Code security detection method and device, equipment, medium and program product

Abstract

The invention provides a code security detection method which can be applied to the technical field of information security. The method comprises the steps of obtaining a to-be-detected code, and generating an ordered sequence by taking each function and an upstream and downstream calling relationship thereof as a unit based on the upstream and downstream calling relationship of each function in the to-be-detected code; translating the to-be-detected code line by line based on the ordered sequence of each function to generate a natural language text of the to-be-detected code; performing first risk assessment on the natural language statement corresponding to the ordered sequence of each function in the natural language text, and identifying a potential risk function in the to-be-detected code; and performing second risk assessment on the context of the natural language statement corresponding to the risk function in the natural language text, and determining a target risk existing in the potential risk function. The invention further provides a code security detection device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of information security, and in particular to a code security detection method, device, equipment, medium and program product. Background Art

[0002] With the rapid development of information technology and the widespread dissemination of hacker technology, information security has become a key bottleneck for the sustainable development of enterprises. In this context, DevSecOps, as an advanced security left-shift concept, emphasizes the integration of security considerations in the early stages of software development and has become a core strategy for enterprises to build security systems. Code security audits, as a key link in DevSecOps, traditionally rely on professional scanning tools, but these tools are not only costly and time-consuming, but also often increase the burden of subsequent analysis due to high false positive rates.

[0003] With the rise of artificial intelligence, especially big model technology, the industry hopes to innovate this field by introducing big models for code auditing. Currently, a variety of big code auditing models based on different technical paths have emerged in the market, such as natural language generation models such as ChatGPT and ChatGLM, models based on data flow graphs such as GraphCodeBert, and models that use abstract syntax trees (AST) to enhance understanding such as UniXCoder. In addition, open source platforms such as Huggingface also provide a number of pre-trained big models for code auditing to choose from.

[0004] Although big model technology has shown certain potential in the field of code auditing, existing technologies still face many defects and limitations. First, although natural language generation models (such as ChatGPT and ChatGLM) have strong natural language understanding capabilities, they are unable to cope with programming languages, especially in terms of the deep logic and structural understanding of the code. Secondly, while models based on data flow graphs or ASTs improve code understanding capabilities, they also face problems such as logic loss (such as key functions or parameters being ignored) or naming sensitivity (the same logic has inaccurate similarity assessments due to naming differences). Furthermore, most existing models still rely too much on preset scanning rules or manually annotated data, resulting in high false alarm rates, poor flexibility, and high preparation costs. Finally, the source and quality of training data for open source big models lack transparency, making it difficult to directly apply to specific enterprise scenarios, and there are limitations common to other big models. Summary of the invention

[0005] In view of the above problems, the present disclosure provides a code security detection method, apparatus, device, medium and program product.

[0006] According to the first aspect of the present disclosure, a code security detection method is provided, the method comprising: obtaining a code to be detected, and based on the upstream and downstream calling relationships of each function in the code to be detected, generating an ordered sequence with each function and its upstream and downstream calling relationships as units; translating the code to be detected line by line based on the ordered sequence of each function to generate a natural language text of the code to be detected; performing a first risk assessment on the natural language statements corresponding to the ordered sequence of each function in the natural language text to identify potential risk functions in the code to be detected; performing a second risk assessment on the context of the natural language statements corresponding to the potential risk functions in the natural language text to determine the target risk of the potential risk functions.

[0007] According to an embodiment of the present disclosure, a first risk assessment is performed on the natural language statements corresponding to the ordered sequence of each of the functions in the natural language text, and identifying the potential risk function in the code to be detected includes: identifying whether there are risk factors in the natural language statements corresponding to the ordered sequence of the functions; when the risk factors exist, determining that the function is a potential risk function.

[0008] According to an embodiment of the present disclosure, the second risk assessment is performed on the context of the natural language sentence corresponding to the potential risk function in the natural language text to determine the target risk of the potential risk function, including: scanning the context of the natural language sentence corresponding to the potential risk function in the natural language text to find out whether there is a description statement for avoiding the risk; if there is no description statement for avoiding the risk, then the potential risk function has a target risk.

