System and method for automatically repairing vulnerabilities of source codes

Abstract

The invention relates to the technical field of vulnerability repair, and discloses an automatic source code vulnerability repair system and method.The method comprises the steps that grammatical analysis, dependency analysis and graph integration are conducted on pre-obtained source codes, and an integrated code graph is obtained; performing static vulnerability analysis on the source code by utilizing the integrated code graph to obtain a static code vulnerability; performing instrumentation compiling on the source code to obtain an instrumentation execution program, and performing seed screening and seed variation on the instrumentation execution program to obtain a variation seed set; performing coverage rate updating on the variation seed set by utilizing an instrumentation execution program to obtain an updated seed set, and performing dynamic vulnerability analysis on the source code by utilizing the updated seed set to obtain a dynamic code vulnerability; and performing vulnerability labeling on the source code according to the static code vulnerability and the dynamic code vulnerability to obtain a labeled vulnerability code, and performing vulnerability semantic extraction and vulnerability repair on the labeled vulnerability code according to the integrated code graph to obtain a repaired source code. According to the invention, the vulnerability repairing accuracy can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability repair, and in particular to a system and method for automatically repairing source code vulnerabilities. Background Art

[0002] Security vulnerabilities in the source code may be exploited by attackers, causing the system to suffer data leakage, system crash, denial of service attacks, etc. In order to identify vulnerabilities in the source code and fix these potential security risks and prevent malicious attacks, it is necessary to fix the vulnerabilities in the source code.

[0003] Most of the existing vulnerability repair methods are based on simple static analysis, that is, they rely on simple static analysis or predefined repair rules to detect and repair vulnerabilities in the source code, such as detecting misspelled function names in the code and repairing them. However, in actual application, the repair methods based on simple static analysis lack a deep understanding of the code semantics and ignore the global context dependencies of the code, which leads to low accuracy in vulnerability repair. Summary of the invention

[0004] The present invention provides a source code vulnerability automatic repair system and method, the main purpose of which is to solve the problem of low accuracy when performing vulnerability repair.

[0005] To achieve the above-mentioned purpose, the present invention provides a source code vulnerability automatic repair system, which includes a dependency analysis module, a static test module, a seed mutation module, a dynamic test module and a code repair module, wherein:

[0006] The dependency analysis module is used to perform syntax analysis and dependency analysis on the pre-acquired source code to obtain an abstract syntax graph and an abstract dependency graph;

[0007] The static test module is used to perform graph integration on the abstract syntax graph and the abstract dependency graph to obtain an integrated code graph, and use the integrated code graph to perform static vulnerability analysis on the source code to obtain static code vulnerabilities. When the static test module uses the integrated code graph to perform static vulnerability analysis on the source code to obtain static code vulnerabilities, the static test module includes: selecting nodes in the integrated code graph one by one as target integration nodes, and using neighboring nodes of the target integration nodes in the integrated code graph as target neighboring nodes; and performing iterative message transmission on the target integration node using the following message transmission formula and the target neighboring nodes to obtain node message features:

[0008]

[0009]

[0010] in, refers to the node message feature obtained by the target integration node v at the lth iteration, v refers to the target integration node, l is the iteration number index, u refers to the target neighborhood node, N(v) refers to the neighborhood of the target integration node v, exp is the exponential function symbol, σ is the activation function symbol, and a u,v is the attention vector between the target integration node v and the target neighborhood node u, T is the transposition symbol, It refers to the weight matrix of the target neighborhood node u at the lth iteration, It refers to the node feature of the target neighborhood node u at the l-1th iteration, is the vector splicing symbol, refers to the weight matrix of the target integration node v at the lth iteration, refers to the node feature of the target integration node v at the l-1th iteration, It refers to the weight matrix of the edge between the target integration node v and the target neighborhood node u at the lth iteration, e u,v refers to the feature vector corresponding to the edge between the target integration node v and the target neighborhood node u, b l refers to the bias coefficient at the lth iteration, k is the neighboring node in the neighborhood of the target integration node v, a k,v is the attention vector between the target integration node v and the neighborhood node k, refers to the weight matrix of the neighborhood node k at the lth iteration, refers to the node feature of the neighborhood node k at the l-1th iteration, refers to the weight matrix of the edge between the target integration node v and the neighboring node k at the lth iteration, e k,v It refers to the eigenvector corresponding to the edge between the target integration node v and the neighborhood node k, tanh is the symbol of the hyperbolic tangent function, It refers to the node features of the target integration node v at the lth iteration; performing multi-layer perceptron classification on the node message features to obtain node vulnerability features; performing feature activation on the node vulnerability features to obtain node vulnerability types; extracting static vulnerability types from the node vulnerability types of all target integration nodes in the integration code graph; extracting static vulnerability codes from the source code using the static vulnerability types, and generating static code vulnerabilities according to the static vulnerability codes and the static vulnerability types;

[0011] The seed mutation module is used to perform plug-in compilation on the source code to obtain a plug-in execution program, and perform seed screening and seed mutation on the plug-in execution program to obtain a mutation seed set;

[0012] The dynamic testing module is used to update the coverage of the variant seed set by using the plug-in execution program to obtain an updated seed set, and to perform dynamic vulnerability analysis on the source code by using the updated seed set to obtain dynamic code vulnerabilities;

[0013] The code repair module is used to mark the source code for vulnerabilities according to the static code vulnerabilities and the dynamic code vulnerabilities to obtain marked vulnerability codes, and to perform vulnerability semantic extraction and vulnerability repair on the marked vulnerability codes according to the integrated code graph to obtain repaired source code.

[0014] Optionally, when the dependency analysis module performs syntax analysis and dependency analysis on the pre-acquired source code respectively to obtain an abstract syntax graph and an abstract dependency graph, the dependency analysis module includes:

[0015] Perform lexical decomposition on the pre-acquired source code to obtain a code word unit set;

[0016] Performing grammatical analysis on the code word unit set to obtain a code syntax tree;

[0017] Performing graph conversion on the code syntax tree to obtain an abstract syntax graph;

[0018] Extracting a module unit set from the source code according to the code syntax tree;

[0019] Performing dependency analysis on the module unit set to obtain a module dependency edge set;

[0020] The module dependency edge set is used to construct a graph of the module unit set to obtain an abstract dependency graph.

