Method and device for constructing embedded operating system vulnerability code dataset

Abstract

The present disclosure relates to the field of information security technology, and specifically to a method and device for constructing an embedded operating system vulnerability code dataset. The method for constructing the embedded operating system vulnerability code dataset includes obtaining information on the impact range of the current vulnerability on the embedded operating system version, obtaining extraction information of the vulnerability code of the current vulnerability, traversing a preset number of system version numbers, and determining whether the traversed current system version number is within the version impact range information. If so, the vulnerability code is extracted based on the extraction information as the vulnerability code corresponding to the current system version number and added to the positive sample set; otherwise, it is added to the negative sample set, and the positive sample set and the negative sample set are combined to form the embedded operating system vulnerability code dataset. The above technical solution can provide sufficient training data with balanced positive and negative samples for the vulnerability detection method, thereby improving the detection accuracy of embedded operating system vulnerability detection.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to a method and device for constructing an embedded operating system vulnerability code dataset. Background Art

[0002] As software businesses become increasingly complex, it's become common for developers to copy or reuse existing code during development. This practice of copying similar or identical existing code is called "code cloning." If the reused code contains a vulnerability, code cloning can undoubtedly lead to the spread of that vulnerability. Code cloning is often overlooked when patches are released, causing vulnerabilities to spread due to code cloning and remain unpatched. Attackers can then exploit vulnerabilities introduced by code cloning based on the released patches, potentially compromising the entire system.

[0003] The embedded operating system vulnerability detection method based on code cloning uses the vulnerability code as a dataset to detect similar parts of the embedded operating system source code to the vulnerability code. The embedded operating system vulnerability detection method based on deep learning also uses the vulnerability code as a dataset to detect similar parts of the embedded operating system source code to the vulnerability code features.

[0004] Publicly available vulnerability code datasets contain limited embedded operating system vulnerability data, and typically one vulnerability corresponds to one vulnerable source code. Furthermore, these datasets suffer from severe sample imbalance, with the number of vulnerability-free codes often far exceeding the number of vulnerable codes. Consequently, embedded operating system vulnerability detection methods based on these publicly available vulnerability code datasets suffer from reduced detection accuracy. Summary of the Invention

[0005] In order to solve the problems in the related art, the embodiments of the present disclosure provide a method and apparatus for constructing an embedded operating system vulnerability code dataset.

[0006] In a first aspect, the present disclosure provides a method for constructing an embedded operating system vulnerability code dataset, including:

[0007] Obtain information about the impact of the current vulnerability on the embedded operating system version;

[0008] Get the extraction information of the vulnerability code of the current vulnerability;

[0009] Traversing a preset number of system version numbers, determining whether the current system version number traversed is within the version impact range information, and if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set; otherwise, adding it to the negative sample set;

[0010] The positive sample set and the negative sample set are combined into the embedded operating system vulnerability code dataset.

[0011] In one implementation of the present disclosure, traversing a preset number of system version numbers and determining whether the traversed current system version number is within the version impact range information; if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set; otherwise, adding it to the negative sample set includes:

[0012] Traversing a preset number of system version numbers, determining whether the current system version number traversed is within the version impact range information, and if so, further determining whether the positive sample set is an empty set;

[0013] If it is an empty set, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set;

[0014] If it is not an empty set, extract the vulnerability code corresponding to the system version number closest to the current system version number from the positive sample set, and compare it with the vulnerability code corresponding to the current system version number extracted based on the extraction information. If the two are different, add the vulnerability code corresponding to the current system version to the positive sample set; or

[0015] If it is not an empty set, the vulnerability codes corresponding to all system version numbers are extracted from the positive sample set, and compared one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information. If the two are different, the vulnerability code of the current system version is added to the positive sample set.

[0016] In one implementation of the present disclosure, traversing a preset number of system version numbers and determining whether the traversed current system version number is within the version impact range information; if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set; otherwise, adding it to the negative sample set includes:

[0017] Traversing a preset number of system version numbers, determining whether the current system version number traversed is within the version impact range information, and if not, further determining whether the negative sample set is an empty set;

[0018] If it is an empty set, extract the vulnerability code corresponding to the current system version based on the extracted information and add it to the negative sample set;

[0019] If it is not an empty set, extract the vulnerability code corresponding to the system version number closest to the current system version number from the negative sample set, and compare it with the vulnerability code corresponding to the current system version extracted based on the extraction information. If the two are different, add the vulnerability code corresponding to the current system version to the negative sample set; or

[0020] If it is not an empty set, the vulnerability codes corresponding to all system version numbers are extracted from the negative sample set, and compared one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information. If the two are different, the vulnerability code corresponding to the current system version is added to the negative sample set.

[0021] In one implementation of the present disclosure, the one-to-one comparison with the vulnerability code corresponding to the current system version extracted based on the extraction information includes:

[0022] Clean the vulnerability codes to be compared before comparing them again.

[0023] In one implementation of the present disclosure, it further includes:

[0024] Remove code duplications for the current vulnerability in the positive and / or negative sample sets.

[0025] In one implementation of the present disclosure, clearing duplicate code items of the current vulnerability in the positive sample set and / or the negative sample set includes:

[0026] Clean up the vulnerability code in all samples corresponding to the current vulnerability, and use the hash algorithm to generate a hash value for the vulnerability code in each sample;

[0027] Grouping all samples according to the hash values ​​and positive and negative sample labels;

[0028] Traverse each group and retain the samples containing the vulnerability code of the latest system version in each group, and delete the remaining samples in the group.

[0029] In one implementation of the present disclosure, obtaining the extraction information of the vulnerability code of the current vulnerability includes:

[0030] Get the vulnerability patch for the current vulnerability;

[0031] Extraction information of the vulnerability code of the current vulnerability is obtained from the vulnerability patch.

