Training method of vulnerability prediction model, vulnerability prediction method, device and equipment
By training the emotional data of vulnerabilities and combining the reference code samples of the developer, the vulnerability prediction model is trained to solve the problem of insufficient evaluation of the severity of the vulnerability in the existing technology, and the more accurate and stable vulnerability prediction is achieved.
Patent Information
- Application Number
- CN202411279738.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-12
- Publication Date
- 2025-01-28
AI Technical Summary
In the current technology, when predicting vulnerabilities, the prediction of vulnerabilities is only related to technical problems, and fails to fully consider user feedback and development team feedback, resulting in the incomplete assessment of vulnerabilities.
Putting a training method for vulnerability prediction models, through obtaining vulnerability data, enhance emotional data, determine training samples, and combine the developer's reference code sample to train the vulnerability prediction model.
Through emotional data enhancement, the model can capture emotional or attitude information related to vulnerabilities, improve the accuracy and robustness of vulnerability prediction, and can better evaluate the severity of the vulnerability.
Smart Images
Figure CN119377962A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of software security technology, and in particular to a training method for a vulnerability prediction model, a vulnerability prediction method, an apparatus, a device, a medium Background Art
[0002] Currently, code vulnerabilities and duplicate code bugs during software development are major factors affecting software quality and security. They also affect development and testing efficiency, leading to increased software maintenance costs, reduced user experience, and even security risks.
[0003] At the same time, in the vulnerability prediction process, the severity of the predicted vulnerability determines the warning method. When predicting vulnerabilities, the existing technology often only associates the severity of the vulnerability with technical issues. However, in the real development environment, user feedback experience and the feedback experience of the development team should also be important reference factors for evaluating the severity of the vulnerability. Different projects and developers have different assessments of the severity of the same vulnerability. Therefore, a vulnerability prediction solution that considers more comprehensive factors is needed. Summary of the Invention
[0004] In view of the above problems, embodiments of the present invention are proposed to provide a vulnerability prediction model training method, vulnerability prediction method, apparatus, device, and medium that overcome the above problems or at least partially solve the above problems.
[0005] To solve the above problems, an embodiment of the present invention discloses a method for training a vulnerability prediction model, the method comprising:
[0006] Obtain vulnerability data;
[0007] Performing emotional data enhancement on the vulnerability data according to preset emotional labels;
[0008] Determining a first training sample based on the vulnerability data for sentiment data enhancement;
[0009] Get reference code samples for developers;
[0010] A vulnerability prediction model is trained according to the first training sample and the reference code sample.
[0011] Optionally, performing emotional data enhancement on the vulnerability data according to a preset emotional tag includes:
[0012] Obtaining sentiment words in the vulnerability data, and determining a sentiment score based on the sentiment words and a preset sentiment dictionary;
[0013] At least one preset emotion label is added to the vulnerability data according to the emotion score.
[0014] Optionally, determining a first training sample based on the vulnerability data for emotional data enhancement includes:
[0015] Determining data sentiment characteristics and vulnerability content characteristics based on the vulnerability data, wherein the data sentiment characteristics are obtained based on preset emotion tags added to the vulnerability data;
[0016] The data sentiment feature and the vulnerability content feature are used as the first training sample.
[0017] Optionally, the vulnerability data includes time node information, and the time node information includes the time when the vulnerability was raised and the time when the developer addressed the vulnerability. Determining the data sentiment characteristics based on the vulnerability data includes:
[0018] Determine the processing efficiency of the vulnerability data based on the time when the vulnerability was reported and the time when the developer processed the vulnerability;
[0019] The emotional characteristics of the data are determined based on the processing efficiency of the vulnerability data and preset emotional labels.
[0020] Optionally, the reference code sample is generated by a reference code generation model, and the reference code generation model is trained in the following manner:
[0021] Acquire a real code dataset, and determine a second training sample using the real code dataset; the real code dataset includes at least one of a development project dataset and a personal dataset provided by a developer;
[0022] Using the second training sample, training the reference code generation model. Optionally, the reference code generation model includes a code generator and a code discriminator;
[0023] The step of using the second training sample to train the reference code generation model includes:
[0024] Initializing the code generator and the code discriminator;
[0025] Inputting the second training sample into the code generator to obtain an initial sample;
[0026] Inputting the second training sample and the initial sample into the code discriminator to obtain a first discrimination result;
[0027] updating the parameters of the code generator according to the first discrimination result;
[0028] Inputting the second training sample into the updated code generator to obtain an updated sample;
[0029] Inputting the updated sample and the second training sample into the code discriminator to obtain a second discrimination result;
[0030] According to the second discrimination result, updating the parameters of the code discriminator;
[0031] Return to the step of inputting the second training sample into the code generator to obtain an initial sample until a preset condition is met.
