Software code bug repairing system based on feature extraction and rule analysis

Abstract

The invention discloses a software code bug repairing system based on feature extraction and rule analysis, which is characterized in that a feature extraction module sequentially performs feature extraction on software codes to be analyzed according to code blocks to obtain code features; the codebase code library is an open source code library set and is used for storing standard software codes; the rule analysis engine is used for storing software code matching analysis rules, matching the code features obtained by the feature extraction module with standard software codes based on the rules in the rule analysis engine, and taking the software codes corresponding to the code features with the matching degree lower than a threshold value as software code vulnerabilities; the MISRA C code rule base is used for storing repair suggestions of various software code vulnerabilities, the software code vulnerabilities are matched with the software code vulnerabilities stored in the MISRA C code rule base, the repair suggestions corresponding to the software code vulnerabilities are found, and the software code vulnerabilities are repaired. According to the method, the software code vulnerabilities can be quickly positioned and repaired.

Description

Technical Field

[0001] The present invention relates to the technical field of software code vulnerability repairing, and in particular to a software code vulnerability repairing system based on feature extraction and rule analysis. Background Art

[0002] In the process of software development, software code vulnerabilities are always a common problem that requires great attention. As the complexity of software development continues to increase, the number and types of software code vulnerabilities are also growing, which brings huge challenges to developers and enterprises.

[0003] Traditional manual vulnerability repair methods often require repeated code review and testing, which is not only time-consuming and labor-intensive, but also places high demands on developers' security knowledge and experience. It also requires a lot of time and energy. Moreover, this method is prone to errors during execution, which may lead to new vulnerabilities and even affect the normal operation of the original functions. Summary of the invention

[0004] In response to the problems existing in the prior art, the present invention provides a software code vulnerability repair system based on feature extraction and rule analysis, which performs feature extraction and rule analysis on software code, thereby quickly locating and repairing software code vulnerabilities, thereby significantly reducing the workload of developers in the vulnerability repair process, making the software code vulnerability repair process more efficient.

[0005] To achieve the above technical objectives, the present invention adopts the following technical solutions: a software code vulnerability repair system based on feature extraction and rule analysis, comprising: a feature extraction module, a rule analysis engine, a codebase code library and a MISRAC code rule library;

[0006] The feature extraction module extracts features of the software code to be analyzed in sequence according to code blocks to obtain code features;

[0007] The codebase is a collection of open source codebases used to store standard software codes;

[0008] The rule analysis engine is used to store the rules for software code matching analysis, match the code features obtained by the feature extraction module with the standard software code based on the rules in the rule analysis engine, and take the software code corresponding to the code features with a matching degree lower than a threshold as a software code vulnerability;

[0009] The MISRAC code rule base is used to store repair suggestions for various software code vulnerabilities, match software code vulnerabilities with software code vulnerabilities stored in the MISRAC code rule base, find repair suggestions corresponding to software code vulnerabilities, and repair software code vulnerabilities.

[0010] Furthermore, the feature extraction module traverses all paths that need to be executed by the software code to be analyzed in each code block, extracts the control dependencies in the software code through the control flow graph, and forms a code control flow graph of the code block; the feature extraction module extracts all functions in the software code to be analyzed in each code block through the call graph, and parses the grammatical features and semantic features of each code block through the abstract syntax tree; the code control flow graph, grammatical features and semantic features are all code features extracted by the feature extraction module.

[0011] Furthermore, it also includes: a data modeling module, which models the code features in the software code vulnerabilities to reflect the logical relationship between entities and attributes in the code vulnerabilities.

[0012] Furthermore, the rules stored in the rule analysis engine include: pattern matching rules, taint analysis rules, symbolic execution rules, abstract interpretation rules and model checking rules.

[0013] Furthermore, the pattern matching rules are used to check the software code structure, perform pattern matching on the semantic features and grammatical features obtained by the feature extraction module and the standard software code in the codebase code library, and calculate the pattern matching similarity. If the maximum value of the pattern matching similarity is less than the pattern matching threshold, it indicates that the software code corresponding to the semantic features and grammatical features has a software code vulnerability with structural defects.

[0014] Furthermore, the taint analysis rules are used to identify and track the flow path of sensitive information in the software code, match the flow path of the sensitive information with the standard software code in the codebase code library, and calculate the flow path matching similarity. If the maximum value of the flow path matching similarity is less than the flow path matching threshold, it indicates that there is a software code vulnerability in the flow path of the sensitive information.

