Code vulnerability detection method and device, computer equipment and storage medium

Abstract

The invention provides a code vulnerability detection method and device, computer equipment and a storage medium, and the method comprises the steps: dividing a to-be-detected code, and obtaining a code snippet corresponding to each function; determining a control dependency relationship among the code snippets, a data dependency relationship among the variables and a context dependency relationship of the to-be-detected code; according to the control dependency relationship, the data dependency relationship and the context dependency relationship, performing first feature extraction on the code snippets to obtain structural feature information; performing second feature extraction on the image information corresponding to the code snippets to obtain sequential feature information; performing third feature extraction on the code snippets to obtain time sequence feature information; performing feature fusion processing on the structural feature information, the sequence feature information and the time sequence feature information to obtain fused feature information of the code snippets; and inputting the fusion feature information of each code snippet into a vulnerability detection model to obtain a vulnerability detection result of each code snippet.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a code vulnerability detection method, device, computer equipment and storage medium. Background Art

[0002] With the rapid development and widespread application of information technology, software plays an increasingly important role in various fields. However, vulnerabilities in software are becoming increasingly prominent and have become a major threat to information security. Among the many software vulnerabilities, some code program vulnerabilities, especially binary code program vulnerabilities, are difficult to be discovered and understood by traditional detection methods due to their concealment and complexity. Therefore, how to detect code program vulnerabilities is a problem worthy of attention. Summary of the invention

[0003] The embodiments of the present disclosure at least provide a code vulnerability detection method, apparatus, computer equipment and storage medium.

[0004] In a first aspect, an embodiment of the present disclosure provides a code vulnerability detection method, comprising: Divide the code to be detected according to the functions contained in the code to be detected, and obtain code snippets corresponding to each function; Determining control dependencies between code snippets, data dependencies between variables contained in code snippets, and context dependencies of the code to be detected; For each code snippet, a first feature extraction is performed on the code snippet according to the control dependency, the data dependency and the context dependency of the code to be detected to obtain structural feature information of the code snippet; for each code snippet, an image conversion process is performed on the code snippet to obtain image information corresponding to the code snippet, and a second feature extraction is performed on the image information corresponding to the code snippet to obtain sequential feature information of the code snippet; for each code snippet, a third feature extraction is performed on the code snippet to obtain temporal feature information of the code snippet; Performing feature fusion processing on the structural feature information, the sequence feature information and the time series feature information of each code fragment respectively to obtain fused feature information of each code fragment; The fused feature information of each code snippet is input into the trained vulnerability detection model to obtain the vulnerability detection results of each code snippet.

[0005] In an optional implementation manner, determining the context dependency of the code to be detected includes: For each code snippet, feature representation is performed on the variables and statements contained in the code snippet to obtain a variable feature vector and a statement feature vector; For each variable, determine a target statement feature vector associated with the variable feature vector of the variable, aggregate statements corresponding to the target statement feature vector, and generate a code slice corresponding to the variable; The code slices are input into a trained self-supervised learning model, and the context dependency of the code to be detected is output.

[0006] In an optional implementation, for each variable, a target statement feature vector associated with a variable feature vector of the variable is determined, and statements corresponding to the target statement feature vector are aggregated to generate a code slice corresponding to the variable, including: For each variable, the variable feature vector and each sentence feature vector of the variable are respectively input into the forward multi-layer perceptron model to obtain a first correlation score value between each sentence feature vector and the variable feature vector; and the variable feature vector and each sentence feature vector of the variable are respectively input into the backward multi-layer perceptron model to obtain a second correlation score value between each sentence feature vector and the variable feature vector; Using a sentence feature vector whose first association score value exceeds a first threshold as a first target sentence feature vector; and using a sentence feature vector whose second association score value exceeds a second threshold as a second target sentence feature vector; Aggregating the statements corresponding to the first target statement feature vector to generate a forward code slice corresponding to the variable; and aggregating the statements corresponding to the second target statement feature vector to generate a backward code slice corresponding to the variable.

[0007] In an optional implementation manner, the trained self-supervised learning model is obtained by training through the following steps: Obtaining a normal code slice, and using the normal code slice to generate a partially masked code slice and a variant code slice; Inputting the normal code slice and the partially masked code slice into an untrained self-supervised learning model to generate a restored code slice; determining first loss information according to the restored code slice and the normal code slice; Inputting the normal code slice and the variant code slice into an untrained self-supervised learning model to determine the similarity between the normal code slice and the variant code slice; and determining second loss information based on the similarity; Inputting the normal code slice and the variant code slice into an untrained self-supervised learning model, restoring the variant code slice to obtain a restored code slice; determining third loss information according to the restored code slice and the normal code slice; According to the first loss information, the second loss information and the third loss information, the parameters in the self-supervised learning model to be trained are adjusted to obtain a trained self-supervised learning model.

[0008] In an optional implementation, for each code snippet, a first feature extraction is performed on the code snippet according to the control dependency, the data dependency, and the context dependency of the code to be detected to obtain structural feature information of the code snippet, including: A control dependency graph is constructed according to the control dependency relationships corresponding to the various code snippets; the nodes included in the control dependency graph are code snippets; the edges between the nodes included in the control dependency graph are jump or call relationships between the code snippets; According to the data dependency relationship between the variables contained in each code snippet, a data dependency graph is constructed; the nodes contained in the data dependency graph are the variables in the code snippet; the edges of the nodes contained in the data dependency graph are the usage relationships of the variables; Generate a program dependency graph according to the control dependency graph, the data dependency graph and the context dependency relationship of the code to be detected; According to the program dependency graph, a first feature extraction is performed on each code fragment to obtain structural feature information of each code fragment.