[0032] In another aspect, an embodiment of the present invention discloses a vulnerability prediction method, comprising:
[0033] Get code data;
[0034] Obtaining a prediction result based on the code data and the vulnerability prediction model; wherein the vulnerability prediction model is trained based on a first training sample and a developer's reference code sample, and the first sample is obtained based on vulnerability data enhanced with emotion data; the prediction result includes: existing vulnerability information, existing vulnerability emotion information corresponding to the existing vulnerability information, predicted vulnerability information, and predicted vulnerability emotion information corresponding to the predicted vulnerability information;
[0035] Output reminder information based on the prediction result.
[0036] Optionally, the method further includes:
[0037] Inputting the code data into a code generation model to generate enhanced code data, and determining enhanced code data;
[0038] Obtaining a prediction result based on the code data and the vulnerability prediction model includes:
[0039] The enhanced code data is input into the vulnerability prediction model to obtain a prediction result.
[0040] On the other hand, an embodiment of the present invention discloses a training device for a vulnerability prediction model, the device comprising:
[0041] Vulnerability data acquisition module, used to obtain vulnerability data;
[0042] A vulnerability data emotion enhancement module is used to enhance the emotion data of the vulnerability data according to preset emotion tags;
[0043] A first training sample confirmation module is used to determine a first training sample based on the vulnerability data for emotional data enhancement;
[0044] A reference code sample acquisition module is used to obtain reference code samples for developers;
[0045] A code vulnerability training module is used to train a vulnerability prediction model based on the first training sample and the reference code sample.
[0046] Optionally, the vulnerability data sentiment enhancement module includes:
[0047] The sentiment score confirmation submodule is used to obtain sentiment words in the vulnerability data and determine the sentiment score based on the sentiment words and a preset sentiment dictionary;
[0048] The emotion label adding submodule is used to add at least one preset emotion label to the vulnerability data according to the emotion score.
[0049] Optionally, the first training sample confirmation module includes:
[0050] A vulnerability data feature confirmation submodule is used to determine data sentiment features and vulnerability content features based on the vulnerability data, wherein the data sentiment features are obtained based on preset emotion tags added to the vulnerability data;
[0051] The first training sample confirmation submodule is configured to use the data sentiment feature and the vulnerability content feature as the first training sample.
[0052] Optionally, the vulnerability data includes time node information, and the time node information includes the time when the vulnerability was raised and the time when the developer handled the vulnerability;
[0053] The vulnerability data feature confirmation submodule includes: a vulnerability data efficiency confirmation submodule for determining the processing efficiency of the vulnerability data based on the vulnerability proposal time and the developer's vulnerability processing time;
[0054] The vulnerability data emotion efficiency feature confirmation submodule is used to determine the data emotion feature according to the processing efficiency of the vulnerability data and the preset emotion label.
[0055] Optionally, the reference code sample is generated by a reference code generation model, and the reference code generation model is trained by the following modules:
[0056] A second training sample acquisition module is configured to acquire a real code dataset and determine a second training sample based on the real code dataset; the real code dataset includes at least one of a development project dataset and a personal dataset provided by a developer;
[0057] The reference code generation model training module is used to train the reference code generation model using the second training sample.
[0058] Optionally, the reference code generation model includes a code generator and a code discriminator; the reference code generation model training module includes:
[0059] An initialization submodule, used to initialize the code generator and the code discriminator;
[0060] an initial sample generating submodule, configured to input the second training sample into the code generator to obtain an initial sample;
[0061] A first discrimination result generating submodule, configured to input the second training sample and the initial sample into the code discriminator to obtain a first discrimination result;
[0062] a code generator updating submodule, configured to update parameters of the code generator according to the first discrimination result;
[0063] an updated sample generating submodule, configured to input the second training sample into the updated code generator to obtain an updated sample;
[0064] A second discrimination result generating submodule, configured to input the updated sample and the second training sample into the code discriminator to obtain a second discrimination result;
[0065] A code discriminator updating submodule, configured to update parameters of the code discriminator according to the second discrimination result;
[0066] The reference code generation model training submodule is used to return to the step of inputting the second training sample into the code generator to obtain an initial sample until a preset condition is met.
[0067] On the other hand, an embodiment of the present invention discloses a vulnerability prediction device, comprising:
[0068] A code data acquisition module, used to acquire code data;
[0069] A prediction module is configured to obtain a prediction result based on the code data and a vulnerability prediction model; wherein the vulnerability prediction model is trained based on a first training sample and a developer's reference code sample, and the first training sample is obtained based on vulnerability data enhanced with sentiment data; and the prediction result includes: existing vulnerability information, existing vulnerability sentiment information corresponding to the existing vulnerability information, predicted vulnerability information, and predicted vulnerability sentiment information corresponding to the predicted vulnerability information;
[0070] The information output module is used to output reminder information according to the prediction result.
