Vulnerability detection model training method, script vulnerability detection method and related device

Abstract

The invention provides a vulnerability detection model training method, a script vulnerability detection method and a related device, and relates to the field of machine learning. The method comprises the following steps: the electronic equipment obtains vulnerability prediction loss of a sample script set according to vulnerability prediction information of the sample script set by a current first to-be-trained model; the variation degree of the sample script set is obtained, the loss is predicted according to the variation degree and the vulnerability, the current first to-be-trained model is updated, and the variation degree represents the complexity of the sample script set. And iterating the above steps until an iteration stop condition of the vulnerability detection model is satisfied. Thus, in the training process of the first to-be-trained model, the parameters of the network are automatically adjusted according to the complexity of the sample script set, so that the trained vulnerability detection model has good generalization ability and can adapt to the dynamic change and complexity of scripts.

Description

Technical Field

[0001] The present application relates to the field of machine learning, and more specifically, to a vulnerability detection model training method, a script vulnerability detection method, and related devices. Background Art

[0002] Scripting languages ​​are popular for their convenience and efficiency. They greatly simplify the programming process, allowing developers to quickly implement various functions with less code. At the same time, scripting languages ​​usually have excellent automation and text processing capabilities. However, current scripting languages ​​are still insufficient in vulnerability detection, mainly manifested in limited detection coverage and low efficiency.

[0003] Take the TCL (Tool Command Language) script as an example. This script is widely used in digital back-end processing, such as layout, routing, timing analysis, etc. Its security and correctness directly affect the quality and reliability of the entire chip design. With the increase in the complexity of integrated circuit design and the shortening of design cycles, traditional manual inspection methods can no longer meet the needs of rapid development. Therefore, it is particularly important to develop an automated and efficient TCL script vulnerability detection method.

[0004] However, existing TCL script vulnerability detection methods usually rely on static code analysis and rule matching, which not only have limited coverage and depth of vulnerability detection, but also have difficulty adapting to the dynamic changes and complexity of scripts. In addition, traditional methods are inefficient when processing large-scale script data and have weak ability to identify new vulnerabilities. Summary of the invention

[0005] In order to overcome at least one of the deficiencies in the prior art, the present application provides a vulnerability detection model training method, a script vulnerability detection method and related devices, specifically including:

[0006] In a first aspect, the present application provides a vulnerability detection model training method, the method comprising:

[0007] Obtaining vulnerability prediction loss for the sample script set according to vulnerability prediction information of the current first to-be-trained model for the sample script set;

[0008] Obtaining the variability of the sample script set, and updating the current first model to be trained according to the variability and the vulnerability prediction loss, wherein the variability represents the complexity of the sample script set;

[0009] The above steps are iterated until the iteration stop condition of the vulnerability detection model is met.

[0010] In conjunction with the optional implementation manner of the first aspect, obtaining the variability of the sample script set includes:

[0011] Calculating the variance of the sample script set;

[0012] According to the variance, the variability of the sample script set is obtained.

[0013] In combination with an optional implementation manner of the first aspect, updating the current first model to be trained according to the variability and the vulnerability prediction loss includes:

[0014] Obtaining an initial parameter update amount of the first to-be-trained model according to the vulnerability prediction loss;

[0015] Using the variability to adjust the initial parameter update amount to obtain a target parameter update amount of the first model to be trained;

[0016] The current first model to be trained is updated according to the target parameter update amount.

[0017] In conjunction with an optional implementation manner of the first aspect, the sample script set includes script features of multiple first original scripts, and the script features of the multiple first original scripts are obtained by reducing the dimensions of initial features of the multiple first original scripts using a feature compression model, and the method further includes:

[0018] Obtaining a reconstruction error of the sample feature set according to a reconstructed feature set of the sample feature set by the current second model to be trained, wherein the sample feature set is sequentially processed by an encoder and a decoder of the second model to be trained to obtain the reconstructed feature set;

[0019] Performing sparse processing on the encoding feature set output by the encoder to obtain a sparse self-expression error;

[0020] Using the sparse self-expression error as a regularization term constraining the reconstruction error, and updating the current second model to be trained;

[0021] The above steps are iterated until an iteration stop condition of the feature compression model is met.

