Service software supply chain security management system based on source code detection

Abstract

The invention relates to the field of intelligent management, in particular to a business software supply chain security management system based on source code detection. Semantic analysis is carried out on a business software source code to construct a code abstract syntax tree of the business software source code, semantic coding and semantic association optimization are carried out on each node in the code abstract syntax tree by adopting an artificial intelligence technology based on deep learning, and semantic feature representation of each node is extracted; and then context semantic association coding is carried out on each node to capture overall semantic structure information of the source code, so that intelligent identification of the source code security vulnerabilities is realized. Therefore, the security of the software supply chain can be effectively improved, and the risk caused by security vulnerabilities is reduced.

Description

Technical Field

[0001] The present application relates to the field of intelligent management, and specifically to a business software supply chain security management system based on source code detection. Background Art

[0002] With the acceleration of digital transformation, software development has become an indispensable part of modern enterprises. However, with the globalization and complexity of the software supply chain, software security issues have become increasingly prominent. Any link in the software supply chain may become a target for attackers, among which source code is the core asset of software development and an important part of ensuring software security. Vulnerabilities in source code may not only lead to data leakage, service interruption and other problems, but may also trigger larger security incidents, causing serious economic losses and reputation damage to enterprises and users.

[0003] Traditional software security testing methods mainly include dynamic testing and static analysis. Although dynamic testing (such as fuzz testing, penetration testing, etc.) can simulate attack behaviors in real environments, it relies on specific input samples, has limited test coverage, and has high execution costs, making it difficult to achieve comprehensive testing.

[0004] Static analysis methods check source code or binary files to find potential security issues, such as SQL injection, cross-site scripting (XSS), buffer overflow, etc. However, traditional static analysis technologies mostly rely on predefined rule sets and signature libraries, making it difficult to deeply understand the internal logic of the code, and have limited ability to identify new or complex vulnerabilities, and are prone to false positives and false negatives.

[0005] Therefore, an optimized business software supply chain security management system based on source code detection is expected. Summary of the invention

[0006] This application is made in view of the above problems. One purpose of this application is to provide a business software supply chain security management system based on source code detection.

[0007] The embodiment of the present application provides a business software supply chain security management system based on source code detection, which includes:

[0008] A source code acquisition module is used to obtain the source code of the business software being tested;

[0009] An abstract syntax tree creation module is used to input the source code of the detected business software into a semantic parsing module to obtain a code abstract syntax tree;

[0010] A syntax tree node semantic understanding module, used for performing semantic feature extraction and semantic association optimization on each node in the code abstract syntax tree to obtain a set of semantic optimization encoding feature vectors of the code abstract syntax tree nodes;

[0011] A source code semantic structure encoding module, used for performing context semantic structure encoding on the set of semantic optimization encoding feature vectors of the code abstract syntax tree nodes to obtain a source code semantic structure encoding feature vector;

[0012] The security detection module is used to determine whether the source code has a security vulnerability based on the source code semantic structure encoding feature vector.

[0013] For example, according to the business software supply chain security management system based on source code detection according to an embodiment of the present application, the syntax tree node semantic understanding module includes:

[0014] A node semantic coding unit, used for semantically coding each node in the code abstract syntax tree to obtain a set of semantic coding feature vectors of the code abstract syntax tree nodes;

[0015] The semantic association optimization unit is used to input the set of semantic encoding feature vectors of the code abstract syntax tree nodes into the internal association semantic optimization network to obtain the set of semantic optimization encoding feature vectors of the code abstract syntax tree nodes.

[0016] For example, according to the business software supply chain security management system based on source code detection according to an embodiment of the present application, the node semantic encoding unit is used to:

[0017] Each node in the code abstract syntax tree is input into a node semantic encoder based on the ALBERT model to obtain a set of semantic encoding feature vectors of the code abstract syntax tree nodes.

