A large model plug-in vulnerability detection method and device

Abstract

The present invention discloses a large model plug-in vulnerability detection method and device, including: obtaining the project code of the large model plug-in, and parsing the project code to generate an abstract syntax tree; obtaining an initial source point set and an initial sink point set; identifying the source points and sink points in the abstract syntax tree based on the initial source point set and the initial sink point set, and obtaining the target source point set and the target sink point set in the project code; generating a cross-process control flow graph of the project code; attaching the target source points in the target source point set to the cross-process control flow graph, and determining the vulnerability detection result of the large model plug-in based on the target sink point set and the cross-process finite allocation subset algorithm. The present invention can efficiently perform data flow taint analysis in the scenario of cross-process calls, accurately identify vulnerabilities in cross-process data flows, solve the limitations of traditional static analysis tools in cross-process data flow analysis, and improve the security of the system.

Description

Technical Field

[0001] The present invention relates to the fields of artificial intelligence security, next generation Internet application security and software security analysis technology, and in particular to a large model plug-in vulnerability detection method and device. Background Art

[0002] In the field of artificial intelligence, large models such as large visual models and large language models have become one of the most eye-catching technologies. With the continuous development and improvement of the above-mentioned large models, plug-ins for the above-mentioned large models have been developed to further enhance their practicality and flexibility. Among them, the above-mentioned plug-ins have given new capabilities to large models, or improved existing functions, and have been widely used in various scenarios. However, while the large model plug-in has expanded the capabilities of the platform, it has also caused some security risks and problems. Specifically, malicious attackers may exploit potential security vulnerabilities in the large model plug-in software package to maliciously operate or damage the software, causing the system to face security risks. Based on this, it is necessary to perform vulnerability detection on the large model plug-in to prevent the large model from being maliciously operated or damaged.

[0003] In the existing technology, static analysis methods mostly focus on data flow analysis within a single process, lack a comprehensive understanding of cross-process data flow, and have difficulty identifying taint propagation between source and sink in the code. Taint analysis is one of the core technologies for identifying security vulnerabilities (such as injection attacks caused by unvalidated input), which can help developers identify potential security risks. The existing technology cannot effectively identify the data transfer path across processes, resulting in insufficient accuracy and efficiency of vulnerability detection, reducing the security of the system. Summary of the invention

[0004] The present invention aims to solve one of the technical problems in the related art at least to a certain extent.

[0005] To this end, one object of the present invention is to propose a large model plug-in vulnerability detection method, which can be based on an abstract syntax tree and a cross-process control flow graph, and attach the target source point to the cross-process control flow graph, and combine the cross-process finite allocation subset algorithm to track the data propagation path, so as to efficiently perform data flow taint analysis in the cross-process call scenario, accurately identify vulnerabilities in the cross-process data flow, solve the limitations of traditional static analysis tools in cross-process data flow analysis, and improve the security of the system.

[0006] Another object of the present invention is to provide a large model plug-in vulnerability detection device.

[0007] To achieve the above object, an embodiment of the present invention provides a large model plug-in vulnerability detection method, comprising:

[0008] Obtaining the project code of the large model plug-in, and parsing the project code to generate an abstract syntax tree;

[0009] Acquire an initial source point set and an initial sink point set, wherein the source point is an entry point of input data, and the sink point is an exit point of data;

[0010] Identify source points and sink points in the abstract syntax tree based on the initial source point set and the initial sink point set, and obtain a target source point set and a target sink point set in the project code;

[0011] generating a cross-process control flow graph of the project code;

[0012] The target source points in the target source point set are attached to the cross-process control flow graph, and the vulnerability detection result of the large model plug-in is determined based on the target sink point set and the cross-process finite allocation subset algorithm.

[0013] The large model plug-in vulnerability detection method of the embodiment of the present invention may also have the following additional technical features:

[0014] Further, the identifying the source points and sink points in the abstract syntax tree based on the initial source point set and the initial sink point set to obtain the target source point set and the target sink point set in the project code includes:

[0015] Identify function and property names in the project code through regular expressions;

[0016] Based on the recognition results of the function and attribute names, and the initial source point set and the initial sink point set, identify the target source point and the target sink point in the project code, and configure unique identifiers for the identified target source point and the target sink point;

[0017] The target source point is stored in a target source point set, and the target sink point is stored in a target sink point set.