[0032] In a second aspect, an embodiment of the present disclosure provides a device for constructing an embedded operating system vulnerability code dataset, including:

[0033] A first acquisition module is configured to obtain information about the impact range of the current vulnerability on the version of the embedded operating system;

[0034] A second acquisition module is configured to obtain extraction information of vulnerability code of the current vulnerability;

[0035] a traversal module configured to traverse a preset number of system version numbers and determine whether the current system version number traversed is within the version impact range information; if so, extract the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and add it to the positive sample set; otherwise, add it to the negative sample set;

[0036] The construction module is configured to combine the positive sample set and the negative sample set to form the embedded operating system vulnerability code dataset.

[0037] In one implementation of the present disclosure, the traversal module includes:

[0038] A first determining unit is configured to traverse a preset number of system version numbers, determine whether the traversed current system version number is within the version impact range information, and if so, further determine whether the positive sample set is an empty set;

[0039] A first adding unit is configured to extract the vulnerability code based on the extraction information and add it into the positive sample set as the vulnerability code corresponding to the current system version number if the set is empty;

[0040] The second adding unit is configured to, if the set is not empty, extract the vulnerability code corresponding to the system version number closest to the current system version number from the positive sample set, and compare it with the vulnerability code corresponding to the current system version number extracted based on the extraction information; if the two are different, add the vulnerability code corresponding to the current system version to the positive sample set; or

[0041] The third adding unit is configured to extract the vulnerability codes corresponding to all system version numbers from the positive sample set if it is not an empty set, and compare them one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information; if the two are different, the vulnerability code of the current system version is added to the positive sample set.

[0042] In one implementation of the present disclosure, the traversal module includes:

[0043] A second determining unit is configured to traverse a preset number of system version numbers, determine whether the traversed current system version number is in the version impact range information, and if not, further determine whether the negative sample set is an empty set;

[0044] a fourth adding unit, configured to extract the vulnerability code corresponding to the current system version based on the extracted information and add it to the negative sample set if the set is empty;

[0045] a fifth adding unit configured to, if the set is not empty, extract from the negative sample set the vulnerability code corresponding to the system version number closest to the current system version number, and compare with the vulnerability code corresponding to the current system version extracted based on the extraction information; if the two are different, add the vulnerability code corresponding to the current system version to the negative sample set; or

[0046] The sixth adding unit is configured to extract the vulnerability codes corresponding to all system version numbers from the negative sample set if it is not an empty set, and compare them one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information; if the two are different, the vulnerability code corresponding to the current system version is added to the negative sample set.

[0047] In one implementation of the present disclosure, the parts of the third adding unit and the sixth adding unit that perform one-to-one comparison with the vulnerability codes corresponding to the current system version extracted based on the extraction information are configured as follows:

[0048] Clean the vulnerability codes to be compared before comparing them again.

[0049] In one implementation of the present disclosure, it further includes:

[0050] The cleaning module is configured to clean the code duplicates of the current vulnerability in the positive sample set and / or the negative sample set.

[0051] In one implementation of the present disclosure, the clearing module includes:

[0052] A cleaning unit is configured to clean the vulnerability code in all samples corresponding to the current vulnerability and generate a hash value for the vulnerability code in each sample using a hash algorithm;

[0053] a grouping unit, configured to group all samples according to the hash value and the positive and negative sample labels;

[0054] The deletion unit is configured to traverse each group, retain the samples containing the vulnerability code of the latest system version in each group, and delete the remaining samples in the group.

[0055] In one implementation of the present disclosure, the second acquisition module includes:

[0056] A first obtaining unit is configured to obtain a vulnerability patch for a current vulnerability;

[0057] The second obtaining unit is configured to extract information of the vulnerability code of the current vulnerability from the vulnerability patch.

[0058] In a third aspect, an embodiment of the present disclosure provides an electronic device comprising a memory and a processor, wherein the memory is used to store one or more computer instructions, and wherein the one or more computer instructions are executed by the processor to implement a method as described in any one of the first aspects.

[0059] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed by a processor, the method as described in any one of the first aspects is implemented.

[0060] In a fifth aspect, an embodiment of the present disclosure provides a chip, which includes a processor, and the processor is used to call a computer program in a memory to execute the above-mentioned method for constructing an embedded operating system vulnerability code data set.

[0061] The technical effects provided by the embodiments of the present disclosure may include the following beneficial effects:

[0062] According to the technical solution provided by the embodiment of the present disclosure, the method for constructing an embedded operating system vulnerability code data set includes obtaining version impact range information of the current vulnerability on the embedded operating system, obtaining extraction information of the vulnerability code of the current vulnerability, traversing a preset number of system version numbers, and determining whether the traversed current system version number is in the version impact range information. If so, the vulnerability code is extracted based on the extraction information as the vulnerability code corresponding to the current system version number and added to the positive sample set; otherwise, it is added to the negative sample set, and the positive sample set and the negative sample set are combined to form the embedded operating system vulnerability code data set. In the above technical solution, based on the comparison between the system version number and the version impact range information, the extracted vulnerability code is added to the positive sample set or the negative sample set according to the comparison result, which can greatly expand the embedded operating system vulnerability code data set, and at the same time expand the positive sample set and the negative sample set, which can provide sufficient training data with balanced positive and negative samples for vulnerability detection methods based on code cloning or deep learning, thereby improving the detection accuracy of embedded operating system vulnerability detection.

[0063] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 A flowchart of a method for constructing an embedded operating system vulnerability code dataset according to an embodiment of the present disclosure is shown.

[0065] Figure 2 Schematic diagram showing vulnerable CPE information.

[0066] Figure 3 Schematic diagram showing vulnerability patches.

[0067] Figure 4 A flowchart illustrating a method for constructing an embedded operating system vulnerability code dataset according to a specific embodiment of the present disclosure is shown.

[0068] Figure 5 A structural block diagram of a device for constructing an embedded operating system vulnerability code dataset according to an embodiment of the present disclosure is shown.

[0069] Figure 6 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown.

[0070] Figure 7 A schematic diagram showing the structure of a computer system suitable for implementing the method according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0071] Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. In addition, for the sake of clarity, parts not related to the description of the exemplary embodiments are omitted in the accompanying drawings.