[0018] For example, according to the business software supply chain security management system based on source code detection according to an embodiment of the present application, the semantic association optimization unit includes:

[0019] A semantic association calculation subunit, used to calculate a semantic association score vector between any two code abstract syntax tree node semantic encoding feature vectors in the set of code abstract syntax tree node semantic encoding feature vectors to obtain a set of code abstract syntax tree node semantic association score vectors;

[0020] A correlation global representation subunit, used to calculate a mean vector of a set of semantic association score vectors of nodes in the code abstract syntax tree to obtain a sequence endogenous correlation global representation vector;

[0021] An association optimization factor calculation subunit, used to calculate the association optimization factor of each code abstract syntax tree node semantic coding feature vector in the set of code abstract syntax tree node semantic coding feature vectors based on the sequence intrinsic correlation global representation vector to obtain a set of association optimization factors;

[0022] A weighting subunit, used for inputting the set of association optimization factors into a Softmax activation function to obtain a set of association optimization weight factors;

[0023] The optimization subunit is used to weight each code abstract syntax tree node semantic coding feature vector in the set of code abstract syntax tree node semantic coding feature vectors by using each associated optimization weight factor in the set of associated optimization weight factors as a weight to obtain the set of code abstract syntax tree node semantic optimization coding feature vectors.

[0024] For example, according to the business software supply chain security management system based on source code detection according to an embodiment of the present application, the semantic association calculation subunit is used to:

[0025] Any two code abstract syntax tree node semantic coding feature vectors in the set of the code abstract syntax tree node semantic coding feature vectors are cascaded and multiplied by a weight coefficient matrix, and then dotted with a bias vector to obtain the code abstract syntax tree node semantic association score vector.

[0026] For example, according to the business software supply chain security management system based on source code detection according to an embodiment of the present application, the associated optimization factor calculation subunit is used to:

[0027] The code abstract syntax tree node semantic encoding feature vector and the sequence endogenous correlation global representation vector are multiplied by different weight coefficient vectors respectively and then added to obtain a semantic correlation coefficient;

[0028] The semantic association coefficient is added with a bias parameter and then passed through a sigmoid activation function to obtain the association optimization factor.

[0029] For example, according to the business software supply chain security management system based on source code detection according to an embodiment of the present application, the source code semantic structure encoding module is used to:

[0030] The set of the semantic optimization encoding feature vectors of the code abstract syntax tree nodes is input into a soft code semantic structure encoding module based on a Tree-LSTM model to obtain the source code semantic structure encoding feature vector.

[0031] For example, according to the business software supply chain security management system based on source code detection according to an embodiment of the present application, the security detection module is used to:

[0032] The source code semantic structure encoding feature vector is input into a source code detection module based on a classifier to obtain a detection result, and the detection result is used to indicate whether there is a security vulnerability.

[0033] According to the business software supply chain security management system based on source code detection of the embodiment of the present application, it performs semantic analysis on the business software source code to construct its code abstract syntax tree, and uses artificial intelligence technology based on deep learning to perform semantic encoding and semantic association optimization on each node in the code abstract syntax tree, extracts the semantic feature representation of each node, and then performs contextual semantic association encoding on each node to capture the overall semantic structure information of the source code, thereby realizing intelligent identification of source code security vulnerabilities. In this way, the security of the software supply chain can be effectively improved and the risks caused by security vulnerabilities can be reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings of the embodiments of the present application are briefly introduced below. Obviously, the drawings described below only relate to some embodiments of the present application, and are not intended to limit the present application.

[0035] Figure 1 A schematic diagram of the application architecture of a business software supply chain security management system based on source code detection in an embodiment of the present application is shown;

[0036] Figure 2 A schematic diagram of the structure of a business software supply chain security management system based on source code detection in an embodiment of the present application is shown;

[0037] Figure 3 A schematic diagram of the structure of a syntax tree node semantic understanding module of a business software supply chain security management system based on source code detection in an embodiment of the present application is shown;

[0038] Figure 4 A flowchart of a business software supply chain security management method based on source code detection in an embodiment of the present application is shown; and

[0039] Figure 5 An application scenario diagram of a business software supply chain security management system based on source code detection in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without creative work also fall within the scope of protection of the present application.

[0041] The terms used in this specification are those common terms currently widely used in the art in consideration of the functions of the present application, but these terms may vary according to the intentions of those skilled in the art, precedents, or new technologies in the art. In addition, specific terms may be selected, and in this case, their detailed meanings will be described in the detailed description of the present application. Therefore, the terms used in the specification should not be understood as simple names, but rather as a general description based on the meaning of the terms and the present application.

[0042] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, any number of different modules can be used and run on the user terminal and / or server. The modules are only illustrative, and different aspects of the system and method can use different modules.

[0043] Flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps may be processed in reverse order or simultaneously as required. At the same time, other operations may also be added to these processes, or a certain step or several steps of operations may be removed from these processes.

[0044] Figure 1 A schematic diagram of the application architecture of a business software supply chain security management system based on source code detection in an embodiment of the present application is shown, including a server 100 and a terminal device 200.

