Code security detection method, device, equipment, medium and program product

Abstract

The present disclosure provides a code security detection method, which can be applied to the technical field of information security. The method comprises: obtaining a to-be-detected code, generating an ordered sequence based on each function and the upstream and downstream calling relationship thereof in the to-be-detected code; performing line-by-line translation on the to-be-detected code based on the ordered sequence of each function to generate a natural language text of the to-be-detected code; performing first risk assessment on the natural language statements corresponding to the ordered sequence of each function in the natural language text to identify potential risk functions in the to-be-detected code; and performing second risk assessment on the context of the natural language statements corresponding to the risk functions in the natural language text to determine the target risk of the potential risk functions. The present disclosure also provides a code security detection device, equipment, storage medium and program product.

Description

Technical Field

[0001] This disclosure relates to the field of information security, specifically to a code security detection method, apparatus, device, medium, and program product. Background Technology

[0002] With the rapid development of information technology and the widespread dissemination of hacking techniques, information security has become a key bottleneck for the sustainable development of enterprises. Against this backdrop, DevSecOps, as an advanced security shift-left concept, emphasizes integrating security considerations into the early stages of software development and has become a core strategy for enterprises to build a secure system. Code security auditing, as a crucial part of DevSecOps, has traditionally relied on professional scanning tools. However, these tools are not only costly and time-consuming, but also often increase the burden of subsequent analysis due to high false positive rates.

[0003] With the rise of artificial intelligence, especially large-scale modeling technology, the industry hopes to revolutionize this field by introducing large-scale code auditing models. Currently, various large-scale code auditing models based on different technical approaches have emerged in the market, such as natural language generation models like ChatGPT and ChatGLM, data flow graph-based models like GraphCodeBert, and models that utilize abstract syntax trees (ASTs) to enhance understanding, such as UniXCoder. In addition, open-source platforms like Huggingface also provide numerous pre-trained large-scale models for code auditing.

[0004] While large-scale modeling technologies have shown promise in code auditing, existing techniques still face numerous shortcomings and limitations. First, while natural language generation models (such as ChatGPT and ChatGLM) possess powerful natural language understanding capabilities, they struggle with programming languages, particularly in understanding deep logic and structure. Second, while data flow graph or abstract syntax tree (AST)-based models improve code comprehension, they also suffer from logical loss (e.g., key functions or parameters are ignored) or naming sensitivity issues (inaccurate similarity assessments due to naming differences in identical logic). Third, most existing models still rely excessively on pre-defined scanning rules or manually labeled data, resulting in high false positive rates, poor flexibility, and high preparation costs. Finally, the lack of transparency regarding the source and quality of training data for open-source large-scale models makes them difficult to apply directly to specific enterprise scenarios and exposes them to limitations common to other large-scale models. Summary of the Invention

[0005] In view of the above problems, this disclosure provides a code security detection method, apparatus, device, medium and program product.

[0006] According to a first aspect of this disclosure, a code security detection method is provided, the method comprising: acquiring code to be detected; generating an ordered sequence based on the upstream and downstream call relationships of each function in the code to be detected, with each function and its upstream and downstream call relationships as units; translating the code to be detected line by line based on the ordered sequence of each function to generate natural language text of the code to be detected; performing a first risk assessment on the natural language statements corresponding to the ordered sequence of each function in the natural language text to identify potential risk functions in the code to be detected; and performing a second risk assessment on the context of the natural language statements corresponding to the potential risk functions in the natural language text to determine the target risk of the potential risk functions.

[0007] According to an embodiment of this disclosure, the first risk assessment of the natural language statements corresponding to the ordered sequence of each function in the natural language text, and the identification of potential risk functions in the code to be detected, includes: identifying whether there are risk factors in the natural language statements corresponding to the ordered sequence of the functions; and determining that the function is a potential risk function when the risk factors exist.

[0008] According to an embodiment of this disclosure, the second risk assessment of the context of the natural language statement corresponding to the potential risk function in the natural language text to determine the target risk of the potential risk function includes: scanning the context of the natural language statement corresponding to the potential risk function in the natural language text to find whether there is a descriptive statement to avoid the risk; if there is no descriptive statement to avoid the risk, then the potential risk function has a target risk.