[0021] Optionally, when the static test module performs graph integration on the abstract syntax graph and the abstract dependency graph to obtain an integrated code graph, the static test module includes:

[0022] Decomposing the abstract syntax graph to obtain a syntax node set and a syntax edge set;

[0023] Decomposing the abstract dependency graph to obtain a module dependency edge set and a module unit set;

[0024] The node distances between each grammar node in the grammar node set and each module unit in the module unit set are calculated using the following node clustering algorithm:

[0025]

[0026] Among them, D x,yIt refers to the node distance between the syntax node x in the syntax node set and the module unit y in the module unit set, exp is the exponential function symbol, · is the inner product symbol, || is the modulus symbol, x is the syntax node in the syntax node set, y refers to the module unit in the module unit set, k, θ, j are preset distance coefficients, α, β are preset weight coefficients, T is the transposition symbol, γ() is the covariance matrix operator, λ is the preset regularization coefficient, and I is the unit matrix;

[0027] Performing node clustering on the grammar node set and the module unit set according to the node distance to obtain a cluster node set;

[0028] Merging nodes of each clustering node class in the clustering node class set to obtain a merged node set;

[0029] Merge the grammatical edge set and the module dependency edge set according to the merged node set to obtain a merged edge set;

[0030] The merged edge set is used to construct a graph for the merged node set to obtain an integrated code graph.

[0031] Optionally, when the seed mutation module performs stub compilation on the source code to obtain the stub execution program, it includes:

[0032] Performing function stubbing on the source code to obtain function stubbing source code;

[0033] Perform branch stubbing on the function stubbing source code to obtain a branch stubbing source code;

[0034] Performing basic block plugging on the branch plugging source code to obtain a basic block plugging source code;

[0035] The basic block plug-in source code is compiled to obtain a plug-in execution program.

[0036] Optionally, when the seed mutation module performs seed screening and seed mutation on the instrumented execution program to obtain a mutation seed set, the seed mutation module includes:

[0037] Performing input detection on the instrumented execution program to obtain a seed input rule;

[0038] Perform seed screening on the plug-in execution program according to the seed input rule to obtain a screening trigger seed;

[0039] Performing bit flipping on the screening trigger seed to obtain a flipped variant seed;

[0040] Performing byte mutation on the screening trigger seed to obtain a byte mutation seed;

[0041] Performing random insertion mutation and random deletion mutation on the screening trigger seed respectively to obtain an insertion mutation seed and a deletion mutation seed;

[0042] A mutation seed set is generated according to the screening trigger seed, the flip mutation seed, the byte mutation seed, the insertion mutation seed and the deletion mutation seed.

[0043] Optionally, when the dynamic test module updates the coverage of the variant seed set by using the instrumentation execution program to obtain the updated seed set, the following steps are included:

[0044] Using the mutation seed set to trigger execution of the instrumentation execution program, to obtain a seed execution result set;

[0045] Performing instrumentation analysis on the seed execution result set to obtain an instrumentation execution result set;

[0046] Perform vulnerability screening on the instrumentation execution result set to obtain a vulnerability execution result set;

[0047] Gather the mutation seeds corresponding to the vulnerability execution result set in the mutation seed set into a vulnerability seed set;

[0048] Performing coverage statistics on the instrumentation execution result set to obtain an execution coverage set;

[0049] According to the execution coverage set and the vulnerability seed set, mutation weights are assigned to the mutation seed set to obtain a mutation weight set;

[0050] The mutation seed set is subjected to weighted mutation according to the mutation weight set to obtain an updated seed set.

[0051] Optionally, when the dynamic testing module performs dynamic vulnerability analysis on the source code using the update seed set to obtain dynamic code vulnerabilities, the dynamic testing module includes:

[0052] Compiling the source code to obtain a compiled execution program;

[0053] Using the update seed set to trigger the compilation execution program to obtain a trigger execution result set;

[0054] Perform vulnerability screening on the trigger execution result to obtain a dynamic vulnerability result set;

[0055] Using the dynamic vulnerability result set to locate the vulnerability of the source code, and obtain dynamic vulnerability code;

[0056] A dynamic vulnerability type is extracted from the dynamic vulnerability result set, and a dynamic code vulnerability is generated according to the dynamic vulnerability code and the dynamic vulnerability type.

[0057] Optionally, when the code repair module performs vulnerability semantic extraction and vulnerability repair on the annotated vulnerability code according to the integrated code graph to obtain the repair source code, it includes:

[0058] Using the vulnerability-marking code to mark vulnerabilities in the integrated code graph, to obtain a marked code graph;

[0059] Performing vector encoding on the annotation code graph to obtain annotation code features;

[0060] Performing self-attention encoding on the annotated code features to obtain attention code semantics;

[0061] Performing a multi-level feedforward operation on the attention code semantics to obtain a feedforward code feature;

[0062] Performing residual connection on the feedforward code features to obtain residual code features;

[0063] Performing feature normalization and feature activation operations on the residual code features to obtain a code patch;

[0064] The code patch is used to repair the vulnerability of the marked vulnerability code to obtain a repair source code.

[0065] Optionally, when the code repair module performs vulnerability marking on the source code according to the static code vulnerability and the dynamic code vulnerability to obtain the marked vulnerability code, it includes:

[0066] Extracting static vulnerability codes and static vulnerability types from the static code vulnerabilities;

[0067] Extracting a dynamic vulnerability code and the dynamic vulnerability type from the dynamic code vulnerability;

[0068] Using the static vulnerability type, annotating a portion of code corresponding to the static vulnerability code in the source code with a vulnerability type, to obtain a primary annotated vulnerability code;

[0069] The dynamic vulnerability type is used to mark the vulnerability type of a portion of code corresponding to the dynamic vulnerability code in the source code to obtain a marked vulnerability code.

[0070] In order to solve the above problems, the present invention also provides a method for automatically repairing source code vulnerabilities, the method comprising:

[0071] Performing syntax analysis and dependency analysis on the pre-acquired source code respectively to obtain an abstract syntax graph and an abstract dependency graph;

[0072] The abstract syntax graph and the abstract dependency graph are graph-integrated to obtain an integrated code graph, and the integrated code graph is used to perform static vulnerability analysis on the source code to obtain static code vulnerabilities, wherein the use of the integrated code graph to perform static vulnerability analysis on the source code to obtain static code vulnerabilities includes: selecting nodes in the integrated code graph one by one as target integration nodes, and using neighboring nodes of the target integration nodes in the integrated code graph as target neighboring nodes; using the following message passing formula and the target neighboring nodes to iteratively pass messages to the target integration node to obtain node message features:

[0073]

[0074]