[0009] According to an embodiment of the present disclosure, the search for whether there is a descriptive statement for risk avoidance includes: obtaining a first vocabulary text representing a risk factor and a second vocabulary text representing a risk avoidance behavior, matching the context of a natural language statement corresponding to the potential risk function based on the first vocabulary text and the second vocabulary text, and performing a language logic analysis; when the risk factor and the risk avoidance behavior exist in the context of the natural language statement corresponding to the potential risk function, and there is an association between the risk factor and the risk avoidance text, then the descriptive statement for risk avoidance exists.

[0010] According to an embodiment of the present disclosure, the method further includes: performing a level assessment according to a risk characteristic of the target risk to obtain a risk level of the target risk.

[0011] According to an embodiment of the present disclosure, the method also includes: performing predictive analysis on the code to be detected based on a zero-shot learning model to obtain a custom vulnerability, wherein the custom vulnerability is a vulnerability inferred by the zero-shot learning model based on the code to be detected; analyzing and obtaining risk factors of the custom vulnerability, and applying the risk factors to the first risk assessment and the second risk assessment.

[0012] The second aspect of the present disclosure provides a code security detection device, which includes: a sequence generation module, which is used to obtain a code to be detected, and based on the upstream and downstream calling relationship of each function in the code to be detected, generate an ordered sequence with each function and its upstream and downstream calling relationship as a unit; a code translation module, which is used to translate the code to be detected line by line based on the ordered sequence of each function to generate a natural language text of the code to be detected; a function analysis module, which is used to perform a first risk assessment on the natural language statements corresponding to the ordered sequence of each function in the natural language text, and identify potential risk functions in the code to be detected; a risk identification module, which is used to perform a second risk assessment on the context of the natural language statements corresponding to the potential risk functions in the natural language text, and determine the target risk of the potential risk functions.

[0013] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0014] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0015] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0017] Figure 1 The following schematically shows an application scenario diagram of the code security detection method, apparatus, device, medium, and program product according to an embodiment of the present disclosure;

[0018] Figure 2 A flowchart of a code security detection method according to an embodiment of the present disclosure is schematically shown;

[0019] Figure 3 The following schematically shows an application flow chart of the code security detection method according to an embodiment of the present disclosure;

[0020] Figure 4 A schematic diagram of a structure of a code security detection device according to an embodiment of the present disclosure is shown; and

[0021] Figure 5 A block diagram of an electronic device suitable for implementing a code security detection method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0022] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0023] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0024] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0025] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0026] It should be noted that the code security detection method and device provided in the present disclosure can be used for code security detection in software development in the financial field, and can also be used in any field other than the financial field. The application field of the code security detection method and device provided in the present disclosure is not limited.

[0027] The acquisition, transmission, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of national laws and regulations. It should be noted that in the embodiments of this application, some existing solutions in the industry such as certain software, components, and models may be mentioned, and they should be considered as exemplary. Their purpose is only to illustrate the feasibility of the implementation of the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0028] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0029] An embodiment of the present disclosure provides a code security detection method, which includes: obtaining a code to be detected, and based on the upstream and downstream calling relationships of each function in the code to be detected, generating an ordered sequence with each function and its upstream and downstream calling relationships as units; translating the code to be detected line by line based on the ordered sequence of each function to generate a natural language text of the code to be detected; performing a first risk assessment on the natural language statements corresponding to the ordered sequence of each function in the natural language text to identify potential risk functions in the code to be detected; performing a second risk assessment on the context of the natural language statements corresponding to the potential risk functions in the natural language text to determine the target risk of the potential risk function.

[0030] Figure 1 The following schematically shows an application scenario diagram of the code security detection method and device according to an embodiment of the present disclosure.

[0031] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a software development project of a bank. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0032] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0033] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0034] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0035] It should be noted that the code security detection method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the code security detection device provided in the embodiment of the present disclosure can generally be set in the server 105. The code security detection method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Correspondingly, the code security detection device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0036] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0037] The following will be based on Figure 1 The scene described by Figure 2~Figure 3 The code security detection method of the disclosed embodiment is described in detail.

[0038] Figure 2 The flowchart of the code security detection method according to the embodiment of the present disclosure is schematically shown.

[0039] like Figure 2 As shown, the code security detection method of this embodiment includes operations S210 to S230, and the transaction processing method can be executed sequentially.