[0009] According to embodiments of this disclosure, the step of searching for the existence of a risk avoidance description statement includes: obtaining a first vocabulary text representing a risk factor and a second vocabulary text representing a risk avoidance behavior; matching the context of the natural language statement corresponding to the potential risk function based on the first vocabulary text and the second vocabulary text, and performing language logic analysis; when the risk factor and the risk avoidance behavior exist in the context of the natural language statement corresponding to the potential risk function, and the risk factor and the risk avoidance text are related, then the risk avoidance description statement exists.

[0010] According to embodiments of this disclosure, the method further includes: performing a risk level assessment based on the risk characteristics of the target risk to obtain the risk level of the target risk.

[0011] According to an embodiment of this disclosure, the method further includes: performing predictive analysis on the code to be detected based on a zero-learning model to obtain a custom vulnerability, wherein the custom vulnerability is a vulnerability inferred by the zero-learning model based on the code to be detected; analyzing and obtaining risk factors of the custom vulnerability, wherein the risk factors are applied to the first risk assessment and the second risk assessment.

[0012] A second aspect of this disclosure provides a code security detection device, comprising: a sequence generation module for acquiring code to be detected and generating an ordered sequence based on the upstream and downstream call relationships of functions in the code to be detected, with each function and its upstream and downstream call relationships as units; a code translation module for translating the code to be detected line by line based on the ordered sequence of each function to generate natural language text of the code to be detected; a function analysis module for performing a first risk assessment on the natural language statements corresponding to the ordered sequence of each function in the natural language text to identify potential risk functions in the code to be detected; and a risk identification module for performing a second risk assessment on the context of the natural language statements corresponding to the potential risk functions in the natural language text to determine the target risk of the potential risk functions.

[0013] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0014] A fourth aspect of this disclosure also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0015] The fifth aspect of this disclosure also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0016] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0017] Figure 1 The illustrations depict application scenarios of code security detection methods, apparatuses, devices, media, and program products according to embodiments of the present disclosure.

[0018] Figure 2 A flowchart illustrating a code security detection method according to an embodiment of the present disclosure is shown schematically.

[0019] Figure 3 This illustration schematically shows an application flowchart of the code security detection method according to an embodiment of the present disclosure;

[0020] Figure 4 A schematic diagram illustrating the structure of a code security detection apparatus according to embodiments of the present disclosure is shown; and

[0021] Figure 5 A block diagram schematically illustrates an electronic device suitable for implementing a code security detection method according to an embodiment of the present disclosure. Detailed Implementation

[0022] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0023] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0024] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0025] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0026] It should be noted that the code security detection method and apparatus provided in this disclosure can be used for code security detection in software development in the financial field, and can also be used in any field other than the financial field. The application field of the code security detection method and apparatus provided in this disclosure is not limited.

[0027] The acquisition, transmission, storage, use, and processing of data in this application comply with relevant national laws and regulations. It should be noted that certain software, components, models, and other existing industry solutions may be mentioned in the embodiments of this application. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0028] In the technical solution disclosed herein, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse.

[0029] The embodiments of this disclosure provide a code security detection method, the method comprising: acquiring code to be detected; generating an ordered sequence based on the upstream and downstream call relationships of each function in the code to be detected, with each function and its upstream and downstream call relationships as units; translating the code to be detected line by line based on the ordered sequence of each function to generate natural language text of the code to be detected; performing a first risk assessment on the natural language statements corresponding to the ordered sequence of each function in the natural language text to identify potential risk functions in the code to be detected; and performing a second risk assessment on the context of the natural language statements corresponding to the potential risk functions in the natural language text to determine the target risk of the potential risk functions.

[0030] Figure 1 The illustration shows an application scenario of the code security detection method and apparatus according to embodiments of the present disclosure.

[0031] like Figure 1 As shown, application scenario 100 according to this embodiment may include a bank's software development project. Network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0032] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0033] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0034] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0035] It should be noted that the code security detection method provided in this disclosure embodiment can generally be executed by server 105. Correspondingly, the code security detection device provided in this disclosure embodiment can generally be located in server 105. The code security detection method provided in this disclosure embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the code security detection device provided in this disclosure embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0036] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0037] The following will be based on Figure 1 The described scene, through Figures 2-3 The code security detection method of the disclosed embodiments is described in detail.