[0018] Furthermore, the generating of the cross-process control flow graph of the project code includes:

[0019] Create different types of nodes in the control flow graph;

[0020] Based on the different types of nodes, establish a cross-process call relationship between the call point and the called function through cross-process function call analysis, and record the return node;

[0021] Based on the cross-process calling relationship, a cross-process control flow graph is generated.

[0022] Further, attaching the target source points in the target source point set to the cross-process control flow graph, and determining the vulnerability detection result of the large model plug-in based on the target sink point set and the cross-process finite allocation subset algorithm, includes:

[0023] Attaching the target source points in the target source point set to the cross-process control flow graph to obtain the attached cross-process control flow graph;

[0024] Initialize the data flow fact domain of the variables in the project code;

[0025] Based on the attached cross-process control flow graph, the data flow fact domain, the target sink set and the taint transfer function, a fixed point algorithm is used to determine the vulnerability detection result of the project code.

[0026] Further, the data flow fact domain includes a taint state; the determining the vulnerability detection result of the project code using a fixed point algorithm based on the attached cross-process control flow graph, the data flow fact domain, the target sink set and the taint transfer function includes:

[0027] Iterate each node and the corresponding data flow fact in the attached cross-process control flow graph by using the fixed point algorithm through the taint transfer function until the taint state of each node in the attached cross-process control flow graph is stable, and obtain the taint propagation path based on the path of the tainted data transferred to the target sink in the target sink set;

[0028] Based on the taint propagation path, a vulnerability detection result of the project code is determined.

[0029] Further, determining the vulnerability detection result of the large model plug-in based on the taint propagation path includes:

[0030] Determine the vulnerability location, trigger conditions and data flow path based on the taint propagation path and the components in the large model plug-in and the cross-process control flow graph after the attachment;

[0031] Based on the vulnerability location, the trigger condition and the data flow path, a vulnerability report is generated and outputted.

[0032] To achieve the above object, another embodiment of the present invention provides a large model plug-in vulnerability detection device, the device comprising:

[0033] A first generation module is used to obtain the project code of the large model plug-in, and parse the project code to generate an abstract syntax tree;

[0034] A first determination module is used to obtain an initial source point set and an initial sink point set, wherein the source point is an entry point of input data and the sink point is an exit point of data;

[0035] an identification module, configured to identify source points and sink points in the abstract syntax tree based on the initial source point set and the initial sink point set, and obtain a target source point set and a target sink point set in the project code;

[0036] A second generation module, used for generating a cross-process control flow graph of the project code;

[0037] The second determination module is used to attach the target source points in the target source point set to the cross-process control flow graph, and determine the vulnerability detection result of the large model plug-in based on the target sink point set and the cross-process finite allocation subset algorithm.

[0038] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0040] Figure 1 is a flow chart of a large model plug-in vulnerability detection method according to an embodiment of the present invention;

[0041] Figure 2 Schematic diagram of the structure of a large model plug-in vulnerability detection device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0043] The following describes a large model plug-in vulnerability detection method and device according to an embodiment of the present invention with reference to the accompanying drawings.

[0044] First, the large model plug-in vulnerability detection method proposed according to an embodiment of the present invention will be described with reference to the accompanying drawings.

[0045] Figure 1 The figure is a flowchart of a large model plug-in vulnerability detection method according to an embodiment of the present invention.

[0046] like Figure 1As shown, the large model plug-in vulnerability detection method includes the following steps:

[0047] Step S1, obtaining the project code of the large model plug-in, and parsing the project code to generate an abstract syntax tree;

[0048] It should be noted that, in one embodiment of the present invention, the above-mentioned project code can be any language code. For example, the project code is C++ or Python, which is not limited in this embodiment of the present invention.

[0049] In one embodiment of the present invention, after obtaining the project code of the large model plug-in, the project code can be parsed to generate an Abstract Syntax Tree (AST), laying the foundation for subsequent analysis of the Interprocedural Finite Distributive Subset (IFDS).

