Code risk detection method and device, electronic equipment and computer storage medium

Abstract

The specification discloses a code risk detection method and device, electronic equipment and computer storage medium, the method comprising: obtaining a code risk detection result for source code, determining the key risk code corresponding to the code risk detection result; generating a taint propagation analysis prompt word and a key risk code prompt word based on the key risk code, then constructing a target prompt word based on the key risk code prompt word and the taint propagation analysis prompt word, and finally determining a taint propagation analysis result based on the target prompt word using a target large language model, thereby updating the code risk detection result based on the taint propagation analysis result to obtain a target code risk detection result.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of computer technology, and particularly relates to a code risk detection method and device, electronic equipment and computer storage medium. BACKGROUND

[0002] In recent years, with the intensification of network security risks, code security problems have been paid more and more attention. In the process of security risk detection of the code, in order to avoid the risk of missing report, a large number of risk false positives will be generated, which will make the security engineers spend a lot of time to check the risk. SUMMARY

[0003] The present specification provides a code risk detection method, device, electronic equipment and computer storage medium, and the technical solution is as follows:

[0004] In a first aspect, the present specification provides a code risk detection method, and the method comprises:

[0005] Obtaining a code risk detection result for source code, determining a key risk code corresponding to the code risk detection result;

[0006] Generating a taint propagation analysis prompt word based on the key risk code, and generating a key risk code prompt word based on the key risk code;

[0007] Constructing a target prompt word based on the key risk code prompt word and the taint propagation analysis prompt word;

[0008] Determining a taint propagation analysis result based on the target prompt word using a target large language model, and updating the code risk detection result based on the taint propagation analysis result to obtain a target code risk detection result.

[0009] In a second aspect, the present specification provides a code risk detection device, and the device comprises:

[0010] An acquisition module adapted to acquire a code risk detection result for source code, and determine a key risk code corresponding to the code risk detection result;

[0011] A generation module adapted to generate a taint propagation analysis prompt word based on the key risk code, and generate a key risk code prompt word based on the key risk code;

[0012] A construction module adapted to construct a target prompt word based on the key risk code prompt word and the taint propagation analysis prompt word;

[0013] The updating module is adapted to determine a taint propagation analysis result based on the target prompt word by using a target large language model, and update the code risk detection result based on the taint propagation analysis result to obtain a target code risk detection result.

[0014] In a third aspect, the present specification provides a computer storage medium storing a plurality of instructions, which are adapted to be loaded and executed by a processor to perform the method steps described above.

[0015] In a fourth aspect, the present specification provides an electronic device, which can include a processor and a memory; wherein the memory stores a computer program, which is adapted to be loaded and executed by the processor to perform the method steps described above.

[0016] In a fifth aspect, the present specification provides a computer program product storing at least one instruction, which is loaded and executed by a processor to perform the method steps of any one of the above.

[0017] The technical solutions provided by some embodiments of the present specification have at least the following beneficial effects: by obtaining the code risk detection result corresponding to the source code, then determining the key risk code corresponding to the code risk detection result, the redundant and useless code compared with the code risk detection result is eliminated, then the key risk code prompt word is constructed based on the key risk code, thereby avoiding the interference of other redundant and useless code on the target large language model when the target prompt word is constructed subsequently, and reducing the input of the target large language model subsequently.

[0018] At the same time, the taint propagation analysis prompt word for the key risk code is determined, the target prompt word of the target large language model is constructed by the key code prompt word and the taint propagation analysis prompt word, thereby effectively improving the understanding accuracy of the target large language model for the target prompt word and the processing efficiency of the taint propagation analysis, finally the risk detection result is updated based on the obtained taint propagation result, and the false positives of the risk detection result are screened out, thereby solving the problem that in the process of detecting the security risk of the code, in order to avoid the false negatives of the risk, a large number of risk false positives are often generated, and the security engineer needs to spend a lot of time to check the risk. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the present specification or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only some embodiments of the present specification, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0020] Figure 1A scenario schematic diagram of a code risk detection system provided for the present specification;

[0021] Figure 2 A flow schematic diagram of a code risk detection method provided for the present specification embodiment;

[0022] Figure 3 A flow schematic diagram of determining a key risk code provided for the present specification embodiment;

[0023] Figure 4 Another flow schematic diagram of determining a key risk code provided for the present specification embodiment;

[0024] Figure 5 A flow schematic diagram of determining a taint analysis hint word provided for the present specification embodiment;

[0025] Figure 6 A flow schematic diagram of constructing a target hint word provided for the present specification embodiment;

[0026] Figure 7 A flow schematic diagram of constructing a code priori knowledge hint word provided for the present specification embodiment;

[0027] Figure 8 A flow schematic diagram of determining a taint analysis result provided for the present specification embodiment;

[0028] Figure 9 A flow schematic diagram of determining a reference hint word corresponding to a reference function provided for the present specification embodiment;

[0029] Figure 10 A code risk detection apparatus provided for the present specification embodiment;

[0030] Figure 11 A structure schematic diagram of an electronic device provided for the present specification;

[0031] Figure 12 A structure schematic diagram of an operating system and user space provided for the present specification;

[0032] Figure 13 For Figure 12 An architecture diagram of an Android operating system;

[0033] Figure 14 For Figure 12 An architecture diagram of an IOS operating system. DETAILED DESCRIPTION

[0034] The technical solutions in the specification will be described clearly and completely in the specification below in combination with the drawings in the specification. Obviously, the described embodiments are only some of the embodiments in the specification, not all the embodiments. Based on the embodiments in the specification, all the other embodiments obtained by those skilled in the art without creative work belong to the protection scope of the specification.

[0035] In the description of the specification, it should be understood that the terms "first", "second" and the like are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance. In the description of the specification, it should be noted that, unless otherwise explicitly specified and limited, "including" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to the process, method, product or device. The specific meaning of the above terms in the specification can be understood by the person skilled in the art according to the specific circumstances. In addition, in the description of the specification, "multiple" means two or more, unless otherwise specified. The association relationship of the associated objects is described, which means that there can be three relationships, for example, A and / or B can mean that A exists alone, A and B exist together, and B exists alone. The character " / " generally represents that the associated objects before and after are a "or" relationship.

[0036] The specification will be described in detail below in combination with specific embodiments.

[0037] Please refer to Figure 1 , Figure 1 A scene schematic diagram of a code risk detection system provided by the specification. As shown in Figure 1 , the code risk detection system can at least include a client cluster and a service platform 100.

[0038] The client cluster can include at least one client, as Figure 1 shown, specifically including client 1 corresponding to user 1, client 2 corresponding to user 2,..., client n corresponding to user n, n is an integer greater than 0.

[0039] The clients in the client cluster can be electronic devices with communication functions, including but not limited to wearable devices, handheld devices, personal computers, tablet computers, vehicle-mounted devices, smart phones, computing devices, or other processing devices connected to wireless modems, etc. Electronic devices can be called different names in different networks, such as user equipment, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device, cellular phone, cordless phone, personal digital assistant (PDA), electronic device in 5G network or future evolution network, etc.

[0040] The service platform 100 can be a separate server device, such as a rack-mounted, blade, tower, or cabinet server device, or a hardware device with strong computing power, such as a workstation, a mainframe computer, etc. It can also be a server cluster composed of multiple servers. The servers in the service cluster can be composed in a symmetrical manner, where each server is functionally and positionally equivalent in the transaction link, and each server can independently provide services externally. The independent service can be understood as not requiring the assistance of another server.