[0038] Figure 2 A flowchart illustrating a code security detection method according to an embodiment of the present disclosure is shown schematically.

[0039] like Figure 2 As shown, the code security detection method of this embodiment includes operations S210 to S230, and the transaction processing method can be executed sequentially.

[0040] In operation S210, the code to be detected is obtained, and based on the upstream and downstream call relationships of each function in the code to be detected, an ordered sequence is generated in units of each function and its upstream and downstream call relationships.

[0041] The existing large model's process of converting PL to NL is for all identifiable code. The converted natural language lacks the specificity of the enterprise's internal business domain or function. Generalization leads to the disappearance of characteristics, which in turn reduces the identifiable risks and ultimately leads to risk escape, which is still the code security risk of functions closely related to the enterprise's business.

[0042] The output of existing large models for the transformation process from PL to NL is descriptive, and the best output is a line-by-line translation. It lacks the relationship between methods and the overall order and logic of the code. Security risks in the code are strongly related to the overall call relationship and logic of the code. Losing the characteristics of order and logic will result in a large number of false negatives and false positives.

[0043] In this embodiment, after retrieving the code to be detected from the code repository, the code is preprocessed. When the code is sent to the large model, its upstream and downstream call relationships are included, allowing the large model to understand that the code is a series of functions, with each function treated as a "token." The entire code file to be scanned (code repository) becomes an ordered token sequence composed of these "tokens." This ordered sequence preserves the overall order and logic of the code, which can improve the accuracy of the code translation results.

[0044] In operation S220, the code to be detected is translated line by line based on the ordered sequence of each function, generating natural language text of the code to be detected.

[0045] In this embodiment, a large language model can be trained to convert code into natural language. The large model is used to understand individual functions line by line. This involves preserving method logic, common SDK method names, class names, and inherited class names (such as database operations, file operations, resource management, system operations, and security SDKs like OWASP); if regular expressions are involved in the code, their meaning is preserved as much as possible; custom parameter names, method names, and class names are replaced with common tokens, ensuring that the same function uses different parameter names, and achieving a similarity of 1 (100%) after encoding by the large model; custom constants are designed to be recognizable in natural language after parsing. The natural language portion of the training corpus should utilize code comments as much as possible. If the code commenting is insufficient, comment governance should be performed before training the model, thereby increasing the relevance of the translation results to the business logic associated with the code. The model outputs two things: one is an ordered sequence of tokens consisting of functions, and the natural language generated from this sequence (similar to telling a story that explains what the project was about and what steps it involved in); the other is a line-by-line translation of each function (explaining the details of the story and how each step was done).

[0046] In operation S230, a first risk assessment is performed on the natural language statements corresponding to the ordered sequence of functions in the natural language text to identify potential risk functions in the code to be detected.

[0047] Traditional security engines rely excessively on rules. If a rule matches, it's considered a vulnerability (potentially a false positive); if it doesn't match, it's not considered a vulnerability (potentially a false negative). This limits the scope of rules and reduces flexibility. Large-scale models only consider code similarity. If the code is similar to "vulnerable code," it may generate a false positive; if it's dissimilar, it may generate a false negative. Lacking a theoretical basis for security, these engines are unreliable and difficult to implement or deploy in production.

[0048] In this embodiment, a first risk assessment is performed on the "natural language generated from an ordered sequence of functions as tokens" to identify potentially risky functions. Then, in operation S240, a risk assessment is performed on the line-by-line translation of the identified potentially risky functions to determine whether the risk actually exists. The overall approach of this scheme is risk-oriented; following the risk assessment approach, only those risks that exist and are likely to have an impact are considered vulnerabilities, thereby improving the accuracy of vulnerability identification.

[0049] In operation S240, a second risk assessment is performed on the context of the natural language statement corresponding to the potential risk function in the natural language text to determine the target risk of the potential risk function.

[0050] In this embodiment of the disclosure, a second risk assessment is used to check whether there are logical vulnerabilities in the natural language context corresponding to the potential risk function. If the second risk assessment determines that the risk actually exists, then the potential risk function is determined to have a vulnerability.