[0072] In the present disclosure, it should be understood that terms such as "include" or "have" are intended to indicate the presence of features, numbers, steps, actions, components, parts, or combinations thereof disclosed in the present specification, and are not intended to exclude the possibility that one or more other features, numbers, steps, actions, components, parts, or combinations thereof exist or are added.

[0073] It should also be noted that, in the absence of conflict, the embodiments and features of the embodiments of the present disclosure may be combined with each other. The present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0074] Publicly available vulnerability code datasets contain limited embedded operating system vulnerability data, and typically one vulnerability corresponds to one vulnerable source code. Furthermore, these datasets suffer from severe sample imbalance, with the number of vulnerability-free codes often far exceeding the number of vulnerable codes. Consequently, embedded operating system vulnerability detection methods based on these publicly available vulnerability code datasets suffer from reduced detection accuracy.

[0075] Taking the above-mentioned defects into consideration, the method for constructing an embedded operating system vulnerability code dataset provided by the present disclosure includes obtaining information on the version impact range of the current vulnerability on the embedded operating system, obtaining extraction information of the vulnerability code of the current vulnerability, traversing a preset number of system version numbers, and determining whether the traversed current system version number is in the version impact range information. If so, the vulnerability code is extracted based on the extraction information and added to the positive sample set as the vulnerability code corresponding to the current system version number; otherwise, it is added to the negative sample set. In the above-mentioned technical solution, based on the comparison between the system version number and the version impact range information, the extracted vulnerability code is added to the positive sample set or the negative sample set according to the comparison result, which can greatly expand the embedded operating system vulnerability code dataset, and at the same time expand the positive sample set and the negative sample set, which can provide sufficient training data with balanced positive and negative samples for vulnerability detection methods based on code cloning or deep learning, thereby improving the detection accuracy of embedded operating system vulnerability detection.

[0076] Figure 1 A flowchart of a method for constructing an embedded operating system vulnerability code dataset according to an embodiment of the present disclosure is shown.

[0077] like Figure 1 As shown, the method for constructing the embedded operating system vulnerability code dataset includes the following steps S110-S140:

[0078] In step S110, information on the impact range of the current vulnerability on the embedded operating system version is obtained;

[0079] In step S120, the extraction information of the vulnerability code of the current vulnerability is obtained;

[0080] In step S130, a preset number of system version numbers are traversed to determine whether the current system version number traversed is within the version impact range information. If so, the vulnerability code is extracted based on the extraction information as the vulnerability code corresponding to the current system version number and added to the positive sample set; otherwise, it is added to the negative sample set.

[0081] In step S140 , the positive sample set and the negative sample set are combined into the embedded operating system vulnerability code dataset.

[0082] In the disclosed method, the method for constructing an embedded operating system vulnerability code dataset is to compare the system version number of the embedded operating system with the version impact range information of the current vulnerability on the embedded operating system, wherein the version impact range information includes at least the version number of the embedded operating system. By comparing the two, if the current system version number is in the version impact range information, it indicates that the vulnerability code of the current vulnerability exists in the current system version. Then, through the extraction information of the vulnerability code of the current vulnerability, the vulnerability code of the current vulnerability is extracted from the embedded operating system code library and added to the positive sample set; if it is not in the version impact range information, it indicates that the vulnerability code of the current vulnerability does not exist in the current system version, and the extracted vulnerability code of the current vulnerability is added to the negative sample set. By traversing a preset number of system version numbers and comparing them one by one, a positive sample set or a negative sample set is constructed, and then the positive sample set and the negative sample set are added to the vulnerability code dataset to construct a vulnerability code dataset. The vulnerability code dataset constructed in the above manner has a relatively balanced data set of positive and negative samples, and the number has been expanded compared to the vulnerability code dataset in the existing technology. This can provide sufficient training data with a balanced positive and negative sample set for vulnerability detection methods based on code cloning or deep learning, thereby improving the detection accuracy of embedded operating system vulnerability detection.

[0083] In the present disclosure, the version impact range information refers to the aggregated version information of the embedded operating system affected by the current vulnerability. By parsing a public vulnerability database and extracting the vulnerability description information of the current vulnerability, the version impact range information can be obtained from the vulnerability description information of the current vulnerability. Of course, the version impact range information can also be obtained by searching or other methods to collect version information of embedded operating systems with the same vulnerability and aggregating them, but this disclosure does not limit this.

[0084] In the disclosed method, the version impact range information may be the CPE (Common Platform Enumeration) information of the vulnerability. CPE is a structured naming method used in vulnerability management to describe which versions of the embedded operating system are affected by the vulnerability.

[0085] For example, taking the vulnerability CVE-2022-43750 as an example, in the NVD (National Vulnerability Database, the U.S. National Computer Common Vulnerability Database) database, the CPE information of the above vulnerability is as follows: Figure 2 As stated, Figure 2 This indicates that Linux kernel versions lower than 5.19.15, or versions between 6.0 and 6.0-rc7 contain the above vulnerabilities.

[0086] In the disclosed method, the extracted information of the vulnerability code of the current vulnerability includes the function name of the current vulnerability and the file name and path where the current vulnerability is located.

[0087] The step S120 of obtaining the extraction information of the vulnerability code of the current vulnerability includes:

[0088] Get the vulnerability patch for the current vulnerability;

[0089] Extraction information of the vulnerability code of the current vulnerability is obtained from the vulnerability patch.

[0090] Specifically, still taking the above vulnerability CVE-2022-43750 as an example, the vulnerability patch corresponding to this vulnerability is as follows: Figure 3 As stated, Figure 3 It can be concluded that the function name of the vulnerability is "mon_bin_mmap", and the file name and path where the vulnerability is located is "drivers / usb / mon / mon_bin.c".

[0091] Among them, the vulnerability patch of the current vulnerability can be obtained through the Commit ID (commit record ID) of the vulnerability patch, and the vulnerability patch corresponding to the current vulnerability can be extracted from the embedded operating system code library through the Commit ID.

