Software vulnerability detection method and device

Abstract

The present disclosure provides a software vulnerability detection method and device, including: obtaining a software source code file to be detected, generating method code vulnerability feature vector data of the software source code file to be detected, inputting the method code vulnerability feature vector data into a pre-trained software vulnerability detection model, obtaining and outputting the vulnerability detection result of the software source code file to be detected, wherein the basic network of the software vulnerability detection model is a neural network model BiGRU-ATT that combines a bidirectional gated recurrent unit and an attention mechanism, and the software vulnerability detection model is obtained by BiGRU-ATT learning and predicting the prediction ability of the vulnerability detection result corresponding to the software source code file sample. The technical effect of directly and automatically detecting more abundant types of vulnerabilities from the actual software source code with lower time cost and higher detection performance is achieved.

Description

Technical Field

[0001] The present disclosure relates to the field of artificial intelligence technology, and in particular to a software vulnerability detection method and device. Background Art

[0002] Software vulnerabilities have always been an important factor threatening software security. Software vulnerability detection is a key means to improve software quality and security, and it has an extremely important position and significance in the field of software engineering.

[0003] Many existing commercial detection methods and tool systems usually use traditional software static or dynamic analysis technology to perform vulnerability detection on the source code files of the software to be detected. For example, they rely on experts to manually analyze various known vulnerabilities to generate vulnerability rules, and then perform vulnerability detection based on the vulnerability rules.

[0004] However, due to the influence of human factors, the above-mentioned software vulnerability detection methods generally have high false alarm rates and missed alarm rates, and the types of detectable vulnerabilities are also very limited.

[0005] The content of the background technology section is only the information known to the inventor personally, and does not mean that the above information has entered the public domain before the application date of this disclosure, nor does it mean that it can become the prior art of the present disclosure. Summary of the invention

[0006] The present disclosure provides a software vulnerability detection method and device to solve at least one of the above technical problems.

[0007] In a first aspect, the present disclosure provides a software vulnerability detection method, comprising:

[0008] Obtain the source code file of the software to be tested;

[0009] Generate method code vulnerability feature vector data of the software source code file to be detected;

[0010] The method code vulnerability feature vector data is input into a pre-trained software vulnerability detection model to obtain and output the vulnerability detection result of the software source code file to be detected, wherein the basic network of the software vulnerability detection model is a neural network model BiGRU-ATT that combines a bidirectional gated recurrent unit and an attention mechanism, and the software vulnerability detection model is obtained by the prediction ability of the BiGRU-ATT learning to predict the vulnerability detection results corresponding to the software source code file samples.

[0011] In some embodiments, the method code vulnerability feature vector data of the software source code file to be detected is generated, including:

[0012] Using a member method extraction and marking algorithm, the source code file of the software to be detected is converted into a code block set, wherein the code block set includes a plurality of method code blocks;

[0013] The abstract syntax tree (AST) extraction algorithm is used to generate AST feature information for each method code block;

[0014] The AST feature information and the code block set are combined to obtain method code vulnerability feature data corresponding to the software source code file to be detected;

[0015] Word2Vec embedding is used to convert the method code vulnerability feature data into method code vulnerability feature vector data.

[0016] In some embodiments, the BiGRU-ATT includes: a BiGRU layer, an attention mechanism, a fully connected layer, and an activation function layer; wherein,

[0017] The BiGRU layer is used to encode the method code vulnerability feature vector data, and obtain two hidden states through GRU in the forward and backward directions, and splice the two hidden states;

[0018] The attention mechanism is used to perform weighted summation of the concatenated hidden states at each moment to obtain a sequence representation;

[0019] The fully connected layer is used to perform a linear transformation on the sequence representation;

[0020] The activation function layer is used to activate the linear transformation result to obtain the vulnerability detection result.

[0021] In some embodiments, the attention mechanism includes: a fully connected layer, a flattened layer, an attention layer, a repeated input layer, a transpose layer, a multiplication layer, and a summation layer; wherein,

[0022] The output of the BiGRU layer passes through the fully connected layer and the flattening layer in turn to obtain the attention weight vector ;

[0023] The attention layer is used to Perform softmax operation to obtain the attention weight vector ;

[0024] The repeated input layer is used to transform the vector Repeat the operation until an output matching the shape of the BiGRU layer is obtained;

[0025] The transposition layer is used to perform a transposition operation on the repeated input layer;

[0026] The multiplication layer is used to perform element-wise multiplication of the output of the transposed layer and the output of the BiGRU layer to obtain a weighted hidden state representation. ;

[0027] The summation layer is used to represent the weighted hidden state Summing along the dimension of time steps yields the sequence representation.

[0028] In some embodiments, the software vulnerability detection model is obtained by training, verifying and testing the BiGRU-ATT based on a code vulnerability feature vector dataset;

[0029] Among them, the training set in the code vulnerability feature vector dataset used to train the BiGRU-ATT is obtained by data enhancement based on the multi-angle data enhancement method MPDA, and the training set includes the software source code file sample.

[0030] In some embodiments, the code vulnerability feature vector dataset is obtained by sequentially processing the acquired software vulnerability dataset using an abstract syntax tree AST extraction algorithm and Word2Vec embedding.