[0051] The code security detection method disclosed herein considers the contextual relationships of functions during the code translation process, treating each function as a "token." The entire code file to be scanned (code repository) becomes an ordered sequence of such "tokens," which helps the language model correctly understand the meaning of the code and improves the accuracy of the translation. This method first identifies risks in the ordered sequence of functions, and then searches for risk-avoidance behaviors through context, thereby determining whether there are risks in the code. This method solves the problem of existing technologies losing the correlation between methods when translating code line by line, and does not rely on vulnerability matching rules. In operation S230, a first risk assessment is performed on the natural language statements corresponding to the ordered sequence of functions in the natural language text to identify potential risky functions in the code to be detected, including operations S231~S232.

[0052] In operation S231, the natural language statements corresponding to the ordered sequence of the identification function are examined to determine whether there are risk factors.

[0053] In this embodiment of the disclosure, risk factors include logical vulnerabilities, abnormal input / output, and functional defects. By identifying whether risk factors exist after the ordered sequence of a function is translated into natural language statements, it can be determined whether the function has vulnerabilities.

[0054] In operation S232, when risk factors exist, the decision function is the potential risk function.

[0055] This method for identifying potential risk functions uses essential functional elements such as logic, functionality, and parameters as conditions for vulnerability judgment. It does not rely on vulnerability identification rules and has a higher accuracy rate.

[0056] In operation S240, a second risk assessment is performed on the context of the natural language statement corresponding to the potential risk function in the natural language text to determine the target risk of the potential risk function, including S241~S242.

[0057] In operation S241, the context of the natural language statement corresponding to the risk function in the natural language text is scanned to find whether there is a descriptive statement for avoiding risk.

[0058] In S241, the search for the existence of descriptive statements for risk avoidance includes S2411 to S2412.

[0059] In operation S2411, the first word text representing risk factors and the second word text representing risk avoidance behavior are obtained. The context of the natural language statement corresponding to the potential risk function is matched based on the first word text and the second word text, and language logic analysis is performed.

[0060] To accurately analyze risk scenarios, the first step is to extract the primary vocabulary representing risk factors and the secondary vocabulary describing risk-avoidance behaviors. These primary vocabulary words are then used as keywords to search and match within the context of natural language statements corresponding to the potential risk functions, locating specific risk descriptions and coping strategies. Based on this, in-depth linguistic logic analysis not only reveals the intrinsic connection between risk factors and avoidance behaviors but also assesses the rationality and effectiveness of the adopted strategies, thus providing strong support for risk management decisions.

[0061] In operation S2412, when there are risk factors and risk avoidance behaviors in the context of the natural language statement corresponding to the potential risk function, and there is a relationship between the risk factors and the risk avoidance text, then there is a descriptive statement for risk avoidance.

[0062] When analyzing the natural language text mapped by the potential risk function, if the text clearly identifies potential risk factors and then describes the avoidance strategies adopted for these risk factors, and these strategies are logically directly linked to the risk factors, then the text contains a clear description of risk avoidance, demonstrating a comprehensive consideration of the identification, assessment, and response measures for potential risks.

[0063] In operation S242, if there is no description statement for risk avoidance, then the potential risk function has a target risk.

[0064] In this embodiment, the object of the second risk assessment is the context of the natural language statement corresponding to the potential risk function. By examining the context, descriptive statements that mitigate the risk are searched. If such descriptive statements exist, it indicates that the code has implemented security protection measures for the existing vulnerability. If no such descriptive statements exist, it indicates that the vulnerability poses a risk. During the context examination process, the scope of logical judgment can be broadened, thereby preventing false positives and false negatives and improving the accuracy of risk assessment.

[0065] After identifying the target risk, the method may further include S243 in this embodiment of the disclosure.

[0066] In operation S243, the risk level of the target risk is obtained by assessing the risk characteristics of the target risk.

[0067] Risk characteristics can include risk category, exploitability, impact after exploitation, and accessible paths to the system to which the risk belongs. Vulnerability severity levels can be determined according to a risk assessment scoring mechanism; the greater the potential loss, the higher the severity level, prompting developers to prioritize addressing higher-severity risks.

[0068] To further improve the accuracy of risk identification, the code security detection method provided in this disclosure also includes S231~S232.

[0069] In operation S231, a predictive analysis is performed on the code to be detected based on a zero-learning model to obtain a custom vulnerability. The custom vulnerability is a vulnerability inferred by the zero-learning model based on the code to be detected.