[0041] In one or more embodiments of the present specification, the service platform 100 can establish a communication connection with at least one client in the client cluster, and complete the interaction of data in the code risk detection process based on the communication connection, such as online transaction data interaction. For example, the service platform 100 can implement content recommendation to the client based on the target neural network model obtained by the code risk detection method of the present specification. For another example, the service platform 100 can obtain training data, such as first training data, from the client.

[0042] It should be noted that the service platform 100 and at least one client in the client cluster establish a communication connection through a network for interactive communication, where the network can be a wireless network or a wired network. The wireless network includes but is not limited to a cellular network, a wireless local area network, an infrared network or a Bluetooth network. The wired network includes but is not limited to an Ethernet, a universal serial bus (USB) or a controller area network. In one or more embodiments of the specification, technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML) and the like are used to represent data (such as target compressed packages) exchanged through the network. In addition, all or some links can be encrypted using conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPsec) and the like. In other embodiments, custom and / or dedicated data communication technologies can be used instead of or in addition to the above data communication technologies.

[0043] The code risk detection system embodiments provided by the specification belong to the same concept as the code risk detection method in one or more embodiments. The execution subject corresponding to the code risk detection method involved in one or more embodiments of the specification can be the service platform 100 described above. The execution subject corresponding to the code risk detection method involved in one or more embodiments of the specification can also be the electronic device corresponding to the client, which is determined based on the actual application environment. The implementation process of the code risk detection system embodiment can be seen from the method embodiments described below, which will not be described here.

[0044] Based on Figure 1 The scene schematic diagram shown in the specification will be described in detail below.

[0045] Please refer to Figure 2 , Figure 2 The flowchart of the code risk detection method provided by the embodiment of the specification. The method can be implemented by relying on a computer program and can run on a code risk detection device based on the von Neumann architecture. The computer program can be integrated in an application or run as an independent tool application. The code risk detection device can be a service platform.

[0046] Specifically, the code risk detection method comprises the following steps.

[0047] S202: Obtain a code risk detection result for the source code, and determine key risk code corresponding to the code risk detection result.

[0048] Optionally, obtaining the code risk detection result for the source code comprises the following steps.

[0049] The source code is subjected to code risk detection to obtain the code risk detection result for the source code.

[0050] The code risk detection comprises but is not limited to program static analysis. The program static analysis refers to a method of program analysis without running the program. Generally, in the scenario of security risk, the static program analysis adopts a data flow / pollution analysis algorithm to perform program analysis, calculate the relationship between program variables between functions and within functions, and finally determine whether there is a security risk in the code under a specific condition.

[0051] Optionally, obtaining the code risk detection result for the source code comprises the following steps.

[0052] The source code is subjected to risk detection based on a code risk detection model to obtain the code risk detection result for the source code. The code risk detection model can be obtained based on an initial code risk detection model through model training of sample code and a reference risk label corresponding to the sample code.

[0053] The source code is input into the code risk detection model, and the source code is processed by the code risk detection model to obtain the code risk detection result.

[0054] Generally, the code risk detection result for the source code may have false positives in order to ensure that potential security risks are not missed, and therefore, the code risk detection result needs to be screened to eliminate the detection result corresponding to the false positives.

[0055] The code risk detection result generally refers to risk function call information of one or more possible security risk vulnerabilities of the source code. Since the function code corresponding to the code risk detection result is generally the entire function code of all risk functions in the risk function call information, not all codes in the function code of the risk function will cause the function to become a risk function, and therefore, the codes in each risk function need to be subjected to useless code filtering processing to determine the key risk code that causes each function to become a risk function.

[0056] S204: Generating a pollution transfer analysis prompt word based on the key risk code, and generating a key risk code prompt word based on the key risk code.

[0057] After determining the whole set of critical risk codes of the source code, in order to improve the processing efficiency of the whole set of critical risk codes, the whole set of critical risk codes can be divided according to the functions corresponding to the whole set of critical risk codes, for example, the critical risk codes corresponding to one, two or more functions are divided into a group, thereby obtaining a plurality of sets of critical risk code sets corresponding to the whole set of critical risk codes. Of course, the whole set of critical risk codes can also be divided into a group.

[0058] Therefore, when generating the taint propagation analysis prompt word and the critical risk code prompt word based on the critical risk code, the taint propagation analysis prompt word and the critical risk code prompt word can be generated based on the whole set of critical risk codes; or the taint propagation analysis prompt word and the critical risk code prompt word corresponding to each set of critical risk code sets can be generated based on the plurality of sets of critical risk code sets. It should be understood that each set of critical risk code sets can correspond to one taint propagation analysis prompt word and one critical risk code prompt word.

[0059] Here, the taint propagation can refer to the transmission process of the data flow of the taint variable in the source code, and the taint variable can be untrusted data or confidential data in the function. The taint propagation analysis prompt word is used to instruct the target large language model to perform taint propagation analysis on the critical risk code corresponding to the taint propagation analysis prompt word.

[0060] S206: Constructing a target prompt word based on the critical risk code prompt word and the taint propagation analysis prompt word.

[0061] After obtaining the critical risk code prompt word and the taint propagation analysis prompt word, the critical risk code prompt word and the taint propagation analysis prompt word can be spliced according to a preset splicing rule to obtain a target prompt word. The preset splicing rule can be determined based on the target large language model. Here, each set of critical risk code sets corresponds to one target prompt word.

[0062] S208: Determining a taint propagation analysis result based on the target prompt word using the target large language model, and updating the code risk detection result based on the taint propagation analysis result to obtain a target code risk detection result.

[0063] After inputting the target prompt word into the target large language model, the target large language model extracts semantic information corresponding to the taint propagation analysis prompt word in the target prompt word, determines a taint propagation analysis task of the target large language model based on the extracted semantic information, and then performs taint propagation analysis on the critical risk code corresponding to the critical risk code prompt word in the target prompt word based on the obtained taint propagation analysis task, thereby obtaining a function taint propagation result for the critical risk code. Here, the target large language model is a language model composed of a neural network with many parameters, which is trained based on self-supervised learning or semi-supervised learning on a large amount of unlabeled text.

[0064] Afterwards, the target large language model performs taint propagation analysis on the key risk code in the source code based on the target prompt word in sequence to obtain a taint propagation analysis result, so as to determine whether the taint variable is successfully propagated in the key risk code corresponding to the source code.

[0065] When the taint variable is successfully propagated in the key risk code corresponding to the source code, it indicates that the code risk detection result for the source code has no false positives; when the taint variable is not successfully propagated in the key risk code corresponding to the source code, it indicates that the code risk detection result for the source code has false positives, and the code risk detection result is corrected and updated to eliminate false positives.

[0066] In the present specification, by obtaining the code risk detection result corresponding to the source code, the key risk code corresponding to the code risk detection result is then determined, so as to eliminate redundant useless code compared with the code risk detection result, and then the key risk code prompt word is constructed based on the key risk code, so as to avoid the interference of other redundant useless code on the target large language model when the target prompt word is constructed subsequently, and to reduce the input of the target large language model subsequently.

[0067] At the same time, the taint propagation analysis prompt word for the key risk code is determined, the target prompt word of the target large language model is constructed through the key code prompt word and the taint propagation analysis prompt word, so as to effectively improve the understanding accuracy of the target large language model for the target prompt word and the processing efficiency of the taint propagation analysis, and finally the risk detection result is updated based on the obtained taint propagation result, and the false positives of the risk detection result are investigated and screened, so as to solve the problem that in the process of detecting the security risk of the code, in order to avoid the false negatives of the risk, a large number of risk false positives are often generated, which makes the security engineers need to spend a lot of time to investigate the risk.

