A code detection method, device, apparatus and storage medium

Abstract

The application discloses a code detection method and device, equipment and a storage medium. The application relates to the technical field of data processing. The method comprises the following steps: if the scanning mode of to-be-detected source code is incremental scanning, determining difference source code of the to-be-detected source code and target scanned source code, and scanning the difference source code; obtaining the to-be-detected source code according to the scanned difference source code and the target scanned source code; splitting the to-be-detected source code into at least one to-be-detected method code, wherein each to-be-detected method code meets a preset code integrity specification; inputting each to-be-detected method code into at least two pre-trained vulnerability detection models to obtain a vulnerability detection result output by each vulnerability detection model, wherein the detection dimensions of the vulnerability detection results output by different vulnerability detection models are different. The detection accuracy and the detection efficiency of the detection method are both high.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and particularly relates to a code detection method and device, equipment and a storage medium. BACKGROUND

[0002] With the development of informatization, the types of software are more and more, and the structure is more and more complex. In order to improve the security of the software, the code of the software needs to be fully tested.

[0003] At present, the code can be detected by a code quality management system: the code quality management system scans the code, and then detects the scanned code based on a pre-defined rule to find potential problems in the code and improve the overall code quality.

[0004] However, in the above detection method, since the code is detected based on the pre-defined rule, new problems cannot be flexibly detected, and the detection accuracy is low. At the same time, the scanning efficiency is low, resulting in low detection efficiency. SUMMARY

[0005] The present application provides a code detection method, device, equipment and storage medium, to solve the technical problems of low detection accuracy and low detection efficiency in the detection method of related technologies.

[0006] In a first aspect, the present application provides a code detection method, comprising:

[0007] If the scanning method of the to-be-detected source code is incremental scanning, the difference source code between the to-be-detected source code and the target scanned source code is determined, and the difference source code is scanned; wherein the identification information of the target scanned code is the same as the identification information of the to-be-detected source code;

[0008] According to the scanned difference source code and the target scanned source code, the to-be-detected source code is obtained.

[0009] The to-be-detected source code is split into at least one to-be-detected method code; wherein each to-be-detected method code conforms to a pre-set code integrity specification.

[0010] Each to-be-detected method code is input into at least two pre-trained vulnerability detection models to obtain a vulnerability detection result output by each vulnerability detection model; wherein the detection dimensions of the vulnerability detection results output by different vulnerability detection models are different.

[0011] In a second aspect, the present application further provides a code detection device, comprising:

[0012] The first scanning module is configured to, if the scanning manner of the to-be-detected source code is incremental scanning, determine difference source code between the to-be-detected source code and the target scanned source code, and scan the difference source code; wherein the identification information of the target scanned code is the same as the identification information of the to-be-detected source code.

[0013] The first determining module is configured to obtain the to-be-detected source code according to the scanned difference source code and the target scanned source code.

[0014] The splitting module is configured to split the to-be-detected source code into at least one to-be-detected method code; wherein each to-be-detected method code conforms to a preset code integrity specification.

[0015] The second determining module is configured to input each to-be-detected method code into at least two pre-trained vulnerability detection models to obtain a vulnerability detection result output by each vulnerability detection model; wherein the detection dimensions of the vulnerability detection results output by different vulnerability detection models are different.

[0016] In a third aspect, the present application also provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor executes the program to implement the code detection method according to any one of the present application.

[0017] In a fourth aspect, the present application also provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to implement the code detection method according to any one of the present application.

[0018] In a fifth aspect, the present application also provides a computer program product, which includes a computer program, and the computer program is executed by a processor to implement the code detection method according to any one of the present application.

[0019] The technical scheme of the application comprises the following steps: if the scanning mode of the to-be-detected source code is incremental scanning, determining the difference source code between the to-be-detected source code and the target scanned source code, and scanning the difference source code, wherein the identification information of the target scanned code is the same as that of the to-be-detected source code; obtaining the to-be-detected source code according to the scanned difference source code and the target scanned source code; splitting the to-be-detected source code into at least one to-be-detected method code, wherein each to-be-detected method code meets a preset code integrity specification; inputting each to-be-detected method code into at least two pre-trained vulnerability detection models to obtain the vulnerability detection results output by each vulnerability detection model, wherein the detection dimensions of the vulnerability detection results output by different vulnerability detection models are different. The technical scheme has the following technical effects: on the one hand, the vulnerability detection model trained based on big data has more flexible detection capability, compared with the detection mode based on pre-defined rules, the code detection method provided in the embodiment can find new problems, has high detection accuracy, and can also realize detection of the to-be-detected source code from at least two detection dimensions, thereby ensuring the comprehensiveness of detection; on the other hand, the detection method can obtain the to-be-detected source code in an incremental scanning mode, thereby improving the scanning efficiency and the detection efficiency; on the other hand, detection can be realized for each to-be-detected method code, which can realize fine-grained source code detection, can also retain the code context content and implementation logic, avoids erroneous judgment caused by misinterpretation, and improves the detection accuracy. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some embodiments of the application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor.

[0021] Figure 1 A schematic diagram of an application scenario of the code detection method provided by the embodiments of the application;

[0022] Figure 2 A flowchart of a code detection method provided by the embodiments of the application;

[0023] Figure 3 A schematic diagram of obtaining a to-be-detected source code in a code detection method provided by the embodiments of the application;

[0024] Figure 4 A schematic diagram of obtaining a to-be-detected method code in a code detection method provided by the embodiments of the application;

[0025] Figure 5Another code detection method provided by the embodiment of the present application is shown in the flowchart.

[0026] Figure 6 Another code detection method provided by the embodiment of the present application is shown in the flowchart.

[0027] Figure 7 An output interface of a code detection method provided by the embodiment of the present application is shown in the schematic diagram.

[0028] Figure 8 Another code detection method provided by the embodiment of the present application is shown in the flowchart.

[0029] Figure 9 A structure of a vulnerability detection model in another code detection method provided by the embodiment of the present application is shown in the schematic diagram.

[0030] Figure 10 The overall implementation steps of another code detection method provided by the embodiment of the present application are shown in the flowchart.

[0031] Figure 11 A structure of a code detection device provided by the embodiment of the present application is shown in the schematic diagram.

[0032] Figure 12 A structure of an electronic device provided by the embodiment of the present application is shown in the schematic diagram. DETAILED DESCRIPTION

[0033] The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application. In addition, it should be noted that, for the convenience of description, only the parts related to the present application are shown in the drawings, but not all the structures.

[0034] It should be noted that: similar reference numerals and letters represent similar items in the following drawings, therefore, once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings. Meanwhile, in the description of the present application, the terms "first", "second", etc. are only used to distinguish the description, but cannot be understood as indicating or implying relative importance. The acquisition, storage, use, processing, etc. of data in the technical solution of the present application all comply with the relevant provisions of the national laws and regulations. It should be noted that, in the embodiments of the present application, some industry existing solutions, components, models, etc. may be mentioned, which should be considered as exemplary, and the purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0035] Figure 1 An application scenario of a code detection method provided by the embodiment of the present application is shown in the schematic diagram. As shown in FIG. 1, the code detection method provided by the embodiment of the present application can be applied to a code detection device 100, which can be a computer, a server, a mobile phone, a tablet computer, a wearable device, etc. Figure 1As shown in the first electronic device 11 shown in the embodiment, the code detection method provided by the embodiment can be applied to the second electronic device 12. Figure 1 The first electronic device 11 in the embodiment can be a computer device, a server, etc. The first electronic device 11 in the embodiment can interact with the second electronic device 12 storing the source code to be detected to obtain the source code to be detected, so as to implement the code detection method provided by the embodiment. The code detection method provided by the embodiment can detect each method code to be detected obtained by splitting the source code to be detected based on at least two vulnerability detection models trained based on big data in multiple dimensions. On the one hand, the vulnerability detection model has more flexible detection capability. Compared with the detection based on the pre-defined rules, the code detection method provided by the embodiment can find new problems and has higher detection accuracy. On the other hand, the detection method can obtain the source code to be detected in an incremental scanning manner, thereby improving the scanning efficiency and the detection efficiency.