[0050] Among them, in one embodiment of the present invention, the method of parsing the project code to generate an abstract syntax tree is the same as the prior art, and the embodiment of the present invention will not be described in detail here.

[0051] And, in one embodiment of the present invention, the above AST can be formally represented as a tree structure ,in,

[0052] in, V A node collection, representing a grammatical element (such as a statement or expression or identifier); E It is a set of edges, representing the parent-child relationship between grammatical elements.

[0053] Furthermore, in one embodiment of the present invention, the AST obtained through the above steps can capture key information about function calls, variable definitions, and dependencies in the project code, thereby laying a solid foundation for subsequent cross-process data flow analysis. It can accurately display function definitions, calls, class inheritance, and data flows.

[0054] Step S2, obtaining an initial source point set and an initial sink point set;

[0055] In one embodiment of the present invention, before obtaining the initial source point set and the initial sink point set, it is necessary to define the existence mode and behavior of the source point and the sink point. The source point is the entry point of the input data (for example, the data comes from user input and / or file reading and / or network communication), and the sink point is the exit point of the data (for example, executing system commands and / or file writing and / or network sending).

[0056] And, in one embodiment of the present invention, according to the different sources and modes of action of the source points and sink points, the initial source point set may include n types of source points, and the initial sink point set may include m types of sink points. , the initial sink set is ,and Among them, the precise definition of source points and sink points through the initial source point set and the initial sink point set can ensure that the flow path of untrusted data can be accurately captured in the complex interaction process of the large model plug-in code.

[0057] Step S3, identifying source points and sink points in the abstract syntax tree based on the initial source point set and the initial sink point set, and obtaining a target source point set and a target sink point set in the project code;

[0058] In one embodiment of the present invention, after obtaining the initial source point set and the initial sink point set through the above steps, the source points and sink points in the abstract syntax tree can be identified based on the initial source point set and the initial sink point set to obtain the target source point set and the target sink point set in the project code.

[0059] Specifically, in one embodiment of the present invention, the method for identifying source points and sink points in an abstract syntax tree based on an initial source point set and an initial sink point set to obtain a target source point set and a target sink point set in a project code may include the following steps:

[0060] Step S31, identifying function and attribute names in the abstract syntax tree by using regular expressions;

[0061] Step S32, identifying the target source points and target sink points in the project code based on the recognition results of the function and attribute names, and the initial source point set and the initial sink point set, and configuring unique identifiers for the identified target source points and target sink points;

[0062] Step S33, storing the target source point into the target source point set, and storing the target sink point into the target sink point set.

[0063] In one embodiment of the present invention, function and attribute names in an abstract syntax tree can be flexibly identified through regular expressions, so as to be applicable to complex and diverse code base environments. In addition, in one embodiment of the present invention, data flows across functions and modules can also be identified through function calls in local and global scopes.

[0064] And, in one embodiment of the present invention, the recognition results obtained by the above steps are matched with the initial source point set and the initial sink point set to identify the target source point and the target sink point in the project code, and the target source point is stored in the target source point set. In the target sink, store the target sink into the target sink set In, and T .

[0065] Furthermore, in one embodiment of the present invention, unique identifiers are configured for the target source points and target sink points in the above target source point set and target sink point set, which can effectively mark potential security risk paths and lay the foundation for subsequent IFDS taint propagation analysis.

[0066] Step S4, generating an interprocedural control flow graph (ICFG) of the project code;

[0067] Among them, in one embodiment of the present invention, it is necessary to generate a cross-process control flow graph of the project code to show a global view of each function call and execution path in the project code.

[0068] Specifically, in one embodiment of the present invention, the method for generating a cross-process control flow graph of a project code may include the following steps:

[0069] Step S41, creating different types of nodes in the control flow graph;

[0070] Step S42, based on different types of nodes, through cross-process function call analysis, establish a cross-process call relationship between the call point and the called function, and record the return node;

[0071] Step S43, generating a cross-process control flow graph based on the cross-process call relationship.

[0072] In one embodiment of the present invention, different types of nodes in a control flow graph (CFG) can be created, and the code line number and scope of each node can be marked, wherein the different types can include one or more of function entry, function exit, conditional judgment, and function call. In one embodiment of the present invention, the control flow graph can be a function internal relationship graph.