[0068] Please refer to Figure 3 , Figure 3 A flowchart for determining key risk code is provided for the embodiments of the present specification. Specifically: the key risk code corresponding to the code risk detection result is determined in S202, which includes:

[0069] S302: obtaining a risk function call link from the code risk detection result, determining a target function in the risk function call link and a function variable of the target function.

[0070] The risk function call link can be a function call link with a security risk. The function call link refers to a process of a series of function calls, that is, when a function is called, the calling of another function is triggered, and this process continues to form a calling chain, that is, a function call link. The function call link includes a function call process and functions related to the function call process. Of course, the function call link can also include the line number information of the function call point.

[0071] Therefore, the risk function call link can be understood as a function call link in which the tainted variable has the possibility of direct propagation to the tainted sink. The tainted sink represents a function site that directly produces a security-sensitive operation or leaks private data to the outside world. The security-sensitive operation usually refers to a violation of data integrity, that is, information loss, error or change occurs in the transmission, storage and processing of data, resulting in the authenticity and accuracy of the data being affected.

[0072] After obtaining the risk function call link from the code risk detection result, the function call relationship of the risk function call link is obtained, and the starting function in the risk function call link is determined. The starting function refers to the first called function in the risk function call link, and the starting function is the starting point of the entire risk function call link. The starting function in the risk function call link is taken as the target function, and the function variable of the target function is determined. The function variable refers to a variable used inside a function. During function call, the function variable can be passed to other functions as an input parameter of the function. It should be understood that since the risk function call link is obtained from the code risk detection result, the function variable corresponding to the starting function in the risk function call link is generally a tainted variable.

[0073] S304: Determine the key risk code of each risk function associated with the function variable from the risk function call link.

[0074] After obtaining the function variable of the target function, the risk function associated with the function variable of the target function is determined from the risk function call link, and the key risk code associated with the function variable of the target function in each risk function is determined. Here, the key risk code can be understood as the function statement code of the function related to the function variable of the target function.

[0075] For example, the risk function is function B, function B includes multiple lines of function code, such as the first line of function code a, the second line of function code b, and the third line of function code c. The second line of function code b is associated with the function variable of the target function, that is, the second line of function code b directly or indirectly calls the function variable of the target function. Therefore, the second line of function code b is the key risk code of function B for the function variable in the target function.

[0076] In the present specification, the target function and function variable of the risk function call link in the code risk detection result are determined, so as to determine the key risk code of each risk function associated with the function variable from the risk function call link through the function variable, so as to eliminate the redundant code in a single function compared with the function variable, and then construct the key risk code prompt word based on the key risk code, so as to prevent the interference of other redundant code on the target large language model, and also reduce the input of the subsequent target large language model.

[0077] In the embodiments provided in the present specification, the target code risk detection result is obtained by updating the code risk detection result based on the taint propagation analysis result in S208, comprising:

[0078] The type of the taint propagation analysis result is determined, and if the type of the taint propagation analysis result is the link taint propagation failure type, the target risk function call link corresponding to the taint propagation failure is removed from the code risk detection result.

[0079] By determining the type of the taint propagation analysis result of each risk function call link in the code risk detection result, it is determined whether each risk function call link is false information in the code risk detection result, and when the type of the taint propagation analysis result is the link taint propagation failure type, the target risk function call link corresponding to the taint propagation failure is removed from the code risk detection result; when the type of the taint propagation analysis result is the link taint propagation success type, the target risk function call link corresponding to the taint propagation success is retained in the code risk detection result.

[0080] Please refer to Figure 4 , Figure 4 Another flowchart for determining key risk code is provided for the embodiments of the present specification. Specifically: in S304, the key risk code of each risk function associated with the function variable is determined from the risk function call link, comprising:

[0081] S402: determining at least one risk function associated with the function variable in the risk function call link.

[0082] Wherein, the risk function call link is functionally split to obtain at least two calling functions corresponding to the risk function call link, and then one or more risk functions associated with the function variable are determined from the calling functions. Here, the number of risk functions is determined based on the number of calling functions associated with the function variable in the risk function call link.

[0083] Specifically, one or more risk functions associated with the function variable can be determined from the at least two calling functions corresponding to the risk function call link through the data flow direction information of the function variable.

[0084] S404: Find the code statements associated with the function variables from the function code statements of the risk functions to obtain the key risk codes corresponding to each risk function.

[0085] In one specific embodiment, when the function variables corresponding to the target function are filename and content, after finding the code statements associated with the function variables from the function code statements of a risk function, it is determined that the key codes corresponding to the risk function are "filepath = "pre_path" + filename" and "file_write(filepath, content)".

[0086] In one specific embodiment, when the function variables corresponding to the target function are filename and content, after finding the code statements associated with the function variables from the function code statements of a risk function, it is determined that the key codes corresponding to the risk function are "filepath = "pre_path" + filename" and "file_write(filepath, content)".

[0087] In this specification, at least one risk function associated with the function variables in the risk function call chain is determined by the function variables corresponding to the target function, and then the key codes of each risk function in the risk function call chain are determined by determining the key codes associated with the function variables in the function code statements of the risk function. In this embodiment, by determining the risk function associated with the function variables, the functions irrelevant to the function variables of the target function are filtered out, which can effectively reduce the model input of the subsequent target large language model. At the same time, by extracting the key codes associated with the function variables in each risk function, the useless codes in each risk function are further filtered out, thereby further reducing the model input of the subsequent target large language model, and effectively excluding the interference of other useless codes on the target large language model.

[0088] See Figure 5 , Figure 5 A flowchart for determining a taint propagation analysis prompt word is provided for the embodiments of this specification. Specifically, the taint propagation analysis prompt word is generated based on the key risk codes in S204, which includes:

[0089] S502: Determine the taint variables corresponding to the risk functions based on the code risk detection results.

[0090] Each risk function has its corresponding taint variable. It should be understood that the taint variable corresponding to each risk function can be from the previous risk function corresponding to the risk function in the taint propagation data flow, or from external input. Therefore, the taint propagation information can be determined based on the code risk detection results, thereby determining the taint variable corresponding to each risk function.

[0091] In the taint propagation process, the taint variable can change. Assuming that the initial taint variable in the risk function call link is W, when the taint variable is transmitted to the next risk function, the taint variable can become N, where N = W + 1. Therefore, based on the taint propagation information in the code risk detection result, the taint variable of the key code of each risk function can be determined. The taint propagation information can refer to the transmission information of the taint variable in the function call link.

[0092] In the risk function call link, the function taint propagation result of the current risk function can affect the function taint propagation result of the next risk function. Because the function taint propagation result of the current risk function affects the taint variable in the next risk function, the function taint propagation result of each risk function in the risk function call link needs to be determined based on the target large language model.

[0093] S504: Find the target sub-function corresponding to the end point code statement from the key risk code corresponding to the risk function.

[0094] After determining the key code corresponding to each risk function, the end point code statement in the key code corresponding to each risk function is determined. The end point code statement can refer to the target code statement that needs to be finally executed when the key code corresponding to the risk function is run. Then, the target code statement can be used as the target sub-function. The target sub-function is used for taint variable transmission between risk functions.

[0095] S506: Generate a taint propagation analysis prompt word for the key risk code based on the taint variable and the target sub-function.

[0096] The taint propagation analysis prompt word can be: judging whether the taint variable can be successfully transmitted to the target sub-function of the key risk code through the key risk code. Because the taint variable, the target sub-function and the key risk code of different risk functions can be different, different risk functions can correspond to different taint propagation analysis prompt words.

[0097] In some embodiments, the key risk code corresponding to the risk function func (filename, content) is { / / filepath = "pre_path" + filename; / / file_write (filepath, content); / / sink}, the taint variables of the risk function are filename and content, and the target sub-function of the risk function is the file_write function. The taint propagation analysis prompt word for the key risk code can be "the parameters of the current func function are filename and content, and filename and content are controllable. Please analyze from the key risk code whether the final taint of the parameters filename and content will reach the file_write function".