[0031] In some embodiments, the number of the software vulnerability detection models is multiple, and one method code corresponds to one software vulnerability detection model; the step of inputting the method code vulnerability feature vector data into a pre-trained software vulnerability detection model to obtain and output the vulnerability detection result of the software source code file to be detected includes:

[0032] Inputting the method code vulnerability feature vectors into each software vulnerability detection model respectively;

[0033] Based on each software vulnerability detection model, the vulnerability detection result corresponding to the corresponding method code in the software source code file to be detected is output, wherein the vulnerability detection result of each software vulnerability detection model includes a detection score used to characterize whether the corresponding method code is a vulnerability code, and location information when the detection score characterizes that the method code is a vulnerability code.

[0034] In a second aspect, the present disclosure provides a software vulnerability detection device, comprising:

[0035] An acquisition unit, used for obtaining the source code file of the software to be detected;

[0036] A generating unit, used to generate method code vulnerability feature vector data of the software source code file to be detected;

[0037] A determination unit is used to input the method code vulnerability feature vector data into a pre-trained software vulnerability detection model to obtain and output the vulnerability detection result of the software source code file to be detected, wherein the basic network of the software vulnerability detection model is a neural network model BiGRU-ATT that combines a bidirectional gated recurrent unit and an attention mechanism, and the software vulnerability detection model is obtained by the prediction ability of the BiGRU-ATT learning to predict the vulnerability detection result corresponding to the software source code file sample.

[0038] In some embodiments, the generating unit is specifically used to convert the software source code file to be detected into a code block set by using a member method extraction and marking algorithm, wherein the code block set includes a plurality of method code blocks;

[0039] An abstract syntax tree (AST) extraction algorithm is used to generate AST feature information of each method code block, and the AST feature information and the code block set are merged to obtain method code vulnerability feature data corresponding to the software source code file to be detected, and Word2Vec embedding is used to convert the method code vulnerability feature data into method code vulnerability feature vector data.

[0040] In some embodiments, the BiGRU-ATT includes: a BiGRU layer, an attention mechanism, a fully connected layer, and an activation function layer; wherein,

[0041] The BiGRU layer is used to encode the method code vulnerability feature vector data, and obtain two hidden states through GRU in the forward and backward directions, and splice the two hidden states;

[0042] The attention mechanism is used to perform weighted summation of the concatenated hidden states at each moment to obtain a sequence representation;

[0043] The fully connected layer is used to perform a linear transformation on the sequence representation;

[0044] The activation function layer is used to activate the linear transformation result to obtain the vulnerability detection result.

[0045] In some embodiments, the attention mechanism includes: a fully connected layer, a flattened layer, an attention layer, a repeated input layer, a transpose layer, a multiplication layer, and a summation layer; wherein,

[0046] The output of the BiGRU layer passes through the fully connected layer and the flattening layer in turn to obtain the attention weight vector ;

[0047] The attention layer is used to Perform softmax operation to obtain the attention weight vector ;

[0048] The repeated input layer is used to transform the vector Repeat the operation until an output matching the shape of the BiGRU layer is obtained;

[0049] The transposition layer is used to perform a transposition operation on the repeated input layer;

[0050] The multiplication layer is used to perform element-wise multiplication of the output of the transposed layer and the output of the BiGRU layer to obtain a weighted hidden state representation. ;

[0051] The summation layer is used to represent the weighted hidden state Summing along the dimension of time steps yields the sequence representation.

[0052] In some embodiments, the software vulnerability detection model is obtained by training, verifying and testing the BiGRU-ATT based on a code vulnerability feature vector dataset;

[0053] Among them, the training set in the code vulnerability feature vector dataset used to train the BiGRU-ATT is obtained by data enhancement based on the multi-angle data enhancement method MPDA, and the training set includes the software source code file sample.

[0054] In some embodiments, the code vulnerability feature vector dataset is obtained by sequentially processing the acquired software vulnerability dataset using an abstract syntax tree AST extraction algorithm and Word2Vec embedding.

[0055] In some embodiments, there are multiple software vulnerability detection models, and one method code corresponds to one software vulnerability detection model; the determination unit is specifically used to input the method code vulnerability feature vector into each software vulnerability detection model respectively, and output the vulnerability detection result corresponding to the corresponding method code in the software source code file to be detected based on each software vulnerability detection model, wherein the vulnerability detection result of each software vulnerability detection model includes a detection score for characterizing whether the corresponding method code is a vulnerability code, and location information when the detection score characterizes that the method code is a vulnerability code.

[0056] In a third aspect, the present disclosure provides a processor-readable storage medium, wherein the processor-readable storage medium stores a computer program, wherein the computer program is used to enable the processor to execute the method described in the first aspect above.

[0057] In a fourth aspect, the present disclosure provides a computer program product, including a computer program, which implements the method described in the first aspect when executed by a processor.

[0058] The software vulnerability detection method and device provided by the present disclosure include: obtaining a software source code file to be detected, generating method code vulnerability feature vector data of the software source code file to be detected, inputting the method code vulnerability feature vector data into a pre-trained software vulnerability detection model, obtaining and outputting the vulnerability detection result of the software source code file to be detected, wherein the basic network of the software vulnerability detection model is a neural network model BiGRU-ATT that combines a bidirectional gated recurrent unit and an attention mechanism, and the software vulnerability detection model is obtained by learning the prediction ability of the vulnerability detection result corresponding to the software source code file sample of BiGRU-ATT. In this embodiment, the neural network detection model BiGRU-ATT constructed by combining the attention mechanism and BiGRU is used as the basic network of the vulnerability detection model trained to obtain the vulnerability detection model, which not only overcomes the problem of dependence on the known vulnerability types of the expert manual analysis in the traditional detection method, but also breaks through the limitation of the limited vulnerability types that can be detected by the existing commercial detection methods and tools, and pays more attention to the key information of the vulnerability characteristics, and can achieve a greater improvement in detection performance with a smaller increase in training time cost. In addition, the technical effect of directly and automatically detecting more types of vulnerabilities from the actual software source code with lower time cost and higher detection performance is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0060] Figure 1 A flowchart of a software vulnerability detection method provided by an embodiment of the present disclosure;

