A POS machine intelligent early warning method and device

Abstract

The invention discloses a POS machine intelligent early warning method and device, which relates to the field of data security technology; the code fragments corresponding to the function execution nodes are split into statements to obtain a first node set, the node features of the nodes in the first node set are extracted to obtain a first feature, the edge features of the edges connected to the nodes are extracted to obtain a second feature, the valid nodes are determined according to the first feature and the second feature, and the final feature vector corresponding to each function execution node is determined according to the valid nodes; all the final feature vectors are substituted into the vulnerability detection model to obtain the vulnerability prediction score, and an early warning is issued according to the vulnerability prediction score. The first feature and the second feature are extracted from the nodes to determine the valid nodes, and then the features of the current function execution node are determined according to all the valid nodes, and then the vulnerability detection is performed according to the features of all the function execution nodes, so as to improve the accuracy of the vulnerability detection and the security of the system.

Description

Technical Field

[0001] The present invention belongs to the technical field of data security, and in particular relates to an intelligent early warning method and device for a POS machine. Background Art

[0002] POS (Point of Sale) machines are terminal devices used by merchants to process consumer payments. They are widely used in retail, catering, transportation and other industries. In the modern business environment, POS machines are not only used to accept payments from bank cards such as credit cards and debit cards, but also support multiple payment methods such as QR code payment and NFC payment. However, with the diversification of payment methods and the continuous increase in payment transactions, the security risks and operational problems faced by POS machines are becoming increasingly serious.

[0003] Patent CN117093916B discloses an intelligent monitoring system for POS machines based on the Internet of Things technology. By classifying the commodities in the POS machine consumption data collected based on the Internet of Things technology, and deeply analyzing the consumption habits of consumers at various consumption locations and the consumption characteristics of each location, the similar consumption habits between consumer groups are identified. Using these data and combining the historical consumption habit rules, a weight model is constructed. Through the differences in consumption habits between consumer groups and the differences in consumption locations, the differences in consumption characteristics of consumers in the current POS machine data are comprehensively evaluated to ensure the accurate identification of consumer consumption habits and reduce the interference of randomness of consumption locations on monitoring results, thereby improving the accuracy of abnormal monitoring. However, this solution does not take into account the security vulnerabilities of the firmware and operating system running the POS machine. When the firmware and operating system of the POS machine have security vulnerabilities, attackers can use remote attacks to tamper with the firmware of the POS machine or implant malware using the vulnerabilities, causing transaction data to be leaked or tampered with, making the system less secure. Summary of the invention

[0004] The purpose of the present invention is to solve the problem that attackers can exploit vulnerabilities to tamper with the firmware of the POS machine or implant malicious software through remote attacks, causing transaction data to be leaked or tampered with, thereby reducing the security of the system, and to propose a POS machine intelligent early warning method and device.

[0005] In the first aspect of the present invention, a POS machine intelligent early warning method is first proposed, the method comprising:

[0006] After the target source code is normalized, a program dependency is constructed to obtain a program dependency graph, and the program dependency graph is traversed to obtain a function execution node list; the target source code is the code of any software installed on the POS machine;

[0007] Perform statement splitting on the code snippet corresponding to the target function execution node to obtain a first node set; the target function execution node is any one in the function execution node list;

[0008] For each node in the first node set, extract node features of the node to obtain a first feature, extract edge features of the edge connected to the node to obtain a second feature, determine whether the node is a valid node based on the first feature and the second feature, and determine the target function feature corresponding to the target function execution node based on all valid nodes;

[0009] Clustering all function execution nodes according to the target function characteristics, and constructing a global relationship graph according to the clustering results, and determining a final feature vector corresponding to each function execution node according to the global relationship graph;

[0010] Substitute all final feature vectors into the vulnerability detection model to obtain the vulnerability prediction score corresponding to each function execution node. If the vulnerability prediction score of a function execution node is greater than the preset vulnerability score, an early warning is sent to the POS machine.

[0011] Optionally, after the target source code is normalized, a program dependency graph is obtained by constructing a program dependency graph, including:

[0012] The target source code is screened by using a regular expression, and non-ASCII characters and comments in the target source code are removed to obtain a first source code;

[0013] Normalizing all names in the first source code to obtain a second source code, and performing dependency analysis on the second source code using a static analysis tool to obtain a program dependency graph.

[0014] Optionally, for each node in the first node set, performing node feature extraction on the node to obtain a first feature, and performing edge feature extraction on an edge connected to the node to obtain a second feature includes:

[0015] Preprocess the sentence corresponding to the target node to obtain a target sequence, and substitute the target sequence into the CodeBERT model to obtain a target embedding matrix; the target node is any node in the first node set;

[0016] Substituting the target embedding matrix into a bidirectional long short-term memory network to obtain a contextual semantic matrix, and inputting the contextual semantic matrix into a Transformer encoder to obtain a first feature;

[0017] The degree centrality and betweenness centrality corresponding to the target node are determined according to the program dependency graph, and the degree centrality and betweenness centrality are used as scalar features to be concatenated with the target embedding matrix to obtain a second feature.