[0092] In one implementation of the present disclosure, in step S130, traversing a preset number of system version numbers and determining whether the traversed current system version number is within the version impact range information, if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set; otherwise, adding it to the negative sample set includes:

[0093] Traversing a preset number of system version numbers, determining whether the current system version number traversed is within the version impact range information, and if so, further determining whether the positive sample set is an empty set;

[0094] If it is an empty set, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set;

[0095] If it is not an empty set, extract the vulnerability code corresponding to the system version number closest to the current system version number from the positive sample set, and compare it with the vulnerability code corresponding to the current system version number extracted based on the extraction information. If the two are different, add the vulnerability code corresponding to the current system version to the positive sample set; or

[0096] If it is not an empty set, the vulnerability codes corresponding to all system version numbers are extracted from the positive sample set, and compared one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information. If the two are different, the vulnerability code of the current system version is added to the positive sample set.

[0097] In one implementation of the present disclosure, traversing a preset number of system version numbers and determining whether the traversed current system version number is within the version impact range information; if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set; otherwise, adding it to the negative sample set includes:

[0098] Traversing a preset number of system version numbers, determining whether the current system version number traversed is within the version impact range information, and if not, further determining whether the negative sample set is an empty set;

[0099] If it is an empty set, extract the vulnerability code corresponding to the current system version based on the extracted information and add it to the negative sample set;

[0100] If it is not an empty set, extract the vulnerability code corresponding to the system version number closest to the current system version number from the negative sample set, and compare it with the vulnerability code corresponding to the current system version extracted based on the extraction information. If the two are different, add the vulnerability code corresponding to the current system version to the negative sample set; or

[0101] If it is not an empty set, the vulnerability codes corresponding to all system version numbers are extracted from the negative sample set, and compared one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information. If the two are different, the vulnerability code corresponding to the current system version is added to the negative sample set.

[0102] In the disclosed method, the specific comparison content for determining whether the current system version number is in the version impact range information at least includes: the name of the embedded operating system and whether the current version number is in the version impact range information.

[0103] In the disclosed method, a sample in the positive sample set and the negative sample set includes at least the following information: current vulnerability ID, function code (or vulnerability code, vulnerability function code), file name and path, current version number, positive sample tag and other data.

[0104] In this disclosure method, the vulnerability code of the current system version is added to the positive sample set or negative sample set in the following situations:

[0105] In the first case, if the positive sample set and the negative sample set are empty sets, they are directly added;

[0106] In the second case, if the positive sample set and the negative sample set are not empty sets, it is necessary to compare the difference between the existing vulnerability codes in the positive sample set and the negative sample set and the vulnerability codes to be added. If there is a difference, it can be added, otherwise it will not be added.

[0107] For the second case, this paper provides two vulnerability code comparison methods, and uses the addition of a positive sample set as an example to illustrate. The comparison method for adding a negative sample set is similar:

[0108] Method 1: Extract the vulnerability code corresponding to the system version number closest to the current system version number to be compared from the positive sample set, and then compare it with the vulnerability code of the current system version. If the two are different, it is allowed to be added to the positive sample set;

[0109] Method 2: Extract the vulnerability codes corresponding to all system version numbers from the positive sample set, and then compare them one by one with the vulnerability codes of the current system version. If the results of the one-to-one comparisons are different, they are allowed to be added to the positive sample set.

[0110] Using method 1 to construct positive and negative sample sets can speed up sample set construction. However, since only the system version closest to the current system version is selected, there may be cases where the vulnerability code of other system versions in the sample set is the same as the vulnerability code of the current system version. Since other system versions are not compared, this will result in duplicate vulnerability code in the sample set. Using method 2 to construct positive and negative sample sets, since the vulnerability code of all system versions in the sample set is compared, the duplication of vulnerability code in method 1 will not occur.

[0111] In one implementation of the present disclosure, the one-to-one comparison of the vulnerability codes corresponding to the current system version extracted based on the extraction information in step S130 includes:

[0112] Clean the vulnerability codes to be compared before comparing them again.

[0113] In the disclosed method, one type of code cloning is that after removing spaces, blank lines and comments, the two codes are exactly the same. When detecting vulnerabilities in code cloning, the essence is to compare the similarity between the software source code and the vulnerability code. Therefore, when providing a vulnerability code dataset for code cloning vulnerability detection, if the two codes only differ in whether they contain "spaces, blank lines and comments" and exist in the same positive sample set or negative sample set, the valid data in the vulnerability code dataset does not increase. Therefore, the disclosed method for the comparison method of the above-mentioned method 2 first performs a cleaning operation on the vulnerability code to be compared, specifically, a cleaning operation of deleting blank lines, comments, and redundant spaces, and then performs a one-to-one comparison, and determines whether to allow it to be added to the positive sample set based on the comparison results. In addition to avoiding the vulnerability code added to the positive sample set from having the code duplication of the vulnerability in method 1, it can also ensure that the sample composed of the added vulnerability code is valid data, thereby improving the training speed of the model trained using the vulnerability code dataset.

[0114] In one implementation of the present disclosure, the construction method further includes:

[0115] Remove code duplications for the current vulnerability in the positive and / or negative sample sets.

[0116] In the disclosed method, as described above, the positive sample set and negative sample set are constructed using method 1. Since only the system version number closest to the current system version number is selected, there may be situations where the vulnerability code of other system version numbers in the sample set is the same as the vulnerability code of the current system version number. Since other system version numbers are not compared, this will result in duplicate vulnerability codes in the sample set. Therefore, after traversing a preset number of system version numbers, the vulnerability code added to the positive sample set and / or negative sample set is further cleared of duplicate code.