[0009] In an optional implementation, the fused feature information of each code snippet is respectively input into a trained vulnerability detection model to obtain vulnerability detection results of each code snippet, including: For each code snippet, input the fused feature information of the code snippet and the fused feature information of the reference code snippet marked with the vulnerability type into the trained vulnerability detection model to obtain the similarity between the code snippet and the reference code snippet; A reference code segment with a similarity greater than a set threshold is used as a target reference segment, and a vulnerability detection result of the code segment is determined according to the annotated vulnerability type of the target reference segment.

[0010] In an optional implementation manner, the trained vulnerability detection model is trained according to the following steps: Obtain a first pair of code snippets with the same vulnerability type and a second pair of code snippets with different vulnerability types; Inputting the fused feature vectors corresponding to the first code snippet pair into an untrained vulnerability detection model to obtain first feature embedding vectors and second feature embedding vectors corresponding to the two code snippets in the first code snippet pair; and inputting the second code snippet pair into an untrained vulnerability detection model to obtain third feature embedding vectors and fourth feature embedding vectors corresponding to the two code snippets in the second code snippet pair; Determining a first Euclidean distance according to the first feature embedding vector and the second feature embedding vector; and determining a second Euclidean distance according to the third feature embedding vector and the fourth feature embedding vector; Determine, according to the first Euclidean distance, a first similarity corresponding to two code segments in the first pair of code segments; and determine, according to the second Euclidean distance, a second similarity corresponding to two code segments in the second pair of code segments; Determining comparison loss information according to the first similarity and the second similarity; According to the contrast loss information, the parameters of the untrained vulnerability detection model are adjusted to obtain a trained vulnerability detection model.

[0011] In a second aspect, the present disclosure provides a code vulnerability detection device, including: A division module is used to divide the code to be detected according to the functions contained in the code to be detected, and obtain code snippets corresponding to each function; A determination module, used to determine the control dependency between the various code snippets, the data dependency between the variables contained in the various code snippets, and the context dependency of the code to be detected; The extraction module is used to perform a first feature extraction on each code snippet according to the control dependency, the data dependency and the context dependency of the code to be detected to obtain structural feature information of the code snippet; perform image conversion processing on each code snippet to obtain image information corresponding to the code snippet, and perform a second feature extraction on the image information corresponding to the code snippet to obtain sequential feature information of the code snippet; perform a third feature extraction on each code snippet to obtain temporal feature information of the code snippet; A fusion module, used to perform feature fusion processing on the structural feature information, the sequence feature information and the time series feature information of each code fragment respectively, to obtain fused feature information of each code fragment; The input module is used to input the fused feature information of each code fragment into the trained vulnerability detection model to obtain the vulnerability detection results of each code fragment.

[0012] In a third aspect, an embodiment of the present disclosure further provides a computer device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the computer device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the above-mentioned first aspect, or any possible implementation of the first aspect are performed.

[0013] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned first aspect or any possible implementation of the first aspect are executed.

[0014] The present disclosure provides a code vulnerability detection method, which can perform more accurate analysis on the code to be detected, especially binary code, by combining the control dependency, data dependency and context dependency of the code to be detected, which helps to locate the cause of the vulnerability, and improves the accuracy and generalization ability of vulnerability detection by extracting and fusing multimodal features of the code to be detected.

[0015] For a description of the effects of the above-mentioned apparatus, computer device, and computer-readable storage medium, please refer to the description of the above-mentioned code vulnerability detection method, which will not be repeated here.

[0016] In order to make the above-mentioned objectives, features and advantages of the present disclosure more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following is a brief introduction to the drawings required for use in the embodiments. The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and are used together with the specification to illustrate the technical solutions of the present disclosure. It should be understood that the following drawings only illustrate certain embodiments of the present disclosure and should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can also be obtained based on these drawings without creative work.

[0018] Figure 1 A flow chart of a code vulnerability detection method provided by an embodiment of the present disclosure is shown; Figure 2 A flowchart of another code vulnerability detection method provided by an embodiment of the present disclosure is shown; Figure 3 A flowchart of the training phase and the inference / prediction phase of the slice decoding model NetSlicer provided in an embodiment of the present disclosure is shown; Figure 4 A schematic diagram of a process for generating an enhanced program dependency graph provided by an embodiment of the present disclosure is shown; Figure 5 A flow chart of feature extraction and feature fusion provided by an embodiment of the present disclosure is shown; Figure 6 A flowchart of a training vulnerability detection model provided by an embodiment of the present disclosure is shown; Figure 7 A schematic diagram of the structure of a code vulnerability detection device provided by an embodiment of the present disclosure is shown; Figure 8 A schematic diagram of a computer device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the embodiments of the present disclosure generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the present disclosure for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present disclosure.

[0020] Research has found that with the rapid development and widespread application of information technology, software plays an increasingly important role in various fields. However, vulnerabilities in software are becoming increasingly prominent and have become a major threat to information security. Software vulnerabilities refer to defects or weaknesses in the design, implementation or operation of software systems, which may be exploited by malicious attackers, leading to serious consequences such as system crashes, data leaks or service interruptions. Among the many software vulnerabilities, binary program vulnerabilities are particularly difficult to detect by traditional detection methods due to their concealment and complexity. Therefore, how to detect vulnerabilities in code programs is a problem worthy of attention.

[0021] Based on this, the present disclosure provides a code vulnerability detection method, which can perform more accurate analysis on the code to be detected, especially binary code, by combining the control dependency, data dependency and context dependency of the code to be detected, which helps to locate the cause of the vulnerability, and by performing multimodal feature extraction and fusion on the code to be detected, thereby improving the accuracy and generalization ability of vulnerability detection.