[0073] And, in one embodiment of the present invention, based on different types of nodes, through cross-process function call analysis, function definitions and call points are identified, cross-process call relationships between call points and called functions are established, and return nodes are recorded to ensure that the control flow after function execution is correctly connected. Among them, for the conditional branch functions and loop structure functions corresponding to if and while, corresponding decision nodes and loop nodes are generated, and a reasonable control flow path is established.

[0074] Further, in one embodiment of the present invention, after the cross-process call relationship is obtained through the above steps, a cross-process control flow graph can be generated based on the cross-process call relationship and the control flow graph, so that on the basis of the internal relationship graph of the function in the control flow graph, a cross-process control flow graph including the relationship between functions can be obtained according to the cross-process call relationship. And, in one embodiment of the present invention, the cross-process control flow graph can be formally represented as a directed graph ,in,

[0075]

[0076] Where N is a node set, representing the basic blocks or statements in the program; F is an edge set, representing the control flow and function call relationship. , define the transfer relationship , represents the set of successor nodes that can be reached from node n:

[0077] in, for The successor node of .

[0078] Furthermore, in one embodiment of the present invention, the cross-process control flow graph generated by the above steps is The control flow structure and function call path of the code can be clearly displayed through visualization tools, laying the foundation for subsequent taint analysis and ensuring that the cross-function and cross-module vulnerability propagation paths in the large model plug-in code can be accurately identified and tracked.

[0079] Step S5, attaching the target source points in the target source point set to the cross-process control flow graph, and determining the vulnerability detection result of the large model plug-in based on the target sink point set and the cross-process finite allocation subset algorithm.

[0080] Among them, in one embodiment of the present invention, after obtaining the target source point set, the target sink point set and the cross-process control flow graph through the above steps, the target source points in the target source point set can be attached to the cross-process control flow graph, and the vulnerability detection result of the large model plug-in can be determined based on the target sink point set and the cross-process finite allocation subset algorithm.

[0081] Specifically, in one embodiment of the present invention, the method of attaching the target source points in the target source point set to the cross-process control flow graph and determining the vulnerability detection result of the large model plug-in based on the target sink point set and the cross-process finite allocation subset algorithm may include the following steps:

[0082] Step S51, attaching the target source point in the target source point set to the cross-process control flow graph to obtain the attached cross-process control flow graph;

[0083] Step S52, initializing the data flow fact domain of the variables in the project code;

[0084] Step S53, based on the attached cross-process control flow graph, data flow fact domain, target sink set and taint transfer function, a fixed point algorithm is used to determine the vulnerability detection result of the project code.

[0085] Among them, in one embodiment of the present invention, the target source points in the target source point set are attached to the cross-process control flow graph to obtain the attached cross-process control flow graph, so that the target source points in the target source point set are marked in the cross-process control flow graph to obtain the attached cross-process control flow graph.

[0086] And, in one embodiment of the present invention, the above data flow fact domain is a finite set, wherein the data flow fact domain set for,

[0087] Among them, the i-th data flow fact domain d i It can be expressed as ,in, is the variable name, For variables The scope of s For variables The taint status mark.

[0088] In one embodiment of the present invention, the above-mentioned data flow fact domain can be used to represent the state of each data element in the program at a specific moment, so that in the cross-process data flow analysis, the propagation path from the source point to the sink point can be traced through the data flow fact domain to identify potential vulnerabilities or security issues in the large model code software package.

[0089] Furthermore, in one embodiment of the present invention, before determining the vulnerability detection result of the project code using a fixed point algorithm based on the attached cross-process control flow graph, the data flow fact domain, the target sink set and the taint transfer function, the method may further include: obtaining the taint transfer function of each node, wherein each node The stain transfer function is:

[0090] Among them, the above function represents the node The change of the above data flow facts, that is, the taint transfer function is the propagation from the same domain to the same domain.