[0045] The terminal device 200 and the server 100 can be connected via the Internet to achieve mutual communication. Optionally, the above-mentioned Internet uses standard communication technology and / or protocol. The Internet is usually the Internet, but it can also be any network, including but not limited to any combination of a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a dedicated network or a virtual private network. In some embodiments, the data exchanged through the network is represented by technologies and / or formats including Hyper Text Markup Language (HTML), Extensible Markup Language (XML), etc. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPsec) can also be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above-mentioned data communication technologies.

[0046] The server 100 can provide various network services for the terminal device 200, wherein the server 100 can be a single server, a server cluster consisting of several servers, or a cloud computing center. Specifically, the server 100 may include a processor 110 (Center Processing Unit, CPU), a memory 120, an input device 130, and an output device 140, etc. The input device 130 may include a keyboard, a mouse, a touch screen, etc., and the output device 140 may include a display device, such as a liquid crystal display (Liquid Crystal Display, LCD), a cathode ray tube (Cathode Ray Tube, CRT), etc.

[0047] The memory 120 may include a read-only memory (ROM) and a random access memory (RAM), and provides the program instructions and data stored in the memory 120 to the processor 110. In the embodiment of the present application, the memory 120 may be used to store the corresponding method of the business software supply chain security management system based on source code detection in the embodiment of the present application.

[0048] The processor 110 calls the program instructions stored in the memory 120, and the processor 110 is used to execute the steps of any one of the business software supply chain security management methods based on source code detection in the embodiments of the present application according to the obtained program instructions.

[0049] In addition, the application architecture diagram in the embodiment of the present application is intended to more clearly illustrate the technical solution in the embodiment of the present application, and does not constitute a limitation on the technical solution provided in the embodiment of the present application. Of course, for other application architectures and business applications, the technical solution provided in the embodiment of the present application is also applicable to similar problems.

[0050] The following is a non-restrictive description of a business software supply chain security management system based on source code detection provided according to at least one embodiment of the present application through several examples or embodiments. As described below, different features in these specific examples or embodiments can be combined with each other without conflicting with each other to obtain new examples or embodiments, and these new examples or embodiments also fall within the scope of protection of the present application.

[0051] In response to the above technical problems, the technical concept of this application is: by semantically parsing the source code of the business software to construct its code abstract syntax tree, and using artificial intelligence technology based on deep learning to semantically encode and optimize the semantic association of each node in the code abstract syntax tree, extract the semantic feature representation of each node, and then by encoding the contextual semantic association of each node to capture the overall semantic structure information of the source code, so as to realize the intelligent identification of source code security vulnerabilities. In this way, the security of the software supply chain can be effectively improved and the risks caused by security vulnerabilities can be reduced.

[0052] Based on this, Figure 2 The schematic diagram of the structure of the business software supply chain security management system 800 based on source code detection in the embodiment of the present application is shown. The business software supply chain security management system 800 based on source code detection includes: a source code acquisition module 810, which is used to acquire the source code of the detected business software; an abstract syntax tree creation module 820, which is used to input the source code of the detected business software into a semantic parsing module to obtain a code abstract syntax tree; a syntax tree node semantic understanding module 830, which is used to perform semantic feature extraction and semantic association optimization on each node in the code abstract syntax tree to obtain a set of code abstract syntax tree node semantic optimization encoding feature vectors; a source code semantic structure encoding module 840, which is used to perform context semantic structure encoding on the set of code abstract syntax tree node semantic optimization encoding feature vectors to obtain a source code semantic structure encoding feature vector; a security detection module 850, which is used to determine whether the source code has a security vulnerability based on the source code semantic structure encoding feature vector.

[0053] Specifically, in the technical solution of the present application, first, the source code of the business software to be detected is obtained. It should be understood that the source code is the core of the software and directly defines the behavior and function of the software. By directly analyzing the source code, the logical structure, data processing flow and potential security vulnerabilities of the software can be most accurately understood. Compared with the method of software execution or binary analysis, the influence of compilation optimization, encryption or runtime environment is avoided, thereby improving the accuracy and reliability of detection.