[0036] The code detection method of the present application will be further described in detail through several specific embodiments.

[0037] Figure 2 A flowchart of a code detection method provided by the embodiment of the present application. The method can be executed by a code detection device, which can be realized in the form of hardware and / or software, and can be configured in an electronic device. The electronic device herein can be the first electronic device in the Figure 1 The electronic device in the embodiment can be a server, for example. As shown in the Figure 2 The code detection method provided by the embodiment includes the following steps.

[0038] Step 201: If the scanning manner of the source code to be detected is incremental scanning, the difference source code between the source code to be detected and the target scanned source code is determined, and the difference source code is scanned.

[0039] The identification information of the target scanned code is the same as the identification information of the source code to be detected.

[0040] The source code to be detected in the embodiment can be the source code constituting a certain software, a certain system, or a certain software module. The code detection method provided by the embodiment can detect the source code before it is put online, so as to find the vulnerabilities in the source code and improve the security of the code.

[0041] In the code detection method provided by the embodiment, the incremental scanning manner can be used for scanning, so as to improve the scanning efficiency. The incremental scanning in the embodiment refers to the scanning manner of only scanning the changed part. The scanning in the embodiment refers to the process of reading the source code, so as to process it subsequently to obtain the vulnerability detection result.

[0042] Optionally, when it is determined that the scanning manner of the source code to be detected is the incremental scanning, it is indicated that the whole information of the source code to be detected does not need to be scanned. Therefore, in step 201, the difference source code between the source code to be detected and the target scanned source code is determined.

[0043] Optionally, the difference source code can be determined based on the version change information of the source code to be detected. Alternatively, the difference source code can be determined based on the indication information of the user. Alternatively, the difference source code can be determined by comparing the source code to be detected with the target scanned source code.

[0044] After the difference source code is determined, the difference source code can be scanned, i.e., the difference source code is read.

[0045] Optionally, in the code detection method provided by the embodiment, the scanning manner of the source code can also be the full scanning. That is, the whole information of the source code to be detected is scanned. The code detection method provided by the embodiment further includes the following step: if the scanning manner of the source code to be detected is the full scanning, the source code to be detected is scanned to obtain the source code to be detected.

[0046] In an implementation manner, the code detection method provided by the embodiment determines the scanning manner of the source code to be detected by the following manner: obtaining the identification information of the source code to be detected; if the target scanned code with the same identification information as the source code to be detected exists in the scanned source code, it is determined that the scanning manner of the source code to be detected is the incremental scanning; if the target scanned code with the same identification information as the source code to be detected does not exist in the scanned source code, it is determined that the scanning manner of the source code to be detected is the full scanning. The implementation manner can efficiently and accurately determine the scanning manner of the source code to be detected.

[0047] In the process of detecting the source code, the identification information of the source code can be saved after each source code is scanned, i.e., the identification information of the scanned source code is saved. When the scanning manner of the source code to be detected is determined, the identification information of the source code to be detected and the identification information of the scanned source code can be compared to determine the scanning manner of the source code to be detected.

[0048] The identification information in the embodiment is used to identify the source code. For example, the identification information in the embodiment can be the main version number of the source code. For example, the version number of a source code is V1.0.0, and the identification information thereof is 1. The version number of a source code is V2.1.2, and the identification information thereof is 2. Alternatively, the identification information in the embodiment can be the main version number and the sub-version number of the source code. For example, the version number of a source code is V1.0.0, and the identification information thereof is 1.0.

[0049] In another implementation, the code detection method provided by the embodiment determines the scanning manner of the source code to be detected by determining the scanning manner of the source code to be detected according to the scanning instruction information sent by the user. If the scanning instruction information indicates that the scanning manner of the source code to be detected is incremental scanning, it is determined that the scanning manner of the source code to be detected is incremental scanning. If the scanning instruction information indicates that the scanning manner of the source code to be detected is full scanning, it is determined that the scanning manner of the source code to be detected is full scanning.

[0050] It should be noted that before step 201, the source code to be detected and the identification information thereof can be obtained through the address of the source code to be detected or a software version control system.

[0051] Step 202: obtaining the source code to be detected according to the scanned difference source code and the target scanned source code.

[0052] After scanning the difference source code, in step 202, the source code to be detected can be obtained according to the scanned difference source code and the target scanned source code. It can be seen that in the process of obtaining the source code to be detected in the embodiment, only the difference source code needs to be scanned, which greatly enhances the scanning efficiency.

[0053] In an implementation, the difference source code scanned can be placed at the position indicated by the position indication information in the target scanned source code based on the position indication information of the user, to obtain the source code to be detected.

[0054] In another implementation, the code detection method provided by the embodiment further includes the following step: determining the position information of the difference source code in the target scanned source code. Correspondingly, the implementation of step 202 can be: placing the scanned difference source code at the position corresponding to the position information in the target scanned source code, to obtain the source code to be detected. This implementation can accurately restore the source code to be detected.

[0055] In this implementation, the position information of the difference source code in the target scanned source code can be determined according to the version change information.

[0056] In the scenario where there are multiple difference source codes, the position information of each difference source code in the target scanned source code is determined. Correspondingly, the implementation of step 202 can be: placing each scanned difference source code at the position corresponding to the position information of the difference source code in the target scanned source code, to obtain the source code to be detected.

[0057] Figure 3 A schematic diagram of obtaining the source code to be detected in the code detection method provided by the embodiment of the application is shown in FIG. 2. Figure 3As shown, the target scanned source code 30 is shown. It is assumed that the number of difference source codes is two. The location information of the first difference source code 31 indicates that the first difference source code 31 is located between the 7th line and the 8th line of the target scanned source code 30. The location information of the second difference source code 32 indicates that the second difference source code 32 is located between the 22nd line and the 23rd line of the target scanned source code 30. Then, the first difference source code 31 is placed between the 7th line and the 8th line of the target scanned source code 30, and the second difference source code 32 is placed between the 22nd line and the 23rd line of the target scanned source code 30, to obtain the to-be-detected method code 33.

[0058] Step 203: split the to-be-detected source code into at least one to-be-detected method code.

[0059] Each to-be-detected method code meets a preset code integrity specification.

[0060] Since the data amount of the to-be-detected source code is generally large, if detection is directly performed according to the to-be-detected source code, the detection efficiency may be low, and the detection granularity is large, and accurate detection cannot be achieved. Therefore, in step 203, the to-be-detected source code is split into at least one to-be-detected method code, so as to achieve fine-grained source code detection and further improve detection accuracy.

[0061] Each to-be-detected method code in this embodiment meets a preset code integrity specification. The code integrity specification in this embodiment is a general specification in the programming industry for specifying code function integrity. If the to-be-detected method code meets the preset code integrity specification, it means that the to-be-detected method code can implement a complete method.

[0062] In this embodiment, the to-be-detected source code is split into at least one to-be-detected method code, which can achieve fine-grained source code detection, and can also preserve code context content and implementation logic, which is equivalent to saving the semantic content of the code, avoiding errors caused by misinterpretation, and improving the accuracy of detection.

[0063] In an implementation manner, the to-be-detected source code is input into a pre-trained code splitting model to obtain at least one to-be-detected method code. The code splitting model is used to split the to-be-detected source code into at least one to-be-detected method code according to a code integrity specification. The code splitting model trained based on big data can achieve splitting of the to-be-detected source code with high accuracy.

[0064] Based on this implementation manner, a code splitting model for splitting source code can be pre-trained. Using the code splitting model, at least one to-be-detected method code obtained after splitting the to-be-detected source code is obtained.