[0075] in, refers to the node message feature obtained by the target integration node v at the lth iteration, v refers to the target integration node, l is the iteration number index, u refers to the target neighborhood node, N(v) refers to the neighborhood of the target integration node v, exp is the exponential function symbol, σ is the activation function symbol, and a u,v is the attention vector between the target integration node v and the target neighborhood node u, T is the transposition symbol, It refers to the weight matrix of the target neighborhood node u at the lth iteration, It refers to the node feature of the target neighborhood node u at the l-1th iteration, is the vector splicing symbol, refers to the weight matrix of the target integration node v at the lth iteration, refers to the node feature of the target integration node v at the l-1th iteration, It refers to the weight matrix of the edge between the target integration node v and the target neighborhood node u at the lth iteration, e u,v refers to the feature vector corresponding to the edge between the target integration node v and the target neighborhood node u, b l refers to the bias coefficient at the lth iteration, k is the neighboring node in the neighborhood of the target integration node v, a k,v is the attention vector between the target integration node v and the neighborhood node k, refers to the weight matrix of the neighborhood node k at the lth iteration, refers to the node feature of the neighborhood node k at the l-1th iteration, refers to the weight matrix of the edge between the target integration node v and the neighboring node k at the lth iteration, e k,vIt refers to the eigenvector corresponding to the edge between the target integration node v and the neighborhood node k, tanh is the symbol of the hyperbolic tangent function, It refers to the node features of the target integration node v at the lth iteration; performing multi-layer perceptron classification on the node message features to obtain node vulnerability features; performing feature activation on the node vulnerability features to obtain node vulnerability types; extracting static vulnerability types from the node vulnerability types of all target integration nodes in the integration code graph; extracting static vulnerability codes from the source code using the static vulnerability types, and generating static code vulnerabilities according to the static vulnerability codes and the static vulnerability types;

[0076] Performing stub compilation on the source code to obtain an stub execution program, and performing seed screening and seed mutation on the stub execution program to obtain a mutation seed set;

[0077] Using the stub execution program to update the coverage of the variant seed set to obtain an updated seed set, and using the updated seed set to perform dynamic vulnerability analysis on the source code to obtain dynamic code vulnerabilities;

[0078] Vulnerabilities are annotated on the source code according to the static code vulnerabilities and the dynamic code vulnerabilities to obtain annotated vulnerability code, and vulnerability semantics are extracted and vulnerabilities are repaired on the annotated vulnerability code according to the integrated code graph to obtain repaired source code.

[0079] The embodiments of the present invention can conveniently connect the code structure and dependency relationships of the source code by performing syntax analysis and dependency analysis on the source code, thereby improving the recognition rate of vulnerability detection; by performing graph integration, the syntax structure and dependency relationships of the source code can be integrated into a graph structure, thereby facilitating the use of graph neural network methods for static vulnerability analysis, retaining the global characteristics of the source code, thereby improving the accuracy of static vulnerability analysis; by performing stub compilation, points for recording call information can be inserted into the source code, thereby facilitating subsequent coverage updates and fine-grained updates; by performing seed screening and seed mutation, a sufficient number and type of seeds can be generated, thereby facilitating obtaining a larger range of dynamic code vulnerabilities in subsequent dynamic vulnerability analysis.

[0080] By updating the coverage, the coverage of dynamic testing can be improved and more comprehensive fuzz testing can be achieved. By performing dynamic vulnerability analysis, the source code can be actually executed to verify its behavior, function and performance, thereby discovering potential defects and problems and improving the comprehensiveness of vulnerability detection. By annotating vulnerabilities, the semantics of code vulnerabilities can be understood more conveniently. By extracting and repairing vulnerabilities, deep learning methods can be used to combine vulnerability semantics and the overall dependency structure of the code for vulnerability repair, thereby improving the readability of the repaired code and the completeness of the code, thereby improving the accuracy of vulnerability repair. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] Figure 1 A functional module diagram of a source code vulnerability automatic repair system provided by an embodiment of the present invention;

[0082] Figure 2 A flowchart of performing static vulnerability analysis provided by an embodiment of the present invention;

[0083] Figure 3 A flow chart of performing dynamic vulnerability analysis provided by an embodiment of the present invention;

[0084] Figure 4 A schematic diagram of a flow chart of a method for automatically repairing source code vulnerabilities provided by an embodiment of the present invention;

[0085] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings in conjunction with the embodiments. DETAILED DESCRIPTION

[0086] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0087] The embodiment of the present application provides a system for automatically repairing vulnerabilities in source code. The execution subject of the system for automatically repairing vulnerabilities in source code includes but is not limited to at least one of the electronic devices such as a server, a terminal, etc. that can be configured to execute the system provided by the embodiment of the present application. In other words, the system for automatically repairing vulnerabilities in source code can be executed by software or hardware installed on a terminal device or a server device. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, etc. The server can be an independent server, or it can be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and big data and artificial intelligence platforms.

[0088] like Figure 1, which is a functional module diagram of a source code vulnerability automatic repair system provided by an embodiment of the present invention.

[0089] The automatic source code vulnerability repair system 100 of the present invention can be installed in an electronic device. According to the functions implemented, the automatic source code vulnerability repair system 100 can include a dependency analysis module 101, a static test module 102, a seed mutation module 103, a dynamic test module 104 and a code repair module 105. The module of the present invention can also be called a unit, which refers to a series of computer program segments that can be executed by an electronic device processor and can complete fixed functions, which are stored in the memory of the electronic device.

[0090] In this embodiment, the functions of each module / unit are as follows:

[0091] The dependency analysis module is used to perform syntax analysis and dependency analysis on the pre-acquired source code to obtain an abstract syntax graph and an abstract dependency graph.

[0092] In detail, the source code refers to the code that needs to be automatically repaired for vulnerabilities, the abstract syntax graph is a graph structure used to represent the syntax structure of the code, and the abstract dependency graph is a graph structure used to represent the sequential relationship and data dependency relationship between codes, wherein the abstract dependency graph includes a control flow graph (Control Flow Graph, abbreviated as CFG), a data flow graph (Data Flow Graph, abbreviated as DFG), a function call graph and a dependency graph.

[0093] In the embodiment of the present invention, when the dependency analysis module performs syntax analysis and dependency analysis on the pre-acquired source code respectively to obtain an abstract syntax graph and an abstract dependency graph, the following steps are performed:

[0094] Perform lexical decomposition on the pre-acquired source code to obtain a code word unit set;

[0095] Performing grammatical analysis on the code word unit set to obtain a code syntax tree;

[0096] Performing graph conversion on the code syntax tree to obtain an abstract syntax graph;

[0097] Extracting a module unit set from the source code according to the code syntax tree;

[0098] Performing dependency analysis on the module unit set to obtain a module dependency edge set;

[0099] The module dependency edge set is used to construct a graph of the module unit set to obtain an abstract dependency graph.

[0100] Specifically, regular expressions or finite state machines (FSM) can be used for lexical decomposition, and recursive descent parsing, LL parser or LR parser can be used for syntax parsing. The code syntax tree is a tree representation of the code syntax structure. Each node in the code syntax tree represents a grammatical structure. For example, the code syntax tree of the code "int a=5;" is "Assignment, Type: int, Variable: a, Value: 5".