[0054] Next, considering that the source code itself is in text form, its structural semantic information is relatively complex. In order to more clearly show the grammatical structure and hierarchical relationship of the code, the present application further adopts semantic parsing technology to convert the source code of the detected business software into a code abstract syntax tree (AST). Those of ordinary skill in the art should know that AST is a tree structure that provides a structured code representation method that can intuitively represent the grammatical structure of the source code, including the hierarchical relationship and dependency relationship between grammatical elements. In AST, each node represents a grammatical element in the source code, such as an expression, a statement, a variable declaration, etc. This structured representation makes subsequent analysis and processing more efficient and accurate, and helps to more accurately identify the logical relationship and potential vulnerabilities in the code. In addition, in the process of building AST, the semantic parsing module will ignore some grammatical details (such as spaces, comments, etc.) in the source code that do not affect the program logic, and only retain the elements that affect the program semantics, so that the subsequent analysis process can be simplified, unnecessary calculations can be reduced, and the risk of false positives or omissions caused by grammatical details can be reduced.

[0055] Then, in order to fully understand the semantic information of the code, each node in the code abstract syntax tree is further semantically encoded, and the syntax elements in each node are mapped to a high-dimensional semantic space, capturing the semantic meaning of the code elements, such as type, scope, function, etc., and converting them into numerical feature vector representations to obtain a set of semantic encoding feature vectors of the code abstract syntax tree nodes. In a specific embodiment of the present application, the ALBERT model is used to implement the semantic encoding process of each node in the code abstract syntax tree.

[0056] Secondly, since each code element (i.e., AST node) in the source code does not exist in isolation, but has complex semantic associations. Therefore, in order to effectively capture the interactions and dependencies between nodes, and further enhance the semantic expression capabilities of each node feature, so as to more accurately understand the overall structure and logic of the code, in the technical solution of the present application, an internal association semantic optimization network is introduced to process the set of semantic encoding feature vectors of the code abstract syntax tree nodes. Specifically, the network first quantifies the similarity or difference by calculating the semantic association between any two code abstract syntax tree node semantic encoding feature vectors, so as to understand the semantic structure within the sequence and generate a set of semantic association score vectors. Then, the aggregate information of the set of semantic association score vectors is used as the overall context information, and the association optimization factor of each code abstract syntax tree node semantic encoding feature vector is calculated to quantify the consistency or deviation between the semantic features of each node and the overall semantic structure of the sequence, and this is used as a guide for feature association optimization. Furthermore, after the associated optimization factor is normalized, it is used as a weight coefficient to perform weighted optimization on the set of semantic coding feature vectors of the code abstract syntax tree nodes to obtain a set of semantic optimization coding feature vectors of the code abstract syntax tree nodes, thereby improving the expressive power of the overall semantic structure of the code.

[0057] Accordingly, if Figure 3 As shown, the syntax tree node semantic understanding module 830 includes: a node semantic encoding unit 831, which is used to semantically encode each node in the code abstract syntax tree to obtain a set of code abstract syntax tree node semantic encoding feature vectors; a semantic association optimization unit 832, which is used to input the set of code abstract syntax tree node semantic encoding feature vectors into an internal association semantic optimization network to obtain a set of code abstract syntax tree node semantic optimization encoding feature vectors.

[0058] The node semantic encoding unit 831 is used to input each node in the code abstract syntax tree into a node semantic encoder based on the ALBERT model to obtain a set of node semantic encoding feature vectors of the code abstract syntax tree.

[0059] The semantic association optimization unit 832 includes: a semantic association calculation subunit, which is used to calculate the semantic association score vector between any two code abstract syntax tree node semantic coding feature vectors in the set of code abstract syntax tree node semantic coding feature vectors to obtain a set of code abstract syntax tree node semantic association score vectors; a correlation global representation subunit, which is used to calculate the mean vector of the set of code abstract syntax tree node semantic association score vectors to obtain a sequence endogenous correlation global representation vector; an association optimization factor calculation subunit, which is used to calculate the association optimization factor of each code abstract syntax tree node semantic coding feature vector in the set of code abstract syntax tree node semantic coding feature vectors based on the sequence endogenous correlation global representation vector to obtain a set of association optimization factors; a weighting subunit, which is used to input the set of association optimization factors into the Softmax activation function to obtain a set of association optimization weight factors; an optimization subunit, which is used to use each association optimization weight factor in the set of association optimization weight factors as a weight to weight each code abstract syntax tree node semantic coding feature vector in the set of code abstract syntax tree node semantic coding feature vectors to obtain the set of code abstract syntax tree node semantic optimization coding feature vectors.

[0060] Specifically, the semantic association calculation subunit is used to: cascade any two code abstract syntax tree node semantic coding feature vectors in the set of code abstract syntax tree node semantic coding feature vectors, multiply them by a weight coefficient matrix, and then add them to the bias vector to obtain the code abstract syntax tree node semantic association score vector.