[0065] In another implementation, the to-be-detected source code is split into at least one to-be-detected initial method code; if there is a to-be-detected initial method code that does not conform to the code integrity specification, the splitting manner is adjusted, and the step of splitting the to-be-detected source code into at least one to-be-detected initial method code is executed again; if all to-be-detected initial method codes conform to the code integrity specification, all to-be-detected initial method codes conforming to the code integrity specification are determined as to-be-detected method codes.

[0066] In this implementation, the to-be-detected source code is split by iterative splitting to obtain at least one to-be-detected method code.

[0067] Figure 4 A schematic diagram of obtaining to-be-detected method codes in a code detection method provided by the embodiment is shown in FIG. 2. Figure 4 As shown in FIG. 2, the splitting of the to-be-detected source code can be implemented by a code splitting model or by iterative splitting in the embodiment.

[0068] Step 204: inputting each to-be-detected method code into at least two pre-trained vulnerability detection models to obtain vulnerability detection results output by each vulnerability detection model.

[0069] The detection dimensions of the vulnerability detection results output by different vulnerability detection models are different.

[0070] In the embodiment, at least two vulnerability detection models can be trained based on big data. The vulnerability detection models are used to detect code vulnerabilities in the to-be-detected method codes. The code vulnerabilities in the embodiment refer to various hidden problems in the codes that can affect the stability of program running and information security, mainly including code specification vulnerabilities, code security vulnerabilities, and code performance vulnerabilities, etc. The code specification vulnerabilities refer to vulnerabilities that do not conform to code specifications, for example, repeated codes, null pointers, and resource unreleased, etc. The code security vulnerabilities refer to vulnerabilities that do not conform to code security regulations, for example, path operations. The code performance vulnerabilities refer to vulnerabilities that cause defects in the performance of the codes, for example, logic vulnerabilities.

[0071] Each to-be-detected method code is input into at least two pre-trained vulnerability detection models to obtain vulnerability detection results output by each vulnerability detection model for the to-be-detected method code. In the embodiment, the detection dimensions of the vulnerability detection results output by different vulnerability detection models are different. Therefore, at least two detection dimensions of vulnerability detection are implemented for each to-be-detected method code.

[0072] Optionally, the detection dimensions in the embodiment at least include a security dimension and a specification dimension.

[0073] Optionally, the vulnerability detection results in this embodiment include at least one of the following: the name of the vulnerability, the type of the vulnerability, the location information of the vulnerability in the code of the method to be detected, and the probability of the vulnerability occurring.

[0074] Optionally, the detection method provided in this embodiment can also output improvement suggestions based on the vulnerability detection results. More specifically, the improvement suggestions corresponding to specific vulnerabilities in the vulnerability detection results can be determined based on the specific vulnerabilities in the vulnerability detection results and the pre-established mapping relationship between vulnerabilities and improvement suggestions.

[0075] The code detection method provided in this embodiment includes: if the scanning method of the source code to be detected is incremental scanning, then determining the source code that differs from the target scanned source code, and scanning the differing source code, wherein the identification information of the target scanned code is the same as the identification information of the source code to be detected; obtaining the source code to be detected based on the scanned differing source code and the target scanned source code; splitting the source code to be detected into at least one method code to be detected, wherein each method code to be detected conforms to a preset code integrity specification; inputting each method code to be detected into at least two pre-trained vulnerability detection models to obtain the vulnerability detection result output by each vulnerability detection model, wherein the vulnerability detection results output by different vulnerability detection models have different detection dimensions. It has the following technical effects: Firstly, the vulnerability detection model trained based on big data has more flexible detection capabilities. Compared with detection methods based on predefined rules, the code detection method provided in this embodiment can discover new problems and has higher detection accuracy. At the same time, it can also detect the source code to be detected from at least two detection dimensions, ensuring the comprehensiveness of the detection. Secondly, the detection method can use incremental scanning to obtain the source code to be detected, which improves scanning efficiency and thus detection efficiency. Thirdly, it can realize detection for each method code to be detected, which can achieve fine-grained source code detection while preserving the code context and implementation logic, avoiding erroneous judgments caused by literal interpretation, and improving the accuracy of detection.

[0076] Figure 5 This is a flowchart illustrating another code detection method provided in an embodiment of this application. This embodiment... Figure 2 Based on the illustrated embodiments and various optional implementations, this paper provides a detailed explanation of the steps for inputting the code of the method to be detected into the vulnerability detection model. For example... Figure 5 As shown, the code detection method provided in this embodiment includes the following steps.

[0077] Step 501: If the scanning method of the source code to be detected is incremental scanning, then determine the source code that is different from the source code to be detected and the target scanned source code, and scan the source code that is different.

[0078] The identification information of the target scanned code is the same as the identification information of the to-be-detected source code.

[0079] Step 502: obtaining the to-be-detected source code according to the scanned difference source code and the target scanned source code.

[0080] Step 503: splitting the to-be-detected source code into at least one to-be-detected method code.

[0081] Each to-be-detected method code meets a preset code integrity specification.

[0082] The implementation manners and technical principles of steps 501, 201, 502, 202, and 503, and 203 are similar, and details are not repeated here.

[0083] Step 504: converting each to-be-detected method code into a token sequence corresponding to the to-be-detected method code.

[0084] In this embodiment, in order to enable the vulnerability detection model to efficiently perform detection, each to-be-detected method code can be subjected to serialization processing, and each to-be-detected method code is converted into a token sequence corresponding to the to-be-detected method code: token1, token2, …, tokenN. N represents the number of tokens in the token sequence.

[0085] Further, a CLS token can be added before token1 to represent the beginning of the token sequence. An EOS token can also be added after tokenN to represent the end of the token sequence.

[0086] Optionally, in step 504, a sequence labeling model can be used to convert each to-be-detected method code into a token sequence corresponding to the to-be-detected method code.

[0087] Optionally, in order to reduce the processing complexity of the vulnerability detection model and improve detection efficiency, before step 504, the code detection method provided in this embodiment can further include the following step: preprocessing each to-be-detected method code to obtain a processed to-be-detected method code. The complexity of the processed to-be-detected method code is lower than that of the to-be-detected method code before processing. Correspondingly, the implementation manner of step 504 is to convert each processed to-be-detected method code into a token sequence corresponding to the processed to-be-detected method code.

[0088] The preprocessing in this embodiment can include operations such as deleting comments, deleting spaces, and simplifying variable names to reduce the complexity of the to-be-detected method code. Then, each processed to-be-detected method code is converted into a token sequence corresponding to the processed to-be-detected method code.

[0089] Step 505: input each token sequence into at least two vulnerability detection models to obtain vulnerability detection results output by each vulnerability detection model.

[0090] wherein the detection dimensions of the vulnerability detection results output by different vulnerability detection models are different.

[0091] Step 505 is different from step 204 in that, in the embodiment, each token sequence is input into each vulnerability detection model to achieve efficient detection. It can be understood that the vulnerability detection model in the embodiment is a model trained based on the training token sequence corresponding to the training method code.

[0092] The code detection method provided in the embodiment reduces the complexity of the vulnerability detection model detection process by converting each to-be-detected method code into a token sequence corresponding to the to-be-detected method code, and inputting each token sequence into at least two vulnerability detection models to obtain vulnerability detection results output by each vulnerability detection model, thereby further improving the detection efficiency.

[0093] Figure 6 A flowchart of another code detection method provided in the embodiment is shown. The embodiment is based on the embodiments shown in Figure 2 , Figure 5 and various optional implementation manners, and details of how to input the to-be-detected method code into the vulnerability detection model are described. In the embodiment, the at least two vulnerability detection models include a security vulnerability detection model and a specification vulnerability detection model. As shown in Figure 6 , the code detection method provided in the embodiment includes the following steps.

[0094] Step 601: if the scanning mode of the to-be-detected source code is incremental scanning, determining a difference source code of the to-be-detected source code and a target scanned source code, and scanning the difference source code.

[0095] wherein the identification information of the target scanned code is the same as the identification information of the to-be-detected source code.

