Information security vulnerability assessment method and system

Abstract

The invention provides an information security vulnerability assessment method and system, and the method comprises the steps: determining an original source code before version update based on a submitted update source code, and then constructing a code analysis chart of the update source code and the original source code; wherein the nodes in the code analysis graph of the updated source code or the original source code represent the nodes in the abstract syntax tree of the corresponding source code, and the edges represent the relationship between the nodes; fusing the code analysis graphs of the updated source code and the original source code to obtain an updated annotation graph; wherein nodes in the update annotation graph are a node union set of the code analysis graphs of the update source code and the original source code, and edges in the update annotation graph are an edge union set of the code analysis graphs of the update source code and the original source code; in the embodiment of the invention, each node of the updated annotation graph also has annotation information, and the annotation information is increased, deleted or unchanged, so that the instant vulnerability assessment result of the updated source code is determined based on the updated annotation graph, and the accuracy of instant vulnerability assessment is effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an information security vulnerability assessment method and system. Background Art

[0002] In the information society, information systems have penetrated into every aspect of life and work, so the security of information systems is extremely important. Among them, attackers will exploit the vulnerabilities of information systems to attack information systems, causing significant damage. Therefore, assessing the vulnerabilities of information systems and timely discovering and repairing the vulnerabilities of information systems is an important part of ensuring the security of information systems.

[0003] Currently, the method of performing vulnerability scanning on the entire source code of an information system is a relatively common vulnerability assessment solution. However, due to the large number of scanned objects and low efficiency, the frequency of the above-mentioned global scan will not be too high. At this time, real-time vulnerability assessment can serve as an effective supplement to the global scanning method to protect the security of the information system in the gaps between global scans. Among them, real-time vulnerability assessment performs vulnerability assessment on the code submitted by the developer after the developer submits (commits) the source code for version update and before the code is deployed to the production environment. It can provide instant feedback on the security of the submitted code, thereby avoiding the introduction of new vulnerabilities.

[0004] Current real-time vulnerability assessment solutions usually use the personal information of the developer who submitted the code (such as the developer's experience), the submission time, and the complexity of the code changes (such as the number of lines of code added / deleted) to determine whether the submitted code has vulnerabilities. However, due to the complexity of the development environment and the code editing habits of different developers, there is no necessary correlation between the above factors and code vulnerabilities, so the accuracy of vulnerability assessment is poor. Summary of the invention

[0005] The present invention provides an information security vulnerability assessment method and system, which are used to solve the defect of poor accuracy of the instant vulnerability assessment scheme in the prior art.

[0006] The present invention provides an information security vulnerability assessment method, comprising: Based on the updated source code submitted by the developer for the version update, determine the original source code corresponding to the version before the update; Constructing a code analysis graph of the updated source code and the original source code; wherein the nodes in the code analysis graph of the updated source code or the original source code represent the nodes in the abstract syntax tree of the corresponding source code, and the edges represent the relationships between the nodes; The code analysis graphs of the updated source code and the original source code are merged to obtain an updated annotation graph; wherein the nodes in the updated annotation graph are the node union of the code analysis graphs of the updated source code and the original source code, and the edges in the updated annotation graph are the edge union of the code analysis graphs of the updated source code and the original source code; each node of the updated annotation graph also has annotation information, and the annotation information is added, deleted, or unchanged; Based on the update annotation graph, an immediate vulnerability assessment result of the updated source code is determined.

[0007] According to an information security vulnerability assessment method provided by the present invention, the edges in the code analysis graph of the updated source code or the original source code represent structural relationships or dependency relationships between nodes.

[0008] According to an information security vulnerability assessment method provided by the present invention, the annotation information of each node of the update annotation graph is determined based on the following rules: If any node belongs to the code analysis graph of the updated source code and does not belong to the code analysis graph of the original source code, the annotation information of the any node is added; If any node belongs to the code analysis graph of the original source code and does not belong to the code analysis graph of the updated source code, the annotation information of the any node is deleted; Otherwise, the label information of any node is unchanged.

[0009] According to an information security vulnerability assessment method provided by the present invention, determining the instant vulnerability assessment result of the updated source code based on the updated annotation graph includes: Determine key nodes and non-key nodes related to code changes in the update annotation graph; Deleting non-critical nodes and edges connecting the non-critical nodes in the update annotation graph to obtain a simplified update annotation graph; Based on the simplified update annotation graph, an immediate vulnerability assessment result of the updated source code is determined.