[0018] Optionally, determining whether the node is a valid node according to the first feature and the second feature, and determining the target function feature corresponding to the target function execution node according to all valid nodes includes:

[0019] For each node in the first node set, normalize the degree centrality and betweenness centrality of all nodes to obtain a centrality group set, sort the centrality group set, and obtain nodes corresponding to a preset number of centrality groups as valid nodes;

[0020] For each valid node, a first feature of the valid node and a second feature of a neighboring node of the valid node are linearly transformed to obtain a hidden feature corresponding to the valid node;

[0021] Performing weighted fusion on the first feature of the valid node and the first features of the valid nodes adjacent to the valid node to obtain an aggregate feature;

[0022] After the hidden feature and the aggregated feature are fused, a node feature matrix corresponding to the node is obtained by performing a nonlinear transformation through an activation function, and a weighted sum is performed on the feature matrices corresponding to all valid nodes to obtain the target function feature corresponding to the target function execution node.

[0023] Optionally, determining a final feature vector corresponding to each function execution node according to the global relationship graph includes:

[0024] For each function execution node, according to the program dependency graph, the upstream related neighbor nodes and the downstream related neighbor nodes connected to the function execution node are obtained to obtain an upstream node set and a downstream node set;

[0025] Aggregate the function execution node features in the upstream node set to obtain the upstream features, and aggregate the function execution node features in the downstream node set to obtain the downstream features;

[0026] The objective function features, upstream features and downstream features of the function execution node are weightedly fused to obtain the final feature vector of the function execution node.

[0027] In a second aspect of the present invention, a POS machine intelligent early warning device is provided, comprising:

[0028] A function execution node determination module is used to perform program dependency construction on the target source code after normalization processing to obtain a program dependency graph, and traverse the program dependency graph to obtain a function execution node list; the target source code is the code of any installed software on the POS machine;

[0029] A statement splitting module, used for performing statement splitting on a code fragment corresponding to a target function execution node to obtain a first node set; the target function execution node is any one in the function execution node list;

[0030] A valid node determination module is used to extract node features of each node in the first node set to obtain a first feature, extract edge features of an edge connected to the node to obtain a second feature, determine whether the node is a valid node based on the first feature and the second feature, and determine the target function feature corresponding to the target function execution node based on all valid nodes;

[0031] A node final feature vector determination module is used to cluster all function execution nodes according to the target function characteristics, and to construct a global relationship graph according to the clustering results, and to determine the final feature vector corresponding to each function execution node according to the global relationship graph;

[0032] The early warning module is used to substitute all final feature vectors into the vulnerability detection model to obtain the vulnerability prediction score corresponding to each function execution node. If the vulnerability prediction score of a function execution node is greater than the preset vulnerability score, an early warning is sent to the POS machine.

[0033] Optionally, the function execution node determination module includes:

[0034] A code screening module, used for screening the target source code by using a regular expression, removing non-ASCII characters and comments in the target source code to obtain a first source code;

[0035] The dependency analysis module is used to perform name normalization on all names in the first source code to obtain a second source code, and perform dependency analysis on the second source code through a static analysis tool to obtain a program dependency graph.

[0036] Optionally, the valid node determination module includes:

[0037] A target embedding matrix determination module is used to preprocess the sentence corresponding to the target node to obtain a target sequence, and substitute the target sequence into the CodeBERT model to obtain a target embedding matrix; the target node is any node in the first node set;

[0038] A first feature determination module is used to substitute the target embedding matrix into a bidirectional long short-term memory network to obtain a context semantic matrix, and input the context semantic matrix into a Transformer encoder to obtain a first feature;

[0039] The second feature determination module is used to determine the degree centrality and betweenness centrality corresponding to the target node according to the program dependency graph, and concatenate the degree centrality and betweenness centrality as scalar features with the target embedding matrix to obtain the second feature.

[0040] Optionally, the valid node determination module further includes:

[0041] A node sorting module, for each node in the first node set, normalizing the degree centrality and betweenness centrality of all nodes to obtain a centrality group set, sorting the centrality group set, and obtaining nodes corresponding to a preset number of centrality groups as valid nodes;

[0042] A hidden feature determination module is used to obtain a hidden feature corresponding to each valid node by performing a linear transformation on a first feature of the valid node and a second feature of a neighboring node of the valid node;

[0043] An aggregate feature determination module, used for performing weighted fusion of the first feature of the valid node and the first features of the valid nodes adjacent to the valid node to obtain an aggregate feature;

[0044] The objective function feature determination module is used to perform feature fusion on the hidden feature and the aggregate feature, perform nonlinear transformation through the activation function to obtain the node feature matrix corresponding to the node, and perform weighted summation on the feature matrices corresponding to all valid nodes to obtain the objective function feature corresponding to the objective function execution node.