[0061] Figure 2 A schematic diagram of the principle of the software vulnerability detection method provided by the embodiment of the present disclosure;

[0062] Figure 3 A schematic diagram of the principle of obtaining a software vulnerability detection model provided in an embodiment of the present disclosure;

[0063] Figure 4 A schematic diagram of the structure of BiGRU-ATT provided in an embodiment of the present disclosure;

[0064] Figure 5 A schematic diagram of the structure of a software vulnerability detection tool based on a software vulnerability detection model provided in an embodiment of the present disclosure;

[0065] Figure 6 A schematic diagram of the structure of a software vulnerability detection device provided by the present disclosure;

[0066] Figure 7A schematic diagram of the structure of an electronic device provided by the present disclosure.

[0067] The above drawings show clear embodiments of the present disclosure, which will be described in more detail below. These drawings and text descriptions are not intended to limit the scope of the present disclosure in any way, but to illustrate the concepts of the present disclosure to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0068] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0069] It should be understood that the terms "including" and "having" and any variations thereof in the embodiments of the present disclosure are intended to cover but not exclude inclusion. For example, a product or device comprising a series of components is not necessarily limited to those components explicitly listed, but may include other components not explicitly listed or inherent to these products or devices.

[0070] In the embodiments of the present disclosure, the term "and / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent three situations: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0071] The term "plurality" in the embodiments of the present disclosure refers to two or more than two, and other quantifiers are similar thereto.

[0072] The terms "first", "second", "third", etc. in the present disclosure are used to distinguish similar or similar objects or entities, and are not necessarily meant to limit a specific order or sequence, unless otherwise indicated. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, for example, they can be implemented in an order other than those given in the diagrams or descriptions of the embodiments of the present disclosure.

[0073] The term "unit / module" as used in this disclosure refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic or a combination of hardware and / or software code that is capable of performing the functions associated with that element.

[0074] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0075] According to an embodiment of the present disclosure, the present disclosure provides a software vulnerability detection method (hereinafter referred to as the detection method).

[0076] See also Figure 1 , Figure 1 Schematic diagram of the detection method provided by the embodiment of the present disclosure. Figure 1 As shown, the method includes:

[0077] S101: Obtain source code files of software to be tested.

[0078] The execution subject of this embodiment is a software vulnerability detection system (hereinafter referred to as a detection device). The detection device can be a server, a processor, a chip, etc., which are not listed here. The detection device is described elsewhere in this disclosure.

[0079] The software source code file to be detected can be understood as a source code file that needs to be detected for the presence of vulnerability codes and, if the vulnerability codes exist, the location of the vulnerability codes.

[0080] The following example can be used to obtain the source code file of the software to be tested:

[0081] In one example, the detection device may be connected to the collection device and receive the source code file of the software to be detected sent by the collection device.

[0082] In another example, the detection device may provide a tool for loading the software source code file to be detected, and the user may transfer the software source code file to be detected to the detection device through the tool for loading the software source code file to be detected.

[0083] Among them, the tool for loading the software source code file to be tested can be an interface for connecting to an external device, such as an interface for connecting to other storage devices, through which the software source code file to be tested transmitted by the external device is obtained; the tool for loading the software source code file to be tested can also be a display device, such as the detection device can output an interface for loading the software source code file to be tested on the display device, and the user can import the software source code file to be tested into the detection device through this interface.

[0084] S102: Generate method code vulnerability feature vector data of the software source code file to be detected.

[0085] Exemplarily, the software source code file includes multiple code blocks. Accordingly, this step can be understood as the detection device generating features (ie, method code vulnerability feature vector data) that characterize the software source code file to be detected with method code blocks as the granularity.

[0086] In some embodiments, S102 may include:

[0087] S1021: Using a member method extraction and marking algorithm, convert the source code file of the software to be detected into a code block set, wherein the code block set includes multiple method code blocks.

[0088] For example, Figure 2 As shown, the detection device can preprocess the input software source code file to be detected to obtain a code block set. The preprocessing can include member method extraction and marking algorithms.

[0089] S1022: Generate AST feature information of each method code block using an Abstract Syntax Tree (AST) extraction algorithm.

[0090] Continue reading Figure 2 For each method code block in the code block set obtained by preprocessing, the detection device can use an AST extraction algorithm to determine the AST feature information of the method code block.

[0091] AST is a tree data structure that represents the structure of source code. Each node represents a grammatical structure in the source code, such as an expression, statement, function, etc.

[0092] In this embodiment, the detection device can retain the structure and semantic information of the code in the source code file of the software to be detected by determining the AST feature information based on the AST extraction algorithm, which is convenient for static analysis and code conversion.

[0093] S1023: Merge the AST feature information and the code block set to obtain method code vulnerability feature data corresponding to the software source code file to be detected.

[0094] Continue reading Figure 2 ,The detection device can merge the results of the preprocessing and AST extraction algorithms to obtain the processed data (i.e., the method code vulnerability feature data).

[0095] Exemplarily, the code block set includes multiple method code blocks, and one method code block corresponds to one AST feature information. The detection device can first merge the AST feature information to obtain the overall AST feature information of the software source code file to be detected, and then merge the overall AST feature information with the code block set to obtain the method code vulnerability feature data.