[0071] Optionally, the device further includes:
[0072] A code data enhancement module is used to input the code data into a code generation model to generate enhanced code data and determine the enhanced code data;
[0073] The prediction module includes:
[0074] The prediction submodule is used to input the enhanced code data into the vulnerability prediction model to obtain a prediction result.
[0075] Accordingly, an embodiment of the present invention discloses an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, the various steps of the above-mentioned vulnerability prediction model training method embodiment or the various steps of the above-mentioned vulnerability prediction method embodiment are implemented.
[0076] Accordingly, an embodiment of the present invention discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the computer program implements the various steps of the above-mentioned vulnerability prediction model training method embodiment or the various steps of the above-mentioned vulnerability prediction method embodiment.
[0077] The embodiments of the present invention include the following advantages:
[0078] By enhancing vulnerability data with emotional data, the model can learn not only the technical features of the vulnerability, but also capture the emotions or attitude information related to the vulnerability. And due to the introduction of emotional tags, the model is more stable when processing vulnerability reports containing subjective descriptions or emotional colors, thereby improving the robustness of the model; by incorporating the developer's reference code samples into the training process, the model can learn the developer's unique code pattern in actual development to more accurately identify potential vulnerability points; and the vulnerability prediction model can not only predict the possible vulnerabilities in the code, but also provide the emotional information corresponding to these vulnerabilities, such as urgency, severity, etc. This enables developers to understand the impact of the vulnerability more comprehensively and take more appropriate countermeasures; based on the vulnerability prediction model provided by the embodiment of the present invention, developers can focus more on the development of core functions and reduce the time and energy spent on vulnerability investigation and repair. BRIEF DESCRIPTION OF THE DRAWINGS
[0079] Figure 1 It is a flowchart of the steps of an embodiment of a method for training a vulnerability prediction model of the present invention;
[0080] Figure 2 It is a flowchart of the steps of an embodiment of a vulnerability prediction method of the present invention;
[0081] Figure 3 It is a structural block diagram of an embodiment of a training device for a vulnerability prediction model of the present invention;
[0082] Figure 4 It is a structural block diagram of an embodiment of a vulnerability prediction device of the present invention. DETAILED DESCRIPTION
[0083] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.
[0084] One of the core concepts of the embodiments of the present invention is to use data sentiment analysis to enhance the sentiment data of the acquired vulnerability data, so that the vulnerability prediction model can incorporate the emotional factors of developers and users into the severity assessment of the vulnerability when predicting vulnerabilities, making the vulnerability prediction model more accurately fit the project itself; on the other hand, using project data or real data sets provided by developers, and generating code that conforms to the project style or developer style based on the adversarial generative network can further enhance the diversity of training data and further improve the model's pertinence to projects or developers.
[0085] Reference Figure 1 , shows a flowchart of a method for training a vulnerability prediction model according to an embodiment of the present invention, which may specifically include the following steps:
[0086] Step 101: Obtain vulnerability data.
[0087] Vulnerability data can be obtained from BUG platforms, public security vulnerability databases, security forums, and hacker communities. BUG platforms are designed specifically for software development teams and testers to manage various issues and vulnerabilities during the software development process. Therefore, the vulnerability data they provide primarily comes from internal project testing, developer reports, and user feedback. This data is typically closely related to specific projects and has a high degree of accuracy and pertinence. Vulnerability data provided by channels such as public security vulnerability databases, security forums, and hacker communities may cover a wide range of software products and systems and may not be directly related to a specific project. This data may also contain noise and false positives. Furthermore, because this data comes from different sources and authors, its quality and accuracy may vary.
[0088] In the embodiment of the present invention, vulnerability data can be obtained from public security vulnerability databases, security forums, hacker communities, and other channels, and can also be obtained from professional BUG platforms through a preset data interface. Vulnerability data can be selectively obtained according to the needs of the project or developer.
[0089] In one example, after obtaining vulnerability data, the vulnerability data may be preprocessed. The preprocessing method may include: verifying data integrity, removing data noise, removing data duplication, etc.
[0090] In another example, the pre-processed vulnerability data may be directly obtained. The obtained vulnerability data includes vulnerability type information, vulnerability content description, vulnerability handler, vulnerability proposer, etc.
[0091] In one embodiment, the vulnerability description may include user feedback, internal developer discussions, expert reviews, and other content used for data sentiment analysis. This information provides a guarantee for a more comprehensive assessment of the severity of the vulnerability.
[0092] Step 102: Perform emotional data enhancement on the vulnerability data according to preset emotional tags.
[0093] Data sentiment analysis, also known as sentiment recognition, sentiment assessment, or sentiment mining, is a natural language processing (NLP) technique that aims to determine the emotional leanings of publishers by analyzing textual data such as social media posts, comments, reviews, and articles. Specifically, data sentiment analysis automatically interprets and categorizes the emotions in textual data, typically classifying these emotions into categories such as positive, negative, or neutral, but sometimes also including more fine-grained sentiment classifications such as joy, anger, and insult.