[0010] According to an information security vulnerability assessment method provided by the present invention, determining the key nodes and non-key nodes related to the code change in the update annotation graph includes: If any node meets any of the following conditions, the node is determined to be a key node related to the code change: From any of the nodes to the node with the annotation information of addition or deletion, there exists a path consisting only of edges corresponding to the structural relationship; From any of the nodes to any of the key nodes or from any of the key nodes to any of the nodes, there exists a path consisting only of edges corresponding to dependency relationships; From any key node to any of the nodes, there exists a path consisting only of edges corresponding to structural relationships.

[0011] According to an information security vulnerability assessment method provided by the present invention, determining the instant vulnerability assessment result of the updated source code based on the simplified update annotation graph includes: Performing feature extraction on the simplified updated annotation graph based on a relational graph neural network to obtain a graph vector representation of the simplified updated annotation graph; The graph vector representation of the simplified update annotation graph is classified based on a multi-layer perceptron to determine an immediate vulnerability assessment result of the updated source code.

[0012] According to an information security vulnerability assessment method provided by the present invention, the feature extraction of the simplified updated annotation graph based on the relationship graph neural network to obtain the graph vector representation of the simplified updated annotation graph includes: Determining a node embedding vector of each node in the simplified updated annotation graph based on the embedding network; Fusing the node embedding vector of each node in the simplified updated annotation graph with the one-hot vector of the annotation information of the corresponding node to obtain the annotation fusion vector of each node; Based on a relational graph neural network, feature extraction is performed on the annotation fusion vector of each node in the simplified updated annotation graph to obtain a graph vector representation of the simplified updated annotation graph.

[0013] The present invention also provides an information security vulnerability assessment system, comprising: A source code determination unit, used to determine the original source code before the version update corresponding to the updated source code for version update submitted by the developer; A code analysis graph construction unit, configured to construct a code analysis graph of the updated source code and the original source code; wherein the nodes in the code analysis graph of the updated source code or the original source code represent the nodes in the abstract syntax tree of the corresponding source code, and the edges represent the relationships between the nodes; an update annotation graph construction unit, configured to merge the code analysis graphs of the update source code and the original source code to obtain an update annotation graph; wherein the nodes in the update annotation graph are the node union of the code analysis graphs of the update source code and the original source code, and the edges in the update annotation graph are the edge union of the code analysis graphs of the update source code and the original source code; each node of the update annotation graph also has annotation information, and the annotation information is added, deleted, or unchanged; The real-time vulnerability assessment unit is used to determine the real-time vulnerability assessment result of the updated source code based on the update annotation graph.

[0014] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the information security vulnerability assessment method described above is implemented.

[0015] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the information security vulnerability assessment method as described in any one of the above is implemented.

[0016] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the information security vulnerability assessment method as described above is implemented.

[0017] The present invention provides an information security vulnerability assessment method and system. The method determines the original source code before the version update corresponding to the updated source code submitted by the developer for version update, and then constructs a code analysis graph of the updated source code and the original source code. The nodes in the code analysis graph of the updated source code or the original source code represent the nodes in the abstract syntax tree of the corresponding source code, and the edges represent the relationship between the nodes. The code analysis graphs of the updated source code and the original source code are merged to obtain an updated annotation graph. The nodes in the updated annotation graph are the node union of the code analysis graphs of the updated source code and the original source code, and the edges in the updated annotation graph are the edge union of the code analysis graphs of the updated source code and the original source code. Each node in the updated annotation graph also has annotation information, and the annotation information is added, deleted or unchanged, so that based on the updated annotation graph, the instant vulnerability assessment result of the updated source code is determined, which effectively improves the accuracy of the instant vulnerability assessment and further maintains the security of the information system. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 This is one of the flow charts of an information security vulnerability assessment method provided by the present invention; Figure 2 This is the second flow chart of an information security vulnerability assessment method provided by the present invention; Figure 3 It is a structural schematic diagram of an information security vulnerability assessment device provided by the present invention; Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Figure 1 It is a flowchart of an information security vulnerability assessment method provided by the present invention, such as Figure 1 As shown, the method includes: Step 110, based on the updated source code submitted by the developer for the version update, determine the original source code before the version update corresponding to the updated source code; Step 120, constructing a code analysis graph of the updated source code and the original source code; wherein the nodes in the code analysis graph of the updated source code or the original source code represent the nodes in the abstract syntax tree of the corresponding source code, and the edges represent the relationship between the nodes; Step 130, merging the code analysis graphs of the updated source code and the original source code to obtain an updated annotation graph; wherein the nodes in the updated annotation graph are the node union of the code analysis graphs of the updated source code and the original source code, and the edges in the updated annotation graph are the edge union of the code analysis graphs of the updated source code and the original source code; each node in the updated annotation graph also has annotation information, and the annotation information is added, deleted, or unchanged; Step 140: Determine a real-time vulnerability assessment result of the updated source code based on the update annotation graph.