[0096] Step 602: obtaining the to-be-detected source code according to the scanned difference source code and the target scanned source code.

[0097] Step 603: splitting the to-be-detected source code into at least one to-be-detected method code.

[0098] wherein each to-be-detected method code meets a preset code integrity specification.

[0099] The implementation manners and technical principles of step 601, step 201, step 602, step 202, step 603, and step 203 are similar, and thus are not described herein again.

[0100] Step 604: input each to-be-detected method code into the security vulnerability detection model to obtain a security vulnerability detection result output by the security vulnerability detection model.

[0101] Optionally, the security vulnerability detection result includes at least one of the following: a name of the security vulnerability, position information of the security vulnerability in the to-be-detected method code, and a probability of occurrence of the security vulnerability.

[0102] For example, the security vulnerability detection result includes the name of the security vulnerability, the position information of the security vulnerability in the to-be-detected method code, and the probability of occurrence of the security vulnerability.

[0103] It can be understood that, based on the embodiments shown in Figure 5 In step 604, the marked sequence corresponding to each to-be-detected method code is input into the security vulnerability detection model to obtain the security vulnerability detection result output by the security vulnerability detection model.

[0104] Step 605: input each to-be-detected method code into the specification vulnerability detection model to obtain a specification vulnerability detection result output by the specification vulnerability detection model.

[0105] Optionally, the specification vulnerability detection result includes at least one of the following: a name of the specification vulnerability, position information of the specification vulnerability in the to-be-detected method code, and a probability of occurrence of the specification vulnerability.

[0106] For example, the specification vulnerability detection result includes the name of the specification vulnerability, the position information of the specification vulnerability in the to-be-detected method code, and the probability of occurrence of the specification vulnerability.

[0107] It can be understood that, based on the embodiments shown in Figure 5 In step 605, the marked sequence corresponding to each to-be-detected method code is input into the specification vulnerability detection model to obtain the specification vulnerability detection result output by the specification vulnerability detection model.

[0108] Optionally, the name of the security vulnerability is used to represent a specific security vulnerability. The name of the specification vulnerability is used to represent a specific specification vulnerability. The position information of the specification vulnerability or the security vulnerability in the to-be-detected method code in the embodiment can be a line number in the to-be-detected method code. The probability of occurrence of the specification vulnerability or the security vulnerability can also be referred to as a confidence. The confidence in the embodiment can be a probability calculated by the security vulnerability detection model and the specification vulnerability detection model in the detection process.

[0109] Optionally, the vulnerability detection result in the embodiment can further include a vulnerability type. The vulnerability type here includes a code specification vulnerability and a code security vulnerability.

[0110] The code detection method provided in this embodiment can detect specific security vulnerabilities or specification vulnerabilities, which is equivalent to implementing a multi-label detection, rather than simply judging whether the code is safe or whether it conforms to the specification, and can accurately predict that the source code has some specific vulnerability problems. It can be understood that, correspondingly, based on the implementation manner, the training process of the specification vulnerability detection model and the security vulnerability detection model needs to be trained in a multi-label manner.

[0111] Figure 7 A schematic diagram of an output interface in a code detection method provided in this embodiment is shown in FIG. 7. Figure 7 As shown in the figure, in the output interface 71, the name of the vulnerability, the code line number where the vulnerability is located, the type of the vulnerability, and the confidence of the vulnerability are output. Figure 7 Six vulnerabilities are shown in FIG. 7. They are: vulnerability name: resources should be closed, code line number: 68-92, type: code specification, confidence: 99.99%; vulnerability name: resources should be closed, code line number: 143-172, type: code specification, confidence: 97.09%; vulnerability name: path manipulation, code line number: 28-36, type: code security, confidence: 98.42%; vulnerability name: path manipulation, code line number: 43-60, type: code security, confidence: 98.02%; vulnerability name: path manipulation, code line number: 68-92, type: code security, confidence: 99.41%; and vulnerability name: path manipulation, code line number: 143-172, type: code security, confidence: 96.69%.

[0112] The code detection method provided in this embodiment can detect security vulnerabilities and specification vulnerabilities in two dimensions, achieving comprehensive vulnerability detection, and can detect specific security vulnerabilities or specification vulnerabilities, which is equivalent to implementing a multi-label detection, rather than simply judging whether the code is safe or whether it conforms to the specification, and can accurately predict that the source code has some specific vulnerability problems.

[0113] Figure 8 A flowchart of another code detection method provided in this embodiment is shown in FIG. 8. Figure 6 Based on the embodiments shown in FIG. 8 and various optional implementation manners, the steps of obtaining the security vulnerability detection model and the specification vulnerability detection model are described in detail.

[0114] The specific implementation manner of the security vulnerability detection model and the specification vulnerability detection model in the code detection method provided in this embodiment is described in detail as follows. Figure 9A structural diagram of a vulnerability detection model in another code detection method provided by an embodiment of the present application is shown in FIG. 9. As shown in FIG. 9, the security vulnerability detection model 91 in this embodiment includes a security vulnerability detection main model 911, a first full connection layer 912, and a first multi-label classification layer 913 connected in sequence. The first multi-label classification layer 913 is configured to determine a security vulnerability detection result according to a first preset threshold or a first preset number. Figure 9

[0115] The security vulnerability detection main model 911 in this embodiment can obtain first embedding information based on the to-be-detected method code or the token sequence of the to-be-detected method code. The first full connection layer 912 integrates the features in the first embedding information to obtain first integrated features. The first multi-label classification layer 913 determines the probability of the to-be-detected method code in each category according to the first integrated features, and obtains the security vulnerability detection result according to each probability. The category here refers to each specific security vulnerability.

[0116] The first multi-label classification layer 913 in this embodiment can determine the security vulnerability detection result according to the first preset threshold or the first preset number.

[0117] In one implementation manner, the first multi-label classification layer 913 determines the security vulnerability detection result according to the first preset threshold, which means that the first multi-label classification layer 913 determines the candidate security vulnerabilities with a probability greater than the first preset threshold as the final security vulnerabilities, and determines the security vulnerability detection result according to the final security vulnerabilities. That is, at least one of the name of the final security vulnerabilities, the position information of the security vulnerabilities in the to-be-detected method code, and the probability of the security vulnerabilities is determined as the security vulnerability detection result. Exemplarily, the first preset threshold can be 0.4, 0.5, or 0.8, etc. The final determined security vulnerabilities can be 0 or more.

[0118] In another implementation manner, the first multi-label classification layer 913 determines the security vulnerability detection result according to the first preset number T1, which means that the first multi-label classification layer 913 sorts the candidate security vulnerabilities according to the probability, determines the T largest candidate security vulnerabilities as the final security vulnerabilities, and determines the security vulnerability detection result according to the final security vulnerabilities. Exemplarily, the first preset number T1 can be 3, 5, etc. The final determined security vulnerabilities can be 0 or more.

[0119] In actual use, the manner in which the first multi-label classification layer determines the security vulnerability detection result can be flexibly adjusted according to the detection effect, and the first preset threshold or the first preset number can be flexibly adjusted to obtain the security vulnerability detection result meeting the expectation.

[0120] ​The security vulnerability detection main model 911 in this embodiment can be a model obtained after fine-tuning training of an initial security vulnerability detection main model. Optionally, the initial security vulnerability detection main model can be a pre-trained model capable of processing a programming language.

[0121] A pre-trained model is a deep learning architecture trained and saved through a large amount of data for a certain task. Such a training task is usually not easy to implement due to the need for a large amount of resources, but a pre-trained model selected by saving the optimal weight after training can be used as an application of transfer learning. Through the means of fine-tuning, the knowledge learned in the open flow field is transferred to the downstream task. The pre-trained model can improve the performance of low-resource tasks and is very beneficial to low-resource language processing. Training the initial security vulnerability detection main model to obtain the security vulnerability detection main model can reduce the training data and improve the training efficiency while ensuring the detection accuracy.

