Method and device for constructing vulnerability code data set of embedded operating system

Abstract

The invention relates to the technical field of information security, in particular to an embedded operating system vulnerability code data set construction method and device.The embedded operating system vulnerability code data set construction method comprises the steps that version influence range information of a current vulnerability on an embedded operating system is obtained, obtaining extraction information of a vulnerability code of a current vulnerability, traversing a preset number of system version numbers, determining whether the traversed current system version number is in the version influence range information, if yes, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number, and adding the vulnerability code into a positive sample set, otherwise, adding the positive sample set and the negative sample set into a negative sample set, and forming the vulnerability code data set of the embedded operating system by the positive sample set and the negative sample set. According to the technical scheme, sufficient training data with balanced positive and negative samples can be provided for the vulnerability detection method, so that the detection accuracy of vulnerability detection of the embedded operating system is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to a method and device for constructing an embedded operating system vulnerability code data set. Background Art

[0002] As software businesses become more and more complex, it is common for developers to copy or reuse existing code during software development. This behavior of copying similar or identical existing code is called "code cloning." If the reused code segment contains a vulnerability, code cloning will undoubtedly lead to the spread of the vulnerability. Often, the code cloning problem is ignored when vulnerability patches are released, which causes the already released vulnerabilities to spread due to code cloning and not be patched. Attackers can then exploit the vulnerabilities caused by code cloning based on the released patches and affect the entire system.

[0003] The embedded operating system vulnerability detection method based on code cloning uses the vulnerability code as a data set to detect the parts of the embedded operating system source code that are similar to the vulnerability code. The embedded operating system vulnerability detection method based on deep learning also uses the vulnerability code as a data set to detect the parts of the embedded operating system source code that are similar to the features of the vulnerability code.

[0004] In the public vulnerability code datasets, the embedded operating system vulnerability data included is limited, and generally one vulnerability corresponds to one vulnerability source code; and the sample imbalance problem in these data sets is very serious, usually the number of codes without vulnerabilities far exceeds the number of codes with vulnerabilities. Therefore, the embedded operating system vulnerability detection method based on these public vulnerability code datasets reduces the accuracy of vulnerability detection. Summary of the invention

[0005] In order to solve the problems in the related art, the embodiments of the present disclosure provide a method and device for constructing an embedded operating system vulnerability code dataset.

[0006] In a first aspect, the present disclosure provides a method for constructing an embedded operating system vulnerability code dataset, including: Get the impact range of the current vulnerability on the embedded operating system version; Get the extraction information of the vulnerability code of the current vulnerability; Traversing a preset number of system version numbers, determining whether the traversed current system version number is in the version impact range information, if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set, otherwise adding it to the negative sample set; The positive sample set and the negative sample set are combined into the embedded operating system vulnerability code data set.

[0007] In an implementation of the present disclosure, traversing a preset number of system version numbers, determining whether the traversed current system version number is in the version impact range information, and if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set, otherwise adding it to the negative sample set includes: Traversing a preset number of system version numbers, determining whether the current system version number traversed is in the version impact range information, and if so, further determining whether the positive sample set is an empty set; If it is an empty set, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set; If it is not an empty set, extract the vulnerability code corresponding to the system version number closest to the current system version number from the positive sample set, and compare it with the vulnerability code corresponding to the current system version number extracted based on the extraction information; if the two are different, add the vulnerability code corresponding to the current system version to the positive sample set; or, If it is not an empty set, the vulnerability codes corresponding to all system version numbers are extracted from the positive sample set, and compared one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information. If the two are different, the vulnerability code of the current system version is added to the positive sample set.

[0008] In an implementation of the present disclosure, traversing a preset number of system version numbers, determining whether the traversed current system version number is in the version impact range information, and if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set, otherwise adding it to the negative sample set includes: Traversing a preset number of system version numbers, determining whether the current system version number traversed is in the version impact range information, and if not, further determining whether the negative sample set is an empty set; If it is an empty set, extract the vulnerability code corresponding to the current system version based on the extracted information and add it to the negative sample set; If it is not an empty set, extract the vulnerability code corresponding to the system version number closest to the current system version number from the negative sample set, and compare it with the vulnerability code corresponding to the current system version extracted based on the extraction information; if the two are different, add the vulnerability code corresponding to the current system version to the negative sample set; or, If it is not an empty set, the vulnerability codes corresponding to all system version numbers are extracted from the negative sample set, and compared one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information. If the two are different, the vulnerability code corresponding to the current system version is added to the negative sample set.

[0009] In an implementation of the present disclosure, the one-to-one comparison with the vulnerability code corresponding to the current system version extracted based on the extraction information includes: Clean the vulnerability codes to be compared before comparing them again.

[0010] In one implementation of the present disclosure, it also includes: Clean code duplications of the current vulnerability in the positive and / or negative sets.

[0011] In one implementation of the present disclosure, clearing duplicate code items of the current vulnerability in the positive sample set and / or the negative sample set includes: Clean up the vulnerability codes in all samples corresponding to the current vulnerability, and use the hash algorithm to generate a hash value for the vulnerability code in each sample; Grouping all samples according to the hash values ​​and positive and negative sample labels; Traverse each group and retain the samples containing the vulnerability code of the latest system version in each group, and delete the remaining samples in the group.

[0012] In one implementation of the present disclosure, obtaining the extraction information of the vulnerability code of the current vulnerability includes: Get the vulnerability patch for the current vulnerability; Extraction information of the vulnerability code of the current vulnerability is obtained from the vulnerability patch.