[0022] In combination with the optional implementation manner of the first aspect, the encoding feature set output by the encoder is subjected to sparse processing to obtain a sparse self-expression error, including:

[0023] Generate a sparse self-expressive matrix according to the coding feature set, wherein the coding feature set includes a plurality of coding vectors, and the sparse self-expressive matrix carries similarity information between the plurality of coding vectors;

[0024] Calculate the vector distance between each encoding vector and its own sparse vector respectively, wherein the sparse vector of each encoding vector is the vector of the encoding vector after being mapped by the sparse self-expression matrix;

[0025] The sum of all the vector distances is taken as the sparse self-expression error.

[0026] In combination with the optional implementation manner of the first aspect, generating a sparse self-expression matrix according to the encoding feature set includes:

[0027] Calculating the Euclidean distance between a feature matrix formed by the plurality of encoding vectors and the transpose of the feature matrix to obtain an initial self-expression matrix;

[0028] The initial self-expression matrix is ​​adjusted by a preset matrix density coefficient to obtain an optimized self-expression matrix;

[0029] The optimized self-expression matrix is ​​normalized to obtain the sparse self-expression matrix.

[0030] In a second aspect, the present application also provides a script vulnerability detection method, the method comprising:

[0031] Get the script to be tested;

[0032] The vulnerability detection model trained by the vulnerability detection model training method processes the script to be detected to obtain vulnerability prediction information of the script to be detected.

[0033] In a third aspect, the present application provides a vulnerability detection model training device, the device comprising:

[0034] A model loss module, used to obtain vulnerability prediction loss for the sample script set according to vulnerability prediction information of the current first model to be trained for the sample script set;

[0035] A model training module, used for obtaining the variability of the sample script set, and updating the current first model to be trained according to the variability and the vulnerability prediction loss, wherein the variability represents the complexity of the sample script set;

[0036] The above steps are iterated until the iteration stop condition of the vulnerability detection model is met.

[0037] In conjunction with the optional implementation manner of the third aspect, the model training module is further specifically used for:

[0038] Calculating the variance of the sample script set;

[0039] According to the variance, the variability of the sample script set is obtained.

[0040] In conjunction with the optional implementation manner of the third aspect, the model training module is further specifically used for:

[0041] Obtaining an initial parameter update amount of the first to-be-trained model according to the vulnerability prediction loss;

[0042] Using the variability to adjust the initial parameter update amount to obtain a target parameter update amount of the first model to be trained;

[0043] The current first model to be trained is updated according to the target parameter update amount.

[0044] In conjunction with an optional implementation manner of the third aspect, the sample script set includes script features of multiple first original scripts, and the script features of the multiple first original scripts are obtained by reducing the dimensions of initial features of the multiple first original scripts through a feature compression model, and the model loss module is further used to:

[0045] Obtaining a reconstruction error of the sample feature set according to a reconstructed feature set of the sample feature set by the current second model to be trained, wherein the sample feature set is sequentially processed by an encoder and a decoder of the second model to be trained to obtain the reconstructed feature set;

[0046] Performing sparse processing on the encoding feature set output by the encoder to obtain a sparse self-expression error;

[0047] The model training module is further used to update the current second model to be trained by taking the sparse self-expression error as a regular term to constrain the reconstruction error;

[0048] The above steps are iterated until an iteration stop condition of the feature compression model is met.

[0049] In conjunction with the optional implementation manner of the third aspect, the model loss module is further specifically used for:

[0050] Generate a sparse self-expressive matrix according to the coding feature set, wherein the coding feature set includes a plurality of coding vectors, and the sparse self-expressive matrix carries similarity information between the plurality of coding vectors;

[0051] Calculate the vector distance between each encoding vector and its own sparse vector respectively, wherein the sparse vector of each encoding vector is the vector of the encoding vector after being mapped by the sparse self-expression matrix;

[0052] The sum of all the vector distances is taken as the sparse self-expression error.

[0053] In conjunction with the optional implementation manner of the third aspect, the model loss module is further specifically used for:

[0054] Calculating the Euclidean distance between a feature matrix formed by the plurality of encoding vectors and the transpose of the feature matrix to obtain an initial self-expression matrix;

[0055] The initial self-expression matrix is ​​adjusted by a preset matrix density coefficient to obtain an optimized self-expression matrix;

[0056] The optimized self-expression matrix is ​​normalized to obtain the sparse self-expression matrix.