[0022] Specifically, the overall idea of ​​the embodiment of the present invention is that the way in which the currently submitted source code introduces new vulnerabilities includes that the changed part of the code itself has a vulnerability, or that after the currently submitted source code is merged into the system source code, the changed part of the code interacts with the unchanged part of the code to cause a vulnerability. Therefore, for the source code submitted by the developer for the version update, the part that is changed relative to the original code before the update is the direct determining factor for evaluating whether the currently submitted source code will introduce a vulnerability.

[0023] Therefore, for the updated source code submitted by the developer for version update, the corresponding original source code before the version update can be determined for code comparison, thereby determining the code snippets of the changed part and the code snippets of the unchanged part.

[0024] To accurately capture the semantics of the code snippets in the changed part, in addition to the code snippets in the changed part, it is also necessary to extract the semantics of the code snippets in the unchanged part, because the code snippets in the unchanged part can connect the relevant code snippets in the changed part and help understand the code snippets in the changed part as a whole. In addition, once the statements in the changed part are merged into the system source code, they interact with the statements in the unchanged part through certain code relationships (such as control / data dependencies) to modify the program behavior. Therefore, accurately distinguishing similar statements in the changed part may require the assistance of their association relationships with the statements in the unchanged part. Among them, the association relationships include the structural relationships and dependency relationships between code snippets, and these structural relationships and dependency relationships can provide rich information for determining the security of the code snippets in the changed part and help improve the accuracy of vulnerability assessment.

[0025] Therefore, to facilitate the extraction of the semantics of the code snippets in the changed part, the semantics of the code snippets in the unchanged part, and the different types of association relationships between the code snippets in the changed part and the code snippets in the unchanged part, a code analysis graph of the updated source code and the original source code can be constructed. Among them, the nodes in the code analysis graph of any source code represent the nodes in the abstract syntax tree of that source code, where the leaf nodes are the code snippets (codetokens) in that source code, and the non-leaf nodes are abstract syntax code elements, such as statements, predicate expressions, assignments, or function calls, etc.; the edges in the code analysis graph of any source code represent the relationships between nodes. In some embodiments, the relationships between nodes include structural relationships (the structural relationship is the organizational relationship between AST nodes based on the syntax structure. For example, for the code segment "len<BUF_SIZE", the relationship between len and < and the relationship between < and BUF_SIZE are structural relationships) and dependency relationships (the dependency relationship is the functional association between AST nodes based on semantics. For example, the relationship between DECL and CALL, and the relationship between PRED and CALL are dependency relationships). It should be noted that the edges of the dependency relationship category connect the nodes corresponding to statements or predicate expressions, and each node corresponding to a statement and a predicate expression contains several descendant nodes connected by edges of the structural relationship category. In some embodiments, the code analysis graph can be obtained based on a code analysis tool (such as Joern).

[0026] Subsequently, the code analysis graphs of the updated source code and the original source code are merged to obtain an updated annotation graph. The nodes in the updated annotation graph are the node union of the code analysis graphs of the updated source code and the original source code, and the edges in the updated annotation graph are the edge union of the code analysis graphs of the updated source code and the original source code. In addition, each node of the updated annotation graph also has corresponding annotation information, and the annotation information is added, deleted, and unchanged. It can be seen that the updated annotation graph provides semantic information including the semantics of the code snippets of the changed part, the semantics of the code snippets of the unchanged part, and the different types of associations between the code snippets of the changed part and the code snippets of the unchanged part. In some embodiments, when adding annotation information to each node of the updated annotation graph, the following rules can be used: If any node belongs to the code analysis graph of the updated source code and does not belong to the code analysis graph of the original source code, the annotation information of the any node is added; If any node belongs to the code analysis graph of the original source code and does not belong to the code analysis graph of the updated source code, the annotation information of the any node is deleted; Otherwise, the label information of any node is unchanged.