[0098] In the present specification, the taint variables corresponding to each risk function are determined by the code risk detection result, and the target sub-function for the taint variable transfer between each risk function is determined based on the key risk code corresponding to each risk function. Finally, the taint propagation analysis prompt word for the key risk code corresponding to each risk function is generated based on the taint variables corresponding to each risk function and the target sub-function corresponding to each risk function. By splitting the entire taint propagation process of the source code into the taint propagation process of a single risk function, the understanding of the target large language model is improved, and the input of the target large language model at a time is reduced.

[0099] Please refer to Figure 6 , Figure 6 A flowchart for constructing a target prompt word is proposed for the embodiments of the present specification. As shown in Figure 6 S206 constructs a target prompt word based on a key risk code prompt word and a taint propagation analysis prompt word, including:

[0100] S602: Construct a code priori knowledge prompt word for the risk function call chain, and construct an output specification prompt word.

[0101] The code priori knowledge prompt word is used to instruct the target large language model to model learning and understand the priori knowledge, wherein the priori knowledge includes a series of vulnerability codes and purification functions. The purification function is usually a function for cleaning or cleaning data or variables, which may involve deleting duplicates, processing errors, standardizing data formats, or performing other data cleaning and preparation related tasks.

[0102] By providing vulnerability codes and purification functions, the target large language model learns the existence of vulnerable codes and the taint variables of the vulnerable codes after passing through which purification functions will be eliminated, thereby improving the accuracy of the target large language model in eliminating false positive information in the code risk detection result.

[0103] The output specification prompt word is used to standardize the output of the target large language model, so that the output format of the target large language model is stable, thereby facilitating the generation of new prompt words based on the output of the target large language model. The output specification prompt word can be: "Please output the result in json format".

[0104] At this time, the taint propagation analysis result can be expressed in json format, which can be divided into two parts, the first part is used to answer whether the taint variable can reach the target function, and the second part is used to describe the taint source on the target function when the taint variable reaches the target function, that is, to perform taint analysis, thereby determining the function corresponding to the taint sink and the starting source function of the taint variable. The position of the taint variable corresponding to the function.

[0105] S604: Construct the target prompt word based on the code priori knowledge prompt word, the key risk code prompt word, the taint propagation analysis prompt word and the output specification prompt word.

[0106] After determining the code priori knowledge prompt word and the output specification prompt word, the code priori knowledge prompt word, the key risk code prompt word, the taint propagation analysis prompt word and the output specification prompt word are spliced to obtain the target prompt word.

[0107] The code priori knowledge prompt word is used to instruct the target large language model to model learning and understand the priori knowledge, so that the target large language model learns the code with vulnerabilities and the taint variable is eliminated after the code with vulnerabilities passes through the purification function, thereby improving the accuracy of the target large language model in eliminating false positive information in the code risk detection result. The key risk code prompt word is used to provide the key risk code to the target large language model for taint propagation risk, avoiding redundant code interference with the model understanding of the target large language model. The taint propagation analysis prompt word is used to instruct the target large language model to perform taint propagation analysis on the key risk code in the key risk code prompt word. The output specification prompt word is used to standardize the output of the target large language model, thereby facilitating the generation of new prompt words based on the output of the target large language model.

[0108] See Figure 7 , Figure 7 A flowchart for constructing a code priori knowledge prompt word is proposed for the embodiments of the present specification. As shown in Figure 7 , the code priori knowledge prompt word for the risk function call link is constructed in S602, including:

[0109] S702: Determine the risk type of the risk function in the risk function call link, and determine the code priori knowledge database information matched with the risk type.

[0110] The risk type of a risk function can be classified based on specific scenarios. For example, risk types can include the first risk type, the second risk type, and the third risk type.

[0111] Each risk type has its own corresponding code prior knowledge database, which may include a series of vulnerability codes and cleanup functions corresponding to that risk type. The code prior knowledge database information may include the location information of the code prior knowledge database.

[0112] S704: Generate code prior knowledge prompts for risky function call chains based on code prior knowledge database information.

[0113] After determining the code prior knowledge database information, code prior knowledge prompt words are generated using the code prior knowledge database information to indicate the target large language model and learn code prior knowledge based on the code prior knowledge database information.

[0114] Specifically, when the code prior knowledge database information is the location information of the code prior knowledge database, the code prior knowledge prompt can be: Please perform model learning on the code prior knowledge in the code prior knowledge database based on the location information of the code prior knowledge database.

[0115] In this specification, by determining the risk type of the risk function in the risk function call chain, the corresponding code prior knowledge database information is determined. This makes the generated code prior knowledge prompts more targeted, and makes the code prior knowledge for model learning of the target large language model more targeted, thereby improving the targeting and efficiency of code prior knowledge learning of the target large language model.

[0116] Please see Figure 8 , Figure 8 This is a schematic flowchart illustrating a method for determining the results of stain transfer analysis as described in an embodiment of this specification. Figure 8 As shown, in S208, the taint propagation analysis results are determined using a target large language model based on the target prompt words, including:

[0117] S802: Input the target prompt word into the target large language model.

[0118] The target hints must include at least critical risk code hints and taint propagation analysis hints; alternatively, the target hints may include code prior knowledge hints, critical risk code hints, taint propagation analysis hints, and output specification hints; or, the target hints may also include code prior knowledge hints, critical risk code hints, and taint propagation analysis hints; or, the target hints may also include critical risk code hints, taint propagation analysis hints, and output specification hints.

[0119] The specific descriptions of the code prior knowledge prompt word, the key risk code prompt word, the taint propagation analysis prompt word, and the output specification prompt word can be referred to the related descriptions of S604, and will not be repeated here.

[0120] S804: Obtain, by the target large language model, a risk function corresponding to the target prompt word and a risk function call link corresponding to the risk function, determine, based on the target prompt word, a taint variable corresponding to the risk function, and perform taint propagation analysis on a key risk code corresponding to the risk function based on the taint variable to obtain a function taint propagation analysis result for the risk function.

[0121] The target prompt word can be determined based on a key risk code corresponding to a single risk function, and therefore, the risk function corresponding to the target prompt word can be obtained based on the target large language model. The code risk detection result includes one or more risk function call links, and the risk function is contained in the corresponding risk function call link, and therefore, the corresponding risk function call link can be obtained from the code risk detection result based on the risk function.

[0122] The taint variable corresponding to the risk function can be determined through the code risk detection result, and it should be understood that the representation form of the taint variable may change in the taint propagation process, and therefore, each risk function has its corresponding taint variable.

[0123] Under the indication of the target prompt word, the target large language model first determines the taint variable corresponding to the risk function, and then performs taint propagation analysis on the key risk code corresponding to the risk function based on the taint variable, so as to determine whether the taint variable is successfully propagated in the key risk code corresponding to the risk function, and thereby obtain the function taint propagation analysis result.

[0124] S806: Determine, based on the risk function call link, whether there is a next reference function of the risk function.

[0125] The risk function call link includes the calling relationship between the risk functions, and therefore, whether there is a next reference function of the taint variable propagation of the risk function can be determined through the risk function call link.

[0126] S808: If not, generate a taint propagation analysis result based on the function taint propagation analysis result.

[0127] When it is determined based on the risk function call link that there is no next reference function of the risk function, it indicates that the risk function is the function where the taint variable is finally propagated, and therefore, the taint propagation analysis result can be determined based on the function taint propagation analysis result of the risk function.