[0057] In a fourth aspect, the present application also provides a storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the vulnerability detection model training method or the script vulnerability detection method.

[0058] In a fifth aspect, the present application also provides an electronic device, comprising a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the vulnerability detection model training method or the script vulnerability detection method is implemented.

[0059] Compared with the prior art, this application has the following beneficial effects:

[0060] The present application provides a vulnerability detection model training method, a script vulnerability detection method and related devices. Among them, the electronic device obtains the vulnerability prediction loss of the sample script set based on the vulnerability prediction information of the current first model to be trained for the sample script set; obtains the variability of the sample script set, and updates the current first model to be trained based on the variability and the vulnerability prediction loss, wherein the variability represents the complexity of the sample script set. Iterate the above steps until the iteration stop condition of the vulnerability detection model is met. In this way, during the training process of the first model to be trained, the parameters of the network are automatically adjusted according to the complexity of the sample script set, so that the trained vulnerability detection model has better generalization ability, so that it can adapt to the dynamic changes and complexity of the script. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0062] Figure 1 A flowchart of a vulnerability detection model training method provided in an embodiment of the present application;

[0063] Figure 2 A flowchart of a method for training a feature compression model provided in an embodiment of the present application;

[0064] Figure 3 A schematic diagram of the structure of a vulnerability detection model training device provided in an embodiment of the present application;

[0065] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0067] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0068] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0069] In the description of the present application, it should be noted that the terms "first", "second", "third", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance. In addition, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0070] Based on the above statement, as introduced in the background technology, existing TCL script vulnerability detection methods usually rely on static code analysis and rule matching, which not only have limited coverage and depth of vulnerability detection, but also have difficulty adapting to the dynamic changes and complexity of scripts.

[0071] Based on the discovery of the above technical problems, the inventors have proposed the following technical solutions to solve or improve the above problems through creative work. It should be noted that the defects in the solutions in the above prior art are the results obtained by the inventors after practice and careful research. Therefore, the discovery process of the above problems and the solutions proposed in the embodiments of the present application for the above problems below should all be the contributions made by the inventors to the present application in the process of invention and creation, and should not be understood as technical contents known to those skilled in the art.

[0072] In view of this, the present embodiment provides a vulnerability detection model training method. In this method, the electronic device obtains the vulnerability prediction loss of the sample script set based on the vulnerability prediction information of the current first model to be trained for the sample script set; obtains the variability of the sample script set, and updates the current first model to be trained based on the variability and the vulnerability prediction loss, wherein the variability represents the complexity of the sample script set. Iterate the above steps until the iteration stop condition of the vulnerability detection model is met. In this way, during the training process of the first model to be trained, the parameters of the network are automatically adjusted according to the complexity of the sample script set, so that the trained vulnerability detection model has better generalization ability, so that it can adapt to the dynamic changes and complexity of the script.

[0073] It should be noted that the electronic device implementing the method may be a desktop computer, server, etc. that can provide sufficient computing power. The server may be a single server or a server group. The server group may be centralized or distributed (for example, the server may be a distributed system). In some embodiments, the server may be local or remote relative to the user terminal. In some embodiments, the server may be implemented on a cloud platform; as an example only, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a community cloud (Community Cloud), a distributed cloud, an inter-cloud (Inter-Cloud), a multi-cloud (Multi-Cloud), etc., or any combination thereof. In some embodiments, the server may be implemented on an electronic device having one or more components.

[0074] In addition, the method provided in this embodiment is not only applicable to TCL scripts, but also to scripts such as Python, JavaScript, PHP, Java, Golang, and non-scripting languages.

[0075] To make the solution provided by this embodiment clearer, the following uses a server as an electronic device and combines Figure 1Each step of the method is described in detail. However, it should be understood that the operations of the flowchart may not be implemented in order, and steps without logical contextual relationships may be reversed in order or implemented simultaneously. In addition, those skilled in the art may add one or more other operations to the flowchart, or remove one or more operations from the flowchart under the guidance of the content of this application. Figure 1 As shown, the method includes:

[0076] S1A, obtaining vulnerability prediction loss for the sample script set according to vulnerability prediction information of the current first model to be trained for the sample script set.