[0040] In operation S210, the code to be detected is obtained, and based on the upstream and downstream calling relationship of each function in the code to be detected, an ordered sequence is generated with each function and its upstream and downstream calling relationship as a unit.

[0041] The existing large model converts PL to NL for all recognizable codes. The converted natural language lacks the specificity of the enterprise's internal business areas or functions. Generalization leads to the disappearance of characteristics, and the disappearance of characteristics leads to a reduction in recognizable risks, which ultimately leads to risk escape, or code security risks for functions that are closely related to the enterprise's business.

[0042] The output of the existing large model for the process of converting PL to NL is descriptive in nature. The best output is line-by-line translation, which lacks the connection between methods and the overall order and logic of the code. The security risks in the code are strongly related to the overall calling relationship and logic of the code. The loss of order and logic characteristics will result in a large number of missed alerts and false positives.

[0043] In the disclosed embodiment, after the code to be detected is pulled from the code warehouse, the code to be detected is preprocessed first, and when the code is transmitted to the big model, the upstream and downstream call relationship of the code is brought along, so that the big model understands that the code is a series of functions, and each function is regarded as a "token". The entire code file to be scanned (code warehouse) becomes an ordered token sequence composed of such "tokens". This ordered sequence retains the overall order and logic of the code, which can improve the accuracy of the code translation results.

[0044] In operation S220 , the code to be checked is translated line by line based on the ordered sequence of each function to generate a natural language text of the code to be checked.

[0045] In the disclosed embodiment, a large language model can be trained to convert code into natural language. Use the large model to understand individual functions line by line. Among them, retain the method logic, method names, class names, inherited class names, etc. of the general SDK (such as database operations, file operations, resource management, system operations, OWASP and other security SDKs); if regular expressions are involved in the code, try to retain the meaning of the regular expressions; self-built parameter names, method names, class names, etc. are replaced with general tokens, and try to ensure that the same function uses different parameter names, and the similarity after encoding by the large model is 1 (100%); self-built constants should be expressed in natural language as much as possible after parsing. Code comments should be used as much as possible in the natural language part of the training corpus. If the code annotation degree is not high, annotation management should be carried out first, and then the model should be trained, so as to help the translation results be more closely related to the business of the code. The model has two outputs: one is an ordered token sequence composed of functions as tokens, and the natural language generated by this token sequence (similar to telling a story, explaining what the project roughly does and what steps it is divided into), and the other is a line-by-line translation of each function (explaining the details of the story and how each step is done).

[0046] In operation S230, a first risk assessment is performed on the natural language statements corresponding to the ordered sequence of each function in the natural language text to identify potential risk functions in the code to be detected.

[0047] Traditional engines rely too much on rules. If the rules are matched, it is a vulnerability (there may be false positives). If they are not matched, it is not a vulnerability (there may be missed negatives). The rules are limited in scope and have poor flexibility. Large models only look at code similarity. If the code is similar to the "vulnerability code", it may produce false positives. If it is not similar, it may produce missed negatives. It lacks security theoretical basis, is unreliable, and difficult to implement or put into production.

[0048] In the disclosed embodiment, a first risk assessment is first performed on the "natural language generated by an ordered token sequence composed of functions as tokens" to identify functions that may have risks, and then in operation S240, a risk assessment is performed on the line-by-line translation of the functions that may have risks to identify whether the risks actually exist. The overall idea of ​​the solution is risk-oriented. According to the idea of ​​risk assessment, only those that have risks and are likely to have an impact are considered vulnerabilities, thereby improving the accuracy of vulnerability identification.

[0049] In operation S240, a second risk assessment is performed on the context of the natural language sentence corresponding to the potential risk function in the natural language text to determine a target risk of the potential risk function.

[0050] In the disclosed embodiment, the second risk assessment is used to check whether the context of the natural language corresponding to the potential risk function has a logical loophole. If the risk is determined to be real according to the second risk assessment, it is determined that the potential risk function has a loophole.

[0051] The code security detection method provided by the present disclosure takes into account the contextual relationship of the function during the code translation process, and regards each function as a "token". The entire code file to be scanned (code warehouse) becomes an ordered token sequence composed of such tokens, which is conducive to the language model to correctly understand the meaning of the code and improve the accuracy of translation; the method first identifies the risk of the ordered sequence of functions, and then finds out whether there is any risk avoidance behavior through the context, so as to determine whether there is a risk in the code. The method solves the problem that the prior art loses the correlation between methods when translating the code line by line, and does not rely on vulnerability matching rules. In operation S230, a first risk assessment is performed on the natural language statements corresponding to the ordered sequence of each function in the natural language text, and the potential risk function in the code to be detected is identified, including operations S231~S232.