[0122] Optionally, the initial security vulnerability detection main model in this embodiment can be a Bidirectional Encoder Representations from Transformer (BERT) model based on a transformer. The BERT model is a typical bidirectional encoding model, which has strong generalization ability as a pre-trained model, does not need to adjust the network structure additionally when used, can realize fast parallelism based on the transformer, can also be increased to a very deep depth, fully explores the characteristics of the model, and improves the accuracy of the model.

[0123] Optionally, the initial security vulnerability detection main model in this embodiment can be a CodeBERT model. The CodeBERT model is an extension of the BERT model, which uses multiple programming languages such as JAVA for bimodal pre-training of programming languages and natural languages. The pre-trained CodeBERT model can learn the syntax and semantic information of the code through research on the encoding and decoding of the code, and can better understand the syntax and semantic information of the code to implement many code-related tasks. The CodeBERT model can be fine-tuned in this embodiment to adjust the use direction of the model to obtain a security vulnerability detection main model specially used for detecting security vulnerabilities of the code.

[0124] Optionally, the initial security vulnerability detection main model in this embodiment can be a graphCodeBERT model or a Generative Pre-Trained (GPT) model.

[0125] Optionally, the first multi-label classification layer can include a Softmax function.

[0126] As shown in Figure 9 The specification vulnerability detection model 92 includes, in sequence, a specification vulnerability detection main model 921, a second full connection layer 922, and a second multi-label classification layer 923. The second multi-label classification layer 923 is configured to determine a specification vulnerability detection result according to a second preset threshold or a second preset number.

[0127] The specification vulnerability detection main model 921 in this embodiment can obtain second embedding information based on the to-be-detected method code or the token sequence of the to-be-detected method code. The second full connection layer 922 integrates the features in the second embedding information to obtain second comprehensive features. The second multi-label classification layer 923 determines the probability of the to-be-detected method code in each category according to the second comprehensive features, and obtains the specification vulnerability detection result according to the probabilities. Here, the category refers to each specific specification vulnerability. Optionally, the probability in each category is greater than 0, and the sum of the probabilities in each category is 1.

[0128] The second multi-label classification layer 923 in this embodiment is configured to determine the specification vulnerability detection result according to the second preset threshold or the second preset number.

[0129] In one implementation manner, the second multi-label classification layer 923 determines the specification vulnerability detection result according to the second preset threshold, which means that the second multi-label classification layer 923 determines the candidate specification vulnerabilities with probabilities greater than the second preset threshold as final specification vulnerabilities, and determines the specification vulnerability detection result according to the final specification vulnerabilities. Exemplarily, the second preset threshold can be 0.4, 0.5, or 0.6, etc.

[0130] In another implementation manner, the second multi-label classification layer 923 determines the specification vulnerability detection result according to the second preset number T2, which means that the second multi-label classification layer 923 sorts the candidate specification vulnerabilities according to the probabilities, determines the maximum T2 candidate specification vulnerabilities as the final specification vulnerabilities, and determines the specification vulnerability detection result according to the final specification vulnerabilities. Exemplarily, the second preset number T2 can be 2, 4, etc.

[0131] In actual use, the manner in which the second multi-label classification layer determines the specification vulnerability detection result can be flexibly adjusted, and the second preset threshold or the second preset number can be flexibly adjusted to obtain the specification vulnerability detection result meeting the expectation.

[0132] The specification vulnerability detection main model 921 in this embodiment can also be a model obtained after fine-tuning training of an initial specification vulnerability detection main model. Optionally, the initial specification vulnerability detection main model can be a pre-trained model capable of processing a programming language. Illustratively, the initial specification vulnerability detection main model can be a BERT model, a CodeBERT model, a graphCodeBERT model, or a GPT model.

[0133] Optionally, the Softmax function can be included in the second multi-label classification layer.

[0134] The following describes how to train the security vulnerability detection model and the specification vulnerability detection model. For ease of description, only the steps of obtaining the security vulnerability detection model and the specification vulnerability detection model are shown in this embodiment. As shown in Figure 8 The code detection method provided by this embodiment includes the following steps.

[0135] Step 8011: Obtain first training source code with a first label and second training source code with a second label.

[0136] The first label is used to represent the annotation result of the security vulnerability existing in the first training source code, and the second label is used to represent the non-existence of the security vulnerability in the second training source code.

[0137] In this embodiment, a large amount of training source code is first collected as training data. These training source codes are divided into two categories: first training source code with security vulnerabilities and second training source code without security vulnerabilities. The difference in the total order of magnitude of the first training source code and the second training source code does not exceed a preset number, so as to prevent the model from being biased due to too much data in the training.

[0138] For the first training source code with security vulnerabilities, the specific security vulnerabilities and their positions can be checked by expert method or other code scanning tools. These specific security vulnerabilities and positions are taken as the first label of the corresponding first training source code for model learning and induction.

[0139] For the second training source code without security vulnerabilities, a second label also needs to be added to distinguish the first training source code and the second training source code.

[0140] Step 8012: Determine the first training method code in which the first training source code is located according to the identification information of the first training source code and the first label.

[0141] The first training method code conforms to the code integrity specification.

[0142] Since the amount of historical stored code is large, or only the problematic code snippets are saved when labeling the training source code, the first training source code obtained through step 8011 is likely to be a fragment of a complete method. Such a fragment of code cannot provide complete method semantic information to the model due to incomplete information, which may adversely affect the training results of the model. Therefore, the problematic code needs to be restored for integrity. In the restoration, in order to achieve more fine-grained detection, the first training method code in which the first training source code is located is determined.

[0143] In daily code development activities, most of the source code is within the coverage of version maintenance. Therefore, the first training method code in which the first training source code is located can be determined through the identification information of the first training source code and the first label. Specifically, the complete source code in which the first training source code is located is determined according to the identification information of the first training source code, and the complete method content in which the first training source code is located, i.e., the first training method code, is deduced according to the complete source code and the position of the security vulnerability indicated in the first label, thereby realizing the integrity restoration of the code method.

[0144] Step 8013: The second training source code is split to obtain the second training method code.

[0145] The second training method code meets the code integrity specification.

[0146] The second training source code is a complete source code, which may contain multiple complete method codes and needs to be split. The specific splitting manner is similar to that of step 203, which will not be described here.

[0147] Step 8014: The initial security vulnerability detection main model, the initial first full connection layer, and the initial first multi-label classification layer are trained according to the first training method code, the second training method code, the first label, and the second label to obtain a security vulnerability detection model.

[0148] Optionally, step 8014 is implemented through steps 80141 to 80145 as follows: The first training method code and the second training method code are randomly divided into a training set, a validation set, and a test set; the initial security vulnerability detection main model, the initial first full connection layer, and the initial first multi-label classification layer are trained according to the training set and the validation set to obtain multiple intermediate security vulnerability detection models; the test set is input into each intermediate security vulnerability detection model to obtain test results; the detection performance indicators of each intermediate security vulnerability detection model are determined according to the test results, the first label, and the second label corresponding to the test set; and the intermediate security vulnerability detection model with the optimal corresponding detection performance indicator is determined as the security vulnerability detection model.

[0149] In an implementation, when training the initial security vulnerability detection main model, the initial first full connection layer, and the initial first multi-label classification layer according to the training set and the verification set, the first training method code and the second training method code in the training set and the verification set can be first converted into a mark sequence, and the initial security vulnerability detection main model, the initial first full connection layer, and the initial first multi-label classification layer are trained according to the mark sequence. The process of converting the mark sequence is similar to step 504, and will not be described here. In another implementation, when training the initial security vulnerability detection main model, the initial first full connection layer, and the initial first multi-label classification layer according to the training set and the verification set, the first training method code and the second training method code can be directly trained.