[0101] In detail, each code word unit in the code word unit set refers to tokens in the source code, the graph conversion refers to converting the tree-structured code syntax tree into a graph-structured abstract syntax graph, and the graph conversion refers to adding edges to each node of the code syntax tree.

[0102] Specifically, each module unit in the module unit set refers to an entity module unit such as a module, class, function or library in the source code. The module unit set can be obtained by dividing each unit in the code syntax tree into blocks and mapping them in the source code. Dependency analysis can be performed using components such as Frama-C, Joern, Doxygen or Maven DependencyPlugin. Each module dependency edge in the module dependency edge set corresponds to the dependency relationship between each module unit in the module unit set.

[0103] In the embodiment of the present invention, by performing syntax analysis and dependency analysis on the source code, the code structure and dependency relationship of the source code can be easily connected, thereby improving the recognition rate of vulnerability detection.

[0104] The static testing module is used to perform graph integration on the abstract syntax graph and the abstract dependency graph to obtain an integrated code graph, and use the integrated code graph to perform static vulnerability analysis on the source code to obtain static code vulnerabilities.

[0105] In detail, the integrated code graph refers to a knowledge graph integrated by the abstract syntax graph and the abstract dependency graph.

[0106] In the embodiment of the present invention, when the static test module performs graph integration on the abstract syntax graph and the abstract dependency graph to obtain an integrated code graph, the static test module includes:

[0107] Decomposing the abstract syntax graph to obtain a syntax node set and a syntax edge set;

[0108] Decomposing the abstract dependency graph to obtain a module dependency edge set and a module unit set;

[0109] Calculate the node distance between each grammar node in the grammar node set and each module unit in the module unit set;

[0110] Performing node clustering on the grammar node set and the module unit set according to the node distance to obtain a cluster node set;

[0111] Merging nodes of each clustering node class in the clustering node class set to obtain a merged node set;

[0112] Merge the grammatical edge set and the module dependency edge set according to the merged node set to obtain a merged edge set;

[0113] The merged edge set is used to construct a graph for the merged node set to obtain an integrated code graph.

[0114] In detail, each syntax definition in the syntax node set corresponds to a node in the abstract syntax graph, and each syntax edge in the syntax edge set corresponds to an edge in the abstract syntax graph.

[0115] Specifically, the node distance is calculated using the following node clustering algorithm:

[0116]

[0117] Among them, D x,y It refers to the node distance between the syntax node x in the syntax node set and the module unit y in the module unit set, exp is the exponential function symbol, · is the inner product symbol, || is the modulus symbol, x is the syntax node in the syntax node set, y refers to the module unit in the module unit set, k, θ, j are preset distance coefficients, α, β are preset weight coefficients, T is the transposition symbol, γ() is the covariance matrix operator, λ is the preset regularization coefficient, and I is the unit matrix.

[0118] In detail, the node clustering algorithm can be combined with the cosine similarity algorithm and the distance metric, and at the same time introduces the attenuation term and the quadratic distance function, thereby improving the flexibility of node distance calculation and the expression ability when calculating nonlinear relationships.

[0119] Specifically, the node clustering method can be a clustering algorithm based on density clustering or a K-nearest neighbor clustering algorithm. The node merging refers to using the node closest to the cluster center in each clustering node class in the clustering node class set as the merging node, and all the merging nodes are aggregated into a merging node set. The edge merging refers to selecting the edges corresponding to each merging node in the merging node set from the grammatical edge set and the module dependency edge set as the merging edges, and all the merging edges are aggregated into a merging edge set.

[0120] For details, refer to Figure 2 As shown, when the static test module uses the integrated code graph to perform static vulnerability analysis on the source code to obtain static code vulnerabilities, it includes:

[0121] S21, selecting nodes in the integration code graph one by one as target integration nodes, and using neighboring nodes of the target integration nodes in the integration code graph as target neighboring nodes;

[0122] S22, using the target neighborhood node to iteratively transmit messages to the target integration node to obtain node message features;

[0123] S23, performing multi-layer perceptron classification on the node message features to obtain node vulnerability features;

[0124] S24, activating the node vulnerability feature to obtain the node vulnerability type;

[0125] S25, extracting static vulnerability types from the node vulnerability types of all target integration nodes in the integration code graph;

[0126] S26. Extracting static vulnerability codes from the source code using the static vulnerability types, and generating static code vulnerabilities according to the static vulnerability codes and the static vulnerability types.

[0127] In detail, the neighborhood node refers to a node in the integrated code graph that is connected to the target integrated node through an edge.

[0128] Specifically, the following message passing formula is used to iterate message passing to obtain the node message feature:

[0129]

[0130]

[0131] in, refers to the node message feature obtained by the target integration node v at the lth iteration, v refers to the target integration node, l is the iteration number index, u refers to the target neighborhood node, N(v) refers to the neighborhood of the target integration node v, exp is the exponential function symbol, σ is the activation function symbol, and a u,v is the attention vector between the target integration node v and the target neighborhood node u, T is the transposition symbol, It refers to the weight matrix of the target neighborhood node u at the lth iteration, It refers to the node feature of the target neighborhood node u at the l-1th iteration, is the vector splicing symbol, refers to the weight matrix of the target integration node v at the lth iteration, refers to the node feature of the target integration node v at the l-1th iteration, It refers to the weight matrix of the edge between the target integration node v and the target neighborhood node u at the lth iteration, e u,v refers to the feature vector corresponding to the edge between the target integration node v and the target neighborhood node u, b l refers to the bias coefficient at the lth iteration, k is the neighboring node in the neighborhood of the target integration node v, a k,v is the attention vector between the target integration node v and the neighborhood node k, refers to the weight matrix of the neighborhood node k at the lth iteration, refers to the node feature of the neighborhood node k at the l-1th iteration, refers to the weight matrix of the edge between the target integration node v and the neighboring node k at the lth iteration, e k,v It refers to the eigenvector corresponding to the edge between the target integration node v and the neighboring node k, tanh is the symbol of the hyperbolic tangent function, h l v It refers to the node feature of the target integration node v at the lth iteration.

[0132] In detail, the message passing formula can combine the dependency relationship between nodes and the node's own characteristics to perform iterative feature extraction, thereby realizing global static analysis of source code in combination with context content and improving the accuracy of static vulnerability analysis.

[0133] Specifically, the multi-layer perceptron classification refers to the classification of vulnerability features using a pre-trained multi-layer perceptron model, the node vulnerability feature is the probability distribution of the node being a static vulnerability, and the static vulnerability type is the node vulnerability type of the node vulnerability type.

[0134] In detail, the static vulnerability code is the partial code corresponding to the target integration node corresponding to the static vulnerability type in the source code, and generating static code vulnerabilities based on the static vulnerability code and the static vulnerability type refers to using the static vulnerability type to mark vulnerabilities in each code in the node vulnerability code.