[0015] Furthermore, the symbolic execution rules are used to verify whether the behavior of the software code in various situations complies with the rules. The software code behavior in the code control flow graph is matched with the standard software code in the codebase code library, and the behavior matching similarity is calculated. If the maximum value of the behavior matching similarity is less than the behavior matching threshold, it means that the behavior of the software code does not comply with the rules and there is a software code vulnerability.

[0016] Furthermore, the abstract interpretation rules are used to perform abstract analysis on functions in the software code, perform abstract representation matching with standard software codes in the codebase code library, and calculate abstract matching similarity. If the maximum value of the abstract matching similarity is less than the abstract representation matching threshold, it indicates that there is a software code vulnerability in the abstract representation of the software code.

[0017] Furthermore, the model checking rule is used to verify whether the model of the software code meets the specifications, and the model of the software code is matched with the model of the standard software code in the codebase code library for model similarity, and the model matching similarity is calculated. If the maximum value of the model matching similarity is less than the model matching threshold, it indicates that there is a software code vulnerability in the model of the software code.

[0018] Furthermore, it also includes: a software quality model, wherein the software quality model is used to perform quality assessment on the software code with vulnerabilities repaired in sequence according to code blocks, and to re-repair the software code vulnerabilities for the code blocks below the quality assessment threshold.

[0019] Compared with the prior art, the present invention has the following beneficial effects: the software code vulnerability repair system based on feature extraction and rule analysis of the present invention extracts code features through a feature extraction module, thereby reducing the amount of data to be processed and improving the efficiency of subsequent analysis; the code features obtained by the feature extraction module are matched with the standard software code based on the rules in the rule analysis engine, and the extracted code features are analyzed in a multi-dimensional and comprehensive manner through multiple rules in the rule analysis engine, which greatly improves the coverage of vulnerability detection and reduces the possibility of missed detection; the software code vulnerability is given a vulnerability repair suggestion through the MISRAC code rule library, and the software code vulnerability is repaired, which can realize the rapid repair of the software code vulnerability and shorten the cycle of software code vulnerability repair. The present invention performs feature extraction and rule analysis on the software code, thereby realizing the rapid positioning and repair of the software code vulnerability, thereby significantly reducing the workload of the developer in the vulnerability repair process, making the software code vulnerability repair process more efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 The schematic diagram is a framework of a software code vulnerability repair system based on feature extraction and rule analysis of the present invention. DETAILED DESCRIPTION

[0021] The technical solution of the present invention is further explained below in conjunction with the accompanying drawings.

[0022] like Figure 1The framework schematic diagram of the software code vulnerability repair system based on feature extraction and rule analysis of the present invention comprises: a feature extraction module, a rule analysis engine, a codebase code library and a MISRAC code rule library; the feature extraction module extracts features of the software code to be analyzed in sequence according to the code block to obtain code features; the codebase code library is an open source code library collection for storing standard software code; the rule analysis engine is used to store the rules of software code matching analysis, matches the code features obtained by the feature extraction module with the standard software code based on the rules in the rule analysis engine, and takes the software code corresponding to the code features with a matching degree lower than the threshold as the software code vulnerability; the MISRAC code rule library is used to store the repair suggestions of various software code vulnerabilities, matches the software code vulnerabilities with the software code vulnerabilities stored in the MISRAC code rule library, finds the repair suggestions corresponding to the software code vulnerabilities, and repairs the software code vulnerabilities. The present invention performs feature extraction and rule analysis on the software code, thereby realizing the rapid positioning and repair of the software code vulnerabilities, thereby significantly reducing the workload of the developer in the vulnerability repair process, and making the repair process of the software code vulnerabilities more efficient.

[0023] The feature extraction module in the present invention traverses all paths that need to be executed by the software code to be analyzed in each code block, extracts the control dependency in the software code through the control flow graph, forms the code control flow graph of the code block, and the code control flow graph helps to understand the control flow structure of the source code, and can be used to detect loops, branches and other structures in the software code, and analyze the execution path of the program; at the same time, the feature extraction module extracts all functions in the software code to be analyzed in each code block through the call graph, and the call graph can help understand the structure of the program and the interaction between functions, detect the call hierarchy of the function, find potential loop calls, perform performance analysis, etc.; and parses the grammatical features and semantic features of each code block through the abstract syntax tree; the code control flow graph, grammatical features and semantic features are all code features extracted by the feature extraction module. Since the existing software system is usually very large and complex, directly analyzing the source code requires a lot of computing resources and time. The feature extraction module of the present invention extracts code features containing key information from the software code, so that the code features are analyzed later, the amount of data to be processed is reduced, and the efficiency of the analysis is improved.