[0077] For the above sample script set, in some implementations, the sample script set may include multiple first original scripts, in which the script code is recorded in text form. In this case, the first model to be trained directly processes the first original scripts in text form. In other implementations, the sample script set may also include script features extracted from the multiple first original scripts by the preprocessing model. In this case, the first model to be trained no longer directly processes the first original scripts in text form, but processes the feature vectors extracted from the original scripts.

[0078] Regardless of the above methods, the script code in text form needs to be converted into vector data that can be received by the model. For this, word embedding technology can be used for vectorization conversion. Taking the TCL original script as an example, the server maps each TCL original script and its parameters into a vector in a high-dimensional space. The vector in the high-dimensional space can represent the semantic relationship between words. For example, TCL keywords such as set and global are converted into unique vector representations; then, the "Bag-of-Words" model is used to count the frequency of each word in the script to generate a vector of fixed length.

[0079] For the first original script mentioned above, continuing to take the TCL original script as an example, the TCL original scripts collected from various digital backends, which involve functions such as script automation processing, configuration management, and environment settings, are stored in plain text. For example, the specific storage format can be JSON format, which includes the original code, file path, modification time and other metadata of the original script:

[0080] {

[0081] "script": "ax1settiming_constraints{-ax2-ax3}",

[0082] "path":" / ax4 / project / ax5 / ",

[0083] "last_modified": "2022-01-01T12:00:00"

[0084] }

[0085] Then, the collected TCL original scripts were annotated by manual labeling. That is, professional software engineers classified and labeled the TCL original scripts according to their functions and potential vulnerability categories. Each original script was divided into four categories of labels according to its potential risks and error types: "no vulnerability", "syntax error", "execution error", and "security risk".

[0086] Based on the introduction of the sample script set in the above embodiment, it is found in practice that the conventional machine learning mechanism needs to adjust the parameters of each network layer, and there is a problem of long training time.

[0087] In this regard, the first model to be trained in this embodiment can use an extreme learning machine, that is, each sample script input is directly passed to the output layer of the extreme learning machine without passing through any hidden layer. Therefore, the extreme learning machine mainly adjusts the weight of the output layer during the training process. The core idea is to randomly set the input weights and hidden layer biases of the network. Once these parameters are determined, they will no longer change. Finally, the least squares method can be used to directly calculate the weight of the output layer to minimize the output error of the network.

[0088] Therefore, unlike traditional neural networks, the training process of extreme learning machines does not involve iterative adjustment of the weights and biases of the hidden layers, but only adjusts the weights of the output layer, which can significantly improve the training speed.

[0089] Based on the introduction of the first model to be trained and the sample script set in the above embodiment, this embodiment also provides the following loss function of the first model to be trained:

[0090] As described in the above embodiment, in a traditional extreme learning machine, the output layer weight is usually obtained by solving a least squares problem. Like the traditional extreme learning machine, the weight qW of the output layer in this embodiment is also achieved by minimizing the loss function qL:

[0091]

[0092] In the formula, qH represents the output matrix of the hidden layer, qt represents the target output matrix, and qH T In this embodiment, the above loss function qL is a loss function improved by the Green function qG(qy,qt), and the expression is as follows:

[0093]

[0094] In the formula, qyi Indicates the vulnerability prediction information of the i-th sample script, qt i represents the true label of the i-th sample script, γ represents the regularization coefficient, which is used to control the influence of the Green function term. In this way, the vulnerability prediction loss can be calculated by the above loss function.

[0095] Among them, the Green function term ∫qG(qy,qt)dq is used to handle the optimization of complex decision boundaries, qy represents the predicted output matrix, and the expression of ∫qG(qy,qt)dq is as follows:

[0096]

[0097] In the formula, σ vy represents a scale parameter based on the data distribution, which is used to enhance the model's sensitivity to output errors, especially near the error boundary. After the integral formula, the result is expressed as:

[0098]

[0099] Combined with the above implementation of the loss function and vulnerability prediction loss, continue to refer to Figure 1 The vulnerability detection model training method provided in this embodiment also includes:

[0100] S2A obtains the variability of the sample script set and updates the current first model to be trained based on the variability and vulnerability prediction loss.