[0117] It is understandable that the operation of clearing code duplicates can be an optional operation, or the constructed vulnerability code dataset can be directly provided without clearing code duplicates. Moreover, the operation of clearing code duplicates can be performed for both the comparison method of the above-mentioned method 1 and the comparison method of the above-mentioned method 2. In this case, the cleaning operation of the vulnerability code to be compared can be omitted, and the vulnerability codes can be directly compared one by one. After traversing a preset number of system version numbers, the operation of clearing code duplicates is further performed for the vulnerability code added to the positive sample set and / or negative sample set.

[0118] In one implementation of the present disclosure, clearing duplicate code items of the current vulnerability in the positive sample set and / or the negative sample set includes:

[0119] Clean up the vulnerability code in all samples corresponding to the current vulnerability, and use the hash algorithm to generate a hash value for the vulnerability code in each sample;

[0120] Grouping all samples according to the hash values ​​and positive and negative sample labels;

[0121] Traverse each group and retain the samples containing the vulnerability code of the latest system version in each group, and delete the remaining samples in the group.

[0122] In the disclosed method, duplicates of vulnerability codes in the positive sample set and / or negative sample set are cleared respectively. When clearing, firstly, the vulnerability codes in all samples of the current vulnerability (for different embedded operating system version numbers) are cleared, specifically, the cleaning operation of deleting blank lines, comments, and extra spaces is performed, and then a hash value is generated for the vulnerability code in each sample, and then all samples are grouped according to the hash value and the positive and negative sample labels, that is, the samples in the positive sample set are grouped according to the hash value, and the samples in the negative sample set are grouped according to the hash value. If samples of vulnerability codes of multiple system versions appear in each group, it indicates that the group has code duplicates. At this time, the sample of the vulnerability code of the latest system version in each group is retained, and the remaining samples in the group are deleted, thereby completing the code duplicate clearing operation in the positive sample set and / or negative sample set.

[0123] Effect comparison ratio:

[0124] Still taking the vulnerability CVE-2022-43750 as an example, Figure 2 As shown in the figure, the CPE information of the vulnerability indicates that Linux Kernel versions lower than 5.19.15 or between 6.0 and 6.0-rc7 contain the above vulnerability.

[0125] The vulnerability patch corresponding to this vulnerability is as follows Figure 3 As stated, Figure 3 It can be concluded that the function name of the vulnerability is "mon_bin_mmap", and the file name and path where the vulnerability is located is "drivers / usb / mon / mon_bin.c";

[0126] Using the solution disclosed in this paper, we traverse all versions of the Linux Kernel, from 2.6.0 to 6.11. By comparing the codes of each version, we add the "mon_bin_mmap" function codes of 3.0 and 3.7 to the positive sample set, and add the "mon_bin_mmap" function codes of 6.1 and 6.3 to the negative sample set.

[0127] As a comparative example:

[0128] In the prior art, after obtaining the vulnerability patch for vulnerability CVE-2022-43750, Figure 3 As shown in the figure, the hyperlinks "---a / drivers / usb / mon / mon_bin.c" and "+++b / drivers / usb / mon / mon_bin.c" are recorded. By clicking these hyperlinks, you can obtain the "mon_bin_mmap" function code before and after applying the vulnerability patch. The former is added to the positive sample set, and the latter is added to the negative sample set. The result is that the positive sample set and the negative sample set each have one sample.

[0129] Compared with the control example, the method disclosed in the present invention doubles the number of positive samples and negative samples corresponding to the vulnerability, and the two numbers are relatively balanced.

[0130] Figure 4 A flowchart illustrating a method for constructing an embedded operating system vulnerability code dataset according to a specific embodiment of the present disclosure is shown.

[0131] The method for constructing the embedded operating system vulnerability code dataset includes the following steps S410-S430:

[0132] In step S410, the public vulnerability database is parsed to extract all vulnerability-related information of the embedded operating system, including the CPE information of the vulnerability and the commit ID corresponding to the vulnerability patch; the embedded operating system code base is synchronized; all vulnerabilities are traversed, and the following steps S420 and S430 are performed for each vulnerability;

[0133] In step S420, the vulnerability patch corresponding to the current vulnerability is extracted from the embedded operating system code library through the Commit ID, and the function name containing the current vulnerability and the file name and path are obtained;

[0134] In step S430, based on the CPE information of the current vulnerability extracted in step S410 and the function name and file name and path containing the current vulnerability extracted in step S420, the corresponding vulnerability function code of each version of the embedded operating system code library is added to the vulnerability data set.

[0135] Wherein, step S430 further includes:

[0136] Step (1) extract all version numbers of the embedded operating system code library and initialize the positive sample set and negative sample set to empty;

[0137] Step (2) traverse each version number in step (1), calculate whether the name of the embedded operating system and the current version number are within the range of the CPE of the current vulnerability, if they are within the CPE range, go to step (3), otherwise go to step (6);

[0138] Step (3) If the positive sample set is empty, go to step (5), otherwise go to step (4);

[0139] Step (4) compares the vulnerability codes of the current vulnerabilities corresponding to all version numbers in the positive sample set with the vulnerability codes of the current vulnerabilities corresponding to the current version. If there is a difference between the two, go to step (5), otherwise go to step (9);

[0140] Step (5) extract the file with the same file name and path as the one containing the current vulnerability from the embedded operating system code library, slice the file code, extract the function code with the same function name as the one containing the current vulnerability, and add the current vulnerability ID, function code, file name and path, current version number, positive sample tag and other data into the positive sample set; go to step (9);

[0141] Step (6) If the negative sample set is empty, go to step (8), otherwise go to step (7);

[0142] Step (7) compares the vulnerability codes of the current vulnerabilities corresponding to all version numbers in the negative sample set with the vulnerability codes of the current vulnerabilities corresponding to the current version. If there is a difference between the two, go to step (8), otherwise go to step (9);

[0143] Step (8) extract the file with the same file name and path as the one containing the current vulnerability from the embedded operating system code library, slice the file code, extract the function code with the same function name as the one containing the current vulnerability, and add the current vulnerability ID, function code, file name and path, current version number, negative sample label and other data into the negative sample set; go to step (9);

[0144] Step (9) If the version numbers in step (1) have not been traversed, go to step (2), otherwise go to step (10);

[0145] Step (10) adds the positive sample set and the negative sample set to the vulnerability code dataset respectively.