[0135] In an embodiment of the present invention, by performing graph integration, the grammatical structure and dependency relationship of the source code can be integrated into a graph structure, thereby facilitating the use of graph neural network methods for static vulnerability analysis, retaining the global characteristics of the source code, and thus improving the accuracy of static vulnerability analysis.

[0136] The seed mutation module is used to perform plug-in compilation on the source code to obtain a plug-in execution program, and perform seed screening and seed mutation on the plug-in execution program to obtain a mutation seed set.

[0137] Specifically, the stub execution program is an executable file with stub information corresponding to the source code, and each mutation seed in the mutation seed set is a code or input content for triggering each execution program in the stub execution program.

[0138] In the embodiment of the present invention, when the seed mutation module performs stub compilation on the source code to obtain the stub execution program, it includes:

[0139] Performing function stubbing on the source code to obtain function stubbing source code;

[0140] Perform branch stubbing on the function stubbing source code to obtain a branch stubbing source code;

[0141] Performing basic block plugging on the branch plugging source code to obtain a basic block plugging source code;

[0142] The basic block plug-in source code is compiled to obtain a plug-in execution program.

[0143] In detail, the function stubbing refers to stubbing at each function entry of the source code to determine whether the corresponding function will be called, the branch stubbing refers to stubbing at each logical branch entry of the source code to determine whether each branch of the source code is called, and the basic block stubbing refers to checking in each basic block of the source code to determine whether each basic block of the source code is called.

[0144] Specifically, the conditional branch point corresponding to the branch, such as conditional judgment statements such as if else or switch case, the basic block is the smallest basic unit of the source code when executing, and components such as Gcov, LLVM Coverage or AFL can be used for instrumentation and code compilation.

[0145] Specifically, when the seed mutation module performs seed screening and seed mutation on the plug-in execution program to obtain a mutation seed set, it includes:

[0146] Performing input detection on the instrumented execution program to obtain a seed input rule;

[0147] Perform seed screening on the plug-in execution program according to the seed input rule to obtain a screening trigger seed;

[0148] Performing bit flipping on the screening trigger seed to obtain a flipped variant seed;

[0149] Performing byte mutation on the screening trigger seed to obtain a byte mutation seed;

[0150] Performing random insertion mutation and random deletion mutation on the screening trigger seed respectively to obtain an insertion mutation seed and a deletion mutation seed;

[0151] A mutation seed set is generated according to the screening trigger seed, the flip mutation seed, the byte mutation seed, the insertion mutation seed and the deletion mutation seed.

[0152] In detail, the input detection refers to checking the detailed parameter requirements of the input of the plug-in execution program, such as the input string length and input format, etc., and the seed screening refers to screening out seeds that meet the corresponding input detailed parameter requirements in a preset seed library as screening trigger seeds. The seed library is a code collection containing various types and rules for triggering program execution.

[0153] Specifically, the bit flipping refers to randomly flipping the bits in the screening trigger seed, the byte mutation refers to modifying the bytes or byte sequences of the screening trigger seed, the random insertion mutation refers to inserting random or malicious data into the screening trigger seed, and the random deletion mutation refers to deleting or copying certain byte blocks in the screening trigger seed.

[0154] In the embodiment of the present invention, by performing stub compilation, points for recording call information can be inserted into the source code, thereby facilitating subsequent coverage updates and fine-grained updates. By performing seed screening and seed mutation, a sufficient number and type of seeds can be generated, thereby facilitating subsequent dynamic vulnerability analysis to obtain a wider range of dynamic code vulnerabilities.

[0155] The dynamic testing module is used to use the plug-in execution program to update the coverage of the variant seed set to obtain an updated seed set, and use the updated seed set to perform dynamic vulnerability analysis on the source code to obtain dynamic code vulnerabilities.

[0156] In detail, each update seed in the update seed set is a code segment or a character segment that triggers the source code and is used to perform dynamic vulnerability analysis on the source code.

[0157] In the embodiment of the present invention, when the dynamic test module uses the instrumentation execution program to update the coverage of the variant seed set to obtain the updated seed set, it includes:

[0158] Using the mutation seed set to trigger execution of the instrumentation execution program, to obtain a seed execution result set;

[0159] Performing instrumentation analysis on the seed execution result set to obtain an instrumentation execution result set;

[0160] Perform vulnerability screening on the instrumentation execution result set to obtain a vulnerability execution result set;

[0161] Gather the mutation seeds corresponding to the vulnerability execution result set in the mutation seed set into a vulnerability seed set;

[0162] Performing coverage statistics on the instrumentation execution result set to obtain an execution coverage set;

[0163] According to the execution coverage set and the vulnerability seed set, mutation weights are assigned to the mutation seed set to obtain a mutation weight set;

[0164] The mutation seed set is subjected to weighted mutation according to the mutation weight set to obtain an updated seed set.

[0165] In detail, the triggering execution refers to using each variant seed in the variant seed set as the input of the instrumentation execution program, executing the instrumentation execution program in a virtual simulation environment or sandbox environment, and monitoring and recording the execution results to obtain a seed execution result set.

[0166] Specifically, the seed execution result set includes the output results of each mutant seed when the execution is triggered and the triggering conditions corresponding to each fine-grained level in the source code during instrumentation compilation. The vulnerability screening refers to screening out the instrumentation execution results in which the instrumentation execution results crash or report an error in the instrumentation execution result set as vulnerability execution results and compiling them into a vulnerability execution result set.

[0167] In detail, the coverage statistics refer to statistics on the coverage of the triggered plug-ins at each fine-grained level in the source code, and the fine-grained levels include the function level, the branch level, and the basic block level.

[0168] Specifically, the mutation weight allocation refers to assigning vulnerability weights to the mutation seeds in the mutation seed set corresponding to the vulnerability seed set to obtain a vulnerability weight set; using the execution coverage set as the coverage weight set of the mutation seed set; and using the adversarial weighted sum of the vulnerability weight set and the coverage weight set as the mutation weight set.

[0169] In detail, the weighted mutation refers to performing a corresponding number of seed mutations on each mutation seed in the mutation seed set according to the numerical value of each mutation weight in the mutation weight set.

[0170] Specifically, refer to Figure 3 As shown, when the dynamic testing module uses the update seed set to perform dynamic vulnerability analysis on the source code to obtain dynamic code vulnerabilities, it includes:

[0171] S31, compiling the source code to obtain a compiled execution program;

[0172] S32, triggering the compilation execution program using the update seed set to obtain a trigger execution result set;

[0173] S33, performing vulnerability screening on the trigger execution result to obtain a dynamic vulnerability result set;

[0174] S34, using the dynamic vulnerability result set to locate the vulnerability in the source code to obtain a dynamic vulnerability code;

[0175] S35, extracting a dynamic vulnerability type from the dynamic vulnerability result set, and generating a dynamic code vulnerability according to the dynamic vulnerability code and the dynamic vulnerability type.