[0061] Specifically, the association optimization factor calculation subunit is used to: multiply the code abstract syntax tree node semantic encoding feature vector and the sequence intrinsic correlation global representation vector by different weight coefficient vectors respectively and then perform addition operations to obtain a semantic association coefficient; add a bias parameter to the semantic association coefficient and then pass it through a sigmoid activation function to obtain the association optimization factor.

[0062] In a specific example, the semantic association optimization unit 832 is used to: process the set of semantic coding feature vectors of the code abstract syntax tree nodes using the following semantic feature association optimization formula to obtain the set of semantic optimized coding feature vectors of the code abstract syntax tree nodes, wherein the semantic feature association optimization formula is:

[0063] F={f1,f2,...,f m}

[0064] r h =W h [f i ;f j]+b h

[0065]

[0066] G i =Softmax[Sigmoid(M m R+H m f i +b m )]

[0067] {x i}={G i ·f i}

[0068] Wherein, F represents the set of semantic encoding feature vectors of the code abstract syntax tree nodes, f1, f2, f i 、f j and f m represents the first, second, i-th, j-th and m-th code abstract syntax tree node semantic coding feature vectors in the set of code abstract syntax tree node semantic coding feature vectors respectively, the value of m is the number of feature vectors in the set of code abstract syntax tree node semantic coding feature vectors, [·,·] represents a cascade operation, W h is the weight coefficient matrix, b h is the bias vector, r h is the hth code abstract syntax tree node semantic association score vector in the set of code abstract syntax tree node semantic association score vectors, the value of T is the number of vectors in the set of code abstract syntax tree node semantic association score vectors, R is the sequence endogenous correlation global representation vector, M m and H m Represent different weight coefficient vectors, b m is the bias parameter, Sigmoid is the sigmoid activation function, Softmax is the normalized exponential function, G i is the i-th correlation optimization factor, x i Represents the semantically optimized encoding feature vector of the i-th code abstract syntax tree node.

[0069] Secondly, in order to effectively integrate the node information of the code abstract syntax tree and fully capture the semantic structure characteristics of the source code, this application uses a soft code semantic structure encoding module based on the Tree-LSTM model to process the set of semantic optimization encoding feature vectors of the code abstract syntax tree node. Specifically, Tree-LSTM (tree-shaped long short-term memory network) is a variant of a recursive neural network (RNN), which is specially designed to process structured input data and can capture the structured dependencies of tree data. In the soft code semantic structure encoding module based on the Tree-LSTM model, each tree node semantic feature corresponds to a long short-term memory (LSTM) unit. Each LSTM unit is responsible for receiving information transmitted by its subordinate child nodes and updating its own state based on this information. Through bottom-up information propagation, each LSTM unit can gradually aggregate the information of its child nodes and finally generate a source code semantic structure encoding feature vector.

[0070] Correspondingly, the source code semantic structure encoding module 840 is used to: input the set of the code abstract syntax tree node semantic optimization encoding feature vectors into the soft code semantic structure encoding module based on the Tree-LSTM model to obtain the source code semantic structure encoding feature vectors.

[0071] It is worth mentioning that the working principle of Tree-LSTM includes: 1. Node representation: Each tree node corresponds to an LSTM unit, each unit receives information from its child nodes and updates its own state based on this information; 2. Information transmission: Information propagates down the edge of the tree, from the leaf node to the root node. Each internal node summarizes the state information of all its child nodes; 3. State update: The LSTM unit of each node updates its own cell state and hidden state through its gating mechanism, and this process takes into account the information from the child nodes. The types of Tree-LSTM include: Child-Sum Tree-LSTM: The cell state of each internal node is obtained by summing the cell states of all its child nodes; N-ary Tree-LSTM: Each internal node is allowed to have multiple child nodes, and each child node participates in the cell state update process.

[0072] Finally, the source code semantic structure encoding feature vector is input into a source code detection module based on a classifier to obtain a detection result, and the detection result is used to indicate whether there is a security vulnerability.

[0073] Correspondingly, the security detection module 850 is used to: input the source code semantic structure encoding feature vector into a source code detection module based on a classifier to obtain a detection result, and the detection result is used to indicate whether there is a security vulnerability.

[0074] It should be understood that the role of the classifier is to use the given categories and known training data to learn classification rules and classifiers, and then classify (or predict) unknown data. Logistic regression and SVM are often used to solve binary classification problems. For multi-class classification problems, logistic regression or SVM can also be used, but multiple binary classifications are required to form a multi-classification. However, this is prone to errors and is not efficient. Commonly used multi-classification methods include the Softmax classification function.