[0052] In operation S231 , it is identified whether the natural language statement corresponding to the ordered sequence of functions has risk factors.

[0053] In the disclosed embodiment, risk factors include logic loopholes, abnormal input and output, functional defects, etc. By identifying whether there are risk factors after the ordered sequence of the function is translated into natural language statements, it can be determined whether the function has loopholes.

[0054] In operation S232, when there is a risk factor, the function is determined to be a potential risk function.

[0055] This potential risk function identification method uses necessary function factors such as logic, function, and parameters as conditions for vulnerability judgment. It does not rely on vulnerability identification rules and has a higher identification accuracy.

[0056] In operation S240, a second risk assessment is performed on the context of the natural language sentence corresponding to the potential risk function in the natural language text to determine the target risk of the potential risk function, including S241-S242.

[0057] In operation S241, the context of the natural language sentence corresponding to the risk function in the natural language text is scanned to find out whether there is a description sentence for avoiding the risk.

[0058] In S241, searching whether there is a description statement for risk avoidance includes S2411~S2412.

[0059] In operation S2411, a first vocabulary text representing risk factors and a second vocabulary text representing risk avoidance behavior are obtained, the context of the natural language sentence corresponding to the potential risk function is matched based on the first vocabulary text and the second vocabulary text, and language logic analysis is performed.

[0060] In order to accurately analyze the risk scenario, we first need to extract the first vocabulary text representing the risk factors and the second vocabulary text describing the risk avoidance behavior. Then, these vocabulary texts are used as keywords to search and match in the context of the natural language sentences corresponding to the potential risk function to locate the specific risk description and response strategy. On this basis, through in-depth language logic analysis, we can not only understand the intrinsic connection between risk factors and avoidance behavior, but also evaluate the rationality and effectiveness of the strategies adopted, thus providing strong support for risk management decisions.

[0061] In operation S2412, when risk factors and risk avoidance behaviors exist in the context of the natural language sentence corresponding to the potential risk function, and there is a correlation between the risk factors and the risk avoidance text, a risk avoidance description sentence exists.

[0062] When analyzing the natural language text mapped by the potential risk function, if the text clearly points out the potential risk factors and then describes the avoidance strategies taken for these risk factors, and there is a logical and direct connection between these strategies and the risk factors, then this text contains a clear description of risk avoidance and shows a comprehensive consideration of the identification, assessment and response measures for potential risks.

[0063] In operation S242, if there is no risk avoidance description statement, the potential risk function has a target risk.

[0064] In the disclosed embodiment, the object of the second risk assessment is the context of the natural language statement corresponding to the potential risk function. By checking the context, the description statement of risk avoidance is found. If there is a description statement of risk avoidance, it means that the code has made security protection for the existing vulnerability. If there is no description statement of risk avoidance, it means that there is a risk problem with the risk vulnerability. In the process of checking the context, the scope of logical judgment can be expanded, thereby preventing false alarms and omissions of vulnerabilities and improving the accuracy of risk assessment.

[0065] After the target risk is identified, in the embodiment of the present disclosure, the method may further include S243.

[0066] In operation S243, a level assessment is performed according to the risk characteristics of the target risk to obtain the risk level of the target risk.

[0067] Risk characteristics may include risk category, risk susceptibility, impact after being exploited, accessible paths of the system to which the risk belongs, etc. The level of vulnerability can be formulated according to the scoring mechanism of risk assessment. The higher the level of risk that causes greater losses, the higher the level of risk, which can prompt developers to prioritize solving risks with higher risk levels.

[0068] In order to further improve the accuracy of risk identification, the code security detection method provided by the present disclosure also includes S231~S232.

[0069] In operation S231, a predictive analysis is performed on the code to be detected based on the zero-shot learning model to obtain a custom vulnerability, where the custom vulnerability is a vulnerability inferred by the zero-shot learning model based on the code to be detected.