[0101] The variability represents the complexity of the sample script set. In a specific implementation, the server calculates the variance of the sample script set; based on the variance, the variability of the sample script set is obtained. In a specific implementation, the variance can be mapped to a value between 0 and 1, which is used as the variability of the sample script set. Exemplarily, the variability can be calculated using the following expression:

[0102] q v =Var(q x )

[0103] In the formula, q v represents the variance, q x Represents a sample script in the sample script set, and the function Var() represents the variance calculation. Based on the calculated variance, it can be mapped to a variation between 0 and 1 through the following expression:

[0104]

[0105] In the formula, q λ Indicates the variation of the sample script set.

[0106] Regarding the variability of the above sample script set, it should be noted that this embodiment is different from the traditional extreme learning machine in that, in order to adapt to the variability of the script, this embodiment adopts an adaptive network redundancy adjustment mechanism based on the loss function to automatically adjust the network parameters according to the complexity of the training data. Therefore, as an optional implementation method, the server can obtain the initial parameter update amount of the first model to be trained based on the vulnerability prediction loss; adjust the initial parameter update amount using the variability to obtain the target parameter update amount of the first model to be trained; and update the current first model to be trained based on the target parameter update amount.

[0107] In a specific implementation, the server calculates the weight update amount of each weight and the bias update amount of each bias based on the vulnerability prediction loss calculated by the above loss function qL; then, the weight update amount and the bias update amount are fine-tuned by the variation degree. The specific expression is as follows:

[0108] qW′=qW+q λ ΔqW

[0109] qb′=qb+q λ Δqb

[0110] In the formula, qW′ represents the updated weight, ΔqW represents the weight update amount, qW represents the weight to be updated, and q λ represents the variation of the sample script set; qb′ represents the updated bias, qb represents the bias to be updated, and Δqb represents the bias update amount.

[0111] S3A, judging whether the iteration stop condition of the vulnerability detection model is satisfied, if not, returning to step S1A to execute, otherwise, executing step S4A.

[0112] S4A, the current first model to be trained will be used as the vulnerability detection model.

[0113] In this way, the parameters of the network are automatically adjusted according to the complexity of the sample script set, so that the trained vulnerability detection model has better generalization ability and can adapt to the dynamic changes and complexity of the script.

[0114] Based on the vulnerability detection model obtained in the above embodiment, this embodiment also provides a script vulnerability detection method. In this method, the electronic device obtains the script to be detected; the vulnerability detection model trained by the vulnerability detection model training method processes the script to be detected to obtain vulnerability prediction information of the script to be detected. Among them, the vulnerability prediction information is one of "no vulnerability", "syntax error", "execution error" and "security risk". In this way, the detection efficiency of the script can be improved.

[0115] In addition, it was found in practice that as the dimension increases, the data becomes increasingly sparse in space, and even similar instances may be far apart due to slight differences in some dimensions. This causes originally closely related semantic information to become dispersed. Therefore, as described in the above embodiment, in some implementations, the sample script set includes script features of multiple first original scripts. However, unlike conventional techniques, the script features of multiple first original scripts are obtained by reducing the dimensionality of the initial features of multiple first original scripts using a feature compression model.

[0116] For the feature compression model, this embodiment uses an autoencoder algorithm to perform feature dimensionality reduction, but unlike the traditional autoencoder, this embodiment uses an autoencoder neural network based on dual loss as a feature dimensionality reduction algorithm. In this algorithm, the autoencoder neural network compresses the input feature vector to a low-dimensional representation, and the decoder part attempts to reconstruct the input features from this low-dimensional representation. Traditional autoencoders usually use reconstruction error as the optimization target. This embodiment is inspired by the fact that the regularization term can make the model structure sparse, and uses the regularization term to sparse the features, so that the feature compression model can make the features more sparse while retaining the maximum information content. In order to reveal more structural information in the encoded feature representation, in-depth mining of the intrinsic structural characteristics of the data can be achieved.

[0117] In this regard, this embodiment uses a model with an encoder and a decoder as the second model to be trained. Figure 2 The training method of the second model to be trained is described in detail:

[0118] S1B, reconstructing a feature set of the sample feature set according to the current second model to be trained, and obtaining a reconstruction error of the sample feature set.

[0119] The sample feature set includes script features of multiple second original scripts. The multiple second original scripts and the multiple first original scripts may be the same original scripts or different original scripts, which is not specifically limited in this embodiment.