[0024] In one technical solution of the present invention, a software code vulnerability repair system based on feature extraction and rule analysis also includes: a data modeling module, which models the code features in the software code vulnerability, so as to intuitively understand the source of the introduction of the software code vulnerability, the upstream and downstream processing flow, and the association relationship between code blocks, and can reflect the logical relationship between entities and attributes in the code vulnerability.

[0025] The rules stored in the rule analysis engine of the present invention include: pattern matching rules, taint analysis rules, symbolic execution rules, abstract interpretation rules and model checking rules. By performing multi-dimensional analysis on the structure, function, class hierarchy, model, etc. of the software code to be analyzed, code structure analysis can find syntax errors and unreasonable architecture design; function analysis helps to detect logical loopholes and potential security risks within the function; class hierarchy analysis can reveal problems and potential misuse in inheritance relationships; model analysis ensures that the overall design of the software meets the requirements from a higher level. This multi-dimensional analysis can greatly improve the coverage of vulnerability detection and reduce the possibility of missed detection.

[0026] The pattern matching rules are used to check the software code structure, perform pattern matching on the semantic features and grammatical features obtained by the feature extraction module and the standard software code in the codebase code library, and calculate the pattern matching similarity. If the maximum value of the pattern matching similarity is less than the pattern matching threshold, it means that the software code corresponding to the semantic features and grammatical features has a software code vulnerability with structural defects. The pattern matching rules can be used to find out the code structure that does not conform to the specifications in the software code to be analyzed, and quickly discover potential problems or anomalies. The pattern matching rules can quickly compare the semantic features and grammatical features of the software code to be analyzed with the standard software code, and quickly find out the code structure that does not conform to the specifications. This efficient detection method can process a large amount of code in a short time, greatly improving the efficiency of vulnerability detection.

[0027] Taint analysis rules are used to identify and track the flow path of sensitive information in software code, match the flow path of sensitive information with the standard software code in the codebase code library, and calculate the flow path matching similarity. If the maximum value of the flow path matching similarity is less than the flow path matching threshold, it means that there is a software code vulnerability in the flow path of the sensitive information. Matching the flow path of sensitive information with the standard software code in the codebase code library can further improve the accuracy of detection. Standard software code usually undergoes strict security review and has high security and reliability. By comparison, it is possible to find out the places in the code to be analyzed that do not meet the standards so that they can be repaired in time.

[0028] Symbolic execution rules are a method of analyzing program behavior by symbolically representing and reasoning about the program. They are used to verify whether the behavior of the software code in various situations complies with the rules. The behavior of the software code in the code control flow graph is matched with the standard software code in the codebase code library, and the behavior matching similarity is calculated. If the maximum value of the behavior matching similarity is less than the behavior matching threshold, it means that the behavior of the software code does not comply with the rules and there is a software code vulnerability. By symbolically representing the program, symbolic execution can explore various possible input values ​​and execution paths, thereby comprehensively analyzing the behavior of the software code in different situations. This helps to discover vulnerabilities that only appear under specific inputs and improve the coverage of vulnerability detection.

[0029] Abstract interpretation rules are used to perform abstract analysis on functions in software code, infer the properties and behaviors of programs through abstract representation, analyze the semantics of programs without executing specific code, detect potential errors, verify the properties of programs, match the abstract representation in software code with the standard software code in the codebase, and calculate the abstract matching similarity. If the maximum value of the abstract matching similarity is less than the abstract representation matching threshold, it means that there is a software code vulnerability in the abstract representation of the software code. Abstract interpretation can analyze the semantics of programs without executing specific code, which greatly saves analysis time. Especially for large and complex software systems, actual code execution may be very time-consuming, and abstract interpretation can quickly provide analysis results. Inferring the properties and behaviors of programs through abstract representation can quickly discover potential errors. It can detect some problems that are difficult to find by actually executing code at an early stage.

[0030] Model checking rules are used to verify whether the model of the software code meets the specifications, and to verify the correctness, security, activity and other properties of the software system. The model of the software code is matched with the model of the standard software code in the codebase code library for model similarity, and the model matching similarity is calculated. If the maximum value of the model matching similarity is less than the model matching threshold, it means that there is a software code vulnerability in the model of the software code. Problems in the software model can be analyzed through model checking.

[0031] In a technical solution of the present invention, the software code vulnerability repair system based on feature extraction and rule analysis also includes: a software quality model, which is used to perform quality assessment on the software code for vulnerability repair in sequence according to code blocks, and re-repair the software code vulnerability for the code blocks below the quality assessment threshold. By performing quality assessment on the vulnerability repair code through the software quality model, efficient and accurate repair of software code vulnerabilities is achieved, the quality of software code is effectively improved, the business assurance capability is improved, the accuracy and reliability of vulnerability repair are ensured, and the overall security of software code is improved.