[0070] In the disclosed embodiment, a zero-shot learning model can be used to perform deep predictive analysis on the code to be detected. This process does not rely on any previously labeled or trained specific vulnerability data set. With its excellent generalization ability and powerful pattern recognition technology, the zero-shot learning model can directly infer unprecedented security weaknesses from the structure, logic, and potential programming paradigm of the code to be detected, which are called "custom vulnerabilities." These custom vulnerabilities are dynamically generated by the model based on the unique characteristics and potential risk points of the code, rather than based on simple matching of known vulnerability libraries. Therefore, they represent new types of security threats that may not have been widely recognized or recorded. In this way, the zero-shot learning model provides software developers and security experts with an unprecedented perspective, enabling them to discover and fix complex vulnerabilities that are difficult to capture with traditional methods in advance, thereby significantly improving the security and reliability of software systems.

[0071] In operation S232, risk factors of the custom vulnerability are analyzed and obtained, and the risk factors are applied to the first risk assessment and the second risk assessment.

[0072] After in-depth analysis and successful identification of custom vulnerabilities, the root causes and characteristics of these vulnerabilities can be analyzed to obtain the risk factors behind them. These risk factors may include but are not limited to code design flaws, unsafe programming practices, vulnerabilities of external dependencies, and security controls that have not been effectively implemented. Each risk factor is recorded in detail and its potential impact is quantified to more accurately assess the degree of threat to system security. Based on the acquired risk factors, they can be used in S230~S240 and applied in the next code risk assessment. As the correspondence between code logic and risk is continuously optimized with the construction of enterprise information security capabilities and practical experience, zero-shot can be used to identify security risks that traditional code auditing tools cannot identify, reducing the escape of enterprise vulnerabilities. Figure 3The application flow chart of the code security detection method according to the embodiment of the present disclosure is schematically shown.

[0073] like Figure 3 As shown, in the embodiment of the present disclosure, before implementing the code security detection method provided by the embodiment of the present disclosure, two large language models can be pre-trained. Among them, the first large model realizes the understanding of the code and particularly emphasizes the context of the code (i.e., the upstream and downstream call relationship), and the second large model is used to perform risk assessment on the function "token" and identify the target risk.

[0074] It should be noted that no matter how strong the understanding ability of a large language model is, there will be a certain loss of code elements such as code syntax, semantics, upstream and downstream logic, which will ultimately affect the results of the code security audit. In the above embodiment, it is possible to consider converting the programming language into an intermediate form (such as pseudocode, machine language, obfuscated code, etc.) that does not lose key code elements, and then bring the intermediate form code as input into the large language model for training or prediction, so as to retain as many initial code elements (syntax, semantics, logical chain, etc.) as possible to ensure the accuracy of the final scanning results.

[0075] Before training the first model, we first need to build a preprocessing process that can convert the source code into a form that not only contains the text information of the code itself, but also embeds the calling relationship and order between functions. This process can be summarized as follows: First, parse the source code, identify all function definitions and their calling relationships, and build a function call graph (Call Graph) to reflect the context structure of the code. Then, divide the training code text into independent "units" by function, and each function is regarded as a special "token". These "tokens" are connected through their relationships in the call graph (such as parent function, child function, etc.). Based on the functions and logic between "tokens" and the calling relationship between functions. Then, use this dataset to train a sequence-to-sequence (Seq2Seq) natural language model, so that it can learn to translate the ordered function sequence of the code into natural language text. Finally, this structured code representation and natural language text, together with the code text in the function body, are input into the first model (such as BERT, GPT, etc.). Through training, the first large model can not only understand the meaning of a single function, but also understand how functions work together in the entire program, thereby more accurately capturing the semantics and logic of the code.

[0076] When training the second largest model, risk assessment knowledge must also be incorporated into the training process, such as by annotating risk functions in the code and their contextual information (actually the code that has a calling relationship with the function) to guide the model to learn how to identify potential risks. After completing the training of the basic translation model, the model can be further trained or fine-tuned to perform risk assessment tasks, that is, to let the model learn to perform a first risk assessment on function statements in the translated natural language text, identify potential risk functions, and perform a second risk assessment based on the context of these functions to determine the specific target risks. This process requires the comprehensive use of natural language processing, machine learning, and expertise in software security.