[0045] Optionally, the node final feature vector determination module includes:

[0046] A neighbor node determination module is used to obtain, for each function execution node, upstream related neighbor nodes and downstream related neighbor nodes connected to the function execution node according to the program dependency graph to obtain an upstream node set and a downstream node set;

[0047] A feature aggregation module is used to aggregate the function execution node features in the upstream node set to obtain the upstream features, and to aggregate the function execution node features in the downstream node set to obtain the downstream features;

[0048] The feature fusion module is used to perform weighted fusion on the objective function features, upstream features and downstream features of the function execution node to obtain the final feature vector of the function execution node.

[0049] Beneficial effects of the present invention:

[0050] The present invention proposes an intelligent early warning method for a POS machine. After the target source code is normalized, a program dependency is constructed to obtain a program dependency graph, and the program dependency graph is traversed to obtain a function execution node list. The target source code is the code of any software installed on the POS machine. The code fragment corresponding to the target function execution node is split into statements to obtain a first node set. The target function execution node is any one in the function execution node list. For each node in the first node set, a node feature is extracted to obtain a first feature, and an edge feature is extracted to obtain a second feature for an edge connected to the node. Whether the node is a valid node is determined according to the first feature and the second feature, and a target function feature corresponding to the target function execution node is determined according to all valid nodes. All function execution nodes are clustered according to the target function feature, and a global relationship graph is constructed according to the clustering result, and a final feature vector corresponding to each function execution node is determined according to the global relationship graph. All the final feature vectors are substituted into a vulnerability detection model to obtain a vulnerability prediction score corresponding to each function execution node. If there is a function execution node with a vulnerability prediction score greater than a preset vulnerability score, an early warning is sent to the POS machine. By extracting the first and second features of the node, we can determine whether the node is a valid node, which helps the system determine which nodes have an important impact on the system security. The characteristics of the current function execution node are determined based on all valid nodes, and then vulnerability detection is performed based on the characteristics of all function execution nodes. This dual strategy of performing local analysis followed by global analysis can not only accurately identify potential vulnerabilities, but also grasp the security risks of the program from a global perspective, thereby improving the accuracy of vulnerability detection and the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The present invention will be further described below in conjunction with the accompanying drawings.

[0052] Figure 1 A flowchart of a POS machine intelligent early warning method is provided for an embodiment of the present invention;

[0053] Figure 2 A structural schematic diagram of an intelligent early warning device for a POS machine is provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0054] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. The term "and / or" herein is only a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the present invention, the description of "first", "second", etc. is only used for descriptive purposes, and cannot be understood as indicating or implying its relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" can explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on the ability of ordinary technicians in the field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0055] Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative work shall fall within the scope of protection of the present invention.

[0056] The embodiment of the present invention provides a POS machine intelligent early warning method. Figure 1 , Figure 1 A flowchart of a POS machine intelligent early warning method provided by an embodiment of the present invention. The method comprises the following steps:

[0057] S101, after normalizing the target source code, construct a program dependency to obtain a program dependency graph, and traverse the program dependency graph to obtain a function execution node list;

[0058] S102, performing statement splitting on the code snippet corresponding to the target function execution node to obtain a first node set;

[0059] S103, for each node in the first node set, extract node features of the node to obtain a first feature, extract edge features of the edge connected to the node to obtain a second feature, determine whether the node is a valid node based on the first feature and the second feature, and determine the target function feature corresponding to the target function execution node based on all valid nodes;

[0060] S104, clustering all function execution nodes according to the target function characteristics, and constructing a global relationship graph according to the clustering results, and determining a final feature vector corresponding to each function execution node according to the global relationship graph;

[0061] S105, substitute all the final feature vectors into the vulnerability detection model to obtain the vulnerability prediction score corresponding to each function execution node. If there is a function execution node with a vulnerability prediction score greater than a preset vulnerability score, send an early warning to the POS terminal.

[0062] The target source code is the code of any software installed on the POS machine; the target function execution node is any one in the function execution node list.

[0063] A POS machine intelligent early warning method provided based on an embodiment of the present invention determines whether a node is a valid node by extracting a first feature and a second feature of the node, thereby helping the system to determine which nodes have an important impact on the system security, and determines the characteristics of the current function execution node based on all valid nodes, and then performs vulnerability detection based on the characteristics of all function execution nodes. This dual strategy of first performing local analysis and then performing global analysis can not only accurately identify potential vulnerabilities, but also grasp the security risks of the program from a global level, thereby improving the accuracy of vulnerability detection and enhancing the security of the system.

[0064] In one implementation, by constructing and traversing a program dependency graph and extracting and analyzing features for each function execution node, the system can automatically identify potential security vulnerabilities without manual review, which not only improves detection efficiency but also enables timely discovery of potential risks in source code.