[0027] However, theoretically, when the submitted source code is long, the corresponding update annotation graph may be very large and contain many unchanged nodes / edges. These irrelevant parts may be unnecessary for extracting the semantics of the code change part and may also generate noise that is not conducive to understanding the semantics of the code change part. Therefore, in some embodiments, Figure 2 As shown, in order to improve the accuracy of vulnerability assessment, the following method can be used to prune the update annotation graph and then perform instant vulnerability assessment: Step 210, determining the key nodes and non-key nodes related to the code change in the update annotation graph; Step 220, deleting non-key nodes in the update annotation graph and edges connecting the non-key nodes to obtain a simplified update annotation graph; Step 230: Determine an instant vulnerability assessment result of the updated source code based on the simplified update annotation graph.

[0028] Specifically, the key nodes related to the code changes and the non-key nodes not related to the code changes can be screened out from the update annotation graph. Subsequently, the non-key nodes in the update annotation graph and the edges connecting the corresponding non-key nodes are deleted to obtain a simplified update annotation graph, and then the instant vulnerability assessment results of the updated source code are determined based on the simplified update annotation graph.

[0029] In some embodiments, if any node satisfies any of the following conditions, the node is determined to be a key node related to the code change: From this node to the node with the annotation information of addition or deletion, there is a path consisting only of edges corresponding to the structural relationship; From this node to any key node or from any key node to this node, there is a path consisting only of edges corresponding to dependency relationships; From any key node to this node, there is a path consisting only of edges corresponding to structural relations.

[0030] After the key nodes are determined, the nodes other than the key nodes in the labeled graph are updated as non-key nodes.

[0031] After obtaining the simplified update annotation graph, it is necessary to capture the semantic information contained in the simplified update annotation graph, which not only needs to consider the content of the nodes, but also the relationship between them. Therefore, a relational graph neural network can be used to analyze and extract features from the simplified update annotation graph. First, based on the embedding network (such as Word2vec), the semantic features of each node are extracted according to the token corresponding to each node to obtain the node embedding vector of each node. Subsequently, the annotation information corresponding to each node is fused into the node embedding vector of each node. One way is to obtain the unique hot vector of the corresponding annotation information and splice it to the node embedding vector of the node to obtain the annotation fusion vector of the corresponding node. In other ways, for any node, based on the annotation information corresponding to the node, the child nodes of the node whose annotation information is the same as the annotation information of the node can be determined as the nodes to be fused, and the categories of the edges (structural relationship or dependency relationship) passed on the path from the node to each node to be fused can be determined as the edges to be fused, so as to fuse the node embedding vector of the node and the unique hot vector of its annotation information, the node embedding vector of each node to be fused and the unique hot vector of the annotation information of the corresponding node, and the categories of each edge to be fused (for example, 0 and 1 can be used to represent the structural relationship and the dependency relationship respectively) to obtain the labeled fusion vector of the node. By fusing the node embedding vector and annotation information of the node, the node embedding vector of each node to be fused and the annotation information of the corresponding node, and the categories of each edge to be fused, the semantic information of each node itself, the semantic information of the nodes closely related to the node, and the relationship category between the node and other closely connected nodes can be more comprehensively obtained, so as to help the subsequent relationship graph neural network to more accurately understand the interaction between each node and other nodes under different relationships and extract more complete and accurate graph semantics. Subsequently, the labeled fusion vectors of each node are input into the relational graph neural network for analysis.

[0032] Among them, each layer of the relationship graph neural network calculates the vector representation of each node through the message passing mechanism, where each node collects features from its neighbor nodes under each relationship (structural relationship and dependency relationship) to represent the local graph structure relationship. Finally, the last layer of the relationship graph neural network can construct a graph-level vector representation of the entire graph by aggregating the features of all nodes to obtain the graph vector representation of the simplified updated annotation graph. Subsequently, the graph vector representation of the simplified updated annotation graph is passed to the multi-layer perceptron (MLP) for classification to determine whether the simplified updated annotation graph will introduce new vulnerabilities, thereby obtaining an instant vulnerability assessment result for the updated source code.