[0146] Figure 5 A structural block diagram of a device for constructing an embedded operating system vulnerability code dataset according to an embodiment of the present disclosure is shown. The device can be implemented as part or all of an electronic device through software, hardware, or a combination of both.

[0147] like Figure 5As shown, the apparatus 500 for constructing an embedded operating system vulnerability code dataset includes:

[0148] The first acquisition module 510 is configured to obtain information about the impact range of the current vulnerability on the version of the embedded operating system;

[0149] The second acquisition module 520 is configured to obtain the extraction information of the vulnerability code of the current vulnerability;

[0150] The traversal module 530 is configured to traverse a preset number of system version numbers and determine whether the current system version number traversed is within the version impact range information. If so, the vulnerability code is extracted based on the extraction information and added to the positive sample set as the vulnerability code corresponding to the current system version number; otherwise, it is added to the negative sample set.

[0151] The construction module 540 is configured to combine the positive sample set and the negative sample set into the embedded operating system vulnerability code dataset.

[0152] According to the technical solution provided by the embodiments of the present disclosure, based on the comparison of the system version number and the version impact range information, the extracted vulnerability code is added to the positive sample set or the negative sample set according to the comparison result, which can greatly expand the embedded operating system vulnerability code data set, and at the same time expand the positive sample set and the negative sample set, which can provide sufficient, positive and negative sample balanced training data for vulnerability detection methods based on code cloning or deep learning, thereby improving the detection accuracy of embedded operating system vulnerability detection.

[0153] In one implementation of the present disclosure, the traversal module includes:

[0154] A first determining unit is configured to traverse a preset number of system version numbers, determine whether the traversed current system version number is within the version impact range information, and if so, further determine whether the positive sample set is an empty set;

[0155] A first adding unit is configured to extract the vulnerability code based on the extraction information and add it into the positive sample set as the vulnerability code corresponding to the current system version number if the set is empty;

[0156] The second adding unit is configured to, if the set is not empty, extract the vulnerability code corresponding to the system version number closest to the current system version number from the positive sample set, and compare it with the vulnerability code corresponding to the current system version number extracted based on the extraction information; if the two are different, add the vulnerability code corresponding to the current system version to the positive sample set; or

[0157] The third adding unit is configured to extract the vulnerability codes corresponding to all system version numbers from the positive sample set if it is not an empty set, and compare them one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information; if the two are different, the vulnerability code of the current system version is added to the positive sample set.

[0158] In one implementation of the present disclosure, the traversal module includes:

[0159] A second determining unit is configured to traverse a preset number of system version numbers, determine whether the traversed current system version number is in the version impact range information, and if not, further determine whether the negative sample set is an empty set;

[0160] a fourth adding unit, configured to extract the vulnerability code corresponding to the current system version based on the extracted information and add it to the negative sample set if the set is empty;

[0161] a fifth adding unit configured to, if the set is not empty, extract from the negative sample set the vulnerability code corresponding to the system version number closest to the current system version number, and compare with the vulnerability code corresponding to the current system version extracted based on the extraction information; if the two are different, add the vulnerability code corresponding to the current system version to the negative sample set; or

[0162] The sixth adding unit is configured to extract the vulnerability codes corresponding to all system version numbers from the negative sample set if it is not an empty set, and compare them one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information; if the two are different, the vulnerability code corresponding to the current system version is added to the negative sample set.

[0163] In one implementation of the present disclosure, the parts of the third adding unit and the sixth adding unit that perform one-to-one comparison with the vulnerability codes corresponding to the current system version extracted based on the extraction information are configured as follows:

[0164] Clean the vulnerability codes to be compared before comparing them again.

[0165] In one implementation of the present disclosure, it further includes:

[0166] The cleaning module is configured to clean the code duplicates of the current vulnerability in the positive sample set and / or the negative sample set.

[0167] In one implementation of the present disclosure, the clearing module includes:

[0168] A cleaning unit is configured to clean the vulnerability code in all samples corresponding to the current vulnerability and generate a hash value for the vulnerability code in each sample using a hash algorithm;

[0169] a grouping unit, configured to group all samples according to the hash value and the positive and negative sample labels;

[0170] The deletion unit is configured to traverse each group, retain the samples containing the vulnerability code of the latest system version in each group, and delete the remaining samples in the group.

[0171] In one implementation of the present disclosure, the second acquisition module includes:

[0172] A first obtaining unit is configured to obtain a vulnerability patch for a current vulnerability;

[0173] The second obtaining unit is configured to extract information of the vulnerability code of the current vulnerability from the vulnerability patch.

[0174] The present disclosure also discloses an electronic device, Figure 6 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown.

[0175] like Figure 6 As shown, the electronic device includes a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method according to an embodiment of the present disclosure.

[0176] Obtain information about the impact of the current vulnerability on the embedded operating system version;

[0177] Get the extraction information of the vulnerability code of the current vulnerability;

[0178] Traversing a preset number of system version numbers, determining whether the current system version number traversed is within the version impact range information, and if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set; otherwise, adding it to the negative sample set;

[0179] The positive sample set and the negative sample set are combined into the embedded operating system vulnerability code dataset.

[0180] In one implementation of the present disclosure, traversing a preset number of system version numbers and determining whether the traversed current system version number is within the version impact range information; if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set; otherwise, adding it to the negative sample set includes:

[0181] Traversing a preset number of system version numbers, determining whether the current system version number traversed is within the version impact range information, and if so, further determining whether the positive sample set is an empty set;

[0182] If it is an empty set, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set;

[0183] If it is not an empty set, extract the vulnerability code corresponding to the system version number closest to the current system version number from the positive sample set, and compare it with the vulnerability code corresponding to the current system version number extracted based on the extraction information. If the two are different, add the vulnerability code corresponding to the current system version to the positive sample set; or

[0184] If it is not an empty set, the vulnerability codes corresponding to all system version numbers are extracted from the positive sample set, and compared one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information. If the two are different, the vulnerability code of the current system version is added to the positive sample set.