[0120] It should be noted that before the sample feature set is input into the second model to be trained, the second model to be trained is initialized. In this regard, in this embodiment, the encoder is represented by E, the decoder is represented by D, and the weight and bias of the encoder are represented by θ E , denote the decoder weights and biases as θ D , and initialize the weights and biases of the encoder and decoder in a random manner.

[0121] After the second model to be trained is initialized, the script features in the sample feature set are processed by the encoder and decoder of the second model to be trained in turn to obtain the corresponding reconstructed features. a, which is converted into a low-dimensional encoding feature set z through the encoder, expressed as z = E(x a ,θ E ). Then, the decoder D reconstructs the encoded feature set z into the reconstructed feature set The expression is

[0122] Since the reconstruction error is used to measure the difference between the sample feature set and the reconstructed feature set, its calculation method is:

[0123]

[0124] In the formula, represents the reconstruction error, represents the i-th script feature in the sample feature set, represents the reconstructed feature of the i-th script feature, and n represents the number of script features in the sample feature set.

[0125] S2B, the encoded feature set output by the encoder is sparsely processed to obtain a sparse self-expression error.

[0126] The coding feature set includes multiple coding vectors. This embodiment sparses the coding feature set by using a sparse self-expression matrix that represents similar information between multiple coding vectors. In this regard, this embodiment also provides an optional implementation of step S2B:

[0127] S2B-1, generate the self-expression matrix based on the encoding feature set.

[0128] In a specific implementation, the server can calculate the Euclidean distance between a feature matrix composed of multiple coding vectors and the transpose of the feature matrix to obtain an initial self-expressive matrix; adjust the initial self-expressive matrix by a preset matrix density coefficient to obtain an optimized self-expressive matrix; normalize the optimized self-expressive matrix to obtain a sparse self-expressive matrix.

[0129] S2B-2, calculate the vector distance between each encoded vector and its own sparse vector respectively.

[0130] The sparse vector of each coding vector is the vector after the coding vector is mapped by the sparse self-expression matrix.

[0131] S2B-3, the sum of all vector distances is taken as the sparse self-expression error.

[0132] For example, assume that the sparse self-expression error is expressed as Its expression is:

[0133]

[0134] Where n represents the number of script features in the sample feature set, α ed represents the regularization parameter, z i represents the i-th coded feature in the coded feature set, and S represents the self-expression matrix. The expression of the self-expression matrix is:

[0135] S = softmax(-γ pe ||ZZ T ||)

[0136] In the formula, Z represents the matrix consisting of all encoding features, Z T represents the transpose of Z, γ pe represents the preset matrix density coefficient, |||| represents the calculation of Euclidean distance, and softmax() represents the function used for normalization.

[0137] S3B, using the sparse self-expression error as a regular term of the constrained reconstruction error, updates the current second model to be trained.

[0138] Based on the above reconstruction error and sparse self-expression error Weight the two and get the weighted error L A , the expression is:

[0139]

[0140] Based on the introduction of the reconstruction error, the sparse self-expression error and the weighted error in the above embodiment, referring to the figure, the method provided in this embodiment further includes:

[0141] S4B, judging whether the iteration stop condition of the feature compression model is satisfied, if not, returning to step S1B to execute, otherwise, executing step S5B.

[0142] S5B, using the current second model to be trained as a feature compression model.

[0143] In this way, when evaluating the feature extraction effect of the second model to be trained, the sparse self-expression layer forces more structural information to be revealed in the encoded feature representation, thereby deeply mining the intrinsic structural characteristics of the data, so that the trained feature compression model can reduce the feature dimension while reducing information loss.

[0144] It should be understood that although the collection, acquisition, labeling and preprocessing of sample data is a time-consuming and labor-intensive process, insufficient sample data can easily lead to poor model generalization ability and affect the accuracy of the model. Therefore, in addition to the scripts written by the developer, the original scripts used during the training of the first and second models to be trained also include some expanded scripts generated based on the scripts written by the developer.

[0145] Therefore, in this embodiment, the server also generates samples based on the generative adversarial network algorithm of deep feature space expansion to achieve data expansion. The generative adversarial network based on deep feature space expansion includes two parts: a generator (G) and a discriminator (D). Through the cooperation between the generator (G) and the discriminator (D), a sufficiently realistic expanded script can be obtained. Continuing with the TCL script as an example, during the model training process, the generator is responsible for generating script code data that is close to the real thing, and the discriminator is responsible for distinguishing whether the input data comes from a real data set or data generated by the generator. After sufficient training, the expanded script generated by the generator can successfully deceive the discriminator.