[0128] That is, when the function taint propagation analysis result of the risk function is of the successful type, the taint propagation analysis result corresponds to successful link taint propagation; when the function taint propagation analysis result of the risk function is of the failed type, the taint propagation analysis result corresponds to failed link taint propagation.

[0129] S810: If there is, obtaining a reference prompt corresponding to the reference function associated with the function taint propagation analysis result, taking the reference prompt as the target prompt, taking the reference function as the risk function, and performing the step of inputting the target prompt into the target large language model.

[0130] In the risk function call link, the function taint propagation result of the current risk function can affect the function taint propagation result of the next reference function, because the function taint propagation result of the current risk function affects the taint variable of the next reference function, therefore, it is necessary to determine the function taint propagation result of each risk function in the risk function call link based on the target large language model.

[0131] Therefore, when it is determined based on the risk function call link that there is a next reference function of the risk function, it indicates that the risk function is not the function through which the taint variable is finally transmitted, then the next reference function of the risk function is determined, at this time, the reference prompt corresponding to the reference function associated with the function taint propagation analysis result is obtained, and similarly, the reference prompt can include the key risk code prompt and the taint propagation analysis prompt corresponding to the reference function; of course, the reference prompt can also include the code priori knowledge prompt, the key risk code prompt, the taint propagation analysis prompt and the output specification prompt corresponding to the reference function; or the reference prompt can also include the code priori knowledge prompt, the key risk code prompt and the taint propagation analysis prompt corresponding to the reference function; or the reference prompt can also include the key risk code prompt, the taint propagation analysis prompt and the output specification prompt corresponding to the reference function.

[0132] After obtaining the reference prompt corresponding to the reference function, the reference prompt corresponding to the reference function is taken as the target prompt, the reference function is taken as the risk function, and step S802 is performed until there is no next reference function of the risk function in the risk function call link, indicating that the target large language model has completed the taint propagation analysis on the risk function call link.

[0133] In this specification, the target large language model is used to perform taint propagation analysis on the risk functions in the risk function call link one by one, reducing the input of a single target large language model, improving the model understanding accuracy and model processing efficiency of the target large language model on the target prompt, so that the final taint propagation analysis result can be accurately and efficiently determined.

[0134] Please refer toFigure 9 , Figure 9 A flowchart for determining a reference prompt word corresponding to a reference function is proposed for an embodiment of the present specification. As shown in Figure 9 S810, the reference prompt word corresponding to the reference function associated with the function taint propagation analysis result is obtained, including:

[0135] S902: determine the reference taint variable corresponding to the reference function based on the function taint propagation analysis result, and find the reference sub-function corresponding to the end point code statement from the reference key risk code of the reference function.

[0136] The function taint propagation analysis result corresponding to the risk function can represent whether the taint variable is successfully propagated in the risk function. When the taint variable is successfully propagated in the risk function, when the taint variable is propagated to the reference function, the form of the taint variable may change due to the operation of the taint variable, so it is necessary to determine the reference taint variable corresponding to the reference function based on the function taint propagation analysis result.

[0137] Then, the key risk code corresponding to the reference function, i.e., the reference key risk code, is found, and the end point code statement is found from the reference key risk code, and the end point code statement is taken as the reference sub-function.

[0138] Optionally, in S902, the reference taint variable corresponding to the reference function is determined based on the function taint propagation analysis result, including:

[0139] Obtain the key risk code of the risk function corresponding to the function taint propagation analysis result, and determine the target sub-function corresponding to the end point code statement in the key risk code;

[0140] If the function taint propagation analysis result is a taint propagation success type, obtain the function output variable of the target sub-function, and take the function output variable as the reference taint variable corresponding to the reference function.

[0141] Wherein, the taint variable of the risk function is generally propagated to the next reference function through the target sub-function corresponding to the end point code statement in the key risk code. When the function taint propagation analysis result of the risk function is a taint propagation success type, it indicates that the function output variable of the target sub-function is the reference taint variable of the next reference function.

[0142] When the function taint propagation analysis result of the risk function is of the taint propagation failure type, it indicates that the function output variable of the target sub-function is not the reference taint variable of the next reference function. At this time, it can be determined based on the code risk detection result whether the next reference function has an additional reference taint variable. If the next reference function does not have an additional reference taint variable, the reference taint variable of the next reference function is empty. At this time, the function taint propagation analysis result of the next reference function is of the taint propagation failure type.

[0143] S904: generating a reference taint propagation analysis prompt word for the reference critical risk code based on the reference taint variable, the reference critical risk code and the reference sub-function.

[0144] The related description of step S904 is similar to that of step S506. For details, refer to step S506, which will not be described here.

[0145] S906: determining a reference prompt word corresponding to the reference function based on the reference taint propagation analysis prompt word.

[0146] The reference prompt word corresponding to the reference function is generated based on at least the reference taint propagation analysis prompt word. The reference prompt word can include a critical risk code prompt word corresponding to the reference function and a reference taint propagation analysis prompt word. Of course, the reference prompt word can also include a code priori knowledge prompt word corresponding to the reference function, a critical risk code prompt word, a reference taint propagation analysis prompt word and an output specification prompt word. Alternatively, the reference prompt word can also include a code priori knowledge prompt word corresponding to the reference function, a critical risk code prompt word and a reference taint propagation analysis prompt word. Alternatively, the reference prompt word can also include a critical risk code prompt word corresponding to the reference function, a reference taint propagation analysis prompt word and an output specification prompt word.

[0147] In this specification, the reference taint variable corresponding to the reference function is determined based on the function taint propagation analysis result of the risk function, the reference taint propagation analysis prompt word for the reference critical risk code is obtained, and the reference prompt word for the reference function is generated, thereby improving the accuracy of the reference prompt word corresponding to the reference function.

[0148] The following will be described in combination with Figure 10 , Figure 10 A code risk detection device is provided for the embodiments of the present specification. It should be noted that Figure 10 The code risk detection device shown in the code risk detection device is used to execute the method of the present specification Figures 1-9 The method of the embodiment shown in the present specification is only shown in the part related to the present specification for the convenience of description, and the specific technical details not disclosed are referred to the embodiment shown in the present specification Figures 1-9 .

[0149] Please refer to Figure 10 , which shows a structural schematic diagram of the code risk detection apparatus of the present specification. The code risk detection apparatus 1 can be realized by software, hardware or a combination of both to become all or part of a user terminal. According to some embodiments, the code risk detection apparatus 1 comprises an acquisition module 11, a generation module 12, a construction module 13 and an update module 14, which are specifically used for:

[0150] The acquisition module 11 is adapted to acquire a code risk detection result for source code, and determine a key risk code corresponding to the code risk detection result;

[0151] The generation module 12 is adapted to generate a taint propagation analysis prompt word based on the key risk code, and generate a key risk code prompt word based on the key risk code;

[0152] The construction module 13 is adapted to construct a target prompt word based on the key risk code prompt word and the taint propagation analysis prompt word;

[0153] The update module 14 is adapted to determine a taint propagation analysis result based on the target prompt word using a target large language model, and update the code risk detection result based on the taint propagation analysis result to obtain a target code risk detection result.

[0154] Optionally, the acquisition module 11 comprises:

[0155] An acquisition unit is adapted to acquire a risk function call link from the code risk detection result, determine a target function in the risk function call link and a function variable of the target function;

[0156] A determination unit is adapted to determine a key risk code of each risk function associated with the function variable from the risk function call link.

[0157] Optionally, the determination unit comprises:

[0158] A determination sub-unit is adapted to determine at least one risk function associated with the function variable in the risk function call link;

[0159] A search sub-unit is adapted to search for a code statement associated with the function variable from a function code statement of the risk function, and obtain the key risk code corresponding to each risk function.