[0075] In a preferred example, considering that the set of semantic coding feature vectors of the code abstract syntax tree node is used to represent the semantic embedded coding features of each node in the code abstract syntax tree (AST) corresponding to the source code of the detected business software. When the set of semantic coding feature vectors of the code abstract syntax tree node is input into the semantic association optimization network of sequence intrinsic correlation analysis, the feature association optimization module based on sequence intrinsic correlation quantification optimizes the feature expression by quantifying the semantic association between each coding feature vector in the set of semantic coding feature vectors of the code abstract syntax tree node, but this will also cause feature information expression redundancy between each code abstract syntax tree node semantic optimization coding feature vector in the set of semantic optimization coding feature vectors of the code abstract syntax tree node. Therefore, when the set of semantic optimization coding feature vectors of the code abstract syntax tree node is input into the soft code semantic structure coding module based on the Tree-LSTM model, due to the redundancy of feature information expression, the semantic tree structure aggregation offset will be introduced. Therefore, it is expected to further improve the semantic tree structure aggregation regression comprehensibility of the source code semantic structure coding feature vector, thereby improving the accuracy of the detection result obtained by inputting the source code detection module based on the classifier.

[0076] Preferably, in an example of the present application, inputting the source code semantic structure encoding feature vector into a source code detection module based on a classifier to obtain a detection result comprises:

[0077] Calculating the sum of the absolute values ​​of each eigenvalue of the source code semantic structure encoding feature vector to obtain a first source code semantic structure encoding space structure value, and calculating the square root of the sum of the squares of each eigenvalue of the source code semantic structure encoding feature vector to obtain a second source code semantic structure encoding space structure value;

[0078] multiplying each feature value of the source code semantic structure encoding feature vector by the first source code semantic structure encoding space structure value and the second source code semantic structure encoding space structure value respectively to obtain a first source code semantic structure encoding structure reference value and a second source code semantic structure encoding structure reference value corresponding to each feature value;

[0079] multiplying each eigenvalue of the source code semantic structure encoding eigenvalue vector by the length of the source code semantic structure encoding eigenvalue vector and the square root of the length to obtain a first source code semantic structure encoding scale transformation value and a second source code semantic structure encoding scale transformation value corresponding to each eigenvalue;

[0080] Dividing the first source code semantic structure coding structure reference value by the difference between the first source code semantic structure coding space structure value and the first source code semantic structure coding scale transformation value to obtain a first source code semantic structure coding transformation adjustment value;

[0081] Dividing the second source code semantic structure coding structure reference value by the difference between the second source code semantic structure coding space structure value and the second source code semantic structure coding scale transformation value to obtain a second source code semantic structure coding transformation adjustment value;

[0082] Calculating a weighted sum of the first source code semantic structure encoding transformation adjustment value and the second source code semantic structure encoding transformation adjustment value to obtain each feature value of the optimized source code semantic structure encoding feature vector;

[0083] The optimized source code semantic structure encoding feature vector is input into a source code detection module based on a classifier to obtain a detection result.

[0084] Here, the source code semantic structure encoding feature vector, denoted as V, is optimized as follows:

[0085]

[0086] v 2i =(α×v i ) / (α-L×v i )

[0087]

[0088] v i ∈V∈R 1×L

[0089] v 1i ∈V1∈R 1×L

[0090] v 2i ∈V2∈R 1×L

[0091] Where V is the feature vector encoding the semantic structure of the source code, R represents a real number set, L represents the length of the feature vector, and v irepresents the eigenvalue of the ith position of the source code semantic structure encoding feature vector, α represents the first source code semantic structure encoding space structure value, β represents the second source code semantic structure encoding space structure value corresponding to each eigenvalue, ⊙ represents the positional point multiplication, Indicates adding by position, v 1i represents the second source code semantic structure coding transformation adjustment value corresponding to each feature value, V1 represents the second source code semantic structure coding transformation adjustment vector composed of each of the second source code semantic structure coding transformation adjustment values, and v 2i represents the first source code semantic structure encoding transformation adjustment value, V2 represents the first source code semantic structure encoding transformation adjustment vector of each of the first source code semantic structure encoding transformation adjustment values, ω represents a weighted hyperparameter, and V' represents an optimized source code semantic structure encoding feature vector.