[0033] In summary, the method provided by the embodiment of the present invention determines the original source code before the version update corresponding to the updated source code submitted by the developer for version update, and then constructs a code analysis graph of the updated source code and the original source code; wherein the nodes in the code analysis graph of the updated source code or the original source code represent the nodes in the abstract syntax tree of the corresponding source code, and the edges represent the relationship between the nodes; the code analysis graphs of the updated source code and the original source code are merged to obtain an updated annotation graph; wherein the nodes in the updated annotation graph are the node union of the code analysis graphs of the updated source code and the original source code, and the edges in the updated annotation graph are the edge union of the code analysis graphs of the updated source code and the original source code; each node of the updated annotation graph also has annotation information, and the annotation information is added, deleted or unchanged, so that based on the updated annotation graph, the instant vulnerability assessment result of the updated source code is determined, which effectively improves the accuracy of the instant vulnerability assessment and further maintains the security of the information system.

[0034] An information security vulnerability assessment device provided by the present invention is described below. The information security vulnerability assessment device described below and the information security vulnerability assessment method described above can be referenced to each other.

[0035] Based on any of the above embodiments, Figure 3 is a schematic diagram of the structure of an information security vulnerability assessment device provided by the present invention, such as Figure 3 As shown, the device comprises: A source code determining unit 310 is used to determine the original source code before the version update corresponding to the updated source code submitted by the developer for the version update; A code analysis graph construction unit 320 is used to construct a code analysis graph of the updated source code and the original source code; wherein the nodes in the code analysis graph of the updated source code or the original source code represent the nodes in the abstract syntax tree of the corresponding source code, and the edges represent the relationship between the nodes; The update annotation graph construction unit 330 is used to merge the code analysis graphs of the update source code and the original source code to obtain an update annotation graph; wherein the nodes in the update annotation graph are the node union of the code analysis graphs of the update source code and the original source code, and the edges in the update annotation graph are the edge union of the code analysis graphs of the update source code and the original source code; each node of the update annotation graph also has annotation information, and the annotation information is added, deleted, or unchanged; The real-time vulnerability assessment unit 340 is used to determine the real-time vulnerability assessment result of the updated source code based on the update annotation graph.

[0036] The device provided by the embodiment of the present invention determines the original source code before the version update corresponding to the updated source code submitted by the developer for version update, and then constructs a code analysis graph of the updated source code and the original source code; wherein the nodes in the code analysis graph of the updated source code or the original source code represent the nodes in the abstract syntax tree of the corresponding source code, and the edges represent the relationship between the nodes; the code analysis graphs of the updated source code and the original source code are merged to obtain an updated annotation graph; wherein the nodes in the updated annotation graph are the node union of the code analysis graphs of the updated source code and the original source code, and the edges in the updated annotation graph are the edge union of the code analysis graphs of the updated source code and the original source code; each node of the updated annotation graph also has annotation information, and the annotation information is added, deleted or unchanged, so that based on the updated annotation graph, the instant vulnerability assessment result of the updated source code is determined, which effectively improves the accuracy of the instant vulnerability assessment and further maintains the security of the information system.

[0037] Based on any of the above embodiments, the edges in the code analysis graph of the updated source code or the original source code represent structural relationships or dependency relationships between nodes.

[0038] Based on any of the above embodiments, the updating of the labeling information of each node of the labeling graph is determined based on the following rules: If any node belongs to the code analysis graph of the updated source code and does not belong to the code analysis graph of the original source code, the annotation information of the any node is added; If any node belongs to the code analysis graph of the original source code and does not belong to the code analysis graph of the updated source code, the annotation information of the any node is deleted; Otherwise, the label information of any node is unchanged.

[0039] Based on any of the above embodiments, determining the instant vulnerability assessment result of the updated source code based on the update annotation graph includes: Determine key nodes and non-key nodes related to code changes in the update annotation graph; Deleting non-critical nodes and edges connecting the non-critical nodes in the update annotation graph to obtain a simplified update annotation graph; Based on the simplified update annotation graph, an immediate vulnerability assessment result of the updated source code is determined.

[0040] Based on any of the above embodiments, determining the key nodes and non-key nodes related to the code change in the update annotation graph includes: If any node meets any of the following conditions, the node is determined to be a key node related to the code change: From any of the nodes to the node with the annotation information of addition or deletion, there exists a path consisting only of edges corresponding to the structural relationship; From any of the nodes to any of the key nodes or from any of the key nodes to any of the nodes, there exists a path consisting only of edges corresponding to dependency relationships; From any key node to any of the nodes, there exists a path consisting only of edges corresponding to structural relationships.