[0094] Sentiment analysis, as a natural language processing technology, can extract multi-level emotional dimensions from user reviews and developer discussions in vulnerability data content descriptions. Based on preset emotional labels, emotional labels are added to vulnerability data as new data features to achieve the purpose of emotional data enhancement.
[0095] In one embodiment, step 102 further includes the following sub-steps:
[0096] Sub-step S11: obtaining sentiment words in the vulnerability data, and determining sentiment scores based on the sentiment words and a preset sentiment dictionary.
[0097] Sentiment analysis requires data preparation and preprocessing. Then, common sentiment analysis terms, such as positive, neutral, and negative, are collected from vulnerability descriptions for use in sentiment analysis. These terms can be sourced from existing sentiment dictionaries, user feedback, and expert opinions. Furthermore, to more precisely express emotions, sentiment terms can be categorized into multiple levels, ranging from basic positive and negative to more specific terms like anger, frustration, satisfaction, and appreciation. Based on these multiple levels of sentiment terms, a multi-level sentiment labeling system is constructed. This allows for more accurate characterization of the emotional tendencies within bug descriptions in subsequent analysis.
[0098] For example, the specific process of calculating the sentiment score and adding sentiment labels to the vulnerability data may include: One-Hot encoding the sentiment labels, that is, converting each sentiment label into a binary vector, where each position corresponds to a sentiment label, which is 1 if it exists and 0 if it does not exist. Use tools such as TextBlob: Use natural language processing tools such as TextBlob, NLTK, and VADER to perform sentiment analysis on the BUG description. These tools can calculate the sentiment score of the text based on sentiment dictionaries and algorithms. For example, when the sentiment score of the text is calculated to be 80 points, the sentiment label "satisfied" is added to the vulnerability data. When the sentiment score of the text is calculated to be 40 points, the sentiment label "angry" is added to the vulnerability data.
[0099] In one embodiment, the sentiment analysis process further includes:
[0100] Adjust the sentiment lexicon and thresholds: Continuously adjust the sentiment lexicon and sentiment analysis thresholds based on actual application feedback and model performance. As the sentiment vocabulary used for data sentiment analysis in vulnerability descriptions diversifies, the sentiment lexicon can be regularly updated to maintain its accuracy and applicability.
[0101] For example, the results of sentiment analysis can be fed back to the bug tracking system or development team, and the sentiment analysis process and algorithm can be further optimized based on the feedback. At the same time, it is also possible to consider combining sentiment analysis results with other types of bug data (such as repair time, recurrence rate, etc.) to more comprehensively assess the impact of the bug.
[0102] Sub-step S12: Based on the sentiment score, add at least one preset sentiment tag to the vulnerability data. The calculated sentiment tag is added to the vulnerability data as a new feature column. This way, each bug record will contain at least one sentiment tag, indicating the sentiment in its description.
[0103] For example, the calculation process may include: traversing each bug description, calculating its sentiment score using a selected tool, and converting the sentiment score into a corresponding sentiment label based on a preset threshold. The threshold can be adjusted based on actual conditions to optimize the classification effect.
[0104] The addition of emotional tags not only enriches the characteristics of vulnerability data, but also these emotional features can be used as important input variables when training vulnerability prediction models, helping to improve the vulnerability prediction model's ability to understand the impact of bugs.
[0105] Step 103: Determine a first training sample based on the vulnerability data for sentiment data enhancement.
[0106] In one embodiment, step 103 includes the following sub-steps:
[0107] Sub-step S21: determining data emotion features and vulnerability content features according to the vulnerability data, wherein the data emotion features are obtained based on preset emotion tags added to the vulnerability data.
[0108] In sub-step S22, the data sentiment features and the vulnerability content features are used as the first training sample. Adding the sentiment features to the data features as a new feature column to input into the vulnerability prediction model for training can strengthen the prediction process of the vulnerability prediction model and make the prediction results more consistent with the project's own situation.
[0109] In one embodiment, sub-step S21 may further include the following steps:
[0110] Sub-step S211 determines the processing efficiency of the vulnerability data based on the vulnerability reporting time and the developer's vulnerability processing time; calculates the BUG processing time through the BUG reporting time and state change process, and combines it with the vulnerability data to obtain processing efficiency data for different types of BUGs in different situations. Based on this data, vulnerability predictions can be made for different developers in a targeted manner.
[0111] Sub-step S213 determines the emotional characteristics of the data based on the processing efficiency of the vulnerability data and the preset emotional labels. By adding an emotional labeling feature column to the bug data and combining it with different types of project descriptions, the model can understand the impact of vulnerabilities with different emotional labels under the same project type, as well as the impact of bugs with the same emotional label under different projects. This allows the model to better grasp the potential emotional bias in vulnerability descriptions and improves its ability to make more targeted and accurate vulnerability predictions.