[0077] In the application, the code to be detected is first input into the first large model to implement operation S210, and the ordered sequence "token" of the functions included therein and the ordered sequence of each function are output to translate the code to be detected line by line to generate a natural language text of the code to be detected; then the ordered sequence of each function is input into the second large model to implement operation S220, the code is translated line by line to generate a natural language text of the code to be detected; according to operation S230, a first risk assessment is performed on the natural language statements corresponding to the ordered sequence of each function in the natural language text to identify whether there are risk factors in the natural language statements corresponding to the ordered sequence of functions, such as logical vulnerabilities, abnormal input and output, functional defects, etc. When there are risk factors, the function can be determined to be a potential risk function; according to operation S240, the natural language statement of the context of the code of the potential risk function is obtained, and the natural language statement is scanned for a second risk assessment to find out whether there are risk avoidance description statements. When there are descriptions of risk factors and risk avoidance behaviors in the context of the natural language statement corresponding to the potential risk function, and there is a correlation between the risk factors and the risk avoidance text, then there is a description statement of risk avoidance in the context of the potential risk function, which means that it can be ruled out that the potential risk function has vulnerabilities that can be attacked; otherwise, the potential risk function has target risks.

[0078] After identifying the target risk, developers are notified according to the risk level and the time to deal with the risk function is arranged. At the same time, the risk problem is solved as much as possible without affecting the use of the code to be tested. The developer's handling methods can include the following aspects: a detailed assessment of the identified risks, including their potential impact, probability of occurrence, and difficulty of repair; Prioritize the risks according to the assessment results, giving priority to high-risk and urgent risks; Develop a detailed repair plan for each high-risk function, including repair steps, required resources, expected completion time, etc.; During the repair process, code review is performed to ensure the quality and correctness of the repair plan; After the repair is completed, comprehensive testing is performed, including unit testing, integration testing, and regression testing, to verify the repair effect and ensure that no new problems are introduced; Update relevant documents, including risk records, repair instructions, and test reports, so that team members can understand the risk situation and repair progress; After the repair is completed, continue to monitor the system to check whether there are similar risks or problems. By comprehensively applying the above-mentioned processing methods, potential risk problems can be effectively solved without affecting the use of the code to be tested, and the security and stability of the code can be improved.

[0079] Based on the above code security detection method, the present disclosure also provides a code security detection device. Figure 4 The device is described in detail.

[0080] Figure 4 The structure block diagram of the code security detection device according to the embodiment of the present disclosure is schematically shown.

[0081] like Figure 4 As shown, the code security detection device 400 of this embodiment includes a sequence generation module 410 , a code translation module 420 , a function analysis module 430 and a risk identification module 440 .

[0082] The sequence generation module 410 is used to obtain the code to be detected, and based on the upstream and downstream call relationship of each function in the code to be detected, generate an ordered sequence with each function and its upstream and downstream call relationship as a unit. In one embodiment, the sequence generation module 410 can be used to perform the operation S210 described above, which will not be repeated here.

[0083] The code translation module 420 is used to translate the code to be detected line by line based on the ordered sequence of each function to generate a natural language text of the code to be detected. In one embodiment, the code translation module 420 can be used to perform the operation S220 described above, which will not be repeated here.

[0084] The function analysis module 430 is used to perform a first risk assessment on the natural language statements corresponding to the ordered sequence of each function in the natural language text, and identify potential risk functions in the code to be detected. In one embodiment, the function analysis module 430 can be used to perform the operation S230 described above, which will not be repeated here.

[0085] The risk identification module 440 is used to perform a second risk assessment on the context of the natural language sentence corresponding to the potential risk function in the natural language text to determine the target risk of the potential risk function. In one embodiment, the risk identification module 440 can be used to perform the operation S240 described above, which will not be repeated here.

[0086] According to an embodiment of the present disclosure, any multiple modules of the sequence generation module 410, the code translation module 420, the function analysis module 430 and the risk identification module 440 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the sequence generation module 410, the code translation module 420, the function analysis module 430 and the risk identification module 440 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the sequence generation module 410 , the code translation module 420 , the function analysis module 430 , and the risk identification module 440 may be at least partially implemented as a computer program module, and when the computer program module is executed, a corresponding function may be performed.