[0065] In one implementation, a program dependency construction is performed to obtain a program dependency graph, specifically, the source code is first analyzed through an abstract syntax tree, and then a control flow graph and a data flow graph are established to finally form a program dependency graph. The nodes in the program dependency graph can be computational nodes: representing a statement in the program, function call nodes: representing function calls in the program, conditional nodes: representing conditional statements, loop nodes: representing loop statements; the edges in the program dependency graph can be data dependency edges: representing that the data of a node depends on the results of other nodes, control dependency edges: representing dependencies on control flow, data flow edges: representing that data flows from one statement to another; the code fragments of the target function execution nodes are split according to grammatical rules to obtain independent statements, and finally a first node set is obtained.

[0066] In one implementation, all function execution nodes are clustered according to the characteristics of the target function, and a global relationship graph is constructed based on the clustering results. Specifically, all function execution nodes are clustered according to the K-means clustering algorithm to obtain different clusters, and the centroid is determined for each cluster. The centroid is the characteristic average of all functions in the cluster. The Euclidean distance between the function node in the function group and the centroid is calculated as the weight of the edge between the function node and the centroid, and the Euclidean distance between all function nodes and the centroid is calculated to construct a global relationship graph.

[0067] In one implementation, the vulnerability detection model is a vulnerability detection model that combines static and dynamic analysis, such as Valgrind and AddressSanitizer. The parameters of the model are obtained by training based on historical software source code data; the preset vulnerability score is determined by the technical staff.

[0068] In one implementation, the code of each function execution node is split into statements to obtain detailed features of each node, which can fully understand the function, behavior and relationship of each node with other nodes; the dual extraction of node features and edge features makes vulnerability detection not limited to single-dimensional analysis, but evaluates the security of the program from multiple angles.

[0069] In one implementation, by clustering the target function features, the relationship between function execution nodes can be identified at the global level, which not only helps understand the dependencies between different nodes, but also identifies sets of functions that may have similar vulnerabilities. Function execution node clustering helps to discover functions with similar behaviors in the code, avoiding missing potential interconnected vulnerabilities when analyzing a single node.

[0070] In one implementation, by training a vulnerability detection model and substituting the feature vector of each node into the model, the system can automatically evaluate the vulnerability risk of each function execution node, generate a vulnerability prediction score, and then combine historical data and known vulnerability types to improve the accuracy of vulnerability detection; when it is detected that the vulnerability prediction score of a function execution node exceeds the preset threshold, the system will immediately send an early warning to the POS machine, thereby helping developers or operation and maintenance teams to respond quickly, fix vulnerabilities, and prevent vulnerabilities from being maliciously exploited.

[0071] In one implementation, by combining local feature analysis and global relationship graphs, the system can conduct comprehensive security assessments on programs at different levels. Combining local and global analysis methods can more accurately discover complex security vulnerabilities than relying solely on static code inspection or dynamic execution analysis, thereby improving the efficiency of detecting vulnerabilities.

[0072] In one embodiment, after the target source code is normalized, program dependency construction is performed to obtain a program dependency graph, including:

[0073] The target source code is filtered by using a regular expression, and non-ASCII characters and comments in the target source code are removed to obtain a first source code;

[0074] All names in the first source code are normalized to obtain a second source code, and dependency analysis is performed on the second source code using a static analysis tool to obtain a program dependency graph.

[0075] In one implementation, regular expressions are used to remove non-ASCII characters and comments in the source code, which can greatly simplify the structure of the code and reduce the interference of irrelevant information. Comments usually contain developer instructions and document information, but have no direct impact on automated analysis. After removing comments, more attention can be paid to program logic. Non-ASCII characters may also be characters in external code libraries or specific language environments. Removing these characters can eliminate potential encoding problems and simplify analysis. By normalizing all names in the source code, such as variable names, function names, and class names, the consistency of all naming can be ensured. For example, all variable names or function names can be converted to a unified format such as lowercase letters, a unified prefix, etc., to avoid misunderstandings or analysis errors caused by non-standard naming. The normalized code structure is more standardized, which is convenient for subsequent static analysis and dependency analysis. Static analysis tools can be SonarQube, Checkmarx, Fortify, etc.

[0076] In one implementation, by removing unnecessary characters and unifying the naming, the source code becomes clearer and more standardized, which can effectively improve the understanding and analysis accuracy of the static analysis tools; static analysis tools usually build program dependency graphs or execution path graphs by scanning and parsing the code. After removing irrelevant information such as comments and non-ASCII characters, the tool will not be affected by irrelevant code fragments during analysis, and can better identify code dependencies and potential vulnerabilities.

[0077] In one embodiment, for each node in the first node set, performing node feature extraction on the node to obtain a first feature, and performing edge feature extraction on an edge connected to the node to obtain a second feature includes:

[0078] Preprocess the sentence corresponding to the target node to obtain the target sequence, and substitute the target sequence into the CodeBERT model to obtain the target embedding matrix; the target node is any node in the first node set;

[0079] Substitute the target embedding matrix into the bidirectional long short-term memory network to obtain the contextual semantic matrix, and input the contextual semantic matrix into the Transformer encoder to obtain the first feature;

[0080] The degree centrality and betweenness centrality corresponding to the target node are determined according to the program dependency graph, and the degree centrality and betweenness centrality are used as scalar features to concatenate with the target embedding matrix to obtain the second feature.