[0070] In this embodiment, a zero-shot learning model can be used for deep predictive analysis of the code to be detected. This process does not rely on any previously labeled or trained specific vulnerability datasets. Leveraging its superior generalization ability and powerful pattern recognition technology, the zero-shot learning model can directly infer unprecedented security weaknesses, termed "custom vulnerabilities," from the structure, logic, and potential programming paradigms of the code to be detected. These custom vulnerabilities are dynamically generated by the model based on the unique characteristics and potential risks of the code, rather than a simple match based on a known vulnerability database. Therefore, they represent new types of security threats that may not yet be widely recognized or documented. Through this approach, the zero-shot learning model provides software developers and security experts with unprecedented insight, enabling them to discover and fix complex vulnerabilities that are difficult to detect using traditional methods, thereby significantly improving the security and reliability of software systems.

[0071] In operation S232, risk factors for custom vulnerabilities are analyzed and obtained, and these risk factors are applied to the first and second risk assessments.

[0072] After in-depth analysis and successful identification of custom vulnerabilities, their root causes and characteristics can be dissected to identify the underlying risk factors. These risk factors may include, but are not limited to, code design flaws, insecure programming practices, vulnerabilities in external dependencies, and ineffective security controls. Each risk factor is meticulously documented and its potential impact quantified to more accurately assess its threat level to system security. Based on the identified risk factors, they can be used in S230-S240 for subsequent code risk assessments. As the correspondence between code logic and risk is continuously optimized along with the development of enterprise information security capabilities and practical experience, zero-shot technology can identify security risks that traditional code auditing tools cannot detect, reducing vulnerability escapes for enterprises. Figure 3The flowchart illustrating the application of the code security detection method according to an embodiment of the present disclosure is shown in the illustration.

[0073] like Figure 3 As shown in this embodiment of the disclosure, two large language models can be pre-trained before implementing the code security detection method provided in this embodiment. The first large model understands the code and particularly emphasizes the code's context (i.e., upstream and downstream call relationships), while the second large model is used to assess the risk of the function "token" and identify target risks.

[0074] It should be noted that no matter how strong the understanding ability of a large language model is, there will always be some loss of code elements such as syntax, semantics, and upstream and downstream logic, ultimately affecting the results of code security audits. In the above embodiments, it is advisable to consider converting the programming language into an intermediate form (such as pseudocode, machine language, obfuscated code, etc.) that does not lose key code elements, and then using the intermediate code as input to train or predict the large language model. This can preserve as many original code elements (syntax, semantics, logical chains, etc.) as possible, ensuring the accuracy of the final scan results.

[0075] Before training the first major model, a preprocessing workflow is needed to transform the source code into a format that includes not only the textual information of the code itself but also embedded function call relationships and sequences. This process can be summarized as follows: First, the source code is parsed to identify all function definitions and their call relationships, constructing a call graph to reflect the code's contextual structure. Next, the training code text is divided into independent "units" by function, with each function treated as a special "token." These "tokens" are connected through their relationships in the call graph (e.g., parent function, child function, etc.). Based on the functionality, logic, and call relationships between the "tokens," a sequence-to-sequence (Seq2Seq) natural language model is trained using this dataset, enabling it to learn to translate ordered sequences of functions in the code into natural language text. Finally, this structured code representation and natural language text, along with the code text within the function bodies, are input into the first major model (such as BERT, GPT, etc.). Through training, the first major model can not only understand the meaning of individual functions, but also how functions cooperate with each other throughout the program, thereby capturing the semantics and logic of the code more accurately.

[0076] When training the second major model, risk assessment knowledge needs to be incorporated into the training process. For example, by annotating risk functions in the code and their contextual information (actually code that has a call relationship with the function), the model can be guided to learn how to identify potential risks. After completing the training of the basic translation model, the model can be further trained or fine-tuned to perform risk assessment tasks. That is, the model learns to perform a first risk assessment on function statements in the translated natural language text, identify potential risk functions, and perform a second risk assessment based on the context of these functions to determine specific target risks. This process requires the comprehensive application of expertise in natural language processing, machine learning, and software security.