[0185] In one implementation of the present disclosure, traversing a preset number of system version numbers and determining whether the traversed current system version number is within the version impact range information; if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set; otherwise, adding it to the negative sample set includes:

[0186] Traversing a preset number of system version numbers, determining whether the current system version number traversed is within the version impact range information, and if not, further determining whether the negative sample set is an empty set;

[0187] If it is an empty set, extract the vulnerability code corresponding to the current system version based on the extracted information and add it to the negative sample set;

[0188] If it is not an empty set, extract the vulnerability code corresponding to the system version number closest to the current system version number from the negative sample set, and compare it with the vulnerability code corresponding to the current system version extracted based on the extraction information. If the two are different, add the vulnerability code corresponding to the current system version to the negative sample set; or

[0189] If it is not an empty set, the vulnerability codes corresponding to all system version numbers are extracted from the negative sample set, and compared one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information. If the two are different, the vulnerability code corresponding to the current system version is added to the negative sample set.

[0190] In one implementation of the present disclosure, the one-to-one comparison with the vulnerability code corresponding to the current system version extracted based on the extraction information includes:

[0191] Clean the vulnerability codes to be compared before comparing them again.

[0192] In one implementation of the present disclosure, it further includes:

[0193] Remove code duplications for the current vulnerability in the positive and / or negative sample sets.

[0194] In one implementation of the present disclosure, clearing duplicate code items of the current vulnerability in the positive sample set and / or the negative sample set includes:

[0195] Clean up the vulnerability code in all samples corresponding to the current vulnerability, and use the hash algorithm to generate a hash value for the vulnerability code in each sample;

[0196] Grouping all samples according to the hash values ​​and positive and negative sample labels;

[0197] Traverse each group and retain the samples containing the vulnerability code of the latest system version in each group, and delete the remaining samples in the group.

[0198] In one implementation of the present disclosure, obtaining the extraction information of the vulnerability code of the current vulnerability includes:

[0199] Get the vulnerability patch for the current vulnerability;

[0200] Extraction information of the vulnerability code of the current vulnerability is obtained from the vulnerability patch.

[0201] Figure 7 A schematic diagram showing the structure of a computer system suitable for implementing the method according to an embodiment of the present disclosure is shown.

[0202] like Figure 7 As shown, the computer system includes a processing unit that can execute the various methods of the above-described embodiments based on a program stored in a read-only memory (ROM) or a program loaded from a storage unit into a random access memory (RAM). The RAM also stores various programs and data required for the operation of the computer system. The processing unit, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0203] The following components are connected to the I / O interface: an input section including a keyboard, mouse, etc.; an output section including a cathode ray tube (CRT), liquid crystal display (LCD), and speakers; a storage section including a hard disk; and a communication section including a network interface card such as a LAN card and a modem. The communication section performs communication processes via a network such as the Internet. A drive is also connected to the I / O interface as needed. Removable media such as magnetic disks, optical disks, magneto-optical disks, semiconductor memories, etc. are installed in the drive as needed, so that computer programs read from them can be installed in the storage section as needed. The processing unit can be implemented as a CPU, GPU, TPU, FPGA, NPU, or other processing unit.

[0204] In particular, according to embodiments of the present disclosure, the methods described above can be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program comprising program code for executing the methods described above. In such embodiments, the computer program can be downloaded and installed from a network via a communication component and / or installed from a removable medium.

[0205] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment or part of code, and the module, program segment or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or can be implemented using a combination of dedicated hardware and computer instructions.

[0206] The units or modules involved in the embodiments described in this disclosure may be implemented by software or programmable hardware. The units or modules described may also be provided in a processor, and the names of these units or modules do not, in certain circumstances, constitute limitations on the units or modules themselves.

[0207] As another aspect, the present disclosure further provides a chip, which includes at least one processor and can be used to implement the method involved in the above system embodiment.

[0208] In one possible design, the chip further includes a memory for storing program instructions and data, and the memory is located inside or outside the processor.

[0209] As another aspect, the present disclosure further provides a computer-readable storage medium. This computer-readable storage medium may be included in the electronic device or computer system described in the above embodiments, or may be a standalone computer-readable storage medium not incorporated into the device. The computer-readable storage medium stores one or more programs, which are used by one or more processors to execute the methods described in the present disclosure.

[0210] The above description is merely a preferred embodiment of the present disclosure and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of the invention herein is not limited to technical solutions formed by specific combinations of the aforementioned technical features. It also encompasses other technical solutions formed by any combination of the aforementioned technical features or their equivalents, without departing from the inventive concept. For example, a technical solution formed by replacing the aforementioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

Claims

1. A method for constructing an embedded operating system vulnerability code dataset, characterized in that: include: Obtain information about the impact of the current vulnerability on the embedded operating system version; Get the extraction information of the vulnerability code of the current vulnerability; Traversing a preset number of system version numbers, determining whether the current system version number traversed is within the version impact range information, and if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set; otherwise, adding it to the negative sample set; The positive sample set and the negative sample set are combined into the embedded operating system vulnerability code dataset.

2. The construction method according to claim 1, characterized in that The traversing of a preset number of system version numbers, determining whether the traversed current system version number is within the version impact range information, and if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set; otherwise, adding it to the negative sample set includes: Traversing a preset number of system version numbers, determining whether the current system version number traversed is within the version impact range information, and if so, further determining whether the positive sample set is an empty set; If it is an empty set, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set; If it is not an empty set, extract the vulnerability code corresponding to the system version number closest to the current system version number from the positive sample set, and compare it with the vulnerability code corresponding to the current system version number extracted based on the extraction information. If the two are different, add the vulnerability code corresponding to the current system version to the positive sample set; or If it is not an empty set, the vulnerability codes corresponding to all system version numbers are extracted from the positive sample set, and compared one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information. If the two are different, the vulnerability code of the current system version is added to the positive sample set.