[0013] In a second aspect, the present disclosure provides an apparatus for constructing an embedded operating system vulnerability code dataset, including: A first acquisition module is configured to obtain information about the impact range of the current vulnerability on the version of the embedded operating system; A second acquisition module is configured to obtain extraction information of vulnerability code of the current vulnerability; A traversal module is configured to traverse a preset number of system version numbers, determine whether the traversed current system version number is in the version impact range information, and if so, extract the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and add it to the positive sample set, otherwise, add it to the negative sample set; The construction module is configured to combine the positive sample set and the negative sample set into the embedded operating system vulnerability code data set.

[0014] In one implementation of the present disclosure, the traversal module includes: A first determining unit is configured to traverse a preset number of system version numbers, determine whether the traversed current system version number is in the version impact range information, and if so, further determine whether the positive sample set is an empty set; A first adding unit is configured to extract the vulnerability code based on the extraction information and add it into the positive sample set as the vulnerability code corresponding to the current system version number if the set is empty; The second adding unit is configured to extract the vulnerability code corresponding to the system version number closest to the current system version number from the positive sample set if it is not an empty set, and compare it with the vulnerability code corresponding to the current system version number extracted based on the extraction information, and if the two are different, add the vulnerability code corresponding to the current system version to the positive sample set; or The third adding unit is configured to extract the vulnerability codes corresponding to all system version numbers from the positive sample set if it is not an empty set, and compare them one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information; if the two are different, the vulnerability code of the current system version is added to the positive sample set.

[0015] In one implementation of the present disclosure, the traversal module includes: A second determination unit is configured to traverse a preset number of system version numbers, determine whether the traversed current system version number is in the version impact range information, and if not, further determine whether the negative sample set is an empty set; a fourth adding unit, configured to extract the vulnerability code corresponding to the current system version based on the extraction information and add it to the negative sample set if the set is empty; A fifth adding unit is configured to extract, if the set is not empty, the vulnerability code corresponding to the system version number closest to the current system version number from the negative sample set, and compare it with the vulnerability code corresponding to the current system version extracted based on the extraction information, and if the two are different, add the vulnerability code corresponding to the current system version to the negative sample set; or The sixth adding unit is configured to extract the vulnerability codes corresponding to all system version numbers from the negative sample set if it is not an empty set, and compare them one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information; if the two are different, the vulnerability code corresponding to the current system version is added to the negative sample set.

[0016] In an implementation of the present disclosure, the parts of the third adding unit and the sixth adding unit that compare one-to-one with the vulnerability codes corresponding to the current system version extracted based on the extraction information are configured as follows: Clean the vulnerability codes to be compared before comparing them again.

[0017] In one implementation of the present disclosure, it also includes: The cleaning module is configured to clean the code duplicates of the current vulnerability in the positive sample set and / or the negative sample set.

[0018] In one implementation of the present disclosure, the clearing module includes: A cleaning unit is configured to perform a cleaning operation on vulnerability codes in all samples corresponding to the current vulnerability, and generate a hash value for the vulnerability code in each sample using a hash algorithm; A grouping unit, configured to group all samples according to the hash values ​​and positive and negative sample labels; The deletion unit is configured to traverse each group, retain the samples containing the vulnerability code of the latest system version in each group, and delete the remaining samples in the group.

[0019] In one implementation of the present disclosure, the second acquisition module includes: A first acquisition unit is configured to acquire a vulnerability patch for a current vulnerability; The second acquisition unit is configured to extract the extraction information of the vulnerability code of the current vulnerability from the vulnerability patch.

[0020] In a third aspect, an embodiment of the present disclosure provides an electronic device, comprising a memory and a processor, wherein the memory is used to store one or more computer instructions, and wherein the one or more computer instructions are executed by the processor to implement a method as described in any one of the first aspects.

[0021] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed by a processor, the method described in any one of the first aspects is implemented.

[0022] In a fifth aspect, an embodiment of the present disclosure provides a chip, the chip including a processor, the processor being used to call a computer program in a memory to execute the method for constructing the above-mentioned embedded operating system vulnerability code data set.

[0023] The technical effects provided by the embodiments of the present disclosure may include the following beneficial effects: According to the technical solution provided by the embodiment of the present disclosure, the method for constructing an embedded operating system vulnerability code data set includes obtaining the version impact range information of the current vulnerability on the embedded operating system, obtaining the extraction information of the vulnerability code of the current vulnerability, traversing a preset number of system version numbers, determining whether the traversed current system version number is in the version impact range information, and if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set, otherwise adding it to the negative sample set, and forming the embedded operating system vulnerability code data set with the positive sample set and the negative sample set. In the above technical solution, based on the comparison between the system version number and the version impact range information, the extracted vulnerability code is added to the positive sample set or the negative sample set according to the comparison result, which can greatly expand the embedded operating system vulnerability code data set, and at the same time expand the positive sample set and the negative sample set, which can provide sufficient training data with balanced positive and negative samples for vulnerability detection methods based on code cloning or deep learning, thereby improving the detection accuracy of embedded operating system vulnerability detection.

[0024] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A flowchart of a method for constructing an embedded operating system vulnerability code dataset according to an embodiment of the present disclosure is shown.

[0026] Figure 2 Schematic diagram showing vulnerable CPE information.

[0027] Figure 3 Schematic diagram showing vulnerability patches for the vulnerability.

[0028] Figure 4 A flowchart of a method for constructing an embedded operating system vulnerability code dataset according to a specific embodiment of the present disclosure is shown.

[0029] Figure 5 A structural block diagram of a device for constructing an embedded operating system vulnerability code dataset according to an embodiment of the present disclosure is shown.

[0030] Figure 6 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown.

[0031] Figure 7 A schematic diagram showing the structure of a computer system suitable for implementing the method according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0032] Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. In addition, for the sake of clarity, parts not related to the description of the exemplary embodiments are omitted in the accompanying drawings.