[0081] In one implementation, the target sequence is generated by preprocessing the sentence corresponding to the target node. The preprocessing is to use sequence padding to pad or truncate the token sequence of each node to unify the length, and then use byte pair encoding (BPE) to decompose rare words into sub-word units. This step ensures that the model receives a standardized token sequence with clear semantics.

[0082] In one implementation, the preprocessing is to use sequence padding to fill or truncate the token sequence of each node to unify the length, and then use byte pair encoding to decompose rare words into sub-word units.

[0083] In one implementation, the target sequence is substituted into the CodeBERT model to generate a target embedding matrix. CodeBERT is a pre-trained model based on the Transformer architecture, which is specially trained for source code. It can capture the contextual information and grammatical structure in the code snippet, which enables it to have a deep understanding of the semantics of the code, especially in the analysis of complex code structures.

[0084] In one implementation, the context of the target node is further modeled by inputting the target embedding matrix into a bidirectional long short-term memory network BiLSTM. BiLSTM can effectively capture the contextual relationship in the sequence data, which is especially important for the complex logic in the code and can identify the dependencies between variables, functions or code blocks. The contextual semantics obtained by BiLSTM is further encoded by Transformer to further enhance the understanding of the code semantics. Transformer has a strong global information modeling capability and is particularly good at handling long-distance dependencies.

[0085] In one implementation, by calculating the degree centrality and betweenness centrality of the target node, we can understand the importance and position of the node in the program dependency graph. The degree centrality measures the number of edges connected to the node, while the betweenness centrality measures the role of the node as an information transfer intermediary in the program graph. These structural features help to better understand the role of the node in the program, thereby increasing the sensitivity to structural information in the model. The degree centrality and betweenness centrality are spliced ​​with the embedding matrix of the target node, integrating the semantic information and structural information of the node, so that the model can not only rely on semantic features when performing tasks, but also combine the structural features of the program to obtain a more comprehensive representation.

[0086] In one implementation, by fusing the semantic features, i.e., the contextual information obtained by CodeBERT and BiLSTM, and the structural features, i.e., degree centrality and betweenness centrality, both the content and structural features of the program can be considered simultaneously, which helps to improve the performance of the model in complex tasks and improves the accuracy of detection. The nodes and edges in the program graph are not just independent entities, but the relationships and dependencies between them play a vital role in executing the program. By combining the code semantics and structural information, the model can understand the meaning of the code more comprehensively and deeply, and improve its ability to handle complex code tasks.

[0087] In one embodiment, determining whether the node is a valid node according to the first feature and the second feature, and determining the target function feature corresponding to the target function execution node according to all valid nodes includes:

[0088] For each node in the first node set, the degree centrality and betweenness centrality of all nodes are normalized to obtain a centrality group set, the centrality group set is sorted, and the nodes corresponding to the first preset number of centrality groups are recorded as valid nodes;

[0089] For each valid node, a first feature of the valid node and a second feature of a neighboring node of the valid node are linearly transformed to obtain a hidden feature corresponding to the valid node;

[0090] Performing weighted fusion on the first feature of the valid node and the first features of the valid nodes adjacent to the valid node to obtain an aggregate feature;

[0091] After the hidden feature and the aggregated feature are fused, a nonlinear transformation is performed through the activation function to obtain the node feature matrix corresponding to the node, and the feature matrices corresponding to all valid nodes are weighted summed to obtain the target function feature corresponding to the target function execution node.

[0092] In one implementation, the degree centrality and betweenness centrality of each node are normalized, and valid nodes are screened according to the normalized degree centrality and betweenness centrality. This takes into account the structural impact of the nodes in the graph and more fairly reflects the importance of the nodes in the graph.

[0093] In one implementation, the degree centrality and betweenness centrality of all nodes are normalized to obtain a centrality group set. Specifically, the minimum value Amin and the maximum value Amax of the degree centrality of all nodes, the minimum value Bmin and the maximum value Bmax of the betweenness centrality of all nodes are obtained, the difference between Amax and Amin is calculated to obtain the degree centrality target difference, the difference between Bmax and Bmin is calculated to obtain the betweenness centrality target difference, the normalized degree centrality of the current node is the degree centrality of the current node minus Amin divided by the degree centrality target difference, the normalized betweenness centrality of the current node is the betweenness centrality of the current node minus Bmin divided by the betweenness centrality target difference, for each node, the normalized degree centrality and betweenness centrality are combined and recorded as a centrality group, the average value of the normalized degree centrality and betweenness centrality is calculated for each centrality group to obtain a ranking value, the groups are sorted from large to small according to the ranking value, and the nodes corresponding to a preset number of centrality groups are obtained and recorded as valid nodes; the preset number is determined by the technical staff.