[0150] In the training process, the loss is calculated according to the difference between the output result of the model and the true value. The true value here is the first label or the second label. The loss function in this embodiment can be cross entropy (CrossEntropy). The loss is back propagated to adjust the initial security vulnerability detection main model, the initial first full connection layer, and the initial first multi-label classification layer. Until the output result of the initial security vulnerability detection main model, the initial first full connection layer, and the initial first multi-label classification layer meets the expectation, the security vulnerability detection model composed of the security vulnerability detection main model, the first full connection layer, and the first multi-label classification layer is obtained.

[0151] In the model training process, the learning rate, the batch size, and the training method (such as selecting the epoch training method) in the training process can be adjusted to obtain the optimal model effect.

[0152] The verification set is used to verify whether the model is overfitting. The test set is used to evaluate the model detection performance after the training is completed. In order to select the best model, the model parameters are gradually adjusted in the fine-tuning process, the loss is reduced, and the results are compared with the verification set. A plurality of iteration models can be obtained. In this embodiment, it is called an intermediate security vulnerability detection model. In this embodiment, the ratio of the training set, the verification set, and the test set can be 8:1:1.

[0153] After the model training is completed, the test set data is detected by the intermediate security vulnerability detection model to test the performance indicators, and the best intermediate security vulnerability detection model is selected as the final model for use, that is, the model fine-tuning work is completed.

[0154] The performance indicators in this embodiment can be measured by recall rate and accuracy. The recall rate is: the number of undetected vulnerabilities / the total number of vulnerabilities. The lower the recall rate, the more vulnerabilities are not predicted, and the higher the recall rate, the higher the proportion of vulnerabilities found. The ideal recall rate is 1. For example, there are 100 vulnerabilities in the code in total, and the model predicts 90, then the recall rate is 0.9. The accuracy is: the number of correct predicted vulnerabilities / the total number of predicted vulnerabilities, the lower the accuracy, the less accurate the prediction result of the model, and the higher the accuracy, the higher the prediction accuracy of the model. The ideal accuracy is still 1. For example, the model predicts a total of 100 vulnerabilities, of which 80 are consistent with the vulnerabilities verified by other methods, and the accuracy is 0.8.

[0155] Obviously, for a model, the most ideal state is that the recall rate and the accuracy are both 1, but in actual application, it is difficult to guarantee the recall rate and the accuracy at the same time.

[0156] Step 8021: Obtain third training source code with a third label and fourth training source code with a fourth label.

[0157] The third label is used to represent the annotation result of the specification vulnerability existing in the third training source code, and the fourth label is used to represent that the fourth training source code does not exist specification vulnerability.

[0158] Step 8022: Determine the third training method code where the third training source code is located according to the identification information of the third training source code and the third label.

[0159] The third training method code conforms to the code integrity specification.

[0160] Step 8023: Split the fourth training source code to obtain the fourth training method code.

[0161] The fourth training method code conforms to the code integrity specification.

[0162] Step 8024: Train the initial specification vulnerability detection main model, the initial second full connection layer and the initial second multi-label classification layer according to the third training method code, the fourth training method code, the third label and the fourth label to obtain a specification vulnerability detection model.

[0163] The implementation process and technical principles of step 8021 and step 8011, step 8022 and step 8012, step 8023 and step 8013, and step 8024 and step 8014 are similar, and will not be repeated here.

[0164] In this embodiment, after the security vulnerability detection model and the specification vulnerability detection model are trained, the following steps can be performed Figure 2 ,Figure 5 and Figure 6 as well as various optional implementations.

[0165] Figure 10 A code detection method provided by the embodiment of the present application is provided.

[0166] As shown in Figure 10 , the training process includes: cleaning and arranging the training source code, splitting or restoring the training source code to obtain the training method code; performing multi-label and multi-target classification model training according to the training method code to obtain a security vulnerability detection model and a specification vulnerability detection model.

[0167] As shown in Figure 10 , the detection process includes: obtaining the to-be-detected source code by means of incremental scanning or full scanning; splitting the to-be-detected source code to obtain at least one to-be-detected method code; inputting the to-be-detected method code into the security vulnerability detection model and the specification vulnerability detection model to obtain a security vulnerability detection result output by the security vulnerability detection model and a specification vulnerability detection result output by the specification vulnerability detection model.

[0168] As shown in Figure 10 , the detection result evaluation process includes: periodically evaluating the detection result obtained by using the model, and after measuring the prediction effect by means of recall rate and accuracy rate and the like, the prediction result is summarized and new training data is generated to form a positive model self-adjusting mechanism to further positively reinforce the prediction effect of the model. Through continuous optimization and adjustment of the model, the false positive rate can be effectively reduced.

[0169] The code detection method provided by the embodiment provides a simple model structure, simple implementation, on the other hand, provides a high-efficiency model training method, and the detection accuracy of the trained model is high.

[0170] Figure 11 A structure diagram of a code detection device provided by the embodiment of the present application is provided. As shown in Figure 11 , the code detection device provided by the embodiment of the present application includes the following modules: a first scanning module 1101, a first determination module 1102, a splitting module 1103, and a second determination module 1104.

[0171] The first scanning module 1101 is configured to, if the scanning mode of the to-be-detected source code is incremental scanning, determine the difference source code between the to-be-detected source code and the target scanned source code, and scan the difference source code.

[0172] The identification information of the target scanned code is the same as the identification information of the to-be-detected source code.

[0173] The first determination module 1102 is configured to obtain the to-be-detected source code according to the scanned difference source code and the target scanned source code.

[0174] The splitting module 1103 is configured to split the to-be-detected source code into at least one to-be-detected method code.

[0175] Each to-be-detected method code meets a preset code integrity specification.

[0176] The second determination module 1104 is configured to input each to-be-detected method code into at least two pre-trained vulnerability detection models to obtain a vulnerability detection result output by each vulnerability detection model.

[0177] The detection dimensions of the vulnerability detection results output by different vulnerability detection models are different.

[0178] In an embodiment, the apparatus further includes a second scanning module configured to scan the to-be-detected source code to obtain the to-be-detected source code if the scanning manner of the to-be-detected source code is full-amount scanning.

[0179] In an embodiment, the apparatus further includes a first obtaining module, a third determination module, and a fourth determination module.

[0180] The first obtaining module is configured to obtain identification information of the to-be-detected source code. The third determination module is configured to determine that the scanning manner of the to-be-detected source code is incremental scanning if the scanned source code includes the target scanned code with the same identification information as the to-be-detected source code. The fourth determination module is configured to determine that the scanning manner of the to-be-detected source code is full-amount scanning if the scanned source code does not include the target scanned code with the same identification information as the to-be-detected source code.

[0181] In an embodiment, the apparatus further includes a fifth determination module configured to determine position information of the difference source code in the target scanned source code. The first determination module 1102 is specifically configured to place the scanned difference source code at a position corresponding to the position information in the target scanned source code to obtain the to-be-detected source code.

[0182] In an embodiment, the splitting module 1103 is specifically configured to input the to-be-detected source code into a pre-trained code splitting model to obtain the at least one to-be-detected method code. The code splitting model is configured to split the to-be-detected source code into at least one to-be-detected method code according to the code integrity specification.

[0183] In an embodiment, the splitting module 1103 is specifically configured to: split the to-be-detected source code into at least one to-be-detected initial method code; if there is a to-be-detected initial method code that does not conform to the code integrity specification, adjust the splitting manner, and return to execute the step of splitting the to-be-detected source code into at least one to-be-detected initial method code; and if all to-be-detected initial method codes conform to the code integrity specification, determine all to-be-detected initial method codes that conform to the code integrity specification as the to-be-detected method code.

[0184] In an embodiment, the second determining module 1104 is specifically configured to: convert each to-be-detected method code into a token sequence corresponding to the to-be-detected method code; and input each token sequence into the at least two vulnerability detection models to obtain a vulnerability detection result output by each vulnerability detection model.