[0033] In the present disclosure, it should be understood that terms such as "include" or "have" are intended to indicate the presence of features, numbers, steps, behaviors, components, parts, or a combination thereof disclosed in the present specification, and are not intended to exclude the possibility that one or more other features, numbers, steps, behaviors, components, parts, or a combination thereof exist or are added.

[0034] It should also be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other. The present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0035] In the public vulnerability code datasets, the embedded operating system vulnerability data included is limited, and generally one vulnerability corresponds to one vulnerability source code; and the sample imbalance problem in these data sets is very serious, usually the number of codes without vulnerabilities far exceeds the number of codes with vulnerabilities. Therefore, the embedded operating system vulnerability detection method based on these public vulnerability code datasets reduces the accuracy of vulnerability detection.

[0036] In view of the above defects, the method for constructing an embedded operating system vulnerability code data set provided by the present disclosure includes obtaining information on the version impact range of the current vulnerability on the embedded operating system, obtaining extraction information of the vulnerability code of the current vulnerability, traversing a preset number of system version numbers, and determining whether the traversed current system version number is in the version impact range information. If so, the vulnerability code is extracted based on the extraction information as the vulnerability code corresponding to the current system version number and added to the positive sample set, otherwise it is added to the negative sample set. In the above technical solution, based on the comparison between the system version number and the version impact range information, the extracted vulnerability code is added to the positive sample set or the negative sample set according to the comparison result, which can greatly expand the embedded operating system vulnerability code data set, and at the same time expand the positive sample set and the negative sample set, which can provide sufficient training data with balanced positive and negative samples for vulnerability detection methods based on code cloning or deep learning, thereby improving the detection accuracy of embedded operating system vulnerability detection.

[0037] Figure 1 A flowchart of a method for constructing an embedded operating system vulnerability code dataset according to an embodiment of the present disclosure is shown.

[0038] like Figure 1 As shown, the method for constructing the embedded operating system vulnerability code data set includes the following steps S110-S140: In step S110, the impact range information of the current vulnerability on the version of the embedded operating system is obtained; In step S120, the extraction information of the vulnerability code of the current vulnerability is obtained; In step S130, a preset number of system version numbers are traversed to determine whether the current system version number traversed is in the version impact range information. If so, the vulnerability code is extracted based on the extraction information as the vulnerability code corresponding to the current system version number and added to the positive sample set; otherwise, it is added to the negative sample set. In step S140, the positive sample set and the negative sample set are combined into the embedded operating system vulnerability code data set.

[0039] In the disclosed method, the method of constructing the embedded operating system vulnerability code data set is to compare the system version number of the embedded operating system with the version impact range information of the current vulnerability on the embedded operating system, wherein the version impact range information includes at least the version number of the embedded operating system, and by comparing the two, if the current system version number is in the version impact range information, it indicates that the vulnerability code of the current vulnerability exists in the current system version, and then the vulnerability code of the current vulnerability is extracted from the embedded operating system code library through the extraction information of the vulnerability code of the current vulnerability and added to the positive sample set; if it is not in the version impact range information, it indicates that the vulnerability code of the current vulnerability does not exist in the current system version, and the extracted vulnerability code of the current vulnerability is added to the negative sample set. By traversing a preset number of system version numbers and comparing them one by one, a positive sample set or a negative sample set is constructed, and then the positive sample set and the negative sample set are added to the vulnerability code data set to construct the vulnerability code data set. The vulnerability code dataset constructed in the above manner has relatively balanced data of positive and negative samples, and the number has been expanded compared to the vulnerability code dataset in the prior art, thereby providing sufficient training data with balanced positive and negative samples for vulnerability detection methods based on code cloning or deep learning, thereby improving the detection accuracy of embedded operating system vulnerability detection.

[0040] In the disclosure method, the version impact range information refers to the version summary information of the embedded operating system affected by the current vulnerability. By parsing the public vulnerability database and extracting the vulnerability description information of the current vulnerability, the version impact range information can be obtained from the vulnerability description information of the current vulnerability. Of course, the version information of the embedded operating system with the same vulnerability can also be collected by retrieval or other methods and summarized to obtain the version impact range information, and the disclosure does not limit this.

[0041] In the disclosed method, the version impact range information may be CPE (Common Platform Enumeration) information of the vulnerability. CPE is a structured naming method used in vulnerability management to describe which versions of the embedded operating system are affected by the vulnerability.

[0042] For example, taking the vulnerability CVE-2022-43750 as an example, in the NVD (National Vulnerability Database, the US National Computer General Vulnerability Database) database, the CPE information of the above vulnerability is as follows: Figure 2 As stated, Figure 2 It shows that Linux Kernel versions lower than 5.19.15, or between 6.0 and 6.0-rc7 contain the above vulnerabilities.

[0043] In the disclosed method, the extracted information of the vulnerability code of the current vulnerability includes the function name of the current vulnerability and the file name and path where the current vulnerability is located.

[0044] The extraction information of the vulnerability code of the current vulnerability obtained in step S120 includes: Get the vulnerability patch for the current vulnerability; Extraction information of the vulnerability code of the current vulnerability is obtained from the vulnerability patch.

[0045] Specifically, taking the above vulnerability CVE-2022-43750 as an example, the vulnerability patch corresponding to this vulnerability is as follows: Figure 3 Said, from Figure 3 It can be concluded that the function name of the vulnerability is "mon_bin_mmap", and the file name and path where the vulnerability is located is "drivers / usb / mon / mon_bin.c".

[0046] Among them, the vulnerability patch of the current vulnerability can be obtained through the Commit ID (commit record ID) of the vulnerability patch, and the vulnerability patch corresponding to the current vulnerability is extracted from the embedded operating system code library through the Commit ID.