[0094] In one implementation, a weighted sum is performed on the feature matrices corresponding to all valid nodes to obtain the target function feature corresponding to the target function execution node. Specifically, for each valid node, the ranking of the node in the centrality group set is obtained, and a weight is assigned to the feature matrix of each valid node according to the ranking, wherein the weights of the top three valid nodes are assigned 20% respectively, and the remaining 40% is equally divided among the remaining valid nodes, and the total weight of the valid nodes is 1. According to the weight corresponding to each valid node, the weighted sum is performed on the feature matrix corresponding to the valid node to obtain the target function feature corresponding to the target function execution node.

[0095] In one implementation, for each valid node, a hidden feature is obtained by linearly transforming the first feature of the node, such as semantic information, and the second feature of its neighboring nodes, such as structural information. This can establish associations between different types of feature semantics and structures, promote information fusion, and help the model understand the relationship between the node and its neighbors from multiple aspects, thereby improving the accuracy of fault detection. The features of the valid node and its neighbors are weighted and fused to generate aggregated features, thereby strengthening the influence of neighboring nodes on the target node, especially in program graphs with complex node relationships, and effectively extracting key contextual information.

[0096] In one implementation, hidden features are fused with aggregated features and transformed nonlinearly through activation functions to obtain more complex and expressive node features, so that the model can capture more nonlinear relationships, which is especially important for complex dependencies and interactions in program graphs. Nonlinear transformation introduces nonlinear features through activation functions, which helps the model process more complex patterns and relationships, avoids the limitations of linear feature expression, and thus improves the model's fitting ability. The activation function is Sigmoid.

[0097] In one implementation, the objective function features are obtained by weighted summing up the feature matrices of all valid nodes. This not only combines the multi-dimensional features of each valid node to generate a final feature representation that meets the target task, but also helps to improve the accuracy and effectiveness of task execution. By combining the degree centrality and betweenness centrality structural information with the semantic information of models such as CodeBERT, the model can take into account both the function and structure of the code when understanding it, improve the effectiveness of task execution, and better deal with complex dependencies in the program.

[0098] In one embodiment, determining the final feature vector corresponding to each function execution node according to the global relationship graph includes:

[0099] For each function execution node, according to the program dependency graph, the upstream related neighbor nodes and the downstream related neighbor nodes connected to the function execution node are obtained to obtain the upstream node set and the downstream node set;

[0100] Aggregate the function execution node features in the upstream node set to obtain the upstream features, and aggregate the function execution node features in the downstream node set to obtain the downstream features;

[0101] The objective function features, upstream features and downstream features of the function execution node are weightedly fused to obtain the final feature vector of the function execution node.

[0102] In one implementation, by obtaining the upstream node set and the downstream node set, the dependency relationship before and after the function execution node can be captured. Not only the local information of the node is considered, but also its contextual information in the program is incorporated to help the model understand the environment of function execution.

[0103] In one implementation, the objective function features, upstream features and downstream features of the function execution node are weightedly fused to obtain a final feature vector of the function execution node in which the upstream features account for 30%, the downstream features account for 30%, and the objective function features account for 40%.

[0104] In one implementation, the objective function features, upstream features, and downstream features of the function execution node are weightedly fused to ensure that important upstream and downstream information and node features are fully utilized, and to more accurately reflect the multi-dimensional features of the function execution node, including its semantics, structure, and upstream and downstream dependencies.

[0105] Based on the same inventive concept, the present invention also provides a POS machine intelligent early warning device. Figure 2 , Figure 2 A schematic diagram of the structure of a POS machine intelligent early warning device provided by an embodiment of the present invention includes:

[0106] The function execution node determination module is used to construct a program dependency after normalizing the target source code to obtain a program dependency graph, and traverse the program dependency graph to obtain a function execution node list; the target source code is the code of any software installed on the POS machine;

[0107] A statement splitting module, used for performing statement splitting on a code fragment corresponding to a target function execution node to obtain a first node set; the target function execution node is any one in the function execution node list;

[0108] A valid node determination module is used to extract node features of each node in the first node set to obtain a first feature, extract edge features of an edge connected to the node to obtain a second feature, determine whether the node is a valid node based on the first feature and the second feature, and determine a target function feature corresponding to a target function execution node based on all valid nodes;

[0109] The node final feature vector determination module is used to cluster all function execution nodes according to the target function characteristics, and build a global relationship graph according to the clustering results, and determine the final feature vector corresponding to each function execution node according to the global relationship graph;

[0110] The early warning module is used to substitute all final feature vectors into the vulnerability detection model to obtain the vulnerability prediction score corresponding to each function execution node. If the vulnerability prediction score of a function execution node is greater than the preset vulnerability score, an early warning is sent to the POS machine.

[0111] A POS machine intelligent early warning device provided based on the embodiment of the present invention determines whether a node is a valid node by extracting a first feature and a second feature of the node, thereby helping the system to determine which nodes have an important impact on the system security, and determines the characteristics of the current function execution node based on all valid nodes, and then performs vulnerability detection based on the characteristics of all function execution nodes. This dual strategy of performing local analysis first and then global analysis can not only accurately identify potential vulnerabilities, but also grasp the security risks of the program from a global level, thereby improving the accuracy of vulnerability detection and enhancing the security of the system.