[0176] In detail, the code compilation method is consistent with the method when the above-mentioned seed mutation module executes code compilation, the trigger execution method is consistent with the method when triggering the execution of the instrumentation execution program, and the vulnerability screening method is consistent with the method when performing vulnerability screening on the instrumentation execution result set.

[0177] Specifically, the vulnerability location refers to using part of the code in the source code corresponding to each dynamic vulnerability result in the dynamic vulnerability result set as the dynamic vulnerability code. The dynamic vulnerability type can be extracted by analyzing the crash log of the triggered execution result set or through components such as AddressSanitizer, Valgrind, and GDB.

[0178] In the embodiment of the present invention, by updating the coverage, the coverage of dynamic testing can be improved and a more comprehensive fuzz test can be achieved. By performing dynamic vulnerability analysis, the source code can be actually executed to verify its behavior, function and performance, thereby discovering potential defects and problems and improving the comprehensiveness of vulnerability detection.

[0179] The code repair module is used to mark the source code for vulnerabilities according to the static code vulnerabilities and the dynamic code vulnerabilities to obtain marked vulnerability codes, and to perform vulnerability semantic extraction and vulnerability repair on the marked vulnerability codes according to the integrated code graph to obtain repaired source code.

[0180] In detail, when the code repair module performs vulnerability annotation on the source code according to the static code vulnerability and the dynamic code vulnerability to obtain the annotated vulnerability code, it includes: extracting the static vulnerability code and the static vulnerability type from the static code vulnerability; extracting the dynamic vulnerability code and the dynamic vulnerability type from the dynamic code vulnerability; using the static vulnerability type to annotate the vulnerability type of the part of the code corresponding to the static vulnerability code in the source code to obtain the primary annotated vulnerability code; using the dynamic vulnerability type to annotate the vulnerability type of the part of the code corresponding to the dynamic vulnerability code in the source code to obtain the annotated vulnerability code.

[0181] In the embodiment of the present invention, when the code repair module extracts vulnerability semantics and repairs the vulnerability of the annotated vulnerability code according to the integrated code graph to obtain the repair source code, it includes:

[0182] Using the vulnerability-marking code to mark vulnerabilities in the integrated code graph, to obtain a marked code graph;

[0183] Performing vector encoding on the annotation code graph to obtain annotation code features;

[0184] Performing self-attention encoding on the annotated code features to obtain attention code semantics;

[0185] Performing a multi-level feedforward operation on the attention code semantics to obtain a feedforward code feature;

[0186] Performing residual connection on the feedforward code features to obtain residual code features;

[0187] Performing feature normalization and feature activation operations on the residual code features to obtain a code patch;

[0188] The code patch is used to repair the vulnerability of the marked vulnerability code to obtain a repair source code.

[0189] In detail, the vulnerability marking refers to marking the corresponding vulnerability type in the standard vulnerability code on the corresponding node of the integrated code graph, and the vector encoding refers to vectorizing the nodes and edges of the marked code graph and performing position encoding.

[0190] Specifically, a multi-head attention mechanism or a self-attention mechanism can be used for self-attention encoding, and multiple feedforward layers of a pre-trained Transformer model can be used for multi-level feedforward operations. The residual connection is simply a residual connection of the features of the feedforward code before each level of feedforward operation with the features after each level of feedforward operation.

[0191] In detail, the feature normalization operation can be performed using layer normalization, and the feature activation operation can be performed using the RuLU function or the GELU function. The vulnerability repair refers to using the code patch to replace and update part of the code at the corresponding position of the marked vulnerability code.

[0192] In the embodiment of the present invention, by performing vulnerability annotation, the semantics of code vulnerabilities can be understood more conveniently. By performing vulnerability semantic extraction and vulnerability repair, the vulnerability repair can be performed by combining the vulnerability semantics and the overall dependency structure of the code through a deep learning method, thereby improving the readability of the repaired code and the completeness of the code.

[0193] Reference Figure 4 FIG. 1 is a flow chart of a method for automatically repairing source code vulnerabilities provided by an embodiment of the present invention. In this embodiment, the method for automatically repairing source code vulnerabilities includes:

[0194] S1. Perform syntax analysis and dependency analysis on the pre-acquired source code to obtain an abstract syntax graph and an abstract dependency graph.

[0195] S2. Performing graph integration on the abstract syntax graph and the abstract dependency graph to obtain an integrated code graph, and performing static vulnerability analysis on the source code using the integrated code graph to obtain static code vulnerabilities, wherein the performing static vulnerability analysis on the source code using the integrated code graph to obtain static code vulnerabilities includes: selecting nodes in the integrated code graph one by one as target integration nodes, and using neighboring nodes of the target integration nodes in the integrated code graph as target neighboring nodes; performing iterative message transmission on the target integration node using the following message transmission formula and the target neighboring nodes to obtain node message features:

[0196]

[0197]

[0198] in, refers to the node message feature obtained by the target integration node v at the lth iteration, v refers to the target integration node, l is the iteration number index, u refers to the target neighborhood node, N(v) refers to the neighborhood of the target integration node v, exp is the exponential function symbol, σ is the activation function symbol, and a u,v is the attention vector between the target integration node v and the target neighborhood node u, T is the transposition symbol, It refers to the weight matrix of the target neighborhood node u at the lth iteration, It refers to the node feature of the target neighborhood node u at the l-1th iteration, is the vector splicing symbol, refers to the weight matrix of the target integration node v at the lth iteration, h l v -1 refers to the node feature of the target integration node v at the l-1th iteration, It refers to the weight matrix of the edge between the target integration node v and the target neighborhood node u at the lth iteration, e u,v refers to the feature vector corresponding to the edge between the target integration node v and the target neighborhood node u, b l refers to the bias coefficient at the lth iteration, k is the neighboring node in the neighborhood of the target integration node v, a k,v is the attention vector between the target integration node v and the neighborhood node k, refers to the weight matrix of the neighborhood node k at the lth iteration, refers to the node feature of the neighborhood node k at the l-1th iteration, refers to the weight matrix of the edge between the target integration node v and the neighboring node k at the lth iteration, e k,v It refers to the eigenvector corresponding to the edge between the target integration node v and the neighborhood node k, tanh is the symbol of the hyperbolic tangent function, It refers to the node features of the target integrated node v at the lth iteration; the node message features are classified by a multi-layer perceptron to obtain node vulnerability features; the node vulnerability features are activated to obtain node vulnerability types; static vulnerability types are extracted from the node vulnerability types of all target integrated nodes in the integrated code graph; static vulnerability codes are extracted from the source code using the static vulnerability types, and static code vulnerabilities are generated according to the static vulnerability codes and the static vulnerability types.