[0047] In one implementation of the present disclosure, the traversal of a preset number of system version numbers in step S130 to determine whether the traversed current system version number is in the version impact range information, if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set, otherwise adding it to the negative sample set includes: Traversing a preset number of system version numbers, determining whether the current system version number traversed is in the version impact range information, and if so, further determining whether the positive sample set is an empty set; If it is an empty set, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set; If it is not an empty set, extract the vulnerability code corresponding to the system version number closest to the current system version number from the positive sample set, and compare it with the vulnerability code corresponding to the current system version number extracted based on the extraction information; if the two are different, add the vulnerability code corresponding to the current system version to the positive sample set; or, If it is not an empty set, the vulnerability codes corresponding to all system version numbers are extracted from the positive sample set, and compared one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information. If the two are different, the vulnerability code of the current system version is added to the positive sample set.

[0048] In an implementation of the present disclosure, traversing a preset number of system version numbers, determining whether the traversed current system version number is in the version impact range information, and if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set, otherwise adding it to the negative sample set includes: Traversing a preset number of system version numbers, determining whether the current system version number traversed is in the version impact range information, and if not, further determining whether the negative sample set is an empty set; If it is an empty set, extract the vulnerability code corresponding to the current system version based on the extracted information and add it to the negative sample set; If it is not an empty set, extract the vulnerability code corresponding to the system version number closest to the current system version number from the negative sample set, and compare it with the vulnerability code corresponding to the current system version extracted based on the extraction information; if the two are different, add the vulnerability code corresponding to the current system version to the negative sample set; or, If it is not an empty set, the vulnerability codes corresponding to all system version numbers are extracted from the negative sample set, and compared one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information. If the two are different, the vulnerability code corresponding to the current system version is added to the negative sample set.

[0049] In the disclosed method, the specific comparison content for determining whether the current system version number is in the version impact range information at least includes: the name of the embedded operating system and whether the current version number is in the version impact range information.

[0050] In the disclosed method, a sample in the positive sample set and the negative sample set includes at least the following information: current vulnerability ID, function code (or vulnerability code, vulnerability function code), file name and path, current version number, positive sample tag and other data.

[0051] In this disclosure method, there are several situations in which the vulnerability code of the current system version is added to the positive sample set or the negative sample set: In the first case, if the positive sample set and the negative sample set are empty sets, they are directly added; In the second case, if the positive sample set and the negative sample set are not empty sets, it is necessary to compare the difference between the existing vulnerability codes in the positive sample set and the negative sample set and the vulnerability codes to be added. If there is a difference, it can be added, otherwise it will not be added.

[0052] For the second case, this disclosure provides two vulnerability code comparison methods, and uses the addition of a positive sample set as an example for explanation. The comparison method for adding a negative sample set is similar: Method 1: Extract the vulnerability code corresponding to the system version number closest to the current system version number to be compared from the positive sample set, and then compare it with the vulnerability code of the current system version. If the two are different, it is allowed to be added to the positive sample set; Method 2: Extract the vulnerability codes corresponding to all system version numbers from the positive sample set, and then compare them one by one with the vulnerability codes of the current system version. If the results of the one-to-one comparisons are all different, they are allowed to be added to the positive sample set.

[0053] By constructing the positive sample set and the negative sample set through method 1, the speed of constructing the sample set can be improved. However, since only the system version number closest to the current system version number is selected, there may be a situation where the vulnerability code of other system version numbers in the sample set is the same as the vulnerability code of the current system version number. Since other system version numbers are not compared, there will be duplicate vulnerability codes in the sample set. By constructing the positive sample set and the negative sample set through method 2, since the vulnerability codes of all system version numbers in the sample set are compared, there will be no duplicate vulnerability codes in method 1.

[0054] In an implementation of the present disclosure, the one-to-one comparison of the vulnerability codes corresponding to the current system version extracted based on the extraction information in step S130 includes: Clean the vulnerability codes to be compared before comparing them again.

[0055] In the disclosed method, one type of code cloning is that after removing spaces, blank lines and comments, the two codes are exactly the same. When detecting code cloning vulnerabilities, the essence is to compare the similarity between the software source code and the vulnerability code. Therefore, when providing a vulnerability code data set for code cloning vulnerability detection, if the two codes only differ in whether they contain "spaces, blank lines and comments" and exist in the same positive sample set or negative sample set, the valid data in the vulnerability code data set does not increase. Therefore, the disclosure is directed to the comparison method of the above-mentioned method 2, firstly, a cleaning operation is performed on the vulnerability code to be compared, specifically, a cleaning operation of deleting blank lines, comments, and redundant spaces, and then a one-to-one comparison is performed, and it is determined whether to allow it to be added to the positive sample set based on the comparison results. In addition to avoiding the vulnerability code added to the positive sample set from having the code duplication of the vulnerability in method one, it can also ensure that the sample composed of the added vulnerability code is valid data, thereby improving the training speed of the model trained using the vulnerability code data set.

[0056] In one implementation of the present disclosure, the construction method further includes: Clean code duplications of the current vulnerability in the positive and / or negative sets.

[0057] In the disclosed method, as described above, the positive sample set and the negative sample set are constructed by method 1. Since only the system version number closest to the current system version number is selected, there may be a situation where the vulnerability code of other system version numbers in the sample set is the same as the vulnerability code of the current system version number. Since other system version numbers are not compared, there will be duplicate vulnerability codes in the sample set. Therefore, after completing the traversal of the preset number of system version numbers, for the vulnerability codes added to the positive sample set and / or the negative sample set, the operation of clearing the code duplicates is further performed.