[0112] In one embodiment, the function execution node determination module includes:

[0113] A code screening module, used for screening the target source code by using a regular expression, removing non-ASCII characters and comments in the target source code to obtain a first source code;

[0114] The dependency analysis module is used to perform name normalization on all names in the first source code to obtain a second source code, and perform dependency analysis on the second source code through a static analysis tool to obtain a program dependency graph.

[0115] In one embodiment, the valid node determination module includes:

[0116] The target embedding matrix determination module is used to preprocess the sentence corresponding to the target node to obtain the target sequence, and substitute the target sequence into the CodeBERT model to obtain the target embedding matrix; the target node is any node in the first node set;

[0117] The first feature determination module is used to substitute the target embedding matrix into the bidirectional long short-term memory network to obtain a context semantic matrix, and input the context semantic matrix into the Transformer encoder to obtain the first feature;

[0118] The second feature determination module is used to determine the degree centrality and betweenness centrality corresponding to the target node according to the program dependency graph, and concatenate the degree centrality and betweenness centrality as scalar features with the target embedding matrix to obtain the second feature.

[0119] In one embodiment, the valid node determination module further includes:

[0120] A node sorting module is used to normalize the degree centrality and betweenness centrality of all nodes in the first node set to obtain a centrality group set, sort the centrality group set, and record the nodes corresponding to the first preset number of centrality groups as valid nodes;

[0121] A hidden feature determination module is used to obtain a hidden feature corresponding to each valid node by performing a linear transformation on a first feature of the valid node and a second feature of a neighboring node of the valid node;

[0122] An aggregate feature determination module, used for performing weighted fusion of the first feature of the valid node and the first features of the valid nodes adjacent to the valid node to obtain an aggregate feature;

[0123] The objective function feature determination module is used to fuse the hidden feature and the aggregate feature, perform nonlinear transformation through the activation function to obtain the node feature matrix corresponding to the node, and perform weighted summation of the feature matrices corresponding to all valid nodes to obtain the objective function feature corresponding to the objective function execution node.

[0124] In one embodiment, the node final feature vector determination module includes:

[0125] A neighbor node determination module is used to obtain, for each function execution node, upstream related neighbor nodes and downstream related neighbor nodes connected to the function execution node according to the program dependency graph to obtain an upstream node set and a downstream node set;

[0126] A feature aggregation module is used to aggregate the function execution node features in the upstream node set to obtain the upstream features, and to aggregate the function execution node features in the downstream node set to obtain the downstream features;

[0127] The feature fusion module is used to perform weighted fusion on the objective function features, upstream features and downstream features of the function execution node to obtain the final feature vector of the function execution node.

[0128] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A POS machine intelligent early warning method, characterized in that: The method comprises: After the target source code is normalized, a program dependency is constructed to obtain a program dependency graph, and the program dependency graph is traversed to obtain a function execution node list; the target source code is the code of any software installed on the POS machine; Perform statement splitting on the code snippet corresponding to the target function execution node to obtain a first node set; the target function execution node is any one in the function execution node list; For each node in the first node set, extract node features of the node to obtain a first feature, extract edge features of the edge connected to the node to obtain a second feature, determine whether the node is a valid node based on the first feature and the second feature, and determine the target function feature corresponding to the target function execution node based on all valid nodes; Clustering all function execution nodes according to the target function characteristics, and constructing a global relationship graph according to the clustering results, and determining a final feature vector corresponding to each function execution node according to the global relationship graph; Substitute all final feature vectors into the vulnerability detection model to obtain the vulnerability prediction score corresponding to each function execution node. If there is a function execution node with a vulnerability prediction score greater than the preset vulnerability score, send an early warning to the POS terminal; For each node in the first node set, performing node feature extraction on the node to obtain a first feature, and performing edge feature extraction on an edge connected to the node to obtain a second feature includes: Preprocess the sentence corresponding to the target node to obtain a target sequence, and substitute the target sequence into the CodeBERT model to obtain a target embedding matrix; the target node is any node in the first node set; Substituting the target embedding matrix into a bidirectional long short-term memory network to obtain a contextual semantic matrix, and inputting the contextual semantic matrix into a Transformer encoder to obtain a first feature; Determine the degree centrality and betweenness centrality corresponding to the target node according to the program dependency graph, and concatenate the degree centrality and betweenness centrality as scalar features with the target embedding matrix to obtain a second feature; Determining whether the node is a valid node according to the first feature and the second feature, and determining the target function feature corresponding to the target function execution node according to all valid nodes includes: For each node in the first node set, normalize the degree centrality and betweenness centrality of all nodes to obtain a centrality group set, sort the centrality group set, and obtain nodes corresponding to a preset number of centrality groups as valid nodes; For each valid node, a first feature of the valid node and a second feature of a neighboring node of the valid node are linearly transformed to obtain a hidden feature corresponding to the valid node; Performing weighted fusion on the first feature of the valid node and the first features of the valid nodes adjacent to the valid node to obtain an aggregate feature; After the hidden feature and the aggregated feature are fused, a node feature matrix corresponding to the node is obtained by performing a nonlinear transformation through an activation function, and a weighted sum is performed on the feature matrices corresponding to all valid nodes to obtain the target function feature corresponding to the target function execution node.