[0199] S3, performing plug-in compilation on the source code to obtain a plug-in execution program, and performing seed screening and seed mutation on the plug-in execution program to obtain a mutation seed set;

[0200] Using the stub execution program to update the coverage of the variant seed set to obtain an updated seed set, and using the updated seed set to perform dynamic vulnerability analysis on the source code to obtain dynamic code vulnerabilities;

[0201] Vulnerabilities are annotated on the source code according to the static code vulnerabilities and the dynamic code vulnerabilities to obtain annotated vulnerability code, and vulnerability semantics are extracted and vulnerabilities are repaired on the annotated vulnerability code according to the integrated code graph to obtain repaired source code.

[0202] The embodiments of the present invention can conveniently connect the code structure and dependency relationships of the source code by performing syntax analysis and dependency analysis on the source code, thereby improving the recognition rate of vulnerability detection; by performing graph integration, the syntax structure and dependency relationships of the source code can be integrated into a graph structure, thereby facilitating the use of graph neural network methods for static vulnerability analysis, retaining the global characteristics of the source code, thereby improving the accuracy of static vulnerability analysis; by performing stub compilation, points for recording call information can be inserted into the source code, thereby facilitating subsequent coverage updates and fine-grained updates; by performing seed screening and seed mutation, a sufficient number and type of seeds can be generated, thereby facilitating obtaining a larger range of dynamic code vulnerabilities in subsequent dynamic vulnerability analysis.

[0203] By updating the coverage, the coverage of dynamic testing can be improved and more comprehensive fuzz testing can be achieved. By performing dynamic vulnerability analysis, the source code can be actually executed to verify its behavior, function and performance, thereby discovering potential defects and problems and improving the comprehensiveness of vulnerability detection. By annotating vulnerabilities, the semantics of code vulnerabilities can be understood more conveniently. By extracting and repairing vulnerabilities, deep learning methods can be used to combine vulnerability semantics and the overall dependency structure of the code for vulnerability repair, thereby improving the readability of the repaired code and the completeness of the code, thereby improving the accuracy of vulnerability repair.

[0204] In detail, the automatic source code vulnerability repair method described in the embodiment of the present invention is used in the same manner as described above. Figure 1 The same technical means are used as the automatic repair system for source code vulnerabilities described in the previous section and can produce the same technical effects, which will not be described in detail here.

[0205] The present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor of an electronic device, the computer program can implement:

[0206] Performing syntax analysis and dependency analysis on the pre-acquired source code respectively to obtain an abstract syntax graph and an abstract dependency graph;

[0207] The abstract syntax graph and the abstract dependency graph are graph-integrated to obtain an integrated code graph, and the integrated code graph is used to perform static vulnerability analysis on the source code to obtain static code vulnerabilities, wherein the use of the integrated code graph to perform static vulnerability analysis on the source code to obtain static code vulnerabilities includes: selecting nodes in the integrated code graph one by one as target integration nodes, and using neighboring nodes of the target integration nodes in the integrated code graph as target neighboring nodes; using the following message passing formula and the target neighboring nodes to iteratively pass messages to the target integration node to obtain node message features:

[0208]

[0209]

[0210] in, refers to the node message feature obtained by the target integration node v at the lth iteration, v refers to the target integration node, l is the iteration number index, u refers to the target neighborhood node, N(v) refers to the neighborhood of the target integration node v, exp is the exponential function symbol, σ is the activation function symbol, and a u,v is the attention vector between the target integration node v and the target neighborhood node u, T is the transposition symbol, It refers to the weight matrix of the target neighborhood node u at the lth iteration, It refers to the node feature of the target neighborhood node u at the l-1th iteration, is the vector splicing symbol, refers to the weight matrix of the target integration node v at the lth iteration, refers to the node feature of the target integration node v at the l-1th iteration, It refers to the weight matrix of the edge between the target integration node v and the target neighborhood node u at the lth iteration, e u,v refers to the feature vector corresponding to the edge between the target integration node v and the target neighborhood node u, b l refers to the bias coefficient at the lth iteration, k is the neighboring node in the neighborhood of the target integration node v, a k,v is the attention vector between the target integration node v and the neighborhood node k, refers to the weight matrix of the neighborhood node k at the lth iteration, refers to the node feature of the neighborhood node k at the l-1th iteration, refers to the weight matrix of the edge between the target integration node v and the neighboring node k at the lth iteration, e k,v It refers to the eigenvector corresponding to the edge between the target integration node v and the neighborhood node k, tanh is the symbol of the hyperbolic tangent function, It refers to the node features of the target integration node v at the lth iteration; performing multi-layer perceptron classification on the node message features to obtain node vulnerability features; performing feature activation on the node vulnerability features to obtain node vulnerability types; extracting static vulnerability types from the node vulnerability types of all target integration nodes in the integration code graph; extracting static vulnerability codes from the source code using the static vulnerability types, and generating static code vulnerabilities according to the static vulnerability codes and the static vulnerability types;

[0211] Performing stub compilation on the source code to obtain an stub execution program, and performing seed screening and seed mutation on the stub execution program to obtain a mutation seed set;

[0212] Using the stub execution program to update the coverage of the variant seed set to obtain an updated seed set, and using the updated seed set to perform dynamic vulnerability analysis on the source code to obtain dynamic code vulnerabilities;

[0213] Vulnerabilities are annotated on the source code according to the static code vulnerabilities and the dynamic code vulnerabilities to obtain annotated vulnerability code, and vulnerability semantics are extracted and vulnerabilities are repaired on the annotated vulnerability code according to the integrated code graph to obtain repaired source code.

[0214] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, systems and systems can be implemented in other ways. For example, the system embodiments described above are only schematic, for example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation.

[0215] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0216] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional modules.

[0217] It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0218] Therefore, no matter from which point of view, the embodiments should be regarded as illustrative and non-restrictive, and the scope of the present invention is limited by the appended claims rather than the above description, so it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any attached figure mark in the claims should not be regarded as limiting the claims involved.

[0219] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, system, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0220] In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. The multiple units or systems stated in the system embodiment can also be implemented by one unit or system through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any specific order.

[0221] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention.