[0058] It is understandable that the operation of clearing code duplicates can be an operation that is selectively executed, or the code duplicates may not be cleared and the constructed vulnerability code data set may be directly provided. Moreover, the operation of clearing code duplicates can be selectively executed for the comparison method of the above-mentioned method 1, and can also be selectively executed for the comparison method of the above-mentioned method 2. At this time, the cleaning operation for the vulnerability code to be compared can be omitted, and the vulnerability codes can be directly compared one by one, and after traversing the preset number of system version numbers, the operation of clearing code duplicates is further executed for the vulnerability code added to the positive sample set and / or the negative sample set.

[0059] In one implementation of the present disclosure, clearing duplicate code items of the current vulnerability in the positive sample set and / or the negative sample set includes: Clean up the vulnerability codes in all samples corresponding to the current vulnerability, and use the hash algorithm to generate a hash value for the vulnerability code in each sample; Grouping all samples according to the hash values ​​and positive and negative sample labels; Traverse each group and retain the samples containing the vulnerability code of the latest system version in each group, and delete the remaining samples in the group.

[0060] In the disclosed method, duplicates of vulnerability codes in the positive sample set and / or negative sample set are cleared respectively. When clearing, firstly, the vulnerability codes in all samples of the current vulnerability (for different embedded operating system version numbers) are cleared, specifically, the cleaning operations of deleting blank lines, comments, and redundant spaces, and then a hash value is generated for the vulnerability code in each sample, and then all samples are grouped according to the hash value and the positive and negative sample labels, that is, the samples in the positive sample set are grouped according to the hash value, and the samples in the negative sample set are grouped according to the hash value. If samples of vulnerability codes of multiple system versions appear in each group, it indicates that the group has code duplicates. At this time, the samples of the vulnerability code of the latest system version in each group are retained, and the remaining samples in the group are deleted, thereby completing the code duplicate clearing operation in the positive sample set and / or the negative sample set.

[0061] Effect comparison ratio: Still taking the vulnerability CVE-2022-43750 as an example, Figure 2 As shown in the figure, the CPE information of the vulnerability shows that the Linux Kernel version lower than 5.19.15 or between 6.0 and 6.0-rc7 contains the above vulnerability.

[0062] The vulnerability patch corresponding to this vulnerability is as follows Figure 3 Said, from Figure 3 It can be concluded that the function name of the vulnerability is "mon_bin_mmap", and the file name and path where the vulnerability is located is "drivers / usb / mon / mon_bin.c"; By adopting the scheme disclosed in the present invention, all versions of Linux Kernel are traversed, from 2.6.0 to 6.11. By comparing the codes of each version, the "mon_bin_mmap" function codes of 3.0 and 3.7 are added to the positive sample set, and the "mon_bin_mmap" function codes of 6.1 and 6.3 are added to the negative sample set.

[0063] As a comparative example: In the prior art, after obtaining the vulnerability patch for vulnerability CVE-2022-43750, Figure 3As shown in the figure, the hyperlinks "---a / drivers / usb / mon / mon_bin.c" and "+++b / drivers / usb / mon / mon_bin.c" are recorded. By clicking the hyperlinks, you can get the "mon_bin_mmap" function code before and after applying the vulnerability patch, and add the former to the positive sample set and the latter to the negative sample set. The construction result is that there is one sample in each of the positive sample set and the negative sample set.

[0064] Compared with the control ratio, the method disclosed in the present invention doubles the number of positive samples and negative samples corresponding to the vulnerability, and the two numbers are relatively balanced.

[0065] Figure 4 A flowchart of a method for constructing an embedded operating system vulnerability code dataset according to a specific embodiment of the present disclosure is shown.

[0066] The method for constructing the embedded operating system vulnerability code data set includes the following steps S410-S430: In step S410, parse the public vulnerability database, extract all vulnerability related information of the embedded operating system, including the CPE information of the vulnerability and the Commit ID corresponding to the vulnerability patch; synchronize the embedded operating system code base; traverse all vulnerabilities, and perform the following steps S420 and S430 for each vulnerability; In step S420, the vulnerability patch corresponding to the current vulnerability is extracted from the embedded operating system code library through the Commit ID, and the function name containing the current vulnerability and the file name and path where it is located are obtained; In step S430, based on the CPE information of the current vulnerability extracted in step S410 and the function name and file name and path containing the current vulnerability extracted in step S420, the corresponding vulnerability function code of each version of the embedded operating system code library is added to the vulnerability data set.

[0067] Wherein, step S430 further includes: Step (1) extract all version numbers of the embedded operating system code library and initialize the positive sample set and negative sample set to be empty; Step (2) traverse each version number in step (1), calculate whether the name of the embedded operating system and the current version number are within the range of the CPE of the current vulnerability, if they are within the CPE range, go to step (3), otherwise go to step (6); Step (3) If the positive sample set is empty, go to step (5), otherwise go to step (4); Step (4) compare the vulnerability codes of the current vulnerabilities corresponding to all version numbers in the positive sample set with the vulnerability codes of the current vulnerabilities corresponding to the current version. If the two are different, go to step (5), otherwise go to step (9); Step (5) extracting files with the same file name and path as those containing the current vulnerability from the embedded operating system code library, slicing the file code, extracting function codes with the same function name as those containing the current vulnerability, and adding the current vulnerability ID, function code, file name and path, current version number, positive sample tag and other data combinations into the positive sample set; go to step (9); Step (6) If the negative sample set is empty, go to step (8), otherwise go to step (7); Step (7) compares the vulnerability codes of the current vulnerabilities corresponding to all version numbers in the negative sample set with the vulnerability codes of the current vulnerabilities corresponding to the current version. If the two are different, go to step (8), otherwise go to step (9); Step (8) extracting files with the same file name and path as those containing the current vulnerability from the embedded operating system code library, slicing the file code, extracting function codes with the same function name as those containing the current vulnerability, and adding the current vulnerability ID, function code, file name and path, current version number, negative sample tag and other data combinations into the negative sample set; go to step (9); Step (9) If the version numbers in step (1) have not been traversed completely, go to step (2); otherwise, go to step (10); Step (10) adds the positive sample set and the negative sample set to the vulnerability code dataset respectively.