[0092] In the preferred example, with respect to the spatial structure information of the feature set of the source code semantic structure encoding feature vector in the high-dimensional space, a scale-based frame transformation of each feature value of the source code semantic structure encoding feature vector is performed by taking the class norm space structured representation of the source code semantic structure encoding feature vector as a reference window, and a spatial structure-based frame attention weight adjustment of each feature value of the source code semantic structure encoding feature vector is implemented to ensure the invariance of the spatial transformation (translation, scaling and rotation) of the source code semantic structure encoding feature vector under the interaction of feature space, thereby improving the accuracy of the detection result obtained by inputting the source code semantic structure encoding feature vector into a source code detection module based on a classifier by improving the comprehensibility of the semantic tree structure aggregation regression of the source code semantic structure encoding feature vector.

[0093] Based on the above embodiments, see Figure 4 As shown in FIG. 1 , a flow chart of a business software supply chain security management method based on source code detection in an embodiment of the present application is shown. For example, the business software supply chain security management method based on source code detection can be executed by a server, which can be Figure 1 The server 100 shown in FIG. Figure 4As shown, according to the business software supply chain security management method based on source code detection according to the embodiment of the present application, the steps include: S510, obtaining the source code of the detected business software; S520, inputting the source code of the detected business software into a semantic parsing module to obtain a code abstract syntax tree; S530, performing semantic feature extraction and semantic association optimization on each node in the code abstract syntax tree to obtain a set of semantic optimization encoding feature vectors of the code abstract syntax tree nodes; S540, performing context semantic structure encoding on the set of semantic optimization encoding feature vectors of the code abstract syntax tree nodes to obtain a source code semantic structure encoding feature vector; S550, based on the source code semantic structure encoding feature vector, determining whether the source code has a security vulnerability.

[0094] Here, those skilled in the art can understand that the specific operations of each step in the above-mentioned business software supply chain security management method based on source code detection have been referred to above. Figure 2 to Figure 3 The description of the business software supply chain security management system 800 based on source code detection has been introduced in detail, and therefore, its repeated description will be omitted.

[0095] Figure 5 FIG. 1 is an application scenario diagram of a business software supply chain security management system based on source code detection according to an embodiment of the present application. Figure 5 As shown, in this application scenario, first, the source code of the detected business software is obtained (for example, Figure 5 D), then, the source code of the detected business software is input into a server (for example, Figure 5 In S) shown in , the server can use the business software supply chain security management algorithm based on source code detection to process the source code of the detected business software to obtain a detection result indicating whether there is a security vulnerability.

[0096] Based on the above embodiments, another exemplary embodiment of an electronic device is also provided in the embodiments of the present application. In some possible implementations, the electronic device in the embodiments of the present application may include a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor can implement the steps of the business software supply chain security management method based on source code detection in the above embodiments when executing the program.

[0097] For example, in the case of electronic equipment Figure 1 Taking the server 100 in the example as an example, the processor in the electronic device is the processor 110 in the server 100, and the memory in the electronic device is the memory 120 in the server 100.

[0098] The embodiment of the present application also provides a computer-readable storage medium, on which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, the business software supply chain security management method based on source code detection according to the embodiment of the present application described with reference to the above figures can be executed. The computer-readable storage medium includes, but is not limited to, for example, volatile memory and / or non-volatile memory. The volatile memory may, for example, include a random access memory (RAM) and / or a cache memory (cache), etc. The non-volatile memory may, for example, include a read-only memory (ROM), a hard disk, a flash memory, etc.

[0099] The embodiment of the present application also provides a computer program product or a computer program, which includes computer executable instructions, and the computer executable instructions are stored in a computer-readable storage medium. The processor of the computer device reads the computer executable instructions from the computer-readable storage medium, and the processor executes the computer executable instructions, so that the computer device executes the business software supply chain security management method based on source code detection according to the embodiment of the present application.

[0100] Those skilled in the art will appreciate that the contents disclosed in this application may be subject to various variations and improvements. For example, the various devices or components described above may be implemented by hardware, or by software, firmware, or a combination of some or all of the three.

[0101] In addition, although the present application makes various references to certain units in the system according to embodiments of the present application, any number of different units can be used and run on the client and / or server. The units are only illustrative, and different aspects of the system and method can use different units.

[0102] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present application is not limited to any particular form of combination of hardware and software.

[0103] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art to which this application belongs. It should also be understood that terms such as those defined in common dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant technology, and should not be interpreted in an idealized or extremely formal sense, unless explicitly defined as such herein.