[0077] In the application, the code to be detected is first input into the first large model to perform operation S210, which outputs the ordered sequence of functions "token" and the ordered sequence of each function to translate the code to be detected line by line, generating natural language text of the code to be detected. Then, the ordered sequence of each function is input into the code to be detected into the second large model to perform operation S220, which translates the code line by line, generating natural language text of the code to be detected. According to operation S230, a first risk assessment is performed on the natural language statements corresponding to the ordered sequences of each function in the natural language text to identify whether there are risk factors, such as logical loopholes, abnormal inputs and outputs, functional defects, etc. When risk factors are present, the function can be determined as a potential risk function. According to operation S240, the natural language statements of the code context of the potential risk function are obtained, and a second risk assessment scan is performed on the natural language statements to look for descriptive statements that avoid risks. If the context of the natural language statement corresponding to a potential risk function contains descriptions of risk factors and risk avoidance behaviors, and there is a correlation between the risk factors and risk avoidance statements, then the context of the potential risk function contains descriptions of risk avoidance, which means that the potential risk function can be ruled out as having an exploitable vulnerability; otherwise, the potential risk function has a target risk.

[0078] After identifying a target risk, developers are notified according to the risk level, and a timeline is set for addressing the risky function. Simultaneously, efforts are made to resolve the risk without affecting the usability of the code under test. Developers' handling methods may include the following: conducting a detailed assessment of the identified risk, including its potential impact, probability of occurrence, and difficulty of remediation; prioritizing risks based on the assessment results, addressing high-risk and urgent risks first; developing a detailed remediation plan for each high-risk function, including remediation steps, required resources, and expected completion time; conducting code reviews during the remediation process to ensure the quality and correctness of the remediation plan; performing comprehensive testing after remediation, including unit testing, integration testing, and regression testing, to verify the remediation effect and ensure no new issues are introduced; updating relevant documentation, including risk records, remediation instructions, and test reports, so that team members are aware of the risk situation and remediation progress; and continuously monitoring the system after remediation to check for the existence of similar risks or issues. By comprehensively applying the above methods, potential risk issues can be effectively resolved without affecting the usability of the code under test, improving code security and stability.

[0079] Based on the above code security detection method, this disclosure also provides a code security detection device. The following will be combined with... Figure 4 The device is described in detail.

[0080] Figure 4 A schematic block diagram of a code security detection apparatus according to an embodiment of the present disclosure is shown.

[0081] like Figure 4 As shown, the code security detection device 400 of this embodiment includes a sequence generation module 410, a code translation module 420, a function analysis module 430, and a risk identification module 440.

[0082] The sequence generation module 410 is used to acquire the code to be detected and, based on the upstream and downstream call relationships of each function in the code to be detected, generates an ordered sequence in units of each function and its upstream and downstream call relationships. In one embodiment, the sequence generation module 410 can be used to perform the operation S210 described above, which will not be repeated here.

[0083] The code translation module 420 is used to translate the code to be detected line by line based on the ordered sequence of each function, generating natural language text of the code to be detected. In one embodiment, the code translation module 420 can be used to perform the operation S220 described above, which will not be repeated here.

[0084] The function analysis module 430 is used to perform a first risk assessment on the natural language statements corresponding to the ordered sequence of functions in the natural language text, and to identify potential risk functions in the code to be detected. In one embodiment, the function analysis module 430 can be used to perform the operation S230 described above, which will not be repeated here.

[0085] The risk identification module 440 is used to perform a second risk assessment on the context of the natural language statement corresponding to the potential risk function in the natural language text, and to determine the target risk present in the potential risk function. In one embodiment, the risk identification module 440 can be used to perform the operation S240 described above, which will not be repeated here.

[0086] According to embodiments of this disclosure, any plurality of modules among the sequence generation module 410, code translation module 420, function analysis module 430, and risk identification module 440 may be combined into one module, or any one of these modules may be split into multiple modules. Alternatively, at least a portion of the functionality of one or more of these modules may be combined with at least a portion of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the sequence generation module 410, code translation module 420, function analysis module 430, and risk identification module 440 may be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in any one of software, hardware, and firmware methods, or in a suitable combination of any of these methods. Alternatively, at least one of the sequence generation module 410, code translation module 420, function analysis module 430, and risk identification module 440 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0087] Figure 5 A block diagram schematically illustrates an electronic device suitable for implementing a code security detection method according to an embodiment of the present disclosure.