[0041] Based on any of the above embodiments, determining the instant vulnerability assessment result of the updated source code based on the simplified update annotation graph includes: Performing feature extraction on the simplified updated annotation graph based on a relational graph neural network to obtain a graph vector representation of the simplified updated annotation graph; The graph vector representation of the simplified update annotation graph is classified based on a multi-layer perceptron to determine an immediate vulnerability assessment result of the updated source code.

[0042] Based on any of the above embodiments, the feature extraction of the simplified updated annotation graph based on the relationship graph neural network to obtain the graph vector representation of the simplified updated annotation graph includes: Determining a node embedding vector of each node in the simplified updated annotation graph based on the embedding network; Fusing the node embedding vector of each node in the simplified updated annotation graph with the one-hot vector of the annotation information of the corresponding node to obtain the annotation fusion vector of each node; Based on a relational graph neural network, feature extraction is performed on the annotation fusion vector of each node in the simplified updated annotation graph to obtain a graph vector representation of the simplified updated annotation graph.

[0043] Figure 4 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 4As shown, the electronic device may include: a processor (processor) 410, a memory (memory) 420, a communication interface (Communications Interface) 430 and a communication bus 440, wherein the processor 410, the memory 420, and the communication interface 430 communicate with each other through the communication bus 440. The processor 410 can call the logic instructions in the memory 420 to execute an information security vulnerability assessment method, which includes: based on the updated source code submitted by the developer for version update, determining the original source code before the corresponding version update; constructing a code analysis graph of the updated source code and the original source code; wherein the nodes in the code analysis graph of the updated source code or the original source code represent the nodes in the abstract syntax tree of the corresponding source code, and the edges represent the relationship between the nodes; the code analysis graphs of the updated source code and the original source code are merged to obtain an updated annotation graph; wherein the nodes in the updated annotation graph are the node union of the code analysis graphs of the updated source code and the original source code, and the edges in the updated annotation graph are the edge union of the code analysis graphs of the updated source code and the original source code; each node of the updated annotation graph also has annotation information, and the annotation information is added, deleted or unchanged; based on the updated annotation graph, determining the instant vulnerability assessment result of the updated source code.

[0044] In addition, the logic instructions in the above-mentioned memory 420 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0045] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute an information security vulnerability assessment method provided by the above methods, the method comprising: based on the updated source code submitted by the developer for version update, determining the original source code before the corresponding version update; constructing a code analysis graph of the updated source code and the original source code; wherein the nodes in the code analysis graph of the updated source code or the original source code represent the nodes in the abstract syntax tree of the corresponding source code, and the edges represent the relationship between the nodes; the code analysis graphs of the updated source code and the original source code are merged to obtain an updated annotation graph; wherein the nodes in the updated annotation graph are the node union of the code analysis graphs of the updated source code and the original source code, and the edges in the updated annotation graph are the edge union of the code analysis graphs of the updated source code and the original source code; each node of the updated annotation graph also has annotation information, and the annotation information is added, deleted or unchanged; based on the updated annotation graph, determining the instant vulnerability assessment result of the updated source code.

[0046] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when a processor executes an information security vulnerability assessment method provided above, the method comprising: determining the original source code before the version update corresponding to the updated source code submitted by the developer for version update; constructing a code analysis graph of the updated source code and the original source code; wherein the nodes in the code analysis graph of the updated source code or the original source code represent the nodes in the abstract syntax tree of the corresponding source code, and the edges represent the relationship between the nodes; merging the code analysis graphs of the updated source code and the original source code to obtain an updated annotation graph; wherein the nodes in the updated annotation graph are the node union of the code analysis graphs of the updated source code and the original source code, and the edges in the updated annotation graph are the edge union of the code analysis graphs of the updated source code and the original source code; each node of the updated annotation graph also has annotation information, and the annotation information is added, deleted or unchanged; based on the updated annotation graph, determining the instant vulnerability assessment result of the updated source code.