[0022] The defects existing in the above schemes and the proposed solutions are the results obtained by the inventor after practice and careful research. Therefore, the discovery process of the above problems and the solutions proposed by the present disclosure for the above problems below should be the contributions made by the inventor to the present disclosure during the disclosure process.

[0023] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0024] To facilitate understanding of this embodiment, a code vulnerability detection method disclosed in the embodiment of the present disclosure is first introduced in detail. The execution subject of the code vulnerability detection method provided in the embodiment of the present disclosure is generally a computer device with certain computing capabilities.

[0025] See also Figure 1 FIG. 1 is a flowchart of a code vulnerability detection method provided by an embodiment of the present disclosure, wherein the method includes S101 to S105, wherein: S101: Divide the code to be detected according to the functions contained in the code to be detected, and obtain code snippets corresponding to each function.

[0026] In the embodiment of the present disclosure, the code to be detected may be a code obtained by disassembling a binary code.

[0027] According to the functions contained in the code to be detected, the code to be detected is divided to obtain code fragments B1, B2, ... Bn corresponding to each function. The code fragment corresponding to each function can realize the function of the function. These code fragments can be used as the basic unit for constructing the control dependency graph.

[0028] See also Figure 2 A flowchart of another method for detecting code vulnerabilities is shown. Next, the control dependencies between the code fragments, the data dependencies between the variables contained in the code fragments, and the context dependencies of the code to be detected can be determined, that is, step S102.

[0029] S102: Determine the control dependency relationship between the various code snippets, the data dependency relationship between the variables contained in the various code snippets, and the context dependency relationship of the code to be detected.

[0030] The control dependency relationship between the code snippets may refer to a jump or call relationship between the code snippets. For example, for code snippets Bi and Bj, if there is a jump or call relationship from Bi to Bj, there is a control dependency relationship between the two.

[0031] There are various variables in each code snippet. The data dependency relationship between the variables contained in each code snippet may refer to the dependency relationship between the variables in different code snippets. The data dependency relationship of the variables may include the definition and usage relationship of the variables.

[0032] The context dependency of the code to be detected may refer to the context dependency across functions in the code to be detected.

[0033] In one embodiment, the above-mentioned determination of the context dependency of the code to be detected may include: for each code snippet, respectively performing feature representation on the variables and statements contained in the code snippet to obtain a variable feature vector and a statement feature vector; for each variable feature vector, determining a target statement feature vector that has an association relationship with the variable feature vector, and aggregating the target statement feature vectors to generate code slices corresponding to the variable feature vectors; inputting the code slices into a trained self-supervised learning model, and outputting the context dependency of the code to be detected.

[0034] In the above implementation, for each code snippet, the variables contained in the code snippet are characterized to obtain a variable feature vector ; Each statement contained in the code snippet is characterized to obtain a statement feature vector .

[0035] For each variable feature vector, the target sentence feature vector associated with the variable feature vector may include a sentence feature vector of a sentence affected by the variable and a sentence feature vector of a sentence affecting the variable.

[0036] In one embodiment, for each variable, a target statement feature vector having an association relationship with a variable feature vector of the variable is determined, and statements corresponding to the target statement feature vector are aggregated to generate a code slice corresponding to the variable, which may include: for each variable, the variable feature vector and each statement feature vector of the variable are respectively input into a forward multi-layer perceptron model to obtain a first association score value between each statement feature vector and the variable feature vector; and, the variable feature vector and each statement feature vector of the variable are respectively input into a backward multi-layer perceptron model to obtain a second association score value between each statement feature vector and the variable feature vector; a statement feature vector whose first association score value exceeds a first threshold is used as a first target statement feature vector; and a statement feature vector whose second association score value exceeds a second threshold is used as a second target statement feature vector; statements corresponding to the first target statement feature vector are aggregated to generate a forward code slice corresponding to the variable; and statements corresponding to the second target statement feature vector are aggregated to generate a backward code slice corresponding to the variable.

[0037] In the above implementation, the static slicing decoding model NetSlicer may be used to generate forward code slices and backward code slices.

[0038] For each variable, the variable feature vector and each sentence feature vector of the variable are respectively input into the forward multi-layer perceptron model of the forward decoder to obtain the first correlation score value of each sentence feature vector and the variable feature vector, which can be expressed by the following formula: .

[0039] For each variable, the variable feature vector and each sentence feature vector of the variable are respectively input into the backward multi-layer perceptron model of the backward decoder to obtain the second correlation score value of each sentence feature vector and the variable feature vector, which can be expressed by the following formula: .

[0040] When the first correlation score value corresponding to the sentence feature vector is greater than the first threshold, it can be determined that the sentence corresponding to the sentence feature vector is a sentence affected by the corresponding variable, so the sentence feature vector is used as the first target sentence feature vector. The sentences corresponding to the first target sentence feature vector are aggregated to generate a forward code slice corresponding to the variable.

[0041] When the second correlation score value corresponding to the sentence feature vector is greater than the second threshold, it can be determined that the sentence corresponding to the sentence feature vector is a sentence that affects the corresponding variable, so the sentence feature vector is used as the second target sentence feature vector. The sentences corresponding to the second target sentence feature vector are aggregated to generate a backward code slice corresponding to the variable.