[0112] Step 104: Obtain a developer's reference code sample.
[0113] During the software development process, different developers have different coding styles. Therefore, the vulnerability prediction model also needs to consider the coding styles of different developers to make the prediction results more targeted and predictive.
[0114] In some embodiments, a generative adversarial network may be selected to generate code data in a developer-specific style as a reference code sample.
[0115] In one embodiment, step 104 includes the following sub-steps:
[0116] Sub-step S31 : obtaining a real code dataset, and determining a second training sample through the real code dataset; the real code dataset includes at least one of a development project dataset and a personal dataset provided by a developer.
[0117] Sub-step S32: using the second training sample to train the reference code generation model.
[0118] Generative Adversarial Networks (GANs) are a deep learning model proposed by Ian Goodfellow et al. in 2014. GANs consist of two main components: a generator (G) and a discriminator (D). These two networks are trained in an adversarial manner to generate new samples that are close to real data.
[0119] In some embodiments, a generative adversarial network may be selected as a reference code generation model.
[0120] In one embodiment, sub-step S32 may include the following sub-steps:
[0121] Sub-step S321: Initialize the code generator and the code discriminator.
[0122] For example, the generator is a neural network that typically starts with a random noise vector and, through a series of network layers, learns how to transform the noise into data samples similar to real data, such as images or text. The discriminator is also a neural network whose task is to distinguish whether the input data is real or generated by the generator. It also extracts features and makes judgments through a series of network layers.
[0123] Sub-step S322: input the second training sample into the code generator to obtain an initial sample.
[0124] Sub-step S323: input the second training sample and the initial sample into the code discriminator to obtain a first discrimination result.
[0125] Sub-step S324: Update the parameters of the code generator based on the first discrimination result. The goal of the generator is to generate samples that can deceive the discriminator. During training, the generator receives code data input and outputs an initial sample. This initial sample is fed into the discriminator for discrimination. When updating the generator parameters, the cross-entropy loss is used to calculate the generator's loss function. Simultaneously, a gradient descent algorithm is used to minimize this loss function, thereby updating the generator parameters.
[0126] For example, the loss function of the generator can be to try to minimize the probability that its generated data is recognized as real data by the discriminator. Since the goal of the generator is to make the discriminator mistake its generated fake data as real, the loss function of the generator can be expressed as minimizing log(1-D(G(z))), where D(G(z)) is the predicted probability of the discriminator for the generated data.
[0127] Sub-step S325: input the second training sample into the updated code generator to obtain an updated sample.
[0128] Sub-step S326: updating the parameters of the code discriminator according to the second discrimination result.
[0129] The discriminator's goal is to distinguish between real samples and generated samples. During training, the discriminator receives two types of input: the second training sample and the initial sample from the generator. For each input, the discriminator outputs a probability value, representing the probability that the input sample is real. The discriminator's loss function is then calculated based on the discriminator's output and the true label. Gradient descent is used to minimize this loss function, thereby updating the discriminator's parameters.
[0130] For example, the loss function of the discriminator can be defined by binary cross-entropy loss. When the input is real data, the target (GT, i.e., ground truth) is 1; when the input is generated data, the target (GT) is 0. The task of the discriminator is to maximize the difference between its predicted probability for the real data and the predicted probability for the generated data. Therefore, the loss function of the discriminator can be expressed as maximizing the difference between the logarithm of the predicted probability of the real data and the logarithm of the predicted probability of the generated data.
[0131] Sub-step S327 returns to the step of inputting the second training sample into the code generator to obtain the initial sample, and this process continues until the preset conditions are met. During GAN training, the generator and discriminator are trained alternately. Specifically, the generator's parameters are first fixed, and the discriminator is trained to distinguish between real and generated samples. Then, the discriminator's parameters are fixed, and the generator is trained to generate samples that can deceive the discriminator. This process is repeated until the code generated by the generator meets the corresponding criteria.
[0132] In one example, the corresponding indicators that the generator should meet may be a grammatical correctness indicator and a code style consistency indicator.
[0133] For example, to check whether the code sample generated by the generator meets the grammatical correctness index, tools such as ESLint and Pylint can be used to check for grammatical errors and potential code quality issues in the code;
[0134] To verify whether the code samples generated by the generator meet the grammatical correctness indicators, you can use tools such as Checkstyle, Clang-Format, Prettier, etc. to check the consistency of the code style and make modification suggestions based on the preset rule set.
[0135] In another example, the generator should meet other metrics, such as reaching a threshold number of training times or achieving convergence of the loss function. These are not discussed here. Using training data generated by a generative adversarial network offers advantages such as increased data diversity, simulating potential vulnerability scenarios, improving prediction accuracy, exploring unknown vulnerabilities, and facilitating model iteration. These advantages contribute to improving the overall performance and practicality of vulnerability prediction models.