3. The construction method according to claim 1, characterized in that The traversing of a preset number of system version numbers, determining whether the traversed current system version number is within the version impact range information, and if so, extracting the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and adding it to the positive sample set; otherwise, adding it to the negative sample set includes: Traversing a preset number of system version numbers, determining whether the current system version number traversed is within the version impact range information, and if not, further determining whether the negative sample set is an empty set; If it is an empty set, extract the vulnerability code corresponding to the current system version based on the extracted information and add it to the negative sample set; If it is not an empty set, extract the vulnerability code corresponding to the system version number closest to the current system version number from the negative sample set, and compare it with the vulnerability code corresponding to the current system version extracted based on the extraction information. If the two are different, add the vulnerability code corresponding to the current system version to the negative sample set; or If it is not an empty set, the vulnerability codes corresponding to all system version numbers are extracted from the negative sample set, and compared one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information. If the two are different, the vulnerability code corresponding to the current system version is added to the negative sample set.

4. The construction method according to claim 2 or 3, characterized in that The one-to-one comparison with the vulnerability code corresponding to the current system version extracted based on the extracted information includes: Clean the vulnerability codes to be compared before comparing them again.

5. The construction method according to any one of claims 1 to 3, characterized in that: Also includes: Remove code duplications for the current vulnerability in the positive and / or negative sample sets.

6. The construction method according to claim 5, characterized in that: The method of removing code duplications of current vulnerabilities in the positive sample set and / or the negative sample set includes: Clean up the vulnerability code in all samples corresponding to the current vulnerability, and use the hash algorithm to generate a hash value for the vulnerability code in each sample; Grouping all samples according to the hash values ​​and positive and negative sample labels; Traverse each group and retain the samples containing the vulnerability code of the latest system version in each group, and delete the remaining samples in the group.

7. The construction method according to claim 1, characterized in that The extraction information of obtaining the vulnerability code of the current vulnerability includes: Get the vulnerability patch for the current vulnerability; Extraction information of the vulnerability code of the current vulnerability is obtained from the vulnerability patch.

8. A device for constructing an embedded operating system vulnerability code dataset, characterized in that: include: A first acquisition module is configured to obtain information about the impact range of the current vulnerability on the version of the embedded operating system; A second acquisition module is configured to obtain extraction information of vulnerability code of the current vulnerability; a traversal module configured to traverse a preset number of system version numbers and determine whether the current system version number traversed is within the version impact range information; if so, extract the vulnerability code based on the extraction information as the vulnerability code corresponding to the current system version number and add it to the positive sample set; otherwise, add it to the negative sample set; The construction module is configured to combine the positive sample set and the negative sample set to form the embedded operating system vulnerability code dataset.

9. The construction device according to claim 8, characterized in that The traversal module includes: A first determining unit is configured to traverse a preset number of system version numbers, determine whether the traversed current system version number is within the version impact range information, and if so, further determine whether the positive sample set is an empty set; A first adding unit is configured to extract the vulnerability code based on the extraction information and add it into the positive sample set as the vulnerability code corresponding to the current system version number if the set is empty; The second adding unit is configured to, if the set is not empty, extract the vulnerability code corresponding to the system version number closest to the current system version number from the positive sample set, and compare it with the vulnerability code corresponding to the current system version number extracted based on the extraction information; if the two are different, add the vulnerability code corresponding to the current system version to the positive sample set; or The third adding unit is configured to extract the vulnerability codes corresponding to all system version numbers from the positive sample set if it is not an empty set, and compare them one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information; if the two are different, the vulnerability code of the current system version is added to the positive sample set.

10. The construction device according to claim 8, characterized in that The traversal module includes: A second determining unit is configured to traverse a preset number of system version numbers, determine whether the traversed current system version number is in the version impact range information, and if not, further determine whether the negative sample set is an empty set; a fourth adding unit, configured to extract the vulnerability code corresponding to the current system version based on the extracted information and add it to the negative sample set if the set is empty; a fifth adding unit configured to, if the set is not empty, extract from the negative sample set the vulnerability code corresponding to the system version number closest to the current system version number, and compare with the vulnerability code corresponding to the current system version extracted based on the extraction information; if the two are different, add the vulnerability code corresponding to the current system version to the negative sample set; or The sixth adding unit is configured to extract the vulnerability codes corresponding to all system version numbers from the negative sample set if it is not an empty set, and compare them one by one with the vulnerability codes corresponding to the current system version extracted based on the extraction information; if the two are different, the vulnerability code corresponding to the current system version is added to the negative sample set.

11. The construction device according to claim 9 or 10, characterized in that The parts of the third adding unit and the sixth adding unit that compare one-to-one with the vulnerability codes corresponding to the current system version extracted based on the extraction information are configured as follows: Clean the vulnerability codes to be compared before comparing them again.

12. The construction device according to any one of claims 8 to 10, characterized in that Also includes: The cleaning module is configured to clean the code duplicates of the current vulnerability in the positive sample set and / or the negative sample set.

13. The construction device according to claim 12, characterized in that The clearing module includes: A cleaning unit is configured to clean the vulnerability code in all samples corresponding to the current vulnerability and generate a hash value for the vulnerability code in each sample using a hash algorithm; a grouping unit, configured to group all samples according to the hash value and the positive and negative sample labels; The deletion unit is configured to traverse each group, retain the samples containing the vulnerability code of the latest system version in each group, and delete the remaining samples in the group.

14. The construction device according to claim 8, characterized in that The second acquisition module includes: A first obtaining unit is configured to obtain a vulnerability patch for a current vulnerability; The second obtaining unit is configured to extract information of the vulnerability code of the current vulnerability from the vulnerability patch.

15. An electronic device, characterized in that: The method comprises a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method according to any one of claims 1 to 7.

16. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

17. A chip, characterized in that: include: At least one processor, configured to implement the method according to any one of claims 1 to 7.

Images