[0096] S1024: Convert the method code vulnerability feature data into method code vulnerability feature vector data using Word2Vec embedding.

[0097] Continue reading Figure 2 After obtaining the method code vulnerability feature data, the detection device can transform the method code vulnerability feature data based on Word2Vec embedding to obtain the method code vulnerability feature vector data.

[0098] Combined with the above analysis of S1021 to S1024, it can be seen that in this embodiment, by converting the software source code file to be detected into a code block set, irrelevant code can be removed, interference in the analysis process can be reduced, and the accuracy and efficiency of the analysis can be improved; by determining the AST feature information through the AST extraction algorithm, fine-grained code analysis can be performed to improve the accuracy of vulnerability detection; by merging the AST feature information and the code block set, more comprehensive and rich method code vulnerability feature data can be obtained to improve the accuracy of vulnerability detection; by embedding the method code vulnerability feature vector data through Word2Vec, high-dimensional feature information can be mapped to a low-dimensional vector space, reducing computational complexity, improving the training efficiency of the model, and also making the generated feature vector have a standardized form, which is convenient for comparison and calculation.

[0099] S103: Input the method code vulnerability feature vector data into a pre-trained software vulnerability detection model to obtain and output the vulnerability detection result of the software source code file to be detected, wherein the basic network of the software vulnerability detection model is a neural network model BiGRU-ATT that combines a bidirectional gated recurrent unit and an attention mechanism, and the software vulnerability detection model is obtained by the prediction ability of BiGRU-ATT learning to predict the vulnerability detection results corresponding to the software source code file samples.

[0100] Continue reading Figure 2 After obtaining the method code vulnerability feature vector data, the detection device can input the method code vulnerability feature vector data into the software vulnerability detection model to use the software vulnerability detection model to predict the method code vulnerability feature vector data and obtain the vulnerability detection result corresponding to the software source code file to be detected.

[0101] It is worth noting that, in this embodiment, the basic network of the software vulnerability detection model includes two major structures: a bidirectional gated recurrent unit (BiGRU) and an attention mechanism (ATT).

[0102] In contrast, BiGRU combines forward GRU and backward GRU, and can utilize both forward and backward information of the sequence. Therefore, it can improve the expressiveness and accuracy of the software vulnerability detection model, especially in tasks that require global context information. The attention mechanism enables the vulnerability detection model to focus on important parts when processing sequence data.

[0103] Therefore, in this embodiment, the neural network detection model BiGRU-ATT constructed by combining the attention mechanism with BiGRU is used as the basic network for training the vulnerability detection model, which not only overcomes the dependence problem of experts manually analyzing known vulnerability types in traditional detection methods, but also breaks through the limitation of the limited types of vulnerabilities that can be detected by existing commercial detection methods and tools, and pays more attention to the key information of vulnerability features, and can achieve a greater improvement in detection performance with a smaller increase in training time cost. In addition, the technical effect of directly and automatically detecting a richer type of vulnerabilities from the actual software source code with lower time cost and higher detection performance is achieved.

[0104] In some embodiments, the software vulnerability detection model is obtained by training, verifying and testing BiGRU-ATT based on a code vulnerability feature vector dataset.

[0105] Among them, the training set used to train BiGRU-ATT in the code vulnerability feature vector dataset is obtained by data enhancement based on the Multi-Perspective Data Augmentation (MPDA) method, and the training set includes software source code file samples.

[0106] Similarly, in some embodiments, the code vulnerability feature vector dataset is obtained by sequentially processing the obtained software vulnerability dataset using an abstract syntax tree AST extraction algorithm and Word2Vec embedding.

[0107] For example, Figure 3As shown in the figure, the stages of obtaining a software vulnerability detection model can be divided into three stages: training stage, verification stage, and testing stage. Among them, the data set used in the training stage can be called a training set; the data set used in the verification stage can be called a verification set; and the data set used in the testing stage can be called a test set. The data set including the training set, verification set, and test set can be called a code vulnerability feature vector data set.

[0108] Continue reading Figure 3 ,The detection device can obtain the software vulnerability dataset for training, verifying, and testing BiGRU-ATT. The software vulnerability dataset includes software source code file samples.

[0109] Similarly, combined Figure 3 It can be seen that the detection device preprocesses the software source code file sample, and uses the abstract syntax tree AST extraction algorithm to process it, and merges the results of the two, and performs Word2Vec embedding to obtain the code vulnerability feature vector dataset. In order to divide the code vulnerability feature vector dataset into a training set, a verification set, and a test set.

[0110] It is worth noting that in this embodiment, the training set is a data set after data enhancement processing. Data enhancement refers to generating new training samples by transforming existing training data to increase the diversity and quantity of data, thereby improving the generalization ability of the model, preventing overfitting, and increasing the robustness of the model.

[0111] In this embodiment, if Figure 3 As shown, the detection device can use MPDA for data enhancement. Among them, MPDA can be understood as enhancing data from multiple different angles, and each angle corresponds to a different data transformation method. Accordingly, through a variety of transformation methods, more diverse training data is generated to increase the diversity and quantity of training data, break the constraints of data imbalance and small sample problems in training data on detection performance, and obtain high-quality training data. Moreover, it can also improve the learning ability and detection performance of BiGRU-ATT (especially in the three evaluation indicators of accuracy, recall and F1-score). Therefore, the robustness and generalization ability of the software vulnerability detection model are improved, and a software vulnerability detection model that can detect richer vulnerability types with lower time cost and higher detection performance can be trained.