[0146] Based on the same inventive concept as the vulnerability detection model training method provided in this embodiment, this embodiment also provides a vulnerability detection model training device, which includes at least one software function module that can be stored in a memory or fixed in the form of software. The processor in the electronic device is used to execute the executable module stored in the memory. For example, the software function module and computer program included in the device. Please refer to Figure 3 , functionally speaking, the device may include:

[0147] A model loss module 11 is used to obtain vulnerability prediction loss for the sample script set according to vulnerability prediction information of the current first model to be trained for the sample script set;

[0148] The model training module 12 is used to obtain the variability of the sample script set, and update the current first model to be trained according to the variability and the vulnerability prediction loss, wherein the variability represents the complexity of the sample script set;

[0149] The above steps are iterated until the iteration stop condition of the vulnerability detection model is met.

[0150] In this embodiment, the above-mentioned model loss module 11 is used to implement Figure 1 In step S1A, the model training module 12 is used to implement Figure 1 Therefore, for the detailed description of each of the above modules, please refer to the specific implementation of the corresponding steps. It should be noted that the vulnerability detection model training device can also implement other steps or sub-steps of the method through the above modules or other modules, which will not be repeated in this embodiment.

[0151] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0152] It should also be understood that if the above implementation is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application.

[0153] Therefore, this embodiment also provides a storage medium, which is a computer-readable storage medium. The storage medium stores a computer program, and when the computer program is executed by the processor, the vulnerability detection model training method or script vulnerability detection method provided in this embodiment is implemented. Among them, the storage medium can be a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a disk or an optical disk, etc., which can store program codes.

[0154] This embodiment provides an electronic device for implementing a vulnerability detection model training method. Figure 4 As shown, the electronic device may include a processor 22 and a memory 21. In addition, the memory 21 stores a computer program, and the processor implements the vulnerability detection model training method or script vulnerability detection method provided in this embodiment by reading and executing the computer program corresponding to the above implementation in the memory 21.

[0155] Continue to see Figure 4 The electronic device further includes a communication unit 23. The memory 21, the processor 22 and the communication unit 23 are electrically connected to each other directly or indirectly through a system bus 24 to achieve data transmission or interaction.

[0156] The memory 21 may be an information recording device based on any electronic, magnetic, optical or other physical principle, used to record execution instructions, data, etc. In some embodiments, the memory 21 may be, but is not limited to, a volatile memory, a non-volatile memory, a storage drive, etc.

[0157] In some embodiments, the volatile memory may be a random access memory (RAM); in some embodiments, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), a flash memory, etc.; in some embodiments, the storage drive may be a disk drive, a solid-state drive, any type of storage disk (such as a CD, a DVD, etc.), or a similar storage medium, or a combination thereof, etc.

[0158] The communication unit 23 is used to send and receive data through a network. In some embodiments, the network may include a wired network, a wireless network, a fiber optic network, a telecommunication network, an intranet, the Internet, a local area network (LAN), a wide area network (WAN), a wireless local area network (WLAN), a metropolitan area network (MAN), a wide area network (WAN), a public switched telephone network (PSTN), a Bluetooth network, a ZigBee network, or a near field communication (NFC) network, or any combination thereof. In some embodiments, the network may include one or more network access points. For example, the network may include a wired or wireless network access point, such as a base station and / or a network switching node, through which one or more components of the service request processing system may be connected to the network to exchange data and / or information.

[0159] The processor 22 may be an integrated circuit chip having a signal processing capability, and the processor may include one or more processing cores (e.g., a single-core processor or a multi-core processor). By way of example only, the processor may include a central processing unit (CPU), an application specific integrated circuit (ASIC), an application specific instruction set processor (ASIP), a graphics processing unit (GPU), a physical processing unit (PPU), a digital signal processor (DSP), a field programmable gate array (FPGA), a programmable logic device (PLD), a controller, a microcontroller unit, a reduced instruction set computer (RISC), or a microprocessor, or any combination thereof.

[0160] Understandably, Figure 4 The structure shown is for illustration only. The electronic device may also have Figure 4 More or fewer components than shown, or with Figure 4 Different configurations are shown. Figure 4 The components shown may be implemented in hardware, software or a combination thereof.