[0160] Optionally, the generation module 12 comprises:

[0161] A taint variable determination unit is adapted to determine a taint variable corresponding to the risk function based on the code risk detection result;

[0162] A target sub-function search unit is adapted to search for a target sub-function corresponding to a terminal code statement from the key risk code corresponding to the risk function;

[0163] The generating unit is adapted to generate a taint propagation analysis prompt word for the key risk code based on the taint variable and the target sub-function.

[0164] Optionally, the constructing module 13 comprises:

[0165] The first constructing unit is adapted to construct a code priori knowledge prompt word for the risk function call link, and construct an output specification prompt word.

[0166] The second constructing unit is adapted to construct the target prompt word based on the code priori knowledge prompt word, the key risk code prompt word, the taint propagation analysis prompt word and the output specification prompt word.

[0167] Optionally, the first constructing unit comprises:

[0168] The code priori knowledge database information determining sub-unit is adapted to determine the risk type of the risk function in the risk function call link, and determine the code priori knowledge database information matched with the risk type.

[0169] The code priori knowledge prompt word generating unit is adapted to generate the code priori knowledge prompt word for the risk function call link based on the code priori knowledge database information.

[0170] Optionally, the updating module 14 comprises:

[0171] The input unit is adapted to input the target prompt word into the target large language model.

[0172] The function taint propagation analysis result determining unit is adapted to acquire the risk function corresponding to the target prompt word and the risk function call link corresponding to the risk function through the target large language model, determine the taint variable corresponding to the risk function based on the target prompt word, and perform taint propagation analysis on the key risk code corresponding to the risk function based on the taint variable, to obtain a function taint propagation analysis result for the risk function.

[0173] The judging unit is adapted to determine whether there is a next reference function under the risk function based on the risk function call link.

[0174] The taint propagation analysis result generating unit is adapted to generate a taint propagation analysis result based on the function taint propagation analysis result if there is not.

[0175] The executing unit is adapted to acquire a reference prompt word corresponding to a reference function associated with the function taint propagation analysis result if there is, take the reference prompt word as the target prompt word and take the reference function as the risk function, and perform the step of inputting the target prompt word into the target large language model.

[0176] Optionally, the executing unit comprises:

[0177] The reference subfunction finds sub-units, which is suitable for determining the reference taint variables corresponding to the reference function based on the function taint propagation analysis results, and for finding the reference subfunctions corresponding to the endpoint code statements from the reference critical risk codes corresponding to the reference function.

[0178] The reference taint propagation analysis hint generation subunit is suitable for generating reference taint propagation analysis hints for reference critical risk codes based on reference taint variables and reference subfunctions.

[0179] Reference prompt words determine sub-units, which is suitable for determining the reference prompt words corresponding to reference functions based on reference taint propagation analysis prompt words.

[0180] Optionally, the reference sub-function lookup sub-unit is suitable for obtaining the key risk code of the risk function corresponding to the function taint propagation analysis result, and determining the target sub-function corresponding to the endpoint code statement in the key risk code;

[0181] If the taint propagation analysis result is a taint propagation success type, then obtain the function output variable of the target subfunction and use the function output variable as the reference taint variable corresponding to the reference function.

[0182] Optionally, the update module 14 is adapted to determine the type of taint propagation analysis result. If the type of taint propagation analysis result is a link taint propagation failure type, the target risk function call link corresponding to the taint propagation failure is removed from the code risk detection result.

[0183] It should be noted that the code risk detection device provided in the above embodiments is only illustrated by the division of the above functional modules when executing the code risk detection method. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the code risk detection device and the code risk detection method embodiments provided in the above embodiments belong to the same concept, and the implementation process is detailed in the method embodiments, which will not be repeated here.

[0184] This specification also provides a computer storage medium capable of storing multiple instructions adapted to be loaded and executed by a processor as described above. Figures 1-9 The code risk detection method described in the illustrated embodiment can be found in the following documentation for its specific execution process. Figures 1-9 The specific details of the illustrated embodiments will not be elaborated here.

[0185] This specification also provides a computer program product that stores at least one instruction, said at least one instruction being loaded and executed by the processor as described above. Figures 1-9The code risk detection method of the embodiment shown, the specific implementation process can be seen from Figures 1-9 The specific description of the embodiment shown, here is not described.

[0186] Please refer to Figure 11 , Figure 11 A structural schematic diagram of an electronic device is provided in the present specification. The electronic device in the present specification can include one or more of the following components: a processor 110, a memory 120, an input device 130, an output device 140, and a bus 150. The processor 110, the memory 120, the input device 130, and the output device 140 can be connected through the bus 150.

[0187] The processor 110 can include one or more processing cores. The processor 110 connects various parts within the entire electronic device through various interfaces and lines, executes various functions of the electronic device 100 and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 120, and calling data stored in the memory 120. Alternatively, the processor 110 can be implemented in at least one of a hardware form of a digital signal processing (DSP), a field-programmable gate array (FPGA), and a programmable logic array (PLA). The processor 110 can integrate a combination of one or several of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used for processing wireless communication. It can be understood that the above-mentioned modem can also not be integrated into the processor 110, but can be realized by a separate communication chip.

[0188] The memory 120 can include random access memory (RAM) and can also include read-only memory (ROM). Optionally, the memory 120 includes a non-transitory computer-readable storage medium. The memory 120 can be used to store instructions, programs, codes, code sets, or instruction sets. The memory 120 can include a program storage area and a data storage area, where the program storage area can store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playing function, an image playing function, etc.), instructions for implementing each of the following method embodiments, etc., and the operating system can be an Android system, an IOS system developed by Apple Inc., a system developed based on the Android system, a system developed based on the IOS system, or other systems. The data storage area can also store data created by the electronic device during use, such as a phonebook, audio and video data, chat record data, etc.

[0189] Referring to Figure 12 as shown, Figure 12 The memory 120 can be divided into an operating system space and a user space, the operating system runs in the operating system space, and native and third-party applications run in the user space. In order to ensure that different third-party applications can achieve good running effect, the operating system allocates corresponding system resources to different third-party applications. However, there are also differences in the demand for system resources in different application scenarios in the same third-party application, for example, in the local resource loading scenario, the third-party application has a higher requirement for disk reading speed; in the animation rendering scenario, the third-party application has a higher requirement for GPU performance. However, the operating system and the third-party application are independent of each other, and the operating system often cannot timely perceive the current application scenario of the third-party application, resulting in that the operating system cannot perform targeted system resource adaptation according to the specific application scenario of the third-party application.

[0190] In order to enable the operating system to distinguish the specific application scenario of the third-party application, it is necessary to open up the data communication between the third-party application and the operating system, so that the operating system can obtain the current scenario information of the third-party application at any time, and then perform targeted system resource adaptation based on the current scenario.

[0191] Figure 13 For Figure 12 The architecture diagram of the Android operating system is taken as an example, the programs and data stored in the memory 120 are as followsFigure 13 As shown, the memory 120 can store the Linux kernel layer 320, the system runtime library layer 340, the application framework layer 360, and the application layer 380. The Linux kernel layer 320, system runtime library layer 340, and application framework layer 360 belong to the operating system space, while the application layer 380 belongs to the user space. The Linux kernel layer 320 provides low-level drivers for various hardware components of the electronic device, such as display drivers, audio drivers, camera drivers, Bluetooth drivers, Wi-Fi drivers, and power management. The system runtime library layer 340 provides support for key features of the Android system through several C / C++ libraries. For example, the SQLite library provides database support, the OpenGL / ES library provides 3D graphics support, and the Webkit library provides browser kernel support. The system runtime library layer 340 also provides the Android runtime library, which mainly provides core libraries that allow developers to write Android applications using the Java language. The Application Framework Layer 360 provides various APIs that may be used when building applications. Developers can also use these APIs to build their own applications, such as activity management, window management, view management, notification management, content provider, package management, call management, resource management, and location management. At least one application runs in the Application Layer 380. These applications can be native applications that come with the operating system, such as contacts, SMS, clock, and camera apps; or third-party applications developed by third-party developers, such as games, instant messaging, and photo editing apps.