[0087] Figure 5 A block diagram of an electronic device suitable for implementing a code security detection method according to an embodiment of the present disclosure is schematically shown.

[0088] like Figure 5As shown, the electronic device 500 according to an embodiment of the present disclosure includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 to a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include an onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0089] In RAM 503, various programs and data required for the operation of electronic device 500 are stored. Processor 501, ROM 502 and RAM 503 are connected to each other via bus 504. Processor 501 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 502 and / or RAM 503. It should be noted that the program can also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0090] According to an embodiment of the present disclosure, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 may further include one or more of the following components connected to the input / output (I / O) interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 508 including a hard disk, etc.; and a communication portion 509 including a network interface card such as a LAN card, a modem, etc. The communication portion 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output (I / O) interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage portion 508 as needed.

[0091] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0092] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 502 and / or RAM 503 described above and / or one or more memories other than ROM 502 and RAM 503.

[0093] The embodiments of the present disclosure also include a computer program product, which includes a computer program, which includes the above-mentioned functions defined in the system / device of the embodiment. According to the embodiments of the present disclosure, the systems, devices, modules, units, etc. described above can be implemented by computer program modules.

[0094] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 509, and / or installed from the removable medium 511. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0095] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the processor 501, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0096] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0097] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0098] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0099] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A code security detection method, characterized in that: The method comprises: Obtain the code to be detected, and based on the upstream and downstream calling relationship of each function in the code to be detected, generate an ordered sequence with each function and its upstream and downstream calling relationship as a unit; Translate the code to be detected line by line based on the ordered sequence of each function to generate a natural language text of the code to be detected; Performing a first risk assessment on the natural language statements corresponding to the ordered sequence of each of the functions in the natural language text to identify potential risk functions in the code to be detected; A second risk assessment is performed on the context of the natural language sentence corresponding to the potential risk function in the natural language text to determine a target risk existing in the potential risk function.

2. The method according to claim 1, characterized in that The performing a first risk assessment on the natural language statements corresponding to the ordered sequence of each function in the natural language text to identify the potential risk functions in the code to be detected includes: Identify whether the natural language statement corresponding to the ordered sequence of the function has risk factors; When the risk factor exists, the function is determined to be a potential risk function.

3. The method according to claim 1, characterized in that The performing a second risk assessment on the context of the natural language sentence corresponding to the potential risk function in the natural language text to determine the target risk of the potential risk function includes: Scan the context of the natural language sentence corresponding to the potential risk function in the natural language text to find out whether there is a description sentence for risk avoidance; If there is no descriptive statement for risk avoidance, then the potential risk function has a target risk.

4. The method according to claim 3, characterized in that The description statement for searching whether there is risk avoidance includes: Acquire a first vocabulary text representing a risk factor and a second vocabulary text representing a risk avoidance behavior, match the context of a natural language sentence corresponding to the potential risk function based on the first vocabulary text and the second vocabulary text, and perform language logic analysis; When the risk factor and the risk avoidance behavior exist in the context of the natural language sentence corresponding to the potential risk function, and there is an association between the risk factor and the risk avoidance text, a description statement of the risk avoidance exists.

5. The method according to claim 1, characterized in that The method further comprises: A level assessment is performed based on the risk characteristics of the target risk to obtain the risk level of the target risk.

6. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: Performing predictive analysis on the code to be detected based on a zero-shot learning model to obtain a custom vulnerability, where the custom vulnerability is a vulnerability inferred by the zero-shot learning model based on the code to be detected; Analyze and obtain risk factors of the custom vulnerability, and apply the risk factors to the first risk assessment and the second risk assessment.

7. A code security detection device, characterized in that: The device comprises: A sequence generation module is used to obtain the code to be detected, and based on the upstream and downstream calling relationship of each function in the code to be detected, generate an ordered sequence with each function and its upstream and downstream calling relationship as a unit; A code translation module, used for translating the code to be detected line by line based on the ordered sequence of each function to generate a natural language text of the code to be detected; A function analysis module, configured to perform a first risk assessment on the natural language statements corresponding to the ordered sequence of each of the functions in the natural language text, and identify potential risk functions in the code to be detected; The risk identification module is used to perform a second risk assessment on the context of the natural language sentence corresponding to the potential risk function in the natural language text to determine the target risk of the potential risk function.

8. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images