[0032] The above are only preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should be regarded as the protection scope of the present invention.

Claims

1. A software code vulnerability repair system based on feature extraction and rule analysis, characterized in that: include: Feature extraction module, rule analysis engine, codebase and MISRA C code rule base; The feature extraction module extracts features of the software code to be analyzed in sequence according to code blocks to obtain code features; The codebase is a collection of open source codebases used to store standard software codes; The rule analysis engine is used to store the rules for software code matching analysis, match the code features obtained by the feature extraction module with the standard software code based on the rules in the rule analysis engine, and take the software code corresponding to the code features with a matching degree lower than a threshold as a software code vulnerability; The MISRA C code rule base is used to store repair suggestions for various software code vulnerabilities, match the software code vulnerabilities with the software code vulnerabilities stored in the MISRA C code rule base, find the repair suggestions corresponding to the software code vulnerabilities, and repair the software code vulnerabilities.

2. A software code vulnerability repair system based on feature extraction and rule analysis according to claim 1, characterized in that: The feature extraction module traverses all paths that need to be executed by the software code to be analyzed in each code block, extracts the control dependencies in the software code through the control flow graph, and forms a code control flow graph of the code block; the feature extraction module extracts all functions in the software code to be analyzed in each code block through the call graph, and parses the grammatical features and semantic features of each code block through the abstract syntax tree; the code control flow graph, grammatical features and semantic features are all code features extracted by the feature extraction module.

3. A software code vulnerability repair system based on feature extraction and rule analysis according to claim 2, characterized in that: Also includes: A data modeling module is used to model code features in software code vulnerabilities and reflect the logical relationship between entities and attributes in the code vulnerabilities.

4. A software code vulnerability repair system based on feature extraction and rule analysis according to claim 2, characterized in that: The rules stored in the rule analysis engine include: pattern matching rules, taint analysis rules, symbolic execution rules, abstract interpretation rules and model checking rules.

5. A software code vulnerability repair system based on feature extraction and rule analysis according to claim 4, characterized in that: The pattern matching rules are used to check the software code structure, perform pattern matching on the semantic features and grammatical features obtained by the feature extraction module and the standard software code in the codebase code library, and calculate the pattern matching similarity. If the maximum value of the pattern matching similarity is less than the pattern matching threshold, it means that the software code corresponding to the semantic features and grammatical features has a software code vulnerability with structural defects.

6. A software code vulnerability repair system based on feature extraction and rule analysis according to claim 4, characterized in that: The taint analysis rules are used to identify and track the flow path of sensitive information in the software code, match the flow path of the sensitive information with the standard software code in the codebase code library, and calculate the flow path matching similarity. If the maximum value of the flow path matching similarity is less than the flow path matching threshold, it indicates that there is a software code vulnerability in the flow path of the sensitive information.

7. A software code vulnerability repair system based on feature extraction and rule analysis according to claim 4, characterized in that: The symbolic execution rules are used to verify whether the behavior of the software code in various situations complies with the rules. The software code behavior in the code control flow graph is matched with the standard software code in the codebase code library, and the behavior matching similarity is calculated. If the maximum value of the behavior matching similarity is less than the behavior matching threshold, it means that the behavior of the software code does not comply with the rules and there is a software code vulnerability.

8. The software code vulnerability repair system based on feature extraction and rule analysis according to claim 4, characterized in that: The abstract interpretation rule is used to perform abstract analysis on the functions in the software code, perform abstract representation matching with the standard software code in the codebase code library, and calculate the abstract matching similarity. If the maximum value of the abstract matching similarity is less than the abstract representation matching threshold, it indicates that there is a software code vulnerability in the abstract representation of the software code.

9. A software code vulnerability repair system based on feature extraction and rule analysis according to claim 4, characterized in that: The model checking rule is used to verify whether the model of the software code meets the specifications, match the model of the software code with the model of the standard software code in the codebase code library for model similarity, and calculate the model matching similarity. If the maximum value of the model matching similarity is less than the model matching threshold, it indicates that there is a software code vulnerability in the model of the software code.

10. The software code vulnerability repair system based on feature extraction and rule analysis according to claim 1, characterized in that: Also includes: Software The software quality model is used to perform quality assessment on the software code for vulnerability repair according to the code blocks in turn, and re-repair the software code vulnerabilities for the code blocks below the quality assessment threshold.

Images