[0068] Figure 5 A structural block diagram of a device for constructing an embedded operating system vulnerability code data set according to an embodiment of the present disclosure is shown, wherein the device can be implemented as part or all of an electronic device through software, hardware, or a combination of both.

[0069] like Figure 5 As shown, the embedded operating system vulnerability code data set construction device 500 includes: The first acquisition module 510 is configured to acquire information about the impact range of the current vulnerability on the version of the embedded operating system; The second acquisition module 520 is configured to obtain the extraction information of the vulnerability code of the current vulnerability; The traversal module 530 is configured to traverse a preset number of system version numbers, determine whether the traversed current system version number is in the version impact range information, and if so, extract the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and add it to the positive sample set, otherwise, add it to the negative sample set; The construction module 540 is configured to combine the positive sample set and the negative sample set into the embedded operating system vulnerability code data set.

[0070] According to the technical solution provided by the embodiments of the present disclosure, based on the comparison between the system version number and the version impact range information, the extracted vulnerability code is added to the positive sample set or the negative sample set according to the comparison result, which can greatly expand the embedded operating system vulnerability code data set, and at the same time expand the positive sample set and the negative sample set, which can provide sufficient positive and negative sample balanced training data for vulnerability detection methods based on code cloning or deep learning, thereby improving the detection accuracy of embedded operating system vulnerability detection.

[0071] In one implementation of the present disclosure, the traversal module includes: A first determining unit is configured to traverse a preset number of system version numbers, determine whether the traversed current system version number is in the version impact range information, and if so, further determine whether the positive sample set is an empty set; A first adding unit is configured to extract the vulnerability code based on the extraction information and add it into the positive sample set as the vulnerability code corresponding to the current system version number if the set is empty; The second adding unit is configured to extract the vulnerability code corresponding to the system version number closest to the current system version number from the positive sample set if it is not an empty set, and compare it with the vulnerability code corresponding to the current system version number extracted based on the extraction information, and if the two are different, add the vulnerability code corresponding to the current system version to the positive sample set; or The third adding unit is configured to extract the vulnerability codes corresponding to all system version numbers from the positive sample set if it is not an empty set, and compare them one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information; if the two are different, the vulnerability code of the current system version is added to the positive sample set.

[0072] In one implementation of the present disclosure, the traversal module includes: A second determination unit is configured to traverse a preset number of system version numbers, determine whether the traversed current system version number is in the version impact range information, and if not, further determine whether the negative sample set is an empty set; a fourth adding unit, configured to extract the vulnerability code corresponding to the current system version based on the extraction information and add it to the negative sample set if the set is empty; A fifth adding unit is configured to extract, if the set is not empty, the vulnerability code corresponding to the system version number closest to the current system version number from the negative sample set, and compare it with the vulnerability code corresponding to the current system version extracted based on the extraction information, and if the two are different, add the vulnerability code corresponding to the current system version to the negative sample set; or The sixth adding unit is configured to extract the vulnerability codes corresponding to all system version numbers from the negative sample set if it is not an empty set, and compare them one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information; if the two are different, the vulnerability code corresponding to the current system version is added to the negative sample set.

[0073] In an implementation of the present disclosure, the parts of the third adding unit and the sixth adding unit that compare one-to-one with the vulnerability codes corresponding to the current system version extracted based on the extraction information are configured as follows: Clean the vulnerability codes to be compared before comparing them again.

[0074] In one implementation of the present disclosure, it also includes: The cleaning module is configured to clean the code duplicates of the current vulnerability in the positive sample set and / or the negative sample set.

[0075] In one implementation of the present disclosure, the clearing module includes: A cleaning unit is configured to perform a cleaning operation on vulnerability codes in all samples corresponding to the current vulnerability, and generate a hash value for the vulnerability code in each sample using a hash algorithm; A grouping unit, configured to group all samples according to the hash values ​​and positive and negative sample labels; The deletion unit is configured to traverse each group, retain the samples containing the vulnerability code of the latest system version in each group, and delete the remaining samples in the group.

[0076] In one implementation of the present disclosure, the second acquisition module includes: A first acquisition unit is configured to acquire a vulnerability patch for a current vulnerability; The second acquisition unit is configured to extract the extraction information of the vulnerability code of the current vulnerability from the vulnerability patch.

[0077] The present disclosure also discloses an electronic device, Figure 6 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown.

[0078] like Figure 6As shown, the electronic device includes a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method according to an embodiment of the present disclosure.

[0079] Get the impact range of the current vulnerability on the embedded operating system version; Get the extraction information of the vulnerability code of the current vulnerability; Traversing a preset number of system version numbers, determining whether the traversed current system version number is in the version impact range information, if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set, otherwise adding it to the negative sample set; The positive sample set and the negative sample set are combined into the embedded operating system vulnerability code data set.

[0080] In an implementation of the present disclosure, traversing a preset number of system version numbers, determining whether the traversed current system version number is in the version impact range information, and if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set, otherwise adding it to the negative sample set includes: Traversing a preset number of system version numbers, determining whether the current system version number traversed is in the version impact range information, and if so, further determining whether the positive sample set is an empty set; If it is an empty set, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set; If it is not an empty set, extract the vulnerability code corresponding to the system version number closest to the current system version number from the positive sample set, and compare it with the vulnerability code corresponding to the current system version number extracted based on the extraction information; if the two are different, add the vulnerability code corresponding to the current system version to the positive sample set; or, If it is not an empty set, the vulnerability codes corresponding to all system version numbers are extracted from the positive sample set, and compared one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information. If the two are different, the vulnerability code of the current system version is added to the positive sample set.