[0192] Figure 14 for Figure 12 The architecture diagram of the iOS operating system, taking the iOS system as an example, shows the programs and data stored in memory 120 as follows: Figure 9As shown, the iOS system includes: Core OS layer 420, Core Services layer 440, Media layer 460, and Cocoa Touch Layer 480. Core OS layer 420 includes the operating system kernel, drivers, and low-level program frameworks. These low-level program frameworks provide hardware-level functionality for use by the program frameworks located in Core Services layer 440. Core Services layer 440 provides system services and / or program frameworks required by applications, such as Foundation framework, account framework, advertising framework, data storage framework, network connectivity framework, geolocation framework, motion framework, etc. Media layer 460 provides applications with audiovisual interfaces, such as interfaces related to graphics and images, audio technology, video technology, and wireless playback (AirPlay) interfaces. Cocoa Touch Layer 480 provides various commonly used interface-related frameworks for application development and is responsible for user touch interaction on electronic devices. Examples include local notification services, remote push services, advertising frameworks, game tool frameworks, message user interface (UI) frameworks, user interface UIKit frameworks, map frameworks, and so on.

[0193] exist Figure 14 The framework shown includes, but is not limited to, the base framework in the core service layer 440 and the UIKit framework in the touchable layer 480. The base framework provides many basic object classes and data types, offering the most basic system services to all applications, and is independent of the UI. The UIKit framework, on the other hand, provides a basic UI class library for creating touch-based user interfaces. iOS applications can use the UIKit framework to provide their UI, thus providing the application's infrastructure for building user interfaces, drawing, handling user interaction events, responding to gestures, and so on.

[0194] The methods and principles for implementing data communication between third-party applications and the operating system in the iOS system can be found in the Android system, and will not be repeated here.

[0195] The input device 130 is configured to receive input instructions or data, and the input device 130 includes but is not limited to a keyboard, a mouse, a camera, a microphone, or a touch device. The output device 140 is configured to output instructions or data, and the output device 140 includes but is not limited to a display device and a speaker. In an example, the input device 130 and the output device 140 can be combined, and the input device 130 and the output device 140 are a touch display screen configured to receive a touch operation of a user using a finger, a stylus, or any suitable object on or near the touch display screen, and display a user interface of each application. The touch display screen is usually arranged on a front panel of the electronic device. The touch display screen can be designed as a full screen, a curved screen, or a special-shaped screen. The touch display screen can also be designed as a combination of a full screen and a curved screen, a combination of a special-shaped screen and a curved screen, which is not limited in the present specification.

[0196] In addition, those skilled in the art can understand that the structure of the electronic device shown in the above-described drawings does not constitute a limitation on the electronic device, and the electronic device can include more or fewer components than those shown in the drawings, or combine certain components, or different component arrangements. For example, the electronic device further includes a radio frequency circuit, an input unit, a sensor, an audio circuit, a wireless fidelity (WiFi) module, a power supply, a Bluetooth module, and the like, which are not described herein.

[0197] In the present specification, the execution subject of each step can be the electronic device described above. Alternatively, the execution subject of each step is an operating system of the electronic device. The operating system can be an Android system, an IOS system, or other operating systems, which are not limited in the present specification.

[0198] The electronic device of the present specification can further have a display device installed thereon. The display device can be various devices capable of realizing a display function, such as a cathode ray tube display (CR), a light-emitting diode display (LED), an electronic ink screen, a liquid crystal display (LCD), a plasma display panel (PDP), and the like. A user can use the display device on the electronic device 101 to view displayed text, images, videos, and the like. The electronic device can be a smart phone, a tablet computer, a game device, an AR (Augmented Reality) device, a car, a data storage device, an audio playback device, a video playback device, a notebook computer, a desktop computing device, a wearable device such as an electronic watch, electronic glasses, an electronic helmet, an electronic bracelet, an electronic necklace, an electronic clothing, and the like.

[0199] In Figure 11 In the electronic device shown, the processor 110 can be configured to invoke a code risk detection program stored in the memory 120, and specifically perform the following operations:

[0200] Obtain a code risk detection result for the source code, and determine a key risk code corresponding to the code risk detection result;

[0201] Generate a taint propagation analysis prompt word based on the key risk code, and generate a key risk code prompt word based on the key risk code;

[0202] Construct a target prompt word based on the key risk code prompt word and the taint propagation analysis prompt word;

[0203] Determine a taint propagation analysis result based on the target prompt word using a target large language model, and update the code risk detection result based on the taint propagation analysis result to obtain a target code risk detection result.

[0204] Optionally, when the processor 110 determines the key risk code corresponding to the code risk detection result, it specifically performs:

[0205] Obtain a risk function call link from the code risk detection result, determine a target function in the risk function call link and a function variable of the target function;

[0206] Determine the key risk code of each risk function associated with the function variable from the risk function call link.

[0207] Optionally, when the processor 110 determines the key risk code of each risk function associated with the function variable from the risk function call link, it specifically performs:

[0208] Determine at least one risk function associated with the function variable in the risk function call link;

[0209] Find the code statement associated with the function variable from the function code statement of the risk function to obtain the key risk code corresponding to each risk function.

[0210] Optionally, when the processor 110 generates a taint propagation analysis prompt word based on the key risk code, it specifically performs:

[0211] Determine a taint variable corresponding to the risk function based on the code risk detection result;

[0212] Find a target sub-function corresponding to a terminal code statement from the key risk code corresponding to the risk function;

[0213] The key risk code is generated based on the taint variable and the target sub-function.

[0214] Optionally, when the processor 110 performs the construction of the target prompt word based on the key risk code prompt word and the taint propagation analysis prompt word, the processor 110 specifically performs:

[0215] Constructing a code priori knowledge prompt word for the risk function call link, and constructing an output specification prompt word.

[0216] The target prompt word is constructed based on the code priori knowledge prompt word, the key risk code prompt word, the taint propagation analysis prompt word, and the output specification prompt word.

[0217] Optionally, when the processor 110 performs the construction of the code priori knowledge prompt word for the risk function call link, the processor 110 specifically performs:

[0218] Determining the risk type of the risk function in the risk function call link, and determining the code priori knowledge database information matched with the risk type;

[0219] The code priori knowledge prompt word for the risk function call link is generated based on the code priori knowledge database information.

[0220] Optionally, when the processor 110 performs the determination of the taint propagation analysis result based on the target prompt word using the target large language model, the processor 110 specifically performs:

[0221] Inputting the target prompt word into the target large language model;

[0222] Obtaining the risk function corresponding to the target prompt word and the risk function call link corresponding to the risk function through the target large language model, determining the taint variable corresponding to the risk function based on the target prompt word, and performing taint propagation analysis on the key risk code corresponding to the risk function based on the taint variable, to obtain a function taint propagation analysis result for the risk function;

[0223] Determining whether there is a next reference function of the risk function based on the risk function call link;

[0224] If not, generating a taint propagation analysis result based on the function taint propagation analysis result;

[0225] If yes, obtaining a reference prompt word corresponding to a reference function associated with the function taint propagation analysis result, taking the reference prompt word as the target prompt word, taking the reference function as the risk function, and performing the step of inputting the target prompt word into the target large language model.