[0042] Figure 3 The flowchart of the training phase and the inference / prediction phase of the slice decoding model NetSlicer is shown. In the training phase, the complete program first generates real forward slices and backward slices as label data through the traditional static slicing tool. Then, the program goes through the tokenization process, the variable and statement dependency learning process, and the static slice decoding process, and finally outputs the predicted forward slices and backward slices. The training loss optimizes the slice decoding model parameters by comparing the predicted slices with the real slices. In the inference phase, the slice decoding model can directly generate forward slices and backward slices for complete or incomplete programs for vulnerability detection and analysis.

[0043] In this way, the static slice decoding model NetSlicer can generate high-precision forward slices and backward slices, so that the implicit contextual dependencies in the code snippets can be captured in the subsequent application process.

[0044] In a specific implementation, the obtained code slices can be input into a trained self-supervised learning model to output the contextual dependencies across functions in the code to be detected.

[0045] The above self-supervised learning model can predict the code content of the masked part in the code snippet, enhancing the ability to understand the code context; it can also determine whether the mutated code maintains similarity with the original code, improving the robustness to code mutation; it can also restore the mutated code to the original code, improving the adaptability to changes in code structure and content.

[0046] In one embodiment, the above-mentioned trained self-supervised learning model can be obtained by training through the following steps: obtaining normal code slices, and using the normal code slices to generate partially masked code slices and variant code slices; inputting the normal code slices and the partially masked code slices into an untrained self-supervised learning model to generate restored code slices; determining first loss information based on the restored code slices and the normal code slices; inputting the normal code slices and the variant code slices into an untrained self-supervised learning model to determine the similarity between the normal code slices and the variant code slices; determining second loss information based on the similarity; inputting the normal code slices and the variant code slices into an untrained self-supervised learning model to restore the variant code slices to obtain restored code slices; determining third loss information based on the restored code slices and the normal code slices; adjusting the parameters in the self-supervised learning model to be trained based on the first loss information, the second loss information and the third loss information to obtain a trained self-supervised learning model.

[0047] In the above process, you can get normal code slices, which can be code slice sets ,Each code slice can represent a function or logic fragment in the code program.

[0048] The self-supervised learning model can be trained through three self-supervised learning tasks.

[0049] Code Prediction Loss: Input normal code slices and partially masked code slices into an untrained self-supervised learning model to generate restored code slices; determine the first loss information based on the restored code slices and normal code slices.

[0050] In a specific implementation, the first loss information can be obtained by the following formula: . Among them, x is the content of the normal code slice; xmasked is the content of the partially masked code slice; P is the probability value of the positive class.

[0051] Through the above code prediction task, the self-supervised learning model can learn the contextual dependencies of the code to be detected by masking the content of the part.

[0052] Mutation detection task (Similarity Contrastive Loss): input the normal code slice and the mutant code slice into the untrained self-supervised learning model to determine the similarity between the normal code slice and the mutant code slice; based on the similarity, determine the second loss information.

[0053] In a specific implementation, the second loss information can be obtained by the following formula: .in, For normal code slicing; Slice the code for the mutation.

[0054] Through the above mutation detection task, the self-supervised learning model can learn the impact of code mutations on vulnerabilities by comparing the similarities between normal code slices and mutant code slices.

[0055] Code Restoration Loss: Input the normal code slices and the mutant code slices into the untrained self-supervised learning model, restore the mutant code slices, and obtain the restored code slices; determine the third loss information based on the restored code slices and the normal code slices.

[0056] In a specific implementation, the third loss information can be obtained by the following formula: .in, For normal code slicing; is the variant code slice; P is the probability value of the positive class.

[0057] Through the above code restoration task, the self-supervised learning model can restore the mutated code slices to normal code slices, thereby enhancing the robustness during code mutation.

[0058] Next, the loss information of the above three tasks is combined to obtain the final loss information, that is, , the self-supervised learning model is optimized using the final loss information to obtain a trained self-supervised learning model. Where N represents the number of normal code slices.

[0059] S103: For each code snippet, perform a first feature extraction on the code snippet according to the control dependency, the data dependency and the context dependency of the code to be detected to obtain structural feature information of the code snippet; for each code snippet, perform image conversion processing on the code snippet to obtain image information corresponding to the code snippet, and perform a second feature extraction on the image information corresponding to the code snippet to obtain sequential feature information of the code snippet; for each code snippet, perform a third feature extraction on the code snippet to obtain temporal feature information of the code snippet.

[0060] When extracting features from a code snippet, a program dependency graph may be constructed based on control dependencies, data dependencies, and context dependencies of the code to be detected, and then a first feature extraction may be performed on the code snippet based on the constructed program dependency graph.

[0061] In one embodiment, for each code snippet, a first feature extraction is performed on the code snippet according to the control dependency, the data dependency and the context dependency of the code to be detected to obtain structural feature information of the code snippet, including: constructing a control dependency graph according to the control dependency corresponding to each code snippet; the nodes contained in the control dependency graph are code snippets; the edges between the nodes contained in the control dependency graph are jump or call relationships between code snippets; constructing a data dependency graph according to the data dependency between the variables contained in each code snippet; the nodes contained in the data dependency graph are variables in the code snippets; the edges of the nodes contained in the data dependency graph are usage relationships of variables; generating a program dependency graph according to the control dependency graph, the data dependency graph and the context dependency of the code to be detected; and according to the program dependency graph, performing a first feature extraction on each code snippet to obtain structural feature information of each code snippet.

[0062] In the above implementation, the control dependency graph may be constructed using the code snippets obtained in S101 as nodes and the jumps or call relationships between the code snippets as edges between the nodes.

[0063] A data dependency graph is constructed with the variables in the code to be tested as nodes and the usage relationships of the variables as edges.