[0104] The above is an explanation of the present application and should not be considered as limiting thereof. Although several exemplary embodiments of the present application have been described, those skilled in the art will readily appreciate that many modifications may be made to the exemplary embodiments without departing from the novel teachings and advantages of the present application.

Claims

1. A business software supply chain security management system based on source code detection, characterized in that: include: A source code acquisition module is used to obtain the source code of the business software being tested; An abstract syntax tree creation module is used to input the source code of the detected business software into a semantic parsing module to obtain a code abstract syntax tree; A syntax tree node semantic understanding module, used for performing semantic feature extraction and semantic association optimization on each node in the code abstract syntax tree to obtain a set of semantic optimization encoding feature vectors of the code abstract syntax tree nodes; A source code semantic structure encoding module, used for performing context semantic structure encoding on the set of semantic optimization encoding feature vectors of the code abstract syntax tree nodes to obtain a source code semantic structure encoding feature vector; The security detection module is used to determine whether the source code has a security vulnerability based on the source code semantic structure encoding feature vector.

2. The business software supply chain security management system based on source code detection according to claim 1 is characterized in that: The syntax tree node semantic understanding module includes: A node semantic coding unit, used for semantically coding each node in the code abstract syntax tree to obtain a set of semantic coding feature vectors of the code abstract syntax tree nodes; The semantic association optimization unit is used to input the set of semantic encoding feature vectors of the code abstract syntax tree nodes into the internal association semantic optimization network to obtain the set of semantic optimization encoding feature vectors of the code abstract syntax tree nodes.

3. The business software supply chain security management system based on source code detection according to claim 2 is characterized in that: The node semantic encoding unit is used to: Each node in the code abstract syntax tree is input into a node semantic encoder based on the ALBERT model to obtain a set of semantic encoding feature vectors of the code abstract syntax tree nodes.

4. The business software supply chain security management system based on source code detection according to claim 3 is characterized in that: The semantic association optimization unit comprises: A semantic association calculation subunit, used to calculate a semantic association score vector between any two code abstract syntax tree node semantic encoding feature vectors in the set of code abstract syntax tree node semantic encoding feature vectors to obtain a set of code abstract syntax tree node semantic association score vectors; A correlation global representation subunit, used to calculate a mean vector of a set of semantic association score vectors of nodes in the code abstract syntax tree to obtain a sequence endogenous correlation global representation vector; An association optimization factor calculation subunit, used to calculate the association optimization factor of each code abstract syntax tree node semantic coding feature vector in the set of code abstract syntax tree node semantic coding feature vectors based on the sequence intrinsic correlation global representation vector to obtain a set of association optimization factors; A weighting subunit, used for inputting the set of association optimization factors into a Softmax activation function to obtain a set of association optimization weight factors; The optimization subunit is used to weight each code abstract syntax tree node semantic coding feature vector in the set of code abstract syntax tree node semantic coding feature vectors by using each associated optimization weight factor in the set of associated optimization weight factors as a weight to obtain the set of code abstract syntax tree node semantic optimization coding feature vectors.

5. The business software supply chain security management system based on source code detection according to claim 4 is characterized in that: The semantic association calculation subunit is used to: Any two code abstract syntax tree node semantic coding feature vectors in the set of the code abstract syntax tree node semantic coding feature vectors are cascaded and multiplied by a weight coefficient matrix, and then dotted with a bias vector to obtain the code abstract syntax tree node semantic association score vector.

6. The business software supply chain security management system based on source code detection according to claim 5 is characterized in that: The associated optimization factor calculation subunit is used to: The code abstract syntax tree node semantic encoding feature vector and the sequence endogenous correlation global representation vector are multiplied by different weight coefficient vectors respectively and then added to obtain a semantic correlation coefficient; The semantic association coefficient is added with a bias parameter and then passed through a sigmoid activation function to obtain the association optimization factor.

7. The business software supply chain security management system based on source code detection according to claim 6 is characterized in that: The source code semantic structure encoding module is used to: The set of the semantic optimization encoding feature vectors of the code abstract syntax tree nodes is input into a soft code semantic structure encoding module based on a Tree-LSTM model to obtain the source code semantic structure encoding feature vector.

8. The business software supply chain security management system based on source code detection according to claim 7 is characterized in that: The safety detection module is used to: The source code semantic structure encoding feature vector is input into a source code detection module based on a classifier to obtain a detection result, and the detection result is used to indicate whether there is a security vulnerability.

Images