[0136] Step 105: Train the vulnerability prediction model according to the first training sample and the reference code sample.
[0137] In some embodiments, a deep learning network model can be selected as a vulnerability prediction model. Training the deep learning network: Use the developer-specific style code data and emotion-enhanced BUG data generated by GANs as training data to train the deep learning network. Use the developer-specific style code data and emotion-enhanced BUG data generated by GANs as training data to train the deep learning network. By enhancing vulnerability data with emotion data and combining it with reference code samples generated by the adversarial generative network to train the vulnerability prediction model, the vulnerability prediction model can not only learn the technical characteristics of the vulnerability, but also capture the emotions or attitude information related to the vulnerability. And because of the introduction of emotional labels, the model is more stable when processing vulnerability reports containing subjective descriptions or emotional colors, thereby improving the robustness of the model; by incorporating the developer's reference code samples into the training process, the model can learn the developer-specific style code patterns in actual development and more accurately identify potential vulnerability points;
[0138] Reference Figure 2 , shows a flowchart of a vulnerability prediction method embodiment of the present invention, which may specifically include the following steps:
[0139] Step 201: Obtain code data.
[0140] Determine the size of the code data; when the size of the code data is greater than a preset size threshold, perform pre-processing such as denoising and deduplication on the code data to obtain the code data for which vulnerabilities need to be detected.
[0141] Step 202: Obtain a prediction result based on the code data and the vulnerability prediction model; wherein the vulnerability prediction model is trained based on a first training sample and a developer's reference code sample, and the first sample is obtained based on vulnerability data enhanced by emotional data; the prediction result includes: existing vulnerability information, existing vulnerability emotional information corresponding to the existing vulnerability information, predicted vulnerability information, and predicted vulnerability emotional information corresponding to the predicted vulnerability information.
[0142] In some embodiments, the vulnerability prediction model can be trained through the above-mentioned vulnerability prediction model training method embodiment, which will not be described in detail here.
[0143] In some embodiments, the method may further include: inputting the code data into a reference code generation model to enhance the generated code data, and determining the enhanced code data;
[0144] Exemplarily, when the size of the code data is smaller than a preset size threshold, the code data may be input into a reference code generation model to generate enhanced code data, and the enhanced code data may be determined.
[0145] Step 202 may include: inputting the enhanced code data into the vulnerability prediction model to obtain a prediction result. The trained reference code generation model can generate reference code that conforms to the developer's coding style to supplement the length of the code data and make the vulnerability prediction model's results more accurate; inputting the enhanced code data into the vulnerability prediction model to obtain a prediction result.
[0146] Step 203: output reminder information according to the prediction result.
[0147] Based on existing vulnerability information and its corresponding vulnerability sentiment information, the vulnerability prediction model can output relevant warning information such as vulnerability type, vulnerability severity, and estimated repair time based on the existing vulnerability information, which helps developers quickly locate vulnerabilities and make good vulnerability repair plans.
[0148] The trained reference code generation model can generate reference code that conforms to the developer's coding style to supplement the length of the code data and make the results of the vulnerability prediction model more accurate. Based on the predicted vulnerability information and predicted vulnerability sentiment information, the vulnerability prediction model can issue warnings on possible vulnerability types, vulnerability severity, estimated repair time, and other information, helping developers plan their work in advance and improve work efficiency.
[0149] It should be noted that for the sake of simplicity, the method embodiments are described as a series of actions. However, those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.
[0150] An embodiment of the present invention further provides a training device for a vulnerability prediction model, the device comprising:
[0151] Vulnerability data acquisition module 301, used to acquire vulnerability data;
[0152] A vulnerability data emotion enhancement module 302 is configured to perform emotion data enhancement on the vulnerability data according to a preset emotion tag;
[0153] A first training sample confirmation module 303 is configured to determine a first training sample based on the vulnerability data for sentiment data enhancement;
[0154] A reference code sample acquisition module 304 is used to acquire a developer's reference code sample;
[0155] The code vulnerability training module 305 is configured to train a vulnerability prediction model based on the first training sample and the reference code sample.
[0156] In one embodiment, the vulnerability data sentiment enhancement module includes:
[0157] The sentiment score confirmation submodule is used to obtain sentiment words in the vulnerability data and determine the sentiment score based on the sentiment words and a preset sentiment dictionary;
[0158] The emotion label adding submodule is used to add at least one preset emotion label to the vulnerability data according to the emotion score.
[0159] In one embodiment, the first training sample confirmation module includes:
[0160] A vulnerability data feature confirmation submodule is used to determine data sentiment features and vulnerability content features based on the vulnerability data, wherein the data sentiment features are obtained based on preset emotion tags added to the vulnerability data;
[0161] The first training sample confirmation submodule is configured to use the data sentiment feature and the vulnerability content feature as the first training sample.