[0185] In an embodiment, the apparatus further includes a preprocessing module configured to preprocess each to-be-detected method code to obtain a processed to-be-detected method code, wherein the complexity of the processed to-be-detected method code is lower than the complexity of the to-be-detected method code. In the aspect of converting each to-be-detected method code into a token sequence corresponding to the to-be-detected method code, the second determining module 1104 is specifically configured to convert each processed to-be-detected method code into a token sequence corresponding to the processed to-be-detected method code.

[0186] In an embodiment, the at least two vulnerability detection models include a security vulnerability detection model and a specification vulnerability detection model. The second determining module 1104 is specifically configured to: input each to-be-detected method code into the security vulnerability detection model to obtain a security vulnerability detection result output by the security vulnerability detection model; and input each to-be-detected method code into the specification vulnerability detection model to obtain a specification vulnerability detection result output by the specification vulnerability detection model.

[0187] In an embodiment, the security vulnerability detection result includes at least one of the following: a name of a security vulnerability, position information of the security vulnerability in the to-be-detected method code, and a probability of occurrence of the security vulnerability. The specification vulnerability detection result includes at least one of the following: a name of a specification vulnerability, position information of the specification vulnerability in the to-be-detected method code, and a probability of occurrence of the specification vulnerability.

[0188] In an embodiment, the security vulnerability detection model comprises: a security vulnerability detection main model, a first full connection layer, and a first multi-label classification layer connected in sequence. The first multi-label classification layer is configured to determine the security vulnerability detection result according to a first preset threshold or a first preset number. The specification vulnerability detection model comprises: a specification vulnerability detection main model, a second full connection layer, and a second multi-label classification layer connected in sequence. The second multi-label classification layer is configured to determine the specification vulnerability detection result according to a second preset threshold or a second preset number.

[0189] In an embodiment, the apparatus further comprises: a second acquisition module, a sixth determination module, and a first training model.

[0190] The second acquisition module is configured to acquire a first training source code with a first label and a second training source code with a second label. The first label is used to represent the annotation result of a security vulnerability existing in the first training source code, and the second label is used to represent that the second training source code does not have a security vulnerability.

[0191] The sixth determination module is configured to determine a first training method code in which the first training source code is located according to the identification information of the first training source code and the first label. The first training method code conforms to the code integrity specification.

[0192] The splitting module 1103 is further configured to split the second training source code to obtain a second training method code. The second training method code conforms to the code integrity specification.

[0193] The first training model is configured to train an initial security vulnerability detection main model, an initial first full connection layer, and an initial first multi-label classification layer according to the first training method code, the second training method code, the first label, and the second label to obtain the security vulnerability detection model.

[0194] In an embodiment, the apparatus further comprises: a third acquisition module, a seventh determination module, and a second training model.

[0195] The third acquisition module is configured to acquire a third training source code with a third label and a fourth training source code with a fourth label. The third label is used to represent the annotation result of a specification vulnerability existing in the third training source code, and the fourth label is used to represent that the fourth training source code does not have a specification vulnerability.

[0196] A seventh determining module is configured to determine a third training method code where the third training source code is located according to the identification information of the third training source code and the third label. The third training method code conforms to the code integrity specification.

[0197] The splitting module 1103 is further configured to split the fourth training source code to obtain a fourth training method code. The fourth training method code conforms to the code integrity specification.

[0198] A second training model is configured to train an initial specification vulnerability detection main model, an initial second full connection layer and an initial second multi-label classification layer according to the third training method code, the fourth training method code, the third label and the fourth label to obtain the specification vulnerability detection model.

[0199] In an embodiment, the initial security vulnerability detection main model and the initial specification vulnerability detection main model are both pre-trained models capable of processing programming languages.

[0200] In an embodiment, the first training model is specifically configured to randomly divide the first training method code and the second training method code into a training set, a verification set and a test set; train an initial security vulnerability detection main model, an initial first full connection layer and an initial first multi-label classification layer according to the training set and the verification set to obtain a plurality of intermediate security vulnerability detection models; input the test set into each of the intermediate security vulnerability detection models to obtain test results; determine a detection performance index of each of the intermediate security vulnerability detection models according to the test results, first labels and second labels corresponding to the test set; and determine the intermediate security vulnerability detection model with the optimal corresponding detection performance index as the security vulnerability detection model.

[0201] The code detection apparatus provided by the embodiments of the present application can be used to execute the technical solutions of the code detection method in the above embodiments, and has similar implementation principles and technical effects, which will not be described here again.

[0202] It should be noted that the division of each module of the above apparatus is only a logical function division, and all or part of them can be integrated into a physical entity or physically separated when actually implemented. These modules can all be implemented in the form of software invoked by a processing element; all can be implemented in the form of hardware; or part of the modules can be implemented in the form of software invoked by a processing element, and part of the modules can be implemented in the form of hardware. For example, the first scanning module 1101, the first determining module 1102, the splitting module 1103 and the second determining module 1104 can be separately arranged processing elements, or can be integrated in a chip of the above apparatus, in addition, they can also be stored in the form of program code in the memory of the above apparatus, and the functions of the above first scanning module 1101, the first determining module 1102, the splitting module 1103 and the second determining module 1104 are invoked and executed by a processing element of the above apparatus. The implementation of other modules is similar. In addition, all or part of these modules can be integrated together or independently implemented. The processing element here can be an integrated circuit with signal processing capability. In the implementation process, each step of the above method or each module can be completed by the integrated logic circuit of hardware or the instruction of software in the processing element.

[0203] Figure 12 The structure schematic diagram of the electronic device provided by the embodiment of the present application is shown in the figure. Figure 12 As shown in the figure, the electronic device can include a transceiver 121, a processor 122 and a memory 123.

[0204] The processor 122 executes the computer execution instructions stored in the memory, so that the processor 122 executes the scheme in the above embodiment. The processor 122 can be a general-purpose processor, including a central processing unit CPU, a network processor NP, etc.; it can also be a digital signal processor DSP, an application-specific integrated circuit ASIC, a field programmable gate array FPGA or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0205] The memory 123 is connected with the processor 122 through a system bus and completes mutual communication, and the memory 123 is used for storing computer program instructions.

[0206] The transceiver 121 can be used to receive the source code to be detected or user instructions.

[0207] The system bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The system bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or only one type of bus. The transceiver is used to realize the communication between the code detection device and other computer equipment. The memory can include random access memory (RAM), and can also include non-volatile memory.

[0208] The embodiment of the present application also provides a chip for running instructions, which is used for executing the technical solution of the code detection method in the above embodiment.

[0209] The embodiment of the present application also provides a computer readable storage medium, which stores computer instructions, and when the computer instructions are run on a computer, the computer executes the technical solution of the code detection method in the above embodiment.

[0210] The embodiment of the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the computer program implements the code detection method provided by any embodiment of the present application.

[0211] In the implementation process of the computer program product, the computer program code for executing the operation of the present application can be written in one or more program design languages or combinations thereof, including object-oriented program design languages such as Java, Smalltalk, C++, and conventional procedural program design languages such as "C" language or similar program design languages. The program code can be completely executed on a user computer, partially executed on a user computer, executed as a separate software package, partially executed on a user computer and partially executed on a remote computer, or completely executed on a remote computer or server. In the case involving a remote computer, the remote computer can be connected to the user computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, connected through the Internet by using an Internet service provider).

[0212] Note that the above merely describes preferred embodiments of the application and the principles of the application. It will be understood by those skilled in the art that the application is not limited to the specific embodiments described herein, and that changes, modifications and substitutions can be made by those skilled in the art without departing from the scope of the application. Therefore, although the application has been described in detail by the above embodiments, the application is not limited to the above embodiments, and can include more other equivalent embodiments without departing from the concept of the application, and the scope of the application is determined by the appended claims.