[0088] like Figure 5As shown, an electronic device 500 according to an embodiment of the present disclosure includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage portion 508 into a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0089] RAM 503 stores various programs and data required for the operation of electronic device 500. Processor 501, ROM 502, and RAM 503 are interconnected via bus 504. Processor 501 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 502 and / or RAM 503. It should be noted that the programs may also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0090] According to embodiments of this disclosure, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to a bus 504. The electronic device 500 may also include one or more of the following components connected to the input / output (I / O) interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output (I / O) interface 505 as needed. A removable medium 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 510 as needed so that computer programs read from it can be installed into the storage section 508 as needed.

[0091] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0092] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 502 and / or RAM 503 and / or one or more memories other than ROM 502 and RAM 503 described above.

[0093] Embodiments of this disclosure also include a computer program product comprising a computer program that includes functions defined in the system / apparatus of the embodiments for performing the functions described above. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented using computer program modules.

[0094] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 509, and / or installed from a removable medium 511. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0095] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by processor 501, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0096] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0097] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0098] Those skilled in the art will understand that the features described in the various embodiments of this disclosure can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments of this disclosure can be combined and / or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0099] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A code security detection method, characterized in that, The method includes: Obtain the code to be detected, and based on the upstream and downstream call relationships of each function in the code to be detected, generate an ordered sequence in units of each function and its upstream and downstream call relationships; The code to be detected is translated line by line based on the ordered sequence of each function to generate natural language text of the code to be detected. A first risk assessment is performed on the natural language statements corresponding to the ordered sequence of each function in the natural language text to identify potential risk functions in the code to be detected; A second risk assessment is performed on the context of the natural language statement corresponding to the potential risk function in the natural language text to determine the target risk present in the potential risk function, including: Scan the context of the natural language statement corresponding to the potential risk function in the natural language text to find whether there are descriptive statements for avoiding risks; If there is no description of the risk avoidance, then the potential risk function has a target risk.

2. The method according to claim 1, characterized in that, The first risk assessment of the natural language statements corresponding to the ordered sequence of each function in the natural language text, and the identification of potential risk functions in the code to be detected, includes: Identify whether there are risk factors in the natural language statements corresponding to the ordered sequence of the function; When the aforementioned risk factors exist, the function is determined to be a potential risk function.

3. The method according to claim 1, characterized in that, The description of checking whether there are risk avoidance measures includes: Obtain the first lexical text representing risk factors and the second lexical text representing risk avoidance behavior; match the context of the natural language statement corresponding to the potential risk function based on the first lexical text and the second lexical text, and perform linguistic logic analysis. When the risk factor and the risk avoidance behavior exist in the context of the natural language statement corresponding to the potential risk function, and the risk factor and the risk avoidance text are related, then the risk avoidance description statement exists.

4. The method according to claim 1, characterized in that, The method further includes: The risk level of the target risk is obtained by assessing its risk characteristics.

5. The method according to any one of claims 1-3, characterized in that, The method further includes: Based on the zero-step learning model, predictive analysis is performed on the code to be detected to obtain custom vulnerabilities. The custom vulnerabilities are vulnerabilities inferred by the zero-step learning model based on the code to be detected. Analyze and obtain the risk factors of the custom vulnerability, and apply the risk factors to the first risk assessment and the second risk assessment.

6. A code security detection device, characterized in that, The device includes: The sequence generation module is used to obtain the code to be detected and generate an ordered sequence based on the upstream and downstream call relationships of each function in the code to be detected, with each function and its upstream and downstream call relationships as the unit; The code translation module is used to translate the code to be detected line by line based on the ordered sequence of each function, and generate the natural language text of the code to be detected. The function analysis module is used to perform a first risk assessment on the natural language statements corresponding to the ordered sequence of each function in the natural language text, and to identify potential risk functions in the code to be detected. The risk identification module is used to perform a second risk assessment on the context of the natural language statement corresponding to the potential risk function in the natural language text, and to determine the target risk existing in the potential risk function, including: Scan the context of the natural language statement corresponding to the potential risk function in the natural language text to find whether there are descriptive statements for avoiding risks; If there is no description of the risk avoidance, then the potential risk function has a target risk.

7. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 5.

9. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 5.

Images