2. A POS machine intelligent early warning method according to claim 1, characterized in that: After the target source code is normalized, the program dependency graph is constructed to obtain the following: The target source code is screened by using a regular expression, and non-ASCII characters and comments in the target source code are removed to obtain a first source code; Normalizing all names in the first source code to obtain a second source code, and performing dependency analysis on the second source code using a static analysis tool to obtain a program dependency graph.

3. A POS machine intelligent early warning method according to claim 1, characterized in that: Determining the final feature vector corresponding to each function execution node according to the global relationship graph includes: For each function execution node, according to the program dependency graph, the upstream related neighbor nodes and the downstream related neighbor nodes connected to the function execution node are obtained to obtain an upstream node set and a downstream node set; Aggregate the function execution node features in the upstream node set to obtain the upstream features, and aggregate the function execution node features in the downstream node set to obtain the downstream features; The objective function features, upstream features and downstream features of the function execution node are weightedly fused to obtain the final feature vector of the function execution node.

4. A POS machine intelligent early warning device, characterized in that: The device comprises: A function execution node determination module is used to perform program dependency construction on the target source code after normalization processing to obtain a program dependency graph, and traverse the program dependency graph to obtain a function execution node list; the target source code is the code of any installed software on the POS machine; A statement splitting module, used for performing statement splitting on a code fragment corresponding to a target function execution node to obtain a first node set; the target function execution node is any one in the function execution node list; A valid node determination module is used to extract node features of each node in the first node set to obtain a first feature, extract edge features of an edge connected to the node to obtain a second feature, determine whether the node is a valid node based on the first feature and the second feature, and determine the target function feature corresponding to the target function execution node based on all valid nodes; A node final feature vector determination module is used to cluster all function execution nodes according to the target function characteristics, and to construct a global relationship graph according to the clustering results, and to determine the final feature vector corresponding to each function execution node according to the global relationship graph; The early warning module is used to substitute all the final feature vectors into the vulnerability detection model to obtain the vulnerability prediction score corresponding to each function execution node. If there is a function execution node with a vulnerability prediction score greater than a preset vulnerability score, an early warning is sent to the POS terminal; The valid node determination module comprises: A target embedding matrix determination module is used to preprocess the sentence corresponding to the target node to obtain a target sequence, and substitute the target sequence into the CodeBERT model to obtain a target embedding matrix; the target node is any node in the first node set; A first feature determination module is used to substitute the target embedding matrix into a bidirectional long short-term memory network to obtain a context semantic matrix, and input the context semantic matrix into a Transformer encoder to obtain a first feature; A second feature determination module is used to determine the degree centrality and betweenness centrality corresponding to the target node according to the program dependency graph, and concatenate the degree centrality and betweenness centrality as scalar features with the target embedding matrix to obtain a second feature; The valid node determination module also includes: A node sorting module, for each node in the first node set, normalizing the degree centrality and betweenness centrality of all nodes to obtain a centrality group set, sorting the centrality group set, and obtaining nodes corresponding to a preset number of centrality groups as valid nodes; A hidden feature determination module is used to obtain a hidden feature corresponding to each valid node by performing a linear transformation on a first feature of the valid node and a second feature of a neighboring node of the valid node; An aggregate feature determination module, used for performing weighted fusion of the first feature of the valid node and the first features of the valid nodes adjacent to the valid node to obtain an aggregate feature; The objective function feature determination module is used to perform feature fusion on the hidden feature and the aggregate feature, perform nonlinear transformation through the activation function to obtain the node feature matrix corresponding to the node, and perform weighted summation on the feature matrices corresponding to all valid nodes to obtain the objective function feature corresponding to the objective function execution node.

5. The intelligent early warning device for POS machine according to claim 4, characterized in that: The function execution node determination module includes: A code screening module, used for screening the target source code by using a regular expression, removing non-ASCII characters and comments in the target source code to obtain a first source code; The dependency analysis module is used to perform name normalization on all names in the first source code to obtain a second source code, and perform dependency analysis on the second source code through a static analysis tool to obtain a program dependency graph.

6. The intelligent early warning device for POS machine according to claim 4, characterized in that: The node final feature vector determination module includes: A neighbor node determination module is used to obtain, for each function execution node, upstream related neighbor nodes and downstream related neighbor nodes connected to the function execution node according to the program dependency graph to obtain an upstream node set and a downstream node set; A feature aggregation module is used to aggregate the function execution node features in the upstream node set to obtain the upstream features, and to aggregate the function execution node features in the downstream node set to obtain the downstream features; The feature fusion module is used to perform weighted fusion on the objective function features, upstream features and downstream features of the function execution node to obtain the final feature vector of the function execution node.

Images