[0091] Further, in one embodiment of the present invention, the method for determining the vulnerability detection result of the project code using a fixed point algorithm based on the attached cross-process control flow graph, the data flow fact domain, the target sink set and the taint transfer function may include the following steps:

[0092] Step 1, using the fixed point algorithm to iterate each node and the corresponding data flow fact in the attached cross-process control flow graph through the taint transfer function until the taint state of each node in the attached cross-process control flow graph is stable, and the taint propagation path is obtained based on the path of the tainted data being transferred to the target sink in the target sink set;

[0093] Step 2: Determine the vulnerability detection results of the project code based on the taint propagation path.

[0094] Specifically, in one embodiment of the present invention, an initial taint fact is generated at the source point, and the taint fact is added to the work list together with the source point to ensure the correct starting point of the taint analysis, and each node and the corresponding data flow fact in the work list is iteratively processed by a fixed algorithm, and the corresponding taint transfer function is applied one by one. When the tainted data is passed to the sink, there will be potential security vulnerabilities. For example, if the node There is an assignment statement , then the stain transfer function Update variables The taint state is the expression The tainted state ,in

[0095] And, for the cross-process control flow graph node set Each node in , the data flow fact domain set can be calculated through the following iterative process : in, For Node The set of predecessor nodes.

[0096] Furthermore, in one embodiment of the present invention, new taint facts can be propagated to successor nodes until the entire work list is processed, that is, the taint state of each node in the cross-process control flow graph after attachment is stable, and the taint propagation path is obtained based on the path of the tainted data to the target sink in the target sink set, that is, if the final taint state of the target sink is contaminated, then the path corresponding to the data propagation flow from the target source point to the target sink is the taint propagation path, ensuring that the cross-process data flow propagation can be fully captured.

[0097] And, in one embodiment of the present invention, after obtaining the taint propagation path through the above steps, the vulnerability detection result of the large model plug-in can be determined based on the taint propagation path. Specifically, in one embodiment of the present invention, the method for determining the vulnerability detection result of the large model plug-in based on the taint propagation path may include: determining the vulnerability location, trigger conditions and data flow path based on the taint propagation path and the components in the large model plug-in and the cross-process control flow graph after attachment, and generating and outputting a vulnerability report based on the vulnerability location, trigger conditions and data flow path.

[0098] Among them, in one embodiment of the present invention, the above-mentioned vulnerability report content may include the specific location, triggering conditions, data flow path and corresponding repair suggestions of each vulnerability, thereby ensuring that large-scale software systems and large model plug-ins have higher security during development and use.

[0099] Furthermore, in one embodiment of the invention, static analysis can be used to capture cross-process data flows in large model plug-ins, components, and their dependencies, clearly identifying vulnerability locations, propagation paths, and specific code modules related to the large model, thereby helping developers quickly locate and fix security issues.

[0100] According to the large model plug-in vulnerability detection method proposed in the embodiment of the present invention, the project code of the large model plug-in is obtained, and the project code is parsed to generate an abstract syntax tree; an initial source point set and an initial sink point set are obtained, wherein the source point is the entry point of the input data and the sink point is the exit point of the data; the source point and the sink point in the abstract syntax tree are identified based on the initial source point set and the initial sink point set, and the target source point set and the target sink point set in the project code are obtained; a cross-process control flow graph of the project code is generated; the target source point in the target source point set is attached to the cross-process control flow graph, and the vulnerability detection result of the large model plug-in is determined based on the target sink point set and the cross-process finite allocation subset algorithm. Thus, the present invention can be based on the abstract syntax tree and the cross-process control flow graph, and the target source point is attached to the cross-process control flow graph, combined with the cross-process finite allocation subset algorithm to track the propagation path of the data, so as to efficiently perform data flow taint analysis in the cross-process call scenario, accurately identify the vulnerabilities in the cross-process data flow, solve the limitations of traditional static analysis tools in cross-process data flow analysis, and improve the security of the system.

[0101] Next, the large model plug-in vulnerability detection device proposed according to an embodiment of the present invention is described with reference to the accompanying drawings.

[0102] Figure 2 The figure is a schematic diagram of the structure of a large model plug-in vulnerability detection device according to an embodiment of the present invention.