[0064] According to the control dependency graph and the data dependency graph, an initial program dependency graph can be generated. According to the initial program dependency graph and the context dependency of the code to be detected, an enhanced program dependency graph can be obtained. Figure 4 A schematic diagram of a flow chart for generating an enhanced program dependency graph is shown.

[0065] According to the enhanced program dependency graph, the first feature extraction is performed on each code fragment to obtain structural feature information of each code fragment.

[0066] See also Figure 5 The flowchart of feature extraction and feature fusion is shown. In a specific implementation, a graph convolutional neural network (GCN) can be used to perform a first feature extraction on each code snippet to obtain structural feature information of each code snippet. The structural feature information here may include global structural features. The structural feature information can be obtained by the following formula: .in, is the adjacency matrix of the program dependency graph; Indicates The node feature matrix of the layer; For the The weight matrix of the layer; is a non-linear activation function.

[0067] In a specific implementation, a convolutional neural network (CNN) may be used to perform second feature extraction on the image information corresponding to the code snippet to obtain sequential feature information of the code snippet. The sequential feature information here may include local sequential feature information of the code snippet.

[0068] In a specific implementation, a gated recurrent unit (GRU) network may be used to extract the third feature of the code snippet to obtain the temporal feature information of the code snippet. The temporal feature information here may include temporal features and long-short distance dependencies.

[0069] S104: performing feature fusion processing on the structural feature information, the sequence feature information and the time series feature information of each code fragment respectively to obtain fused feature information of each code fragment.

[0070] For each code snippet, feature fusion processing can be performed on the structural feature information, the sequential feature information and the temporal feature information to obtain the fused feature information of the code snippet. In a specific implementation, the fused feature information can be obtained according to the following formula: .in, is the structural feature information, is the sequential feature information, is the time series feature information; , and It is a weight dynamically generated by an adaptive weighting strategy, which is defined as: ,here Represents the weight vector of different features, is the learnable weight matrix, Represents a nonlinear combination of input features; function is the normalized exponential function softmax function, which is used to ensure that the sum of the weight vector is 1. Specifically, ,in, It is a linear combination of the weight matrix and the input features, and i and j represent the feature dimension index values ​​respectively.

[0071] S105: Inputting the fused feature information of each code snippet into the trained vulnerability detection model respectively to obtain the vulnerability detection results of each code snippet.

[0072] In the disclosed embodiment, the fused feature information of the code snippet and the fused feature information of the reference code snippet with the vulnerability type marked can be input into a trained vulnerability detection model. The trained vulnerability detection model can determine the vulnerability detection result of the code snippet based on the similarity between the fused feature information of the code snippet and the fused feature information of the reference code snippet.

[0073] In one embodiment, step S105 may specifically include: for each code snippet, inputting the fused feature information of the code snippet and the fused feature information of the reference code snippet with the vulnerability type marked into a trained vulnerability detection model to obtain the similarity between the code snippet and the reference code snippet; taking the reference code snippet with the corresponding similarity greater than a set threshold as the target reference snippet, and determining the vulnerability detection result of the code snippet according to the marked vulnerability type of the target reference snippet.

[0074] In the above implementation, the fused feature information of the code snippet and the fused feature information of the reference code snippet with the vulnerability type marked are input into the trained vulnerability detection model to obtain the Euclidean distance between the code snippet and the reference code snippet, which can be expressed by the following formula: ;in, Indicates the code snippet to be tested and reference code snippet The Euclidean distance between is the fusion feature information of the code snippet to be detected, is the fused feature information of the reference code snippet.

[0075] According to the Euclidean distance between the code snippet and the reference code snippet, the similarity between the code snippet and the reference code snippet can be obtained according to the following formula: .in, is the number of code snippets.

[0076] Here, a threshold of similarity can be set, and the corresponding reference code snippet with a similarity greater than the set threshold is used as the target reference snippet. The annotated vulnerability type of the target reference snippet can be used as the vulnerability type of the code snippet.

[0077] In one embodiment, the vulnerability detection model can be trained according to the following steps: obtaining a first code snippet pair with the same vulnerability type and a second code snippet pair with different vulnerability types; inputting the fused feature vector corresponding to the first code snippet pair into an untrained vulnerability detection model to obtain a first feature embedding vector and a second feature embedding vector corresponding to the two code snippets in the first code snippet pair; and inputting the second code snippet pair into an untrained vulnerability detection model to obtain a third feature embedding vector and a fourth feature embedding vector corresponding to the two code snippets in the second code snippet pair; determining a first Euclidean distance based on the first feature embedding vector and the second feature embedding vector; and determining a second Euclidean distance based on the third feature embedding vector and the fourth feature embedding vector; determining a first similarity corresponding to the two code snippets in the first code snippet pair based on the first Euclidean distance; and determining a second similarity corresponding to the two code snippets in the second code snippet pair based on the second Euclidean distance; determining comparison loss information based on the first similarity and the second similarity; and adjusting the parameters of the untrained vulnerability detection model based on the comparison loss information to obtain a trained vulnerability detection model.

[0078] In the above process, the vulnerability detection model can be a twin network and a contrastive learning model, and can specifically include a twin network and a contrastive learning network.

[0079] The twin network consists of two parallel networks, which process the corresponding fused feature vectors of the two input code snippets respectively and output the corresponding feature embedding vectors.

[0080] See also Figure 6 The flowchart of the training vulnerability detection model is shown. The fused feature vectors corresponding to the first code snippet pair are input into the twin network to obtain the first feature embedding vector and the second feature embedding vector corresponding to the two code snippets in the first code snippet pair. And, the second code snippet pair is input into the twin network to obtain the third feature embedding vector and the fourth feature embedding vector corresponding to the two code snippets in the second code snippet pair.

