the first adjustment value of the value coefficient is much larger than the initial value coefficient and the second adjustment value of the value coefficient. This is because the fragile code behavior is an intuitive reflection of the code vulnerability, and the call chain position plays an auxiliary role in the search for the fragile code segment, so it needs to be distinguished numerically.

[0164] According to the call chain, identify the method F that is currently traversed i Untraversed method F in the same call chain l , calculate the second adjustment value of its value coefficient δ l ;

[0165] δ l =ω·Δ i

[0166] Where ω is the weight coefficient, Δ i The method F currently being traversed i The total change in confidence in the model.

[0167] In this embodiment, ω=1 is assumed, and according to the change in confidence of the model by method 1 and its position in the call chain, the second adjustment values ​​of the value coefficients of other methods are obtained as shown in Table 6 below:

[0168] Table 6

[0169] Method No. Second adjustment value of value coefficient 3 0.24536 5 0.24536

[0170] The above steps S3-S5 are executed in a loop until the code sample is successfully converted into an adversarial sample or all methods have been traversed, and the conversion of the code sample into the adversarial sample is based on whether the predicted label of the sample output by the target model of the adversarial attack changes.

[0171] Preferably, the step S7 of sorting the code segments according to their impact factors to generate a secondary processing code segment list includes:

[0172] The masked element x is calculated by the following formula i Impact Factor I i :

[0173]

[0174] Merge all methods F in the code sample i Corresponding common code segment list N i , sort the code segments according to the impact factors and generate a secondary processing code segment list N total ;

[0175]

[0176] Among them, among them ||O|| and Represent the output sequence O and The distance paradigm, O and For the original input sequence X and the masked input sequence After inputting the model, the model output sequence is obtained respectively; N i Represents any method F i The corresponding list of common code segments, n represents the number of methods contained in the code sample.

[0177] Specifically, if all methods have been traversed and the code samples have not been converted into adversarial samples, the ordinary code segment lists N of all methods are merged and sorted according to the influence factors of the code segments to generate the secondary processing code segment list N total , replace the code snippets in the list one by one until the code sample is converted into an adversarial sample, or all code snippets are replaced.

[0178] Merge all methods F in the code sample i Corresponding common code segment list N i , and sort the code segments according to the impact factors obtained in step S4-4 to generate a secondary processing code segment list N total ;

[0179]

[0180] Where N i Represents any method F i The corresponding list of common code segments, n represents the number of methods contained in the code sample.

[0181] For the secondary processing code segment list N total For each code segment in, the same operations as steps S4-S6 are performed in sequence, and a replacement code segment is selected for replacement until the code sample is converted into an adversarial sample, or all code segments are replaced.

[0182] In this embodiment, the second prediction confidence of the model is set to 0.63424, and the change in the first prediction confidence of the model before and after the replacement of each code segment in the secondary processing code segment list is shown in Table 7 below:

[0183] Table 7

[0184]

[0185]

[0186] According to the data in the table, when code segment 3 is replaced, the first prediction confidence of the model is lower than the second prediction confidence, which causes the model's prediction result for the code sample to change, that is, the adversarial sample is successfully generated. The process shown in Table 7 is the situation when the search method degenerates, which does not happen frequently in actual scenarios. As long as the model's prediction result changes during the search process, the generation of the adversarial sample is completed. Here, the complete search method execution process is demonstrated, so the possible degradation situation is shown.

[0187] This embodiment uses code call chains and behavior graphs to visualize code behaviors and calling relationships between methods, and dynamically adjusts the priority of each method in the traversal by acquiring knowledge from the traversal process, so that functions that are more likely to contain vulnerable code segments are searched first, thereby reducing the number of model accesses during the replacement point search process and reducing the time overhead of the search.

[0188] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. All equivalent structural changes made by using the contents of the present invention specification and drawings under the concept of the present invention, or directly / indirectly applied in other related technical fields are included in the patent protection scope of the present invention.