[0162] In one embodiment, the vulnerability data includes time node information, and the time node information includes the time when the vulnerability was raised and the time when the developer handled the vulnerability;
[0163] The vulnerability data feature confirmation submodule includes: a vulnerability data efficiency confirmation submodule for determining the processing efficiency of the vulnerability data based on the vulnerability proposal time and the developer's vulnerability processing time;
[0164] The vulnerability data emotion efficiency feature confirmation submodule is used to determine the data emotion feature according to the processing efficiency of the vulnerability data and the preset emotion label.
[0165] In one embodiment, the reference code sample is generated by a reference code generation model, and the reference code generation model is trained by the following modules:
[0166] A second training sample acquisition module is configured to acquire a real code dataset and determine a second training sample based on the real code dataset; the real code dataset includes at least one of a development project dataset and a personal dataset provided by a developer;
[0167] The reference code generation model training module is used to train the reference code generation model using the second training sample.
[0168] In one embodiment, the reference code generation model includes a code generator and a code discriminator; the reference code generation model training module includes:
[0169] An initialization submodule, used to initialize the code generator and the code discriminator;
[0170] an initial sample generating submodule, configured to input the second training sample into the code generator to obtain an initial sample;
[0171] A first discrimination result generating submodule, configured to input the second training sample and the initial sample into the code discriminator to obtain a first discrimination result;
[0172] a code generator updating submodule, configured to update parameters of the code generator according to the first discrimination result;
[0173] an updated sample generating submodule, configured to input the second training sample into the updated code generator to obtain an updated sample;
[0174] A second discrimination result generating submodule, configured to input the updated sample and the second training sample into the code discriminator to obtain a second discrimination result;
[0175] A code discriminator updating submodule, configured to update parameters of the code discriminator according to the second discrimination result;
[0176] The reference code generation model training submodule is used to return to the step of inputting the second training sample into the code generator to obtain an initial sample until a preset condition is met.
[0177] By enhancing vulnerability data with sentiment data and combining it with reference code samples generated by a generative adversarial network, the vulnerability prediction model is trained. This allows the model to not only learn the technical characteristics of vulnerabilities but also capture the emotions and attitudes associated with them. Furthermore, the introduction of sentiment tags makes the model more stable when processing vulnerability reports containing subjective descriptions or emotional overtones, thereby improving the model's robustness. By incorporating developer reference code samples into the training process, the model can learn the unique coding patterns of developers in actual development, thereby more accurately identifying potential vulnerabilities.
[0178] An embodiment of the present invention further provides a vulnerability prediction device, comprising:
[0179] The code data acquisition module 401 is used to acquire code data;
[0180] Prediction module 402 is configured to obtain a prediction result based on the code data and a vulnerability prediction model; wherein the vulnerability prediction model is trained based on a first training sample and a developer's reference code sample, wherein the first training sample is obtained based on vulnerability data enhanced with sentiment data; and the prediction result includes: existing vulnerability information, existing vulnerability sentiment information corresponding to the existing vulnerability information, predicted vulnerability information, and predicted vulnerability sentiment information corresponding to the predicted vulnerability information;
[0181] The information output module 403 is used to output reminder information according to the prediction result.
[0182] In one embodiment, the apparatus further comprises:
[0183] A code data enhancement module is used to input the code data into a code generation model to generate enhanced code data and determine the enhanced code data;
[0184] The prediction module includes:
[0185] The prediction submodule is used to input the enhanced code data into the vulnerability prediction model to obtain a prediction result.
[0186] The trained reference code generation model can generate reference code that conforms to the developer's coding style to supplement the length of the code data and make the results of the vulnerability prediction model more accurate. Based on the predicted vulnerability information and predicted vulnerability sentiment information, the vulnerability prediction model can issue warnings on possible vulnerability types, vulnerability severity, estimated repair time, and other information, helping developers plan their work in advance and improve work efficiency.
[0187] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.
[0188] An embodiment of the present invention further provides an electronic device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor. When executed by the processor, the computer program implements each step of the aforementioned embodiment of the method for training a vulnerability prediction model or each step of the aforementioned embodiment of the method for vulnerability prediction. The electronic device achieves the same technical effects, and to avoid repetition, the details are omitted here.
[0189] An embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the various steps of the above-mentioned vulnerability prediction model training method embodiment or the various steps of the above-mentioned vulnerability prediction method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.
[0190] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.
[0191] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus, or computer program products. Thus, embodiments of the present invention may take the form of a fully hardware embodiment, a fully software embodiment, or an embodiment combining software and hardware. Furthermore, embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0192] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the process in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0193] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.
[0194] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.
[0195] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they become aware of the basic creative concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.
[0196] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or terminal device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal device that includes the element.
[0197] The above is a detailed introduction to the training method, vulnerability prediction method, device, equipment, and medium of the vulnerability prediction model provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the ideas of the present invention, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as limiting the present invention.