[0081] The twin network can determine a first Euclidean distance based on the first feature embedding vector and the second feature embedding vector, and determine a second Euclidean distance based on the third feature embedding vector and the fourth feature embedding vector.

[0082] Then, the twin network can calculate a first similarity of the first code snippet pair based on the first Euclidean distance, and calculate a second similarity of the second code snippet pair based on the second Euclidean distance.

[0083] The obtained first similarity and second similarity can be input into the contrastive learning network. It is determined whether the first similarity and the second similarity are greater than a set threshold. If less than the set threshold, the distance is minimized. If greater than the set threshold, the distance is maximized. Then the contrastive loss information can be obtained according to the following formula: .in, and is a similar code snippet, is with Dissimilar code snippets, It is the margin value of the set element, which is used to control the distance between similar and dissimilar code snippets.

[0084] Through the obtained contrast loss information, the parameters in the vulnerability detection model can be adjusted so that the trained vulnerability detection model can maximize the similarity between similar fragments and minimize the similarity between dissimilar fragments, thereby more accurately identifying known vulnerability types and identifying unknown or variant vulnerability types through similarity.

[0085] Those skilled in the art will appreciate that, in the above method of specific implementation, the order in which the steps are written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of the steps should be determined by their functions and possible internal logic.

[0086] Based on the same inventive concept, a code vulnerability detection device corresponding to the code vulnerability detection method is also provided in the embodiment of the present disclosure. Since the principle of solving the problem by the device in the embodiment of the present disclosure is similar to the above-mentioned code vulnerability detection method in the embodiment of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0087] Reference Figure 7 FIG. 1 is a schematic diagram of a code vulnerability detection device provided by an embodiment of the present disclosure, wherein the device comprises: A division module 701 is used to divide the code to be detected according to the functions contained in the code to be detected, and obtain code snippets corresponding to each function; A determination module 702 is used to determine the control dependency between the various code snippets, the data dependency between the variables contained in the various code snippets, and the context dependency of the code to be detected; The extraction module 703 is used to perform a first feature extraction on each code snippet according to the control dependency, the data dependency and the context dependency of the code to be detected to obtain structural feature information of the code snippet; perform image conversion processing on each code snippet to obtain image information corresponding to the code snippet, and perform a second feature extraction on the image information corresponding to the code snippet to obtain sequential feature information of the code snippet; perform a third feature extraction on each code snippet to obtain temporal feature information of the code snippet; A fusion module 704 is used to perform feature fusion processing on the structural feature information, the sequence feature information and the time series feature information of each code fragment respectively to obtain fused feature information of each code fragment; The input module 705 is used to input the fusion feature information of each code fragment into the trained vulnerability detection model to obtain the vulnerability detection results of each code fragment.

[0088] In an optional implementation manner, the determination module 702 is specifically configured to: For each code snippet, feature representation is performed on the variables and statements contained in the code snippet to obtain a variable feature vector and a statement feature vector; For each variable, determine a target statement feature vector associated with the variable feature vector of the variable, aggregate statements corresponding to the target statement feature vector, and generate a code slice corresponding to the variable; The code slices are input into a trained self-supervised learning model, and the context dependency of the code to be detected is output.

[0089] In an optional implementation manner, the determination module 702 is specifically configured to: For each variable, the variable feature vector and each sentence feature vector of the variable are respectively input into the forward multi-layer perceptron model to obtain a first correlation score value between each sentence feature vector and the variable feature vector; and the variable feature vector and each sentence feature vector of the variable are respectively input into the backward multi-layer perceptron model to obtain a second correlation score value between each sentence feature vector and the variable feature vector; Using a sentence feature vector whose first association score value exceeds a first threshold as a first target sentence feature vector; and using a sentence feature vector whose second association score value exceeds a second threshold as a second target sentence feature vector; Aggregating the statements corresponding to the first target statement feature vector to generate a forward code slice corresponding to the variable; and aggregating the statements corresponding to the second target statement feature vector to generate a backward code slice corresponding to the variable.

[0090] In an optional implementation, the device includes a first training module, which is used to: Obtaining a normal code slice, and using the normal code slice to generate a partially masked code slice and a variant code slice; Inputting the normal code slice and the partially masked code slice into an untrained self-supervised learning model to generate a restored code slice; determining first loss information according to the restored code slice and the normal code slice; Inputting the normal code slice and the variant code slice into an untrained self-supervised learning model to determine the similarity between the normal code slice and the variant code slice; and determining second loss information based on the similarity; Inputting the normal code slice and the variant code slice into an untrained self-supervised learning model, restoring the variant code slice to obtain a restored code slice; determining third loss information according to the restored code slice and the normal code slice; According to the first loss information, the second loss information and the third loss information, the parameters in the self-supervised learning model to be trained are adjusted to obtain a trained self-supervised learning model.

[0091] In an optional implementation manner, the extraction module 703 is specifically configured to: A control dependency graph is constructed according to the control dependency relationships corresponding to the various code snippets; the nodes included in the control dependency graph are code snippets; the edges between the nodes included in the control dependency graph are jump or call relationships between the code snippets; According to the data dependency relationship between the variables contained in each code snippet, a data dependency graph is constructed; the nodes contained in the data dependency graph are the variables in the code snippet; the edges of the nodes contained in the data dependency graph are the usage relationships of the variables; Generate a program dependency graph according to the control dependency graph, the data dependency graph and the context dependency relationship of the code to be detected; According to the program dependency graph, a first feature extraction is performed on each code fragment to obtain structural feature information of each code fragment.