[0161] It should be understood that the apparatus and method disclosed in the above-mentioned embodiments can also be implemented in other ways. The apparatus embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the apparatus, methods and computer program products according to the multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of boxes in the block diagram and / or the flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0162] The above are only various implementations of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A vulnerability detection model training method, characterized in that: The method comprises: Obtaining vulnerability prediction loss for the sample script set according to vulnerability prediction information of the current first to-be-trained model for the sample script set; Obtaining the variability of the sample script set, and updating the current first model to be trained according to the variability and the vulnerability prediction loss, wherein the variability represents the complexity of the sample script set; The above steps are iterated until the iteration stop condition of the vulnerability detection model is met.

2. The vulnerability detection model training method according to claim 1, characterized in that: Obtaining the variability of the sample script set includes: Calculating the variance of the sample script set; According to the variance, the variability of the sample script set is obtained.

3. The vulnerability detection model training method according to claim 1, characterized in that: According to the variability and the vulnerability prediction loss, updating the current first model to be trained includes: Obtaining an initial parameter update amount of the first to-be-trained model according to the vulnerability prediction loss; Using the variability to adjust the initial parameter update amount to obtain a target parameter update amount of the first model to be trained; The current first model to be trained is updated according to the target parameter update amount.

4. The vulnerability detection model training method according to claim 3, characterized in that: The sample script set includes script features of a plurality of first original scripts, and the script features of the plurality of first original scripts are obtained by reducing the dimensions of initial features of the plurality of first original scripts using a feature compression model. The method further includes: Obtaining a reconstruction error of the sample feature set according to a reconstructed feature set of the sample feature set by the current second model to be trained, wherein the sample feature set is sequentially processed by an encoder and a decoder of the second model to be trained to obtain the reconstructed feature set; Performing sparse processing on the encoded feature set output by the encoder to obtain a sparse self-expression error; Using the sparse self-expression error as a regularization term constraining the reconstruction error, and updating the current second model to be trained; The above steps are iterated until an iteration stop condition of the feature compression model is met.

5. The vulnerability detection model training method according to claim 4, characterized in that: The encoding feature set output by the encoder is subjected to sparse processing to obtain a sparse self-expression error, including: Generate a sparse self-expressive matrix according to the coding feature set, wherein the coding feature set includes a plurality of coding vectors, and the sparse self-expressive matrix carries similarity information between the plurality of coding vectors; Calculate the vector distance between each encoding vector and its own sparse vector respectively, wherein the sparse vector of each encoding vector is the vector of the encoding vector after being mapped by the sparse self-expression matrix; The sum of all the vector distances is taken as the sparse self-expression error.

6. The vulnerability detection model training method according to claim 5, characterized in that: According to the encoding feature set, a sparse self-expression matrix is ​​generated, including: Calculating the Euclidean distance between a feature matrix formed by the plurality of encoding vectors and the transpose of the feature matrix to obtain an initial self-expression matrix; The initial self-expression matrix is ​​adjusted by a preset matrix density coefficient to obtain an optimized self-expression matrix; The optimized self-expression matrix is ​​normalized to obtain the sparse self-expression matrix.

7. A script vulnerability detection method, characterized in that: The method comprises: Get the script to be tested; The vulnerability detection model trained by the vulnerability detection model training method according to any one of claims 1 to 6 is used to process the script to be detected to obtain vulnerability prediction information of the script to be detected.

8. A vulnerability detection model training device, characterized in that: The device comprises: A model loss module, used to obtain vulnerability prediction loss for the sample script set according to vulnerability prediction information of the current first model to be trained for the sample script set; A model training module, used for obtaining the variability of the sample script set, and updating the current first model to be trained according to the variability and the vulnerability prediction loss, wherein the variability represents the complexity of the sample script set; The above steps are iterated until the iteration stop condition of the vulnerability detection model is met.

9. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, it implements the vulnerability detection model training method described in any one of claims 1 to 6 or the script vulnerability detection method described in claim 7.

10. An electronic device, characterized in that: The electronic device includes a processor and a memory, the memory stores a computer program, and when the computer program is executed by the processor, it implements the vulnerability detection model training method described in any one of claims 1 to 6 or the script vulnerability detection method described in claim 7.

Images