[0103] like Figure 2As shown, the large model plug-in vulnerability detection device 10 includes: a first generation module 201, a first determination module 202, an identification module 203, a second generation module 204 and a second determination module 205, wherein

[0104] The first generation module 201 is used to obtain the project code of the large model plug-in and parse the project code to generate an abstract syntax tree;

[0105] A first determination module 202 is used to obtain an initial source point set and an initial sink point set, wherein the source point is an entry point of input data and the sink point is an exit point of data;

[0106] An identification module 203 is used to identify source points and sink points in the abstract syntax tree based on the initial source point set and the initial sink point set, and obtain a target source point set and a target sink point set in the project code;

[0107] A second generation module 204 is used to generate a cross-process control flow graph of the project code;

[0108] The second determination module 205 is used to attach the target source points in the target source point set to the cross-process control flow graph, and determine the vulnerability detection result of the large model plug-in based on the target sink point set and the cross-process finite allocation subset algorithm.

[0109] Furthermore, the identification module 203 is specifically used for:

[0110] Identify function and property names in the abstract syntax tree through regular expressions;

[0111] Based on the recognition results of the function and attribute names, and the initial source point set and the initial sink point set, the target source point and the target sink point in the project code are identified, and unique identifiers are configured for the identified target source point and the target sink point;

[0112] The target source points are stored in the target source point set, and the target sink points are stored in the target sink point set.

[0113] Furthermore, the second generating module 204 is specifically used for:

[0114] Create different types of nodes in the control flow graph;

[0115] Based on different types of nodes, through cross-process function call analysis, the cross-process call relationship between the call point and the called function is established, and the return node is recorded;

[0116] Based on the cross-process call relationship, a cross-process control flow graph is generated.

[0117] Furthermore, the second determining module 205 is specifically configured to:

[0118] Attaching the target source points in the target source point set to the cross-process control flow graph to obtain the attached cross-process control flow graph;

[0119] Initialize the data flow fact domain of variables in the project code;

[0120] Based on the attached cross-process control flow graph, data flow fact domain, target sink set and taint transfer function, the fixed point algorithm is used to determine the vulnerability detection results of the project code.

[0121] Furthermore, the data flow fact domain includes a tainted state; and the second determination module 205 is further configured to:

[0122] Iterate each node and the corresponding data flow facts in the attached cross-process control flow graph by using the fixed point algorithm through the taint transfer function until the taint state of each node in the attached cross-process control flow graph is stable, and obtain the taint propagation path based on the path of the tainted data being transferred to the target sink in the target sink set;

[0123] Based on the taint propagation path, determine the vulnerability detection results of the project code.

[0124] Furthermore, the second determining module 205 is further configured to:

[0125] Determine the vulnerability location, trigger conditions, and data flow path based on the taint propagation path and the components in the large model plug-in and the cross-process control flow graph after attachment;

[0126] Generate and output vulnerability reports based on vulnerability locations, trigger conditions, and data flow paths.

[0127] According to the large model plug-in vulnerability detection device proposed in the embodiment of the present invention, the project code of the large model plug-in is obtained, and the project code is parsed to generate an abstract syntax tree; an initial source point set and an initial sink point set are obtained, wherein the source point is the entry point of the input data and the sink point is the exit point of the data; the source point and the sink point in the abstract syntax tree are identified based on the initial source point set and the initial sink point set, and the target source point set and the target sink point set in the project code are obtained; a cross-process control flow graph of the project code is generated; the target source point in the target source point set is attached to the cross-process control flow graph, and the vulnerability detection result of the large model plug-in is determined based on the target sink point set and the cross-process finite allocation subset algorithm. Thus, the present invention can be based on the abstract syntax tree and the cross-process control flow graph, and the target source point is attached to the cross-process control flow graph, combined with the cross-process finite allocation subset algorithm to track the propagation path of the data, so as to efficiently perform data flow taint analysis in the cross-process call scenario, accurately identify the vulnerabilities in the cross-process data flow, solve the limitations of traditional static analysis tools in cross-process data flow analysis, and improve the security of the system.