[0112] In some embodiments, Figure 4 As shown in the figure, BiGRU-ATT includes: BiGRU layer, attention mechanism, fully connected layer, and activation function layer.

[0113] Among them, the BiGRU layer is used to encode the method code vulnerability feature vector data, and obtains two hidden states through the GRU in the forward and backward directions, and the two hidden states are spliced.

[0114] For example, the BiGRU layer encodes its input and obtains two hidden states through the GRU in the forward and backward directions, which are then concatenated to obtain the hidden state.

[0115] The attention mechanism is used to perform weighted summation of the concatenated hidden states at each moment to obtain a sequence representation.

[0116] For example, through the attention mechanism, the detection device can perform weighted summation of the hidden states at each moment to obtain a vector of corresponding length as the vector representation of the entire input sequence (i.e., the method code vulnerability feature vector data).

[0117] The fully connected layer is used to perform linear transformation on the sequence representation.

[0118] For example, the vector representation of the entire input sequence obtained by the attention mechanism is input into the fully connected layer so that it can be linearly transformed by the fully connected layer.

[0119] The activation function layer is used to activate the linear transformation results to obtain vulnerability detection results.

[0120] For example, the output of the fully connected layer is the input of the activation function layer. The activation function layer activates the output of the fully connected layer to obtain the vulnerability detection result.

[0121] Combination Figure 4 It can be seen that BiGRU-ATT also includes an input layer and an output layer. In the application stage, the input layer is used to output the method code vulnerability feature vector data to the BiGRU layer. In the training stage, verification stage, and testing stage of obtaining the software vulnerability detection model, the input layer user obtains the code vulnerability feature vector data set. Taking the training stage of obtaining the software vulnerability detection model as an example, the various components of BiGRU-ATT are described in detail. The implementation principles of the verification stage, the testing stage, and the application stage can be found in the description of the training stage, so they will not be repeated here.

[0122] For example, first, the vulnerability sample data of the input layer It can be expressed by formula 1:

[0123]

[0124] The vulnerability sample data may be part of the samples in the training set, the validation set or the test set. is the number of vulnerability sample data (batch_size), is the length of each sequence in the vulnerability sample data (max length), is the embedding dimension, that is, the size of the embedding vector associated with each word or element in the sequence.

[0125] Then, the BiGRU layer can encode its input and obtain two hidden states through the GRU in the forward and backward directions, and then concatenate them to obtain the hidden state . Hidden state It can be expressed by formula 2:

[0126]

[0127] in, express, Represents the dimension of the hidden state. The hidden state is an abstract representation learned by the neural network when processing inputs, representing the internal state of the network during the sequence processing, and its dimension is usually determined by the specific task and network structure.

[0128] Then, through the attention mechanism, the hidden state at each moment is weighted and summed to obtain a vector of length hd , as the representation of the entire sequence. The vector It can be expressed by formula 3:

[0129]

[0130] in, For the The hidden state at a moment. For the The weight of the moment, and It can be expressed by formula 4:

[0131]

[0132] in, For the The attention score at that moment, For the The attention score at that moment, and For the The attention score at each moment can be expressed by Formula 5:

[0133]

[0134] Finally, the vector Through a fully connected layer, a linear transformation is performed and the sigmoid activation function is used for activation to obtain the same vulnerability sample data. The corresponding prediction results . Prediction results It can be expressed by formula 6:

[0135]

[0136] in, is the sigmoid activation function, is a fully connected layer.

[0137] In this embodiment, by using BiGRU-ATT including an input layer, a BiGRU layer, an attention mechanism, a fully connected layer, an activation function layer, and an output layer as a basic network to build a vulnerability detection model, the accuracy, effectiveness, and reliability of vulnerability detection by the vulnerability detection model can be improved.

[0138] In some embodiments, in combination Figure 4 It can be seen that the attention mechanism includes: fully connected layer, flattened layer, attention layer, repeated input layer, transposed layer, multiplication layer and summation layer; among them,

[0139] The output of the BiGRU layer passes through the fully connected layer and the flattening layer in turn to obtain the attention weight vector .

[0140] Combining the above examples with Figure 4 , the output of the BiGRU layer Through a fully connected layer using the activation function tanh and a flattening layer, we get an attention weight vector ,vector It can be expressed by formula 7:

[0141]

[0142] As shown. is the tanh activation function. The function of full connection is to connect each input node to each output node, and each connection has a corresponding weight.

[0143] The attention layer is used to vector Perform softmax operation to obtain the attention weight vector .

[0144] Continuing with the examples above and Figure 4 , based on the attention layer Perform a softmax operation so that the weight of each time step is between 0 and 1, and the sum of the weights is equal to 1. It can be expressed by formula 8:

[0145]

[0146] in, express The purpose of the attention layer operation is to use the attention mechanism to enable the software vulnerability detection model to focus more on the time steps that contribute to the entire sequence. The softmax operation ensures the effective normalization of the attention weights, making it a valid probability distribution.

[0147] The repeated input layer is used to transform the vector This is repeated until we get an output that matches the shape of the BiGRU layer.

[0148] Combining the above examples with Figure 4 , based on the repeated input layer, the vector Repeat the operation, such as hd times, to hide the state to match the shape.

[0149] The transpose layer is used to transpose the repeated input layer.

[0150] Combining the above examples with Figure 4 , based on the transposition layer, the output of the repeated input layer is transposed to obtain the attention matrix . Attention Matrix It can be expressed by formula 9:

[0151]

[0152] in, To repeat the operation hd times in the repeated input layer, that is, the final output of the repeated input layer, To perform the transpose operation.