[0047] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0048] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0049] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for assessing information security vulnerabilities, characterized in that: include: Based on the updated source code submitted by the developer for the version update, determine the original source code corresponding to the version before the update; Constructing a code analysis graph of the updated source code and the original source code; wherein the nodes in the code analysis graph of the updated source code or the original source code represent the nodes in the abstract syntax tree of the corresponding source code, and the edges represent the relationships between the nodes; The code analysis graphs of the updated source code and the original source code are merged to obtain an updated annotation graph; wherein the nodes in the updated annotation graph are the node union of the code analysis graphs of the updated source code and the original source code, and the edges in the updated annotation graph are the edge union of the code analysis graphs of the updated source code and the original source code; each node of the updated annotation graph also has annotation information, and the annotation information is added, deleted, or unchanged; Based on the update annotation graph, an immediate vulnerability assessment result of the updated source code is determined.

2. The information security vulnerability assessment method according to claim 1, characterized in that: The edges in the code analysis graph of the updated source code or the original source code represent structural relationships or dependency relationships between nodes.

3. The information security vulnerability assessment method according to claim 1 or 2, characterized in that: The updating of the annotation information of each node of the annotation graph is determined based on the following rules: If any node belongs to the code analysis graph of the updated source code and does not belong to the code analysis graph of the original source code, the annotation information of the any node is added; If any node belongs to the code analysis graph of the original source code and does not belong to the code analysis graph of the updated source code, the annotation information of the any node is deleted; Otherwise, the label information of any node is unchanged.

4. The information security vulnerability assessment method according to claim 2, characterized in that: The step of determining the instant vulnerability assessment result of the updated source code based on the updated annotation graph includes: Determine key nodes and non-key nodes related to code changes in the update annotation graph; Deleting non-critical nodes and edges connecting the non-critical nodes in the update annotation graph to obtain a simplified update annotation graph; Based on the simplified update annotation graph, an immediate vulnerability assessment result of the updated source code is determined.

5. The information security vulnerability assessment method according to claim 4, characterized in that: Determining the key nodes and non-key nodes related to the code change in the update annotation graph includes: If any node meets any of the following conditions, the node is determined to be a key node related to the code change: From any of the nodes to the node with the annotation information of addition or deletion, there exists a path consisting only of edges corresponding to the structural relationship; From any of the nodes to any of the key nodes or from any of the key nodes to any of the nodes, there exists a path consisting only of edges corresponding to dependency relationships; From any key node to any of the nodes, there exists a path consisting only of edges corresponding to structural relationships.

6. The information security vulnerability assessment method according to claim 4, characterized in that: The step of determining the instant vulnerability assessment result of the updated source code based on the simplified update annotation graph includes: Performing feature extraction on the simplified updated annotation graph based on a relational graph neural network to obtain a graph vector representation of the simplified updated annotation graph; The graph vector representation of the simplified update annotation graph is classified based on a multi-layer perceptron to determine an immediate vulnerability assessment result of the updated source code.

7. The information security vulnerability assessment method according to claim 6, characterized in that: The extracting features of the simplified updated annotation graph based on the relationship graph neural network to obtain a graph vector representation of the simplified updated annotation graph includes: Determining a node embedding vector of each node in the simplified updated annotation graph based on the embedding network; Fusing the node embedding vector of each node in the simplified updated annotation graph with the one-hot vector of the annotation information of the corresponding node to obtain the annotation fusion vector of each node; Based on a relational graph neural network, feature extraction is performed on the annotation fusion vector of each node in the simplified updated annotation graph to obtain a graph vector representation of the simplified updated annotation graph.

8. An information security vulnerability assessment system, characterized in that: include: A source code determination unit, used to determine the original source code before the version update corresponding to the updated source code for version update submitted by the developer; A code analysis graph construction unit, configured to construct a code analysis graph of the updated source code and the original source code; wherein the nodes in the code analysis graph of the updated source code or the original source code represent the nodes in the abstract syntax tree of the corresponding source code, and the edges represent the relationships between the nodes; an update annotation graph construction unit, configured to merge the code analysis graphs of the update source code and the original source code to obtain an update annotation graph; wherein the nodes in the update annotation graph are the node union of the code analysis graphs of the update source code and the original source code, and the edges in the update annotation graph are the edge union of the code analysis graphs of the update source code and the original source code; each node of the update annotation graph also has annotation information, and the annotation information is added, deleted, or unchanged; The real-time vulnerability assessment unit is used to determine the real-time vulnerability assessment result of the updated source code based on the update annotation graph.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, an information security vulnerability assessment method as described in any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, an information security vulnerability assessment method as described in any one of claims 1 to 7 is implemented.

Images