Claims

1. A code detection method characterized by, The method comprises the following steps: If the scanning mode of the to-be-detected source code is incremental scanning, the difference source code between the to-be-detected source code and the target scanned source code is determined, and the difference source code is scanned; wherein the identification information of the target scanned source code is the same as the identification information of the to-be-detected source code; According to the scanned difference source code and the target scanned source code, the to-be-detected source code is obtained. The to-be-detected source code is split into at least one to-be-detected method code; wherein each to-be-detected method code meets a preset code integrity specification. Each to-be-detected method code is input into at least two pre-trained vulnerability detection models to obtain the vulnerability detection results output by each vulnerability detection model; wherein the detection dimensions of the vulnerability detection results output by different vulnerability detection models are different.

2. The method of claim 1, wherein, The method further comprises: If the scanning mode of the to-be-detected source code is full scanning, the to-be-detected source code is scanned to obtain the to-be-detected source code.

3. The method of claim 2, wherein, The method further comprises: Obtain the identification information of the to-be-detected source code; If the target scanned source code with the same identification information as the to-be-detected source code exists in the scanned source code, it is determined that the scanning mode of the to-be-detected source code is incremental scanning; If the target scanned source code with the same identification information as the to-be-detected source code does not exist in the scanned source code, it is determined that the scanning mode of the to-be-detected source code is full scanning.

4. The method of claim 1, wherein, The method further comprises: Determine the position information of the difference source code in the target scanned source code; According to the scanned difference source code and the target scanned source code, the to-be-detected source code is obtained, comprising: Place the scanned difference source code at the position corresponding to the position information in the target scanned source code to obtain the to-be-detected source code.

5. The method of claim 1, wherein, The to-be-detected source code is split into at least one to-be-detected method code, comprising: The to-be-detected source code is input into a pre-trained code splitting model to obtain the at least one to-be-detected method code; wherein the code splitting model is used to split the to-be-detected source code into at least one to-be-detected method code according to the code integrity specification.

6. The method of claim 1, wherein, The to-be-detected source code is split into at least one to-be-detected method code, comprising: The to-be-detected source code is split into at least one to-be-detected initial method code; If there is a to-be-detected initial method code that does not meet the code integrity specification, adjust the splitting mode and return to execute the step of "splitting the to-be-detected source code into at least one to-be-detected initial method code"; If all to-be-detected initial method codes meet the code integrity specification, all to-be-detected initial method codes that meet the code integrity specification are determined as the to-be-detected method code.

7. The method of claim 1, wherein, Each to-be-detected method code is converted into a corresponding mark sequence of the to-be-detected method code; ​ Each of the labeled sequences is input into the at least two vulnerability detection models to obtain the vulnerability detection results output by each vulnerability detection model.

8. The method of claim 7, wherein, Before converting each of the methods to be detected into a tag sequence corresponding to the method to be detected, the method further includes: Each of the methods to be detected is preprocessed to obtain processed methods to be detected; wherein the complexity of the processed methods to be detected is lower than the complexity of the methods to be detected. The step of converting each of the methods to be detected into a tag sequence corresponding to the method to be detected includes: Each of the processed detection method codes is converted into a tag sequence corresponding to the processed detection method code.

9. The method of claim 1, wherein, The at least two vulnerability detection models include a security vulnerability detection model and a standard vulnerability detection model; The step of inputting the code of each method to be detected into at least two pre-trained vulnerability detection models to obtain the vulnerability detection result output by each vulnerability detection model includes: Each of the code for the method to be detected is input into the security vulnerability detection model to obtain the security vulnerability detection result output by the security vulnerability detection model. Each of the code for the method to be detected is input into the standard vulnerability detection model to obtain the standard vulnerability detection result output by the standard vulnerability detection model.

10. The method of claim 9, wherein, The security vulnerability detection result includes at least one of the following: the name of the security vulnerability, the location information of the security vulnerability in the code of the method to be detected, and the probability of the security vulnerability occurring; The specification vulnerability detection results include at least one of the following: the name of the specification vulnerability, the location information of the specification vulnerability in the code of the method to be detected, and the probability of the specification vulnerability occurring.

11. The method of claim 9, wherein, The security vulnerability detection model includes: a main security vulnerability detection model, a first fully connected layer, and a first multi-label classification layer connected in sequence; wherein, the first multi-label classification layer is used to determine the security vulnerability detection result based on a first preset threshold or a first preset number; The standard vulnerability detection model includes: a standard vulnerability detection main model, a second fully connected layer, and a second multi-label classification layer connected in sequence; wherein, the second multi-label classification layer is used to determine the standard vulnerability detection result based on a second preset threshold or a second preset number.

12. The method of claim 11, wherein, The method further includes: Obtain a first training source code with a first label and a second training source code with a second label; wherein, the first label is used to characterize the annotation result of security vulnerabilities existing in the first training source code, and the second label is used to characterize the second training source code that does not have security vulnerabilities; Based on the identification information and the first tag of the first training source code, the first training method code containing the first training source code is determined; wherein, the first training method code conforms to the code integrity specification; The second training source code is split to obtain the second training method code; wherein the second training method code conforms to the code integrity specification. The initial security vulnerability detection main model, the initial first full connection layer, and the initial first multi-label classification layer are trained according to the first training method code, the second training method code, the first label, and the second label, so as to obtain the security vulnerability detection model.

13. The method of claim 12, wherein, The method further comprises: obtaining third training source code with a third label and fourth training source code with a fourth label; wherein the third label is used to represent the annotation result of the specification vulnerability existing in the third training source code, and the fourth label is used to represent that the fourth training source code does not exist specification vulnerability; According to the identification information of the third training source code and the third label, the third training method code in which the third training source code is located is determined; wherein the third training method code conforms to the code integrity specification; The fourth training source code is split to obtain the fourth training method code; wherein the fourth training method code conforms to the code integrity specification; The initial specification vulnerability detection main model, the initial second full connection layer, and the initial second multi-label classification layer are trained according to the third training method code, the fourth training method code, the third label, and the fourth label, so as to obtain the specification vulnerability detection model.

14. The method of claim 13, wherein, The initial security vulnerability detection main model and the initial specification vulnerability detection main model are pre-training models capable of processing programming languages.

15. The method of claim 12, wherein, The initial security vulnerability detection main model, the initial first full connection layer, and the initial first multi-label classification layer are trained according to the first training method code, the second training method code, the first label, and the second label, so as to obtain the security vulnerability detection model, comprising: The first training method code and the second training method code are randomly divided into a training set, a validation set, and a test set; According to the training set and the validation set, the initial security vulnerability detection main model, the initial first full connection layer, and the initial first multi-label classification layer are trained to obtain a plurality of intermediate security vulnerability detection models; The test set is input into each of the intermediate security vulnerability detection models to obtain test results; According to the test results, the first label and the second label corresponding to the test set, the detection performance indicators of each of the intermediate security vulnerability detection models are determined; The intermediate security vulnerability detection model with the optimal corresponding detection performance indicator is determined as the security vulnerability detection model.

16. A code detection apparatus characterized by comprising: comprises: The first scanning module is configured to determine difference source code between the to-be-detected source code and target scanned source code if the scanning mode of the to-be-detected source code is incremental scanning, and scan the difference source code; wherein the identification information of the target scanned source code is the same as that of the to-be-detected source code. The first determination module is configured to obtain the to-be-detected source code according to the scanned difference source code and the target scanned source code. The splitting module is configured to split the source code to be detected into at least one method code to be detected, wherein each of the method codes to be detected conforms to a preset code integrity specification. The second determining module is configured to input each of the method codes to be detected into at least two pre-trained vulnerability detection models, and obtain a vulnerability detection result output by each of the vulnerability detection models, wherein the detection dimensions of the vulnerability detection results output by different vulnerability detection models are different.

17. An electronic device, comprising: Computer program product comprising a memory, a processor and a computer program stored on the memory and loadable into the memory, the computer program being loadable into the memory and / or being executable by the processor, wherein the computer program comprises instructions for implementing the method according to any one of claims 1 to 15 when the computer program is executed by the processor.

18. A computer readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the code detection method according to any one of claims 1 to 15.

19. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the code detection method according to any one of claims 1 to 15.

Images