[0153] The multiplication layer is used to perform element-wise multiplication of the output of the transposed layer and the output of the BiGRU layer to obtain the weighted hidden state representation. .

[0154] Continuing with the examples above and Figure 4 , based on the output of the multiplication layer to the BiGRU layer With the attention matrix Perform element-wise multiplication to obtain the weighted hidden state representation The weighted hidden state representation It is expressed by formula 10:

[0155]

[0156] in, is element-wise multiplication.

[0157] The summation layer is used to represent the weighted hidden state Summing along the dimension of time steps yields a sequence representation.

[0158] Continuing with the examples above and Figure 4 , based on the summation layer, the weighted hidden state is represented The sum is taken along the dimension of time steps to obtain the representation of the entire sequence (i.e., sequence representation). The sequence representation is output to the fully connected layer for subsequent processing. It can be expressed by formula 11:

[0159]

[0160] Based on the above analysis, we can see that the sequence representation It contains a comprehensive representation of vulnerability feature information in the context of the entire sequence, which can reduce the impact of other irrelevant information in the sequence while retaining the key information of vulnerability features. In other words, in the attention mechanism structure design of BiGRU-ATT, the attention weight is used to perform weighted summation on each time step in the input sequence to obtain a comprehensive representation of the entire sequence, which can allow the software vulnerability detection model to pay more attention to the key information of vulnerability features and improve the performance and interpretability of the software vulnerability model. Adding the design of the attention mechanism to BiGRU can make the software vulnerability detection model adapt to different inputs, making it more flexible and conducive to improving the generalization ability of the software vulnerability detection model.

[0161] In some embodiments, there are multiple software vulnerability detection models, and one method code corresponds to one software vulnerability detection model; S103 may include:

[0162] S1031: Input the method code vulnerability feature vector into each software vulnerability detection model respectively.

[0163] Exemplarily, for different method codes, corresponding vulnerability detection models can be trained to input method code vulnerability feature vectors into each software vulnerability detection model.

[0164] S1032: Output the vulnerability detection result corresponding to the corresponding method code in the source code file of the software to be detected based on each software vulnerability detection model, wherein the vulnerability detection result of each software vulnerability detection model includes a detection score used to characterize whether the corresponding method code is a vulnerability code, and location information when the detection score characterizes that the method code is a vulnerability code.

[0165] Accordingly, different software vulnerability detection models are used to detect different method codes, so as to determine the detection scores of the types of vulnerabilities that may be contained in the source code file of the software to be detected through the software vulnerability detection models. The vulnerability detection result is determined according to the vulnerability type and location information of the detection score characterized as the vulnerability code. For example, if the detection score is 1, which is characterized as the vulnerability code, the vulnerability detection result is determined according to the vulnerability type and location information of the detection score being 1.

[0166] In some embodiments, the structural design of the software vulnerability detection tool based on the software vulnerability detection model is as follows: Figure 5 The tool is mainly divided into front-end detection interface functions (such as Figure 5 The tool front end shown in the figure) and the back end intelligent detection service and storage functions (such as Figure 5 tool backend shown).

[0167] The tool front end is mainly responsible for receiving the source code files of the software to be tested submitted by the user, and displaying and downloading the test report of the vulnerability detection results. Figure 5 As shown, the tool front end can detect whether a user has submitted a software source code file to be tested, and if so, receive the software source code file to be tested submitted by the user.

[0168] The tool backend mainly implements the above example to determine the vulnerability detection results of the software source code file to be detected and generate a detection report. Figure 5 As shown, the tool backend can extract and embed source code features for vulnerability detection, so as to implement the operation of obtaining the method code vulnerability feature vector data of the software source code file to be detected in the above example. The method code vulnerability feature vector data is input into the trained BiGRU-ATT (i.e., the software vulnerability detection model). The detection result database is used to store the vulnerability detection results determined by the software vulnerability detection model. For example, the vulnerability detection results of the software source code file to be detected are stored in the detection result database, and a corresponding detection report can be generated. Accordingly, through the detection result management interface, the detection report can be transmitted to the tool front end so that the user can browse and download it through the tool front end. Or, as Figure 5 As shown, the software vulnerability detection model can also transmit the detection report to the tool front end based on the detection result management interface.

[0169] In this embodiment, different method codes are detected as vulnerability codes through different software vulnerability detection models, thereby obtaining corresponding vulnerability detection results, which can improve the comprehensiveness, effectiveness, and reliability of vulnerability detection. It can also facilitate users to perform high-performance, intelligent software vulnerability detection online in real time in software engineering practice to improve software quality and ensure software security.

[0170] According to an embodiment of the present disclosure, the present disclosure also provides a software vulnerability detection device. Figure 6 , Figure 6 A schematic diagram of the structure of the software vulnerability detection device provided by the present disclosure. Figure 6 As shown, the software vulnerability detection device 600 includes:

[0171] The acquisition unit 601 is used to obtain the source code file of the software to be detected;

[0172] A generating unit 602 is used to generate method code vulnerability feature vector data of the software source code file to be detected;

[0173] The determination unit 603 is used to input the method code vulnerability feature vector data into a pre-trained software vulnerability detection model to obtain and output the vulnerability detection result of the software source code file to be detected, wherein the basic network of the software vulnerability detection model is a neural network model BiGRU-ATT that combines a bidirectional gated recurrent unit and an attention mechanism, and the software vulnerability detection model is obtained by the prediction ability of the BiGRU-ATT learning to predict the vulnerability detection result corresponding to the software source code file sample.