Claims
1. A method for training a vulnerability prediction model, characterized in that: The method comprises: Get vulnerability data; Performing emotional data enhancement on the vulnerability data according to preset emotional tags; Determining a first training sample according to the vulnerability data for which sentiment data enhancement is performed; Get reference code samples for developers; The vulnerability prediction model is trained according to the first training sample and the reference code sample.
2. The method according to claim 1, characterized in that The performing emotional data enhancement on the vulnerability data according to the preset emotional tags includes: Acquire sentiment words in the vulnerability data, and determine sentiment scores according to the sentiment words and a preset sentiment dictionary; At least one preset emotion label is added to the vulnerability data according to the emotion score.
3. The method according to claim 2, characterized in that The determining a first training sample according to the vulnerability data for emotional data enhancement includes: Determine data sentiment characteristics and vulnerability content characteristics according to the vulnerability data, wherein the data sentiment characteristics are obtained based on preset emotion tags added to the vulnerability data; The data sentiment feature and the vulnerability content feature are used as the first training sample.
4. The method according to claim 3, characterized in that The vulnerability data includes time node information, and the time node information includes the vulnerability proposal time and the vulnerability processing time of the developer; Determining data sentiment characteristics according to the vulnerability data includes: Determine the processing efficiency of the vulnerability data according to the vulnerability proposal time and the developer vulnerability processing time; The emotional characteristics of the data are determined according to the processing efficiency of the vulnerability data and preset emotional labels.
5. The method according to claim 1, characterized in that The reference code sample is generated by a reference code generation model, and the reference code generation model is trained in the following manner: Acquire a real code data set, and determine a second training sample through the real code data set; The real code dataset includes: at least one of a development project dataset and a personal dataset provided by a developer; The reference code generation model is trained using the second training sample.
6. The method according to claim 5, characterized in that The reference code generation model includes a code generator and a code discriminator; The using the second training sample to train the reference code generation model includes: Initializing the code generator and the code discriminator; Inputting the second training sample into the code generator to obtain an initial sample; Inputting the second training sample and the initial sample into the code discriminator to obtain a first discrimination result; According to the first discrimination result, updating the parameters of the code generator; Inputting the second training sample into the updated code generator to obtain an updated sample; Inputting the update sample and the second training sample into the code discriminator to obtain a second discrimination result; According to the second discrimination result, updating the parameters of the code discriminator; Return to the step of inputting the second training sample into the code generator to obtain an initial sample until a preset condition is met.
7. A vulnerability prediction method, characterized in that: The method comprises: Get code data; According to the code data and the vulnerability prediction model, a prediction result is obtained; wherein the vulnerability prediction model is trained according to a first training sample and a reference code sample of a developer, and the first training sample is obtained according to vulnerability data enhanced by emotion data; the prediction result includes: existing vulnerability information, existing vulnerability emotion information corresponding to the existing vulnerability information, predicted vulnerability information, and predicted vulnerability emotion information corresponding to the predicted vulnerability information; According to the prediction result, a reminder message is output.
8. The method according to claim 7, characterized in that Also includes: Inputting the code data into a code generation model to generate enhanced code data, and determining enhanced code data; The step of obtaining a prediction result according to the code data and the vulnerability prediction model includes: The enhanced code data is input into the vulnerability prediction model to obtain a prediction result.
9. A training device for a vulnerability prediction model, characterized in that: The device comprises: A vulnerability data acquisition module is used to acquire vulnerability data; A vulnerability data emotion enhancement module, used to enhance the emotion data of the vulnerability data according to preset emotion tags; A first training sample confirmation module, used to determine a first training sample according to the vulnerability data for emotional data enhancement; A reference code sample acquisition module is used to acquire reference code samples for developers; A code vulnerability training module is used to train a vulnerability prediction model according to the first training sample and the reference code sample.
10. A vulnerability prediction device, characterized in that: The device comprises: A code data acquisition module, used for acquiring code data; A prediction module, configured to obtain a prediction result according to the code data and the vulnerability prediction model; wherein the vulnerability prediction model is obtained by training according to a first training sample and a reference code sample of a developer, and the first training sample is obtained according to vulnerability data enhanced by emotion data; the prediction result includes: existing vulnerability information, existing vulnerability emotion information corresponding to the existing vulnerability information, predicted vulnerability information, and predicted vulnerability emotion information corresponding to the predicted vulnerability information; The information output module is used to output reminder information according to the prediction result.
11. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of a method for training a vulnerability prediction model as described in any one of claims 1 to 6 or the steps of a method for vulnerability prediction as described in any one of claims 7 to 8 are implemented.
12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, it implements the steps of a training method for a vulnerability prediction model as described in any one of claims 1-6 or the steps of a vulnerability prediction method as described in any one of claims 7-8.