[0226] Optionally, when the processor 110 performs the obtaining of the reference prompt word corresponding to the reference function associated with the function taint propagation analysis result, the processor 110 specifically performs:

[0227] determine a reference tainted variable corresponding to the reference function based on the function taint propagation analysis result, and find a reference sub-function corresponding to the end point code statement from reference key risk code corresponding to the reference function;

[0228] generate a reference taint propagation analysis hint word for the reference key risk code based on the reference tainted variable and the reference sub-function;

[0229] determine a reference hint word corresponding to the reference function based on the reference taint propagation analysis hint word.

[0230] Optionally, when the processor 110 executes the determination of the reference tainted variable corresponding to the reference function based on the function taint propagation analysis result, the processor 110 specifically executes:

[0231] obtains key risk code of a risk function corresponding to the function taint propagation analysis result, and determines a target sub-function corresponding to an end point code statement in the key risk code;

[0232] If the function taint propagation analysis result is a taint propagation success type, a function output variable of the target sub-function is obtained, and the function output variable is taken as the reference tainted variable corresponding to the reference function.

[0233] Optionally, when the processor 110 executes the updating of the code risk detection result based on the taint propagation analysis result to obtain the target code risk detection result, the processor 110 specifically executes:

[0234] determines the type of the taint propagation analysis result, and if the type of the taint propagation analysis result is a link taint propagation failure type, a target risk function call link corresponding to the taint propagation failure is removed from the code risk detection result.

[0235] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing related hardware. The program can be stored in a computer readable storage medium, and when the program is executed, the processes of the above-mentioned embodiments can be included. The storage medium can be a magnetic disk, an optical disk, a read-only memory, or a random access memory.

[0236] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data for analysis, stored data, displayed data, etc.), and signals involved in the embodiments of the present specification are all authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data need to comply with relevant laws, regulations, and standards of relevant countries and regions. For example, the object features, interaction behavior features, and user information involved in the present specification are all obtained under sufficient authorization.

[0237] The above descriptions are only the preferred embodiments of the present specification, and certainly cannot limit the scope of the rights of the present specification, so the equivalent changes made according to the claims of the present specification still belong to the scope covered by the present specification.

Claims

1. A code risk detection method, the method comprising: obtaining a code risk detection result for source code, obtaining a risk function call link from the code risk detection result, determining a target function in the risk function call link and a function variable of the target function, and determining key risk codes of each risk function associated with the function variable from the risk function call link; determining a tainted variable corresponding to a risk function based on the code risk detection result, finding a target sub-function corresponding to a terminal code statement from the key risk code of the risk function, generating a taint propagation analysis prompt word for the key risk code based on the tainted variable and the target sub-function, and generating a key risk code prompt word based on the key risk code; constructing a target prompt word based on the key risk code prompt word and the taint propagation analysis prompt word; determining a taint propagation analysis result based on the target prompt word using a target large language model, and updating the code risk detection result based on the taint propagation analysis result to obtain a target code risk detection result.

2. The method of claim 1, wherein the code risk detection result for source code is obtained by: performing code risk detection on the source code using program static analysis to obtain a code risk detection result for the source code; and / or performing risk detection on the source code based on a code risk detection model to obtain a code risk detection result for the source code.

3. The method of claim 1, wherein the key risk codes of each risk function associated with the function variable are determined from the risk function call link by: determining at least one risk function associated with the function variable in the risk function call link; and finding code statements associated with the function variable from the function code statements of the risk function to obtain key risk codes corresponding to each risk function.

4. The method of claim 1, wherein the target prompt word is constructed based on the key risk code prompt word and the taint propagation analysis prompt word by: constructing a code prior knowledge prompt word for the risk function call link, and constructing an output specification prompt word; constructing a target prompt word based on the code prior knowledge prompt word, the key risk code prompt word, the taint propagation analysis prompt word, and the output specification prompt word.

5. The method of claim 4, wherein the code prior knowledge prompt word for the risk function call link is constructed by: determining a risk type of a risk function in the risk function call link, and determining code prior knowledge database information matching the risk type; generating a code prior knowledge prompt word for the risk function call link based on the code prior knowledge database information.

6. The method of any one of claims 1 to 5, wherein the taint propagation analysis result is determined based on the target prompt word using a target large language model by: inputting the target prompt word into a target large language model. ​ obtaining, by the target large language model, a risk function corresponding to the target prompt word and a risk function call link corresponding to the risk function, determining a tainted variable corresponding to the risk function based on the target prompt word, and performing a taint propagation analysis on a key risk code corresponding to the risk function based on the tainted variable to obtain a function taint propagation analysis result of the risk function; determining whether there is a next reference function of the risk function based on the risk function call link; if not, generating a taint propagation analysis result based on the function taint propagation analysis result; if so, obtaining a reference prompt word corresponding to the reference function associated with the function taint propagation analysis result, taking the reference prompt word as the target prompt word and the reference function as the risk function, and executing the step of inputting the target prompt word into the target large language model.

7. The method of claim 6, wherein the obtaining a reference prompt word corresponding to the reference function associated with the function taint propagation analysis result comprises: determining a reference tainted variable corresponding to the reference function based on the function taint propagation analysis result, and finding a reference sub-function corresponding to a sink code statement from a reference key risk code corresponding to the reference function; generating a reference taint propagation analysis prompt word for the reference key risk code based on the reference tainted variable and the reference sub-function; determining a reference prompt word corresponding to the reference function based on the reference taint propagation analysis prompt word.

8. The method of claim 7, wherein the determining a reference tainted variable corresponding to the reference function based on the function taint propagation analysis result comprises: obtaining a key risk code of a risk function corresponding to the function taint propagation analysis result, and determining a target sub-function corresponding to a sink code statement in the key risk code; if the function taint propagation analysis result is a taint propagation success type, obtaining a function output variable of the target sub-function, and taking the function output variable as a reference tainted variable corresponding to the reference function.

9. The method of claim 1, wherein the updating the code risk detection result based on the taint propagation analysis result to obtain a target code risk detection result comprises: determining a type of the taint propagation analysis result, and if the type of the taint propagation analysis result is a link taint propagation failure type, removing a target risk function call link corresponding to the taint propagation failure from the code risk detection result.

10. A code risk detection device, comprising: an obtaining module adapted to obtain a code risk detection result for a source code, obtain a risk function call link from the code risk detection result, determine a target function in the risk function call link and a function variable of the target function, and determine key risk codes of respective risk functions associated with the function variable from the risk function call link. The generating module is adapted to determine a tainted variable corresponding to a risk function based on the code risk detection result, find a target sub-function corresponding to an end code statement from critical risk code corresponding to the risk function, generate a taint propagation analysis prompt word for the critical risk code based on the tainted variable and the target sub-function, and generate a critical risk code prompt word based on the critical risk code; The constructing module is adapted to construct a target prompt word based on the critical risk code prompt word and the taint propagation analysis prompt word; The updating module is adapted to determine a taint propagation analysis result based on the target prompt word using a target large language model, and update the code risk detection result based on the taint propagation analysis result to obtain a target code risk detection result.

11. A computer storage medium, the computer storage medium storing a plurality of instructions, the instructions being adapted to be loaded and executed by a processor to perform the method steps of any one of claims 1-9.

12. A computer program product, the computer program product storing at least one instruction, the at least one instruction being loaded and executed by a processor to perform the method steps of any one of claims 1-9.

13. An electronic device comprising: A processor and a memory; wherein the memory stores a computer program, and the computer program is adapted to be loaded and executed by the processor to perform the method steps of any one of claims 1-9.

Images