[0092] In an optional implementation manner, the input module 702 is specifically configured to: For each code snippet, input the fused feature information of the code snippet and the fused feature information of the reference code snippet marked with the vulnerability type into the trained vulnerability detection model to obtain the similarity between the code snippet and the reference code snippet; A reference code segment with a similarity greater than a set threshold is used as a target reference segment, and a vulnerability detection result of the code segment is determined according to the annotated vulnerability type of the target reference segment.

[0093] In an optional implementation, the device further includes a second training module, which is used to: Obtain a first pair of code snippets with the same vulnerability type and a second pair of code snippets with different vulnerability types; Inputting the fused feature vectors corresponding to the first code snippet pair into an untrained vulnerability detection model to obtain first feature embedding vectors and second feature embedding vectors corresponding to the two code snippets in the first code snippet pair; and inputting the second code snippet pair into an untrained vulnerability detection model to obtain third feature embedding vectors and fourth feature embedding vectors corresponding to the two code snippets in the second code snippet pair; Determining a first Euclidean distance according to the first feature embedding vector and the second feature embedding vector; and determining a second Euclidean distance according to the third feature embedding vector and the fourth feature embedding vector; Determine, according to the first Euclidean distance, a first similarity corresponding to two code segments in the first pair of code segments; and determine, according to the second Euclidean distance, a second similarity corresponding to two code segments in the second pair of code segments; Determining comparison loss information according to the first similarity and the second similarity; According to the contrast loss information, the parameters of the untrained vulnerability detection model are adjusted to obtain a trained vulnerability detection model.

[0094] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0095] Based on the same technical concept, the embodiment of the present disclosure also provides a computer device. Figure 8 As shown, it is a schematic diagram of the structure of a computer device 800 provided in an embodiment of the present disclosure, including a processor 801, a memory 802, and a bus 803. Among them, the memory 802 is used to store execution instructions, including a memory 8021 and an external memory 8022; the memory 8021 here is also called an internal memory, which is used to temporarily store the operation data in the processor 801, and the data exchanged with the external memory 8022 such as a hard disk. The processor 801 exchanges data with the external memory 8022 through the memory 8021. When the computer device 800 is running, the processor 801 communicates with the memory 802 through the bus 803, so that the processor 801 executes the following instructions: Divide the code to be detected according to the functions contained in the code to be detected, and obtain code snippets corresponding to each function; Determining control dependencies between code snippets, data dependencies between variables contained in code snippets, and context dependencies of the code to be detected; For each code snippet, a first feature extraction is performed on the code snippet according to the control dependency, the data dependency and the context dependency of the code to be detected to obtain structural feature information of the code snippet; for each code snippet, an image conversion process is performed on the code snippet to obtain image information corresponding to the code snippet, and a second feature extraction is performed on the image information corresponding to the code snippet to obtain sequential feature information of the code snippet; for each code snippet, a third feature extraction is performed on the code snippet to obtain temporal feature information of the code snippet; Performing feature fusion processing on the structural feature information, the sequence feature information and the time series feature information of each code fragment respectively to obtain fused feature information of each code fragment; The fused feature information of each code snippet is input into the trained vulnerability detection model to obtain the vulnerability detection results of each code snippet.

[0096] The embodiment of the present disclosure also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the code vulnerability detection method described in the above method embodiment are executed. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0097] The present disclosure also provides a computer program product that carries a program code. The program code includes instructions that can be used to execute the steps of the code vulnerability detection method described in the above method embodiment. For details, please refer to the above method embodiment, which will not be repeated here.

[0098] The computer program product may be implemented in hardware, software or a combination thereof. In one optional embodiment, the computer program product is implemented as a computer storage medium. In another optional embodiment, the computer program product is implemented as a software product, such as a software development kit (SDK).

[0099] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. In the several embodiments provided in the present disclosure, it should be understood that the disclosed device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the device or unit can be electrical, mechanical or other forms.

[0100] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0101] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0102] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present disclosure, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0103] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present disclosure, which are used to illustrate the technical solutions of the present disclosure, rather than to limit them. The protection scope of the present disclosure is not limited thereto. Although the present disclosure is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed in the present disclosure, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure shall be based on the protection scope of the claims.

Claims

1. A code vulnerability detection method, characterized in that: include: Divide the code to be detected according to the functions contained in the code to be detected, and obtain code snippets corresponding to each function; Determining control dependencies between code snippets, data dependencies between variables contained in code snippets, and context dependencies of the code to be detected; For each code snippet, a first feature extraction is performed on the code snippet according to the control dependency, the data dependency and the context dependency of the code to be detected to obtain structural feature information of the code snippet; for each code snippet, an image conversion process is performed on the code snippet to obtain image information corresponding to the code snippet, and a second feature extraction is performed on the image information corresponding to the code snippet to obtain sequential feature information of the code snippet; for each code snippet, a third feature extraction is performed on the code snippet to obtain temporal feature information of the code snippet; Performing feature fusion processing on the structural feature information, the sequence feature information and the time series feature information of each code fragment respectively to obtain fused feature information of each code fragment; The fused feature information of each code snippet is input into the trained vulnerability detection model to obtain the vulnerability detection results of each code snippet.

2. The method according to claim 1, characterized in that Determining the context dependency of the code to be detected includes: For each code snippet, feature representation is performed on the variables and statements contained in the code snippet to obtain a variable feature vector and a statement feature vector; For each variable, determine a target statement feature vector associated with the variable feature vector of the variable, aggregate statements corresponding to the target statement feature vector, and generate a code slice corresponding to the variable; The code slices are input into a trained self-supervised learning model, and the context dependency of the code to be detected is output.