[0081] In an implementation of the present disclosure, traversing a preset number of system version numbers, determining whether the traversed current system version number is in the version impact range information, and if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set, otherwise adding it to the negative sample set includes: Traversing a preset number of system version numbers, determining whether the current system version number traversed is in the version impact range information, and if not, further determining whether the negative sample set is an empty set; If it is an empty set, extract the vulnerability code corresponding to the current system version based on the extracted information and add it to the negative sample set; If it is not an empty set, extract the vulnerability code corresponding to the system version number closest to the current system version number from the negative sample set, and compare it with the vulnerability code corresponding to the current system version extracted based on the extraction information; if the two are different, add the vulnerability code corresponding to the current system version to the negative sample set; or, If it is not an empty set, the vulnerability codes corresponding to all system version numbers are extracted from the negative sample set, and compared one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information. If the two are different, the vulnerability code corresponding to the current system version is added to the negative sample set.

[0082] In an implementation of the present disclosure, the one-to-one comparison with the vulnerability code corresponding to the current system version extracted based on the extraction information includes: Clean the vulnerability codes to be compared before comparing them again.

[0083] In one implementation of the present disclosure, it also includes: Clean code duplications of the current vulnerability in the positive and / or negative sets.

[0084] In one implementation of the present disclosure, clearing duplicate code items of the current vulnerability in the positive sample set and / or the negative sample set includes: Clean up the vulnerability codes in all samples corresponding to the current vulnerability, and use the hash algorithm to generate a hash value for the vulnerability code in each sample; Grouping all samples according to the hash values ​​and positive and negative sample labels; Traverse each group and retain the samples containing the vulnerability code of the latest system version in each group, and delete the remaining samples in the group.

[0085] In one implementation of the present disclosure, obtaining the extraction information of the vulnerability code of the current vulnerability includes: Get the vulnerability patch for the current vulnerability; Extraction information of the vulnerability code of the current vulnerability is obtained from the vulnerability patch.

[0086] Figure 7 A schematic diagram showing the structure of a computer system suitable for implementing the method according to an embodiment of the present disclosure is shown.

[0087] like Figure 7 As shown, the computer system includes a processing unit, which can execute various methods in the above-mentioned embodiments according to a program stored in a read-only memory (ROM) or a program loaded from a storage part into a random access memory (RAM). In the RAM, various programs and data required for the operation of the computer system are also stored. The processing unit, ROM and RAM are connected to each other through a bus. An input / output (I / O) interface is also connected to the bus.

[0088] The following components are connected to the I / O interface: an input part including a keyboard, a mouse, etc.; an output part including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage part including a hard disk, etc.; and a communication part including a network interface card such as a LAN card, a modem, etc. The communication part performs a communication process via a network such as the Internet. The drive is also connected to the I / O interface as needed. Removable media, such as disks, optical disks, magneto-optical disks, semiconductor memories, etc., are installed on the drive as needed so that the computer program read therefrom can be installed into the storage part as needed. Among them, the processing unit can be implemented as a processing unit such as a CPU, a GPU, a TPU, an FPGA, an NPU, etc.

[0089] In particular, according to an embodiment of the present disclosure, the method described above can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program tangibly contained on a machine-readable medium, and the computer program includes a program code for executing the above method. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part, and / or installed from a removable medium.

[0090] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0091] The units or modules involved in the embodiments described in the present disclosure may be implemented by software or programmable hardware. The units or modules described may also be set in a processor, and the names of these units or modules do not constitute limitations on the units or modules themselves in some cases.

[0092] As another aspect, the present disclosure further provides a chip, which includes at least one processor and can be used to implement the method involved in the above system embodiment.

[0093] In one possible design, the chip also includes a memory, which is used to store program instructions and data, and the memory is located inside or outside the processor.

[0094] As another aspect, the present disclosure further provides a computer-readable storage medium, which may be a computer-readable storage medium included in the electronic device or computer system in the above embodiment; or a computer-readable storage medium that exists independently and is not assembled into a device. The computer-readable storage medium stores one or more programs, and the programs are used by one or more processors to execute the method described in the present disclosure.

[0095] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present disclosure is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the inventive concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other.

Claims

1. A method for constructing an embedded operating system vulnerability code dataset, characterized in that: include: Get the impact range of the current vulnerability on the embedded operating system version; Get the extraction information of the vulnerability code of the current vulnerability; Traversing a preset number of system version numbers, determining whether the traversed current system version number is in the version impact range information, if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set, otherwise adding it to the negative sample set; The positive sample set and the negative sample set are combined into the embedded operating system vulnerability code data set.

2. The construction method according to claim 1, characterized in that: The traversing of a preset number of system version numbers, determining whether the traversed current system version number is in the version impact range information, if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set, otherwise adding it to the negative sample set includes: Traversing a preset number of system version numbers, determining whether the current system version number traversed is in the version impact range information, and if so, further determining whether the positive sample set is an empty set; If it is an empty set, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set; If it is not an empty set, extract the vulnerability code corresponding to the system version number closest to the current system version number from the positive sample set, and compare it with the vulnerability code corresponding to the current system version number extracted based on the extraction information; if the two are different, add the vulnerability code corresponding to the current system version to the positive sample set; or, If it is not an empty set, the vulnerability codes corresponding to all system version numbers are extracted from the positive sample set, and compared one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information. If the two are different, the vulnerability code of the current system version is added to the positive sample set.