[0174] In some embodiments, the generating unit 602 is specifically used to convert the software source code file to be detected into a code block set by using a member method extraction and marking algorithm, wherein the code block set includes a plurality of method code blocks;

[0175] An abstract syntax tree (AST) extraction algorithm is used to generate AST feature information of each method code block, and the AST feature information and the code block set are merged to obtain method code vulnerability feature data corresponding to the software source code file to be detected, and Word2Vec embedding is used to convert the method code vulnerability feature data into method code vulnerability feature vector data.

[0176] In some embodiments, the BiGRU-ATT includes: a BiGRU layer, an attention mechanism, a fully connected layer, and an activation function layer; wherein,

[0177] The BiGRU layer is used to encode the method code vulnerability feature vector data, and obtain two hidden states through GRU in the forward and backward directions, and splice the two hidden states;

[0178] The attention mechanism is used to perform weighted summation of the concatenated hidden states at each moment to obtain a sequence representation;

[0179] The fully connected layer is used to perform a linear transformation on the sequence representation;

[0180] The activation function layer is used to activate the linear transformation result to obtain the vulnerability detection result.

[0181] In some embodiments, the attention mechanism includes: a fully connected layer, a flattened layer, an attention layer, a repeated input layer, a transpose layer, a multiplication layer, and a summation layer; wherein,

[0182] The output of the BiGRU layer passes through the fully connected layer and the flattening layer in turn to obtain the attention weight vector ;

[0183] The attention layer is used to Perform softmax operation to obtain the attention weight vector ;

[0184] The repeated input layer is used to transform the vector Repeat the operation until an output matching the shape of the BiGRU layer is obtained;

[0185] The transposition layer is used to perform a transposition operation on the repeated input layer;

[0186] The multiplication layer is used to perform element-wise multiplication of the output of the transposed layer and the output of the BiGRU layer to obtain a weighted hidden state representation. ;

[0187] The summation layer is used to represent the weighted hidden state Summing along the dimension of time steps yields the sequence representation.

[0188] In some embodiments, the software vulnerability detection model is obtained by training, verifying and testing the BiGRU-ATT based on a code vulnerability feature vector dataset;

[0189] Among them, the training set in the code vulnerability feature vector dataset used to train the BiGRU-ATT is obtained by data enhancement based on the multi-angle data enhancement method MPDA, and the training set includes the software source code file sample.

[0190] In some embodiments, the code vulnerability feature vector dataset is obtained by sequentially processing the acquired software vulnerability dataset using an abstract syntax tree AST extraction algorithm and Word2Vec embedding.

[0191] In some embodiments, there are multiple software vulnerability detection models, and one method code corresponds to one software vulnerability detection model; the determination unit 603 is specifically used to input the method code vulnerability feature vector into each software vulnerability detection model respectively, and output the vulnerability detection result corresponding to the corresponding method code in the software source code file to be detected based on each software vulnerability detection model, wherein the vulnerability detection result of each software vulnerability detection model includes a detection score for characterizing whether the corresponding method code is a vulnerability code, and location information when the detection score characterizes that the method code is a vulnerability code.

[0192] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0193] According to an embodiment of the present disclosure, the present disclosure also provides a computer program product, which includes: a computer program, the computer program is stored in a readable storage medium, at least one processor of an electronic device can read the computer program from the readable storage medium, and at least one processor executes the computer program so that the electronic device executes the solution provided by any of the above embodiments.

[0194] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0195] like Figure 7 As shown, the device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the device 700 can also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0196] A number of components in the device 700 are connected to the I / O interface 705, including: an input unit 706, such as a keyboard, a mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the device 700 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0197] The computing unit 701 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 701 performs the various methods and processes described above, such as a software vulnerability detection method. For example, in some embodiments, the software vulnerability detection method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the computing unit 701, one or more steps of the software vulnerability detection method described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to perform the software vulnerability detection method in any other appropriate manner (e.g., by means of firmware).

[0198] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0199] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0200] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0201] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0202] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0203] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed system, or a server combined with a blockchain.

[0204] It should be understood by those skilled in the art that the embodiments of the present disclosure may be provided as methods, devices, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program codes.

[0205] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, apparatuses (devices), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer executable instructions. These computer executable instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0206] These processor executable instructions may also be stored in a processor readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the processor readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0207] These processor-executable instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0208] Obviously, those skilled in the art can make various changes and modifications to the present disclosure without departing from the spirit and scope of the present disclosure. Thus, if these modifications and variations of the present disclosure fall within the scope of the claims of the present disclosure and their equivalents, the present disclosure is also intended to include these modifications and variations.

Claims

1. A software vulnerability detection method, characterized in that: The method comprises: Obtain the source code file of the software to be tested; Generate method code vulnerability feature vector data of the software source code file to be detected; Inputting the method code vulnerability feature vector data into a pre-trained software vulnerability detection model to obtain and output the vulnerability detection result of the software source code file to be detected; Among them, the basic network of the software vulnerability detection model is a neural network model BiGRU-ATT that combines a bidirectional gated recurrent unit and an attention mechanism, and the software vulnerability detection model is obtained by the prediction ability of the BiGRU-ATT to learn and predict the vulnerability detection results corresponding to the software source code file sample. The BiGRU-ATT includes a BiGRU layer, an attention mechanism, a fully connected layer, and an activation function layer. The BiGRU layer is used to encode the method code vulnerability feature vector data, and obtain two hidden states through GRU in the front and back directions, and the two hidden states are spliced. The attention mechanism is used to weighted sum the spliced ​​hidden states at each moment to obtain a sequence representation. The fully connected layer is used to perform a linear transformation on the sequence representation, and the activation function layer is used to activate the linear transformation result to obtain a vulnerability detection result. The attention mechanism includes a fully connected layer, a flattening layer, an attention layer, a repeated input layer, a transposition layer, a multiplication layer, and a summation layer. The output of the BiGRU layer passes through the fully connected layer and the flattening layer of the attention mechanism in turn to obtain an attention weight vector , the attention layer is used to Perform softmax operation to obtain the attention weight vector , the repeated input layer is used to transform the vector Repeat the operation until an output matching the shape of the hidden state output by the BiGRU layer is obtained, the transposition layer is used to transpose the output vector of the repeated input layer, and the multiplication layer is used to perform element-wise multiplication of the output of the transposition layer and the output of the BiGRU layer to obtain a weighted hidden state representation , the summation layer is used to represent the weighted hidden state Summing along the dimension of time steps yields the sequence representation.