[0128] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0129] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0130] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A large model plug-in vulnerability detection method, characterized in that: The method comprises: Obtaining the project code of the large model plug-in, and parsing the project code to generate an abstract syntax tree; Acquire an initial source point set and an initial sink point set, wherein the source point is an entry point of input data, and the sink point is an exit point of data; Identify source points and sink points in the abstract syntax tree based on the initial source point set and the initial sink point set, and obtain a target source point set and a target sink point set in the project code; generating a cross-process control flow graph of the project code; Attaching a target source point in the target source point set to the cross-process control flow graph, and determining a vulnerability detection result of the large model plug-in based on the target sink point set and a cross-process finite allocation subset algorithm; The step of identifying source points and sink points in the abstract syntax tree based on the initial source point set and the initial sink point set, and obtaining a target source point set and a target sink point set in the project code, comprises: Identify function and property names in the abstract syntax tree by regular expressions; Based on the recognition results of the function and attribute names, and the initial source point set and the initial sink point set, identify the target source point and the target sink point in the project code, and configure unique identifiers for the identified target source point and the target sink point; The target source point is stored in a target source point set, and the target sink point is stored in a target sink point set; The attaching the target source points in the target source point set to the cross-process control flow graph, and determining the vulnerability detection result of the large model plug-in based on the target sink point set and the cross-process finite allocation subset algorithm, includes: Attaching the target source points in the target source point set to the cross-process control flow graph to obtain the attached cross-process control flow graph; Initialize the data flow fact domain of the variables in the project code; Based on the attached cross-process control flow graph, the data flow fact domain, the target sink set and the taint transfer function, a fixed point algorithm is used to determine the vulnerability detection result of the project code.

2. The method according to claim 1, characterized in that The generating of the cross-process control flow graph of the project code comprises: Create different types of nodes in the control flow graph; Based on the different types of nodes, establish a cross-process call relationship between the call point and the called function through cross-process function call analysis, and record the return node; Based on the cross-process calling relationship, a cross-process control flow graph is generated.

3. The method according to claim 1, characterized in that The data flow fact domain includes a taint state; the method of determining the vulnerability detection result of the project code by using a fixed point algorithm based on the attached cross-process control flow graph, the data flow fact domain, the target sink set and the taint transfer function includes: Iterate each node and the corresponding data flow fact in the attached cross-process control flow graph by using the fixed point algorithm through the taint transfer function until the taint state of each node in the attached cross-process control flow graph is stable, and obtain the taint propagation path based on the path of the tainted data transferred to the target sink in the target sink set; Based on the taint propagation path, a vulnerability detection result of the project code is determined.

4. The method according to claim 3, characterized in that The step of determining the vulnerability detection result of the large model plug-in based on the taint propagation path includes: Determine the vulnerability location, trigger conditions and data flow path based on the taint propagation path and the components in the large model plug-in and the cross-process control flow graph after the attachment; Based on the vulnerability location, the trigger condition and the data flow path, a vulnerability report is generated and outputted.

5. A large model plug-in vulnerability detection device, characterized in that: The device comprises: A first generation module is used to obtain the project code of the large model plug-in, and parse the project code to generate an abstract syntax tree; A first determination module is used to obtain an initial source point set and an initial sink point set, wherein the source point is an entry point of input data and the sink point is an exit point of data; an identification module, configured to identify source points and sink points in the abstract syntax tree based on the initial source point set and the initial sink point set, and obtain a target source point set and a target sink point set in the project code; A second generation module, used for generating a cross-process control flow graph of the project code; A second determination module is used to attach the target source points in the target source point set to the cross-process control flow graph, and determine the vulnerability detection result of the large model plug-in based on the target sink point set and the cross-process finite allocation subset algorithm; The identification module is specifically used for: Identify function and property names in the project code through regular expressions; Based on the recognition results of the function and attribute names, and the initial source point set and the initial sink point set, identify the target source point and the target sink point in the project code, and configure unique identifiers for the identified target source point and the target sink point; The target source point is stored in a target source point set, and the target sink point is stored in a target sink point set; The second determining module is specifically used to: Attaching the target source points in the target source point set to the cross-process control flow graph to obtain the attached cross-process control flow graph; Initialize the data flow fact domain of the variables in the project code; Based on the attached cross-process control flow graph, the data flow fact domain, the target sink set and the taint transfer function, a fixed point algorithm is used to determine the vulnerability detection result of the project code.

6. An electronic device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 4.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images