3. The method according to claim 2, characterized in that For each variable, a target statement feature vector associated with the variable feature vector of the variable is determined, and statements corresponding to the target statement feature vector are aggregated to generate a code slice corresponding to the variable, including: For each variable, the variable feature vector and each sentence feature vector of the variable are respectively input into the forward multi-layer perceptron model to obtain a first correlation score value between each sentence feature vector and the variable feature vector; and the variable feature vector and each sentence feature vector of the variable are respectively input into the backward multi-layer perceptron model to obtain a second correlation score value between each sentence feature vector and the variable feature vector; Using a sentence feature vector whose first association score value exceeds a first threshold as a first target sentence feature vector; and using a sentence feature vector whose second association score value exceeds a second threshold as a second target sentence feature vector; Aggregating the statements corresponding to the first target statement feature vector to generate a forward code slice corresponding to the variable; and aggregating the statements corresponding to the second target statement feature vector to generate a backward code slice corresponding to the variable.

4. The method according to claim 2 or 3, characterized in that: The trained self-supervised learning model is obtained by training in the following steps: Obtaining a normal code slice, and using the normal code slice to generate a partially masked code slice and a variant code slice; Inputting the normal code slice and the partially masked code slice into an untrained self-supervised learning model to generate restored code slices; Determining first loss information according to the restored code slice and the normal code slice; Inputting the normal code slice and the variant code slice into an untrained self-supervised learning model to determine the similarity between the normal code slice and the variant code slice; Based on the similarity, determining second loss information; Inputting the normal code slice and the variant code slice into an untrained self-supervised learning model, restoring the variant code slice, and obtaining a restored code slice; Determining third loss information according to the restored code slice and the normal code slice; According to the first loss information, the second loss information and the third loss information, the parameters in the untrained self-supervised learning model are adjusted to obtain a trained self-supervised learning model.

5. The method according to claim 1, characterized in that: For each code snippet, a first feature extraction is performed on the code snippet according to the control dependency, the data dependency, and the context dependency of the code to be detected to obtain structural feature information of the code snippet, including: A control dependency graph is constructed according to the control dependency relationships corresponding to the various code snippets; the nodes included in the control dependency graph are code snippets; the edges between the nodes included in the control dependency graph are jump or call relationships between the code snippets; According to the data dependency relationship between the variables contained in each code snippet, a data dependency graph is constructed; the nodes contained in the data dependency graph are the variables in the code snippet; the edges of the nodes contained in the data dependency graph are the usage relationships of the variables; Generate a program dependency graph according to the control dependency graph, the data dependency graph and the context dependency relationship of the code to be detected; According to the program dependency graph, a first feature extraction is performed on each code fragment to obtain structural feature information of each code fragment.

6. The method according to claim 1, characterized in that The fused feature information of each code snippet is input into the trained vulnerability detection model to obtain the vulnerability detection results of each code snippet, including: For each code snippet, input the fused feature information of the code snippet and the fused feature information of the reference code snippet marked with the vulnerability type into the trained vulnerability detection model to obtain the similarity between the code snippet and the reference code snippet; A reference code segment with a similarity greater than a set threshold is used as a target reference segment, and a vulnerability detection result of the code segment is determined according to the annotated vulnerability type of the target reference segment.

7. The method according to claim 1, characterized in that The trained vulnerability detection model is trained according to the following steps: Obtain a first pair of code snippets with the same vulnerability type and a second pair of code snippets with different vulnerability types; Inputting the fused feature vectors corresponding to the first code snippet pair into an untrained vulnerability detection model to obtain first feature embedding vectors and second feature embedding vectors corresponding to the two code snippets in the first code snippet pair; and, inputting the second code snippet pair into an untrained vulnerability detection model to obtain a third feature embedding vector and a fourth feature embedding vector corresponding to the two code snippets in the second code snippet pair respectively; Determining a first Euclidean distance according to the first feature embedding vector and the second feature embedding vector; and determining a second Euclidean distance according to the third feature embedding vector and the fourth feature embedding vector; Determine, according to the first Euclidean distance, a first similarity corresponding to two code segments in the first pair of code segments; and determine, according to the second Euclidean distance, a second similarity corresponding to two code segments in the second pair of code segments; Determining comparison loss information according to the first similarity and the second similarity; According to the contrast loss information, the parameters of the untrained vulnerability detection model are adjusted to obtain a trained vulnerability detection model.

8. A code vulnerability detection device, characterized in that: include: A division module is used to divide the code to be detected according to the functions contained in the code to be detected, and obtain code snippets corresponding to each function; A determination module, used to determine the control dependency between the various code snippets, the data dependency between the variables contained in the various code snippets, and the context dependency of the code to be detected; The extraction module is used to perform a first feature extraction on each code snippet according to the control dependency, the data dependency and the context dependency of the code to be detected to obtain structural feature information of the code snippet; perform image conversion processing on each code snippet to obtain image information corresponding to the code snippet, and perform a second feature extraction on the image information corresponding to the code snippet to obtain sequential feature information of the code snippet; perform a third feature extraction on each code snippet to obtain temporal feature information of the code snippet; A fusion module, used to perform feature fusion processing on the structural feature information, the sequence feature information and the time series feature information of each code fragment respectively, to obtain fused feature information of each code fragment; The input module is used to input the fused feature information of each code fragment into the trained vulnerability detection model to obtain the vulnerability detection results of each code fragment.

9. A computer device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the computer device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the code vulnerability detection method according to any one of claims 1 to 7 are performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the code vulnerability detection method according to any one of claims 1 to 7 are executed.

Images