2. The method according to claim 1, characterized in that The method code vulnerability feature vector data of the software source code file to be detected is generated, including: Using a member method extraction and marking algorithm, the source code file of the software to be detected is converted into a code block set, wherein the code block set includes a plurality of method code blocks; The abstract syntax tree (AST) extraction algorithm is used to generate AST feature information for each method code block; The AST feature information and the code block set are combined to obtain method code vulnerability feature data corresponding to the software source code file to be detected; Word2Vec embedding is used to convert the method code vulnerability feature data into method code vulnerability feature vector data.

3. The method according to claim 1, characterized in that The software vulnerability detection model is obtained by training, verifying and testing the BiGRU-ATT based on the code vulnerability feature vector dataset; Among them, the training set in the code vulnerability feature vector dataset used to train the BiGRU-ATT is obtained by data enhancement based on the multi-angle data enhancement method MPDA, and the training set includes the software source code file sample.

4. The method according to claim 3, characterized in that The code vulnerability feature vector dataset is obtained by sequentially processing the obtained software vulnerability dataset using an abstract syntax tree AST extraction algorithm and Word2Vec embedding.

5. The method according to claim 1, characterized in that There are multiple software vulnerability detection models, one method code corresponds to one software vulnerability detection model; inputting the method code vulnerability feature vector data into a pre-trained software vulnerability detection model to obtain and output the vulnerability detection result of the software source code file to be detected, including: Inputting the method code vulnerability feature vectors into each software vulnerability detection model respectively; Based on each software vulnerability detection model, the vulnerability detection result corresponding to the corresponding method code in the software source code file to be detected is output, wherein the vulnerability detection result of each software vulnerability detection model includes a detection score used to characterize whether the corresponding method code is a vulnerability code, and location information when the detection score characterizes that the method code is a vulnerability code.

6. A software vulnerability detection device, characterized in that: include: An acquisition unit, used for obtaining the source code file of the software to be detected; A generating unit, used to generate method code vulnerability feature vector data of the software source code file to be detected; A determination unit, used to input the method code vulnerability feature vector data into a pre-trained software vulnerability detection model, and obtain and output the vulnerability detection result of the software source code file to be detected; Among them, the basic network of the software vulnerability detection model is a neural network model BiGRU-ATT that combines a bidirectional gated recurrent unit and an attention mechanism, and the software vulnerability detection model is obtained by the prediction ability of the BiGRU-ATT to learn and predict the vulnerability detection results corresponding to the software source code file sample. The BiGRU-ATT includes a BiGRU layer, an attention mechanism, a fully connected layer, and an activation function layer. The BiGRU layer is used to encode the method code vulnerability feature vector data, and obtain two hidden states through GRU in the front and back directions, and the two hidden states are spliced. The attention mechanism is used to weighted sum the spliced ​​hidden states at each moment to obtain a sequence representation. The fully connected layer is used to perform a linear transformation on the sequence representation, and the activation function layer is used to activate the linear transformation result to obtain a vulnerability detection result. The attention mechanism includes a fully connected layer, a flattening layer, an attention layer, a repeated input layer, a transposition layer, a multiplication layer, and a summation layer. The output of the BiGRU layer passes through the fully connected layer and the flattening layer of the attention mechanism in turn to obtain an attention weight vector , the attention layer is used to Perform softmax operation to obtain the attention weight vector , the repeated input layer is used to transform the vector Repeat the operation until an output matching the shape of the hidden state output by the BiGRU layer is obtained, the transposition layer is used to transpose the output vector of the repeated input layer, and the multiplication layer is used to perform element-wise multiplication of the output of the transposition layer and the output of the BiGRU layer to obtain a weighted hidden state representation , the summation layer is used to represent the weighted hidden state Summing along the dimension of time steps yields the sequence representation.

7. The software vulnerability detection device according to claim 6, characterized in that: The software vulnerability detection model is obtained by training, verifying and testing the BiGRU-ATT based on the code vulnerability feature vector dataset; Among them, the training set in the code vulnerability feature vector dataset used to train the BiGRU-ATT is obtained by data enhancement based on the multi-angle data enhancement method MPDA, and the training set includes the software source code file sample.

8. The method according to claim 7, characterized in that The code vulnerability feature vector dataset is obtained by sequentially processing the obtained software vulnerability dataset using an abstract syntax tree AST extraction algorithm and Word2Vec embedding.

9. A processor-readable storage medium, characterized in that: The processor-readable storage medium stores a computer program, and the computer program is used to cause the processor to execute the method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program, which implements the steps of the method according to any one of claims 1 to 5 when executed by a processor.

Images