Claims

1. A vulnerable code segment search method for generating adversarial samples, characterized in that: The method comprises the following steps: S1. Generate a corresponding code behavior graph for the code sample to be processed, and abstract the call chain between methods from the code behavior graph; wherein the code behavior graph is a code representation form that describes the execution process and behavior of the code sample, and includes the code behavior of the code sample, and the code behavior is the dynamic behavior displayed by the code during operation; the method is the code used to perform a specific task or operation in the code, and there is a call relationship between them, and the call chain is a chain composed of a series of method calls, which represents the control flow when the code is executed; S2. Allocate different initial value coefficients to any current method in the code sample according to the call chain, the number of times the current method is called, and the level of the current method in the call chain; S3, calculating the method value coefficient according to the initial value coefficient, the first adjustment value of the value coefficient and the second adjustment value of the value coefficient of each current method, and normalizing it using the softmax function to generate the traversal priority of the current method; Wherein, the traversal priority of the current method generated in step S3 includes: For any method F i , the value coefficient V is obtained according to the following formula i ; Value coefficient V i Use the softmax function for normalization and generate method F i The traversal priority P i ; in For method F i The initial value coefficient, γ i and δ i are the first adjustment value and the second adjustment value of its value coefficient, V i For method F i The value coefficient of n is the number of methods contained in the code sample, V j is the value coefficient of any method; S4. For the untraversed method with the highest current priority, identify a vulnerable code segment list and a common code segment list therein, and for each vulnerable code segment, generate a replacement code segment to replace the vulnerable code segment in the code sample; S5. According to the behavior graph, determine the code behavior corresponding to each vulnerable code segment, search for other methods that contain this code behavior and have not been traversed, and calculate a first adjustment value of the value coefficient of the untraversed method; according to the call chain, determine the relationship between the untraversed method and the current method, and calculate a second adjustment value of the value coefficient of the untraversed method; S6. Loop through the above steps S3-S5 until the code sample is successfully converted into an adversarial sample or all methods have been traversed. S7. If all methods have been traversed and the code sample has not been converted into an adversarial sample, the ordinary code segment lists of all methods are merged and sorted according to the influence factors of the code segments to generate a secondary processing code segment list, and the code segments in the secondary processing code segment list are replaced in sequence until the code sample is converted into an adversarial sample, or all code segments are replaced.

2. The method according to claim 1, characterized in that In step S1, for the code sample to be processed, a corresponding code behavior graph is generated, and the call chain between methods is abstracted from the code behavior graph, including: The code behavior diagram of the code sample is as follows: For the code behavior graph, identify the method calling behavior and generate the calling relationship L ij ; L ij =(F i ,F j ) Where G represents the code behavior graph of the code sample, n is the number of methods contained in the code sample, and BL i Represents a list of code actions for any method, F i F is the initiating method of the identified method call behavior. j The method being called.

3. The method according to claim 1, characterized in that The allocation of different initial value coefficients in step S2 includes: For any method F i , identify the call chain level l according to the call chain i , the call chain level l i To satisfy the following formula i The minimum value of Identify calling method F based on calling chain i The number of methods is recorded as the number of calls n i ; According to its corresponding call chain level l i and the number of calls n i , assigning its initial value coefficient Among them, a and l b Respectively represent method F a and F b The call chain level, K is the call chain, L is the ij is the calling relationship; n i , l i Method F i The number of times it is called and the call chain level it is in, ∑n represents the number of times it is called and the call chain level it is in, and ... i The sum of the number of times all methods at the same call chain level are called, and α is the adjustment parameter.

4. The method according to claim 1, characterized in that: The step S4 of generating a replacement code segment to replace the vulnerable code segment in the code sample includes: The similarity between the target code segment and all code segments in the replacement space is calculated according to the following formula, and the code segment with the highest similarity is selected as the replacement code segment; For any method F i , calculation method F i The total amount of confidence change in the model Δ i ; Among them, ||·|| is the distance norm, l is the length of the replacement space, c i is the target code segment, s k is any code segment in the replacement space; l is the length of the replacement space, Δ ij Replace any vulnerable code segment c in the space ij The amount of change in confidence caused.

5. The method according to claim 1, characterized in that The step S5 of calculating the first adjustment value of the value coefficient of the untraversed method and calculating the second adjustment value of the value coefficient of the untraversed method includes: For the current traversal method F i Any vulnerable code segment c ij , and the corresponding vulnerable code behavior is recorded as b ij ; Search the behavior graph for the untraversed method F that contains the vulnerable code behavior k , calculate the first adjustment value of its value coefficient γ k ; According to the call chain, identify the method F that is currently traversed i Untraversed method F in the same call chain l , calculate the second adjustment value of its value coefficient δ l ; d l =ω·D i Among them, q is the untraversed method F k In the method F that contains the current traversal i Searched vulnerable code behavior b ij The number of ij is the confidence change caused by the jth vulnerable code behavior, ω is the weight coefficient, Δ i The method F currently being traversed i The total change in confidence in the model.

6. The method according to claim 1, characterized in that The step S7 of sorting the code segments according to their impact factors to generate a secondary processing code segment list includes: The masked element x is calculated by the following formula i Impact Factor I i : Merge all methods F in the code sample i Corresponding common code segment list N i , sort the code segments according to the impact factors and generate a secondary processing code segment list N total ; Among them, ||O|| and Represent the output sequence O and The distance paradigm, O and For the original input sequence X and the masked input sequence After inputting the model, the model output sequence is obtained respectively; N i Represents any method F i The corresponding list of common code segments, n represents the number of methods contained in the code sample.

Images