3. The construction method according to claim 1, characterized in that: The traversing of a preset number of system version numbers, determining whether the traversed current system version number is in the version impact range information, if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set, otherwise adding it to the negative sample set includes: Traversing a preset number of system version numbers, determining whether the current system version number traversed is in the version impact range information, and if not, further determining whether the negative sample set is an empty set; If it is an empty set, extract the vulnerability code corresponding to the current system version based on the extracted information and add it to the negative sample set; If it is not an empty set, extract the vulnerability code corresponding to the system version number closest to the current system version number from the negative sample set, and compare it with the vulnerability code corresponding to the current system version extracted based on the extraction information; if the two are different, add the vulnerability code corresponding to the current system version to the negative sample set; or, If it is not an empty set, the vulnerability codes corresponding to all system version numbers are extracted from the negative sample set, and compared one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information. If the two are different, the vulnerability code corresponding to the current system version is added to the negative sample set.

4. The construction method according to claim 2 or 3, characterized in that: The one-to-one comparison with the vulnerability code corresponding to the current system version extracted based on the extraction information includes: Clean the vulnerability codes to be compared before comparing them again.

5. The construction method according to any one of claims 1 to 3, characterized in that: Also includes: Clean code duplications of the current vulnerability in the positive and / or negative sets.

6. The construction method according to claim 5, characterized in that: The method of removing code duplication items of the current vulnerability in the positive sample set and / or the negative sample set includes: Clean up the vulnerability codes in all samples corresponding to the current vulnerability, and use the hash algorithm to generate a hash value for the vulnerability code in each sample; Grouping all samples according to the hash values ​​and positive and negative sample labels; Traverse each group and retain the samples containing the vulnerability code of the latest system version in each group, and delete the remaining samples in the group.

7. The construction method according to claim 1, characterized in that: The extraction information of obtaining the vulnerability code of the current vulnerability includes: Get the vulnerability patch for the current vulnerability; Extraction information of the vulnerability code of the current vulnerability is obtained from the vulnerability patch.

8. A device for constructing an embedded operating system vulnerability code dataset, characterized in that: include: A first acquisition module is configured to obtain information about the impact range of the current vulnerability on the version of the embedded operating system; A second acquisition module is configured to obtain extraction information of vulnerability code of the current vulnerability; A traversal module is configured to traverse a preset number of system version numbers, determine whether the traversed current system version number is in the version impact range information, and if so, extract the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and add it to the positive sample set, otherwise, add it to the negative sample set; The construction module is configured to combine the positive sample set and the negative sample set into the embedded operating system vulnerability code data set.

9. The construction device according to claim 8, characterized in that The traversal module includes: A first determining unit is configured to traverse a preset number of system version numbers, determine whether the traversed current system version number is in the version impact range information, and if so, further determine whether the positive sample set is an empty set; A first adding unit is configured to extract the vulnerability code based on the extraction information and add it into the positive sample set as the vulnerability code corresponding to the current system version number if the set is empty; The second adding unit is configured to extract the vulnerability code corresponding to the system version number closest to the current system version number from the positive sample set if it is not an empty set, and compare it with the vulnerability code corresponding to the current system version number extracted based on the extraction information, and if the two are different, add the vulnerability code corresponding to the current system version to the positive sample set; or The third adding unit is configured to extract the vulnerability codes corresponding to all system version numbers from the positive sample set if it is not an empty set, and compare them one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information; if the two are different, the vulnerability code of the current system version is added to the positive sample set.

10. The construction device according to claim 8, characterized in that The traversal module includes: A second determination unit is configured to traverse a preset number of system version numbers, determine whether the traversed current system version number is in the version impact range information, and if not, further determine whether the negative sample set is an empty set; a fourth adding unit, configured to extract the vulnerability code corresponding to the current system version based on the extraction information and add it to the negative sample set if the set is empty; A fifth adding unit is configured to extract, if the set is not empty, the vulnerability code corresponding to the system version number closest to the current system version number from the negative sample set, and compare it with the vulnerability code corresponding to the current system version extracted based on the extraction information, and if the two are different, add the vulnerability code corresponding to the current system version to the negative sample set; or The sixth adding unit is configured to extract the vulnerability codes corresponding to all system version numbers from the negative sample set if it is not an empty set, and compare them one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information; if the two are different, the vulnerability code corresponding to the current system version is added to the negative sample set.

11. The construction device according to claim 9 or 10, characterized in that The parts of the third adding unit and the sixth adding unit that compare one-to-one with the vulnerability codes corresponding to the current system version extracted based on the extraction information are configured as follows: Clean the vulnerability codes to be compared before comparing them again.

12. The construction device according to any one of claims 8 to 10, characterized in that: Also includes: The cleaning module is configured to clean the code duplicates of the current vulnerability in the positive sample set and / or the negative sample set.

13. The construction device according to claim 12, characterized in that The clearing module comprises: A cleaning unit is configured to perform a cleaning operation on vulnerability codes in all samples corresponding to the current vulnerability, and generate a hash value for the vulnerability code in each sample using a hash algorithm; A grouping unit, configured to group all samples according to the hash values ​​and positive and negative sample labels; The deletion unit is configured to traverse each group, retain the samples containing the vulnerability code of the latest system version in each group, and delete the remaining samples in the group.

14. The construction device according to claim 8, characterized in that The second acquisition module includes: A first acquisition unit is configured to acquire a vulnerability patch for a current vulnerability; The second acquisition unit is configured to extract the extraction information of the vulnerability code of the current vulnerability from the vulnerability patch.

15. An electronic device, characterized in that: The method comprises a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method according to any one of claims 1 to 7.

16. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

17. A chip, characterized in that: include: At least one processor, configured to implement the method according to any one of claims 1 to 7.

Images