Claims

1. A source code vulnerability automatic repair system, characterized in that: The system includes a dependency analysis module, a static test module, a seed mutation module, a dynamic test module and a code repair module, wherein: The dependency analysis module is used to perform syntax analysis and dependency analysis on the pre-acquired source code to obtain an abstract syntax graph and an abstract dependency graph; The static test module is used to perform graph integration on the abstract syntax graph and the abstract dependency graph to obtain an integrated code graph, and use the integrated code graph to perform static vulnerability analysis on the source code to obtain static code vulnerabilities. When the static test module uses the integrated code graph to perform static vulnerability analysis on the source code to obtain static code vulnerabilities, the static test module includes: selecting nodes in the integrated code graph one by one as target integration nodes, and using neighboring nodes of the target integration nodes in the integrated code graph as target neighboring nodes; and performing iterative message transmission on the target integration node using the following message transmission formula and the target neighboring nodes to obtain node message features: in, refers to the node message feature obtained by the target integration node v at the lth iteration, v refers to the target integration node, l is the iteration number index, u refers to the target neighborhood node, N(v) refers to the neighborhood of the target integration node v, exp is the exponential function symbol, σ is the activation function symbol, and a u,v is the attention vector between the target integration node v and the target neighborhood node u, T is the transposition symbol, It refers to the weight matrix of the target neighborhood node u at the lth iteration, It refers to the node feature of the target neighborhood node u at the l-1th iteration, ⊕ is the vector concatenation symbol, refers to the weight matrix of the target integration node v at the lth iteration, refers to the node feature of the target integration node v at the l-1th iteration, It refers to the weight matrix of the edge between the target integration node v and the target neighborhood node u at the lth iteration, e u,v refers to the feature vector corresponding to the edge between the target integration node v and the target neighborhood node u, b l refers to the bias coefficient at the lth iteration, k is the neighboring node in the neighborhood of the target integration node v, a k,v is the attention vector between the target integration node v and the neighborhood node k, refers to the weight matrix of the neighborhood node k at the lth iteration, refers to the node feature of the neighborhood node k at the l-1th iteration, refers to the weight matrix of the edge between the target integration node v and the neighboring node k at the lth iteration, e k,v It refers to the eigenvector corresponding to the edge between the target integration node v and the neighborhood node k, tanh is the symbol of the hyperbolic tangent function, It refers to the node features of the target integration node v at the lth iteration; performing multi-layer perceptron classification on the node message features to obtain node vulnerability features; performing feature activation on the node vulnerability features to obtain node vulnerability types; extracting static vulnerability types from the node vulnerability types of all target integration nodes in the integration code graph; extracting static vulnerability codes from the source code using the static vulnerability types, and generating static code vulnerabilities according to the static vulnerability codes and the static vulnerability types; The seed mutation module is used to perform plug-in compilation on the source code to obtain a plug-in execution program, and perform seed screening and seed mutation on the plug-in execution program to obtain a mutation seed set; The dynamic testing module is used to update the coverage of the variant seed set by using the plug-in execution program to obtain an updated seed set, and to perform dynamic vulnerability analysis on the source code by using the updated seed set to obtain dynamic code vulnerabilities; The code repair module is used to mark the source code for vulnerabilities according to the static code vulnerabilities and the dynamic code vulnerabilities to obtain marked vulnerability codes, and to perform vulnerability semantic extraction and vulnerability repair on the marked vulnerability codes according to the integrated code graph to obtain repaired source code.

2. The automatic source code vulnerability repair system according to claim 1, characterized in that: When the dependency analysis module performs syntax analysis and dependency analysis on the pre-acquired source code respectively to obtain an abstract syntax graph and an abstract dependency graph, the dependency analysis module includes: Perform lexical decomposition on the pre-acquired source code to obtain a code word unit set; Performing grammatical analysis on the code word unit set to obtain a code syntax tree; Performing graph conversion on the code syntax tree to obtain an abstract syntax graph; Extracting a module unit set from the source code according to the code syntax tree; Performing dependency analysis on the module unit set to obtain a module dependency edge set; The module dependency edge set is used to construct a graph of the module unit set to obtain an abstract dependency graph.

3. The automatic source code vulnerability repair system according to claim 1, characterized in that: When the static test module performs graph integration on the abstract syntax graph and the abstract dependency graph to obtain an integrated code graph, the static test module includes: Decomposing the abstract syntax graph to obtain a syntax node set and a syntax edge set; Decomposing the abstract dependency graph to obtain a module dependency edge set and a module unit set; The node distances between each grammar node in the grammar node set and each module unit in the module unit set are calculated using the following node clustering algorithm: Among them, D x,y It refers to the node distance between the syntax node x in the syntax node set and the module unit y in the module unit set, exp is the exponential function symbol, · is the inner product symbol, || is the modulus symbol, x is the syntax node in the syntax node set, y refers to the module unit in the module unit set, k, θ, j are preset distance coefficients, α, β are preset weight coefficients, T is the transposition symbol, γ() is the covariance matrix operator, λ is the preset regularization coefficient, and I is the unit matrix; Performing node clustering on the grammar node set and the module unit set according to the node distance to obtain a cluster node set; Merging nodes of each clustering node class in the clustering node class set to obtain a merged node set; Merge the grammatical edge set and the module dependency edge set according to the merged node set to obtain a merged edge set; The merged edge set is used to construct a graph for the merged node set to obtain an integrated code graph.

4. The automatic source code vulnerability repair system according to claim 1, characterized in that: When the seed mutation module performs the stub compilation on the source code to obtain the stub execution program, it includes: Performing function stubbing on the source code to obtain function stubbing source code; Perform branch stubbing on the function stubbing source code to obtain a branch stubbing source code; Performing basic block plugging on the branch plugging source code to obtain a basic block plugging source code; The basic block plug-in source code is compiled to obtain a plug-in execution program.

5. The automatic source code vulnerability repair system according to claim 1, characterized in that: When the seed mutation module performs seed screening and seed mutation on the plug-in execution program to obtain a mutation seed set, it includes: Performing input detection on the instrumented execution program to obtain a seed input rule; Perform seed screening on the plug-in execution program according to the seed input rule to obtain a screening trigger seed; Performing bit flipping on the screening trigger seed to obtain a flipped variant seed; Performing byte mutation on the screening trigger seed to obtain a byte mutation seed; Performing random insertion mutation and random deletion mutation on the screening trigger seed respectively to obtain an insertion mutation seed and a deletion mutation seed; A mutation seed set is generated according to the screening trigger seed, the flip mutation seed, the byte mutation seed, the insertion mutation seed and the deletion mutation seed.

6. The automatic source code vulnerability repair system according to claim 1, characterized in that: When the dynamic test module uses the instrumentation execution program to update the coverage of the variant seed set to obtain the updated seed set, it includes: Using the mutation seed set to trigger execution of the instrumentation execution program, to obtain a seed execution result set; Performing instrumentation analysis on the seed execution result set to obtain an instrumentation execution result set; Perform vulnerability screening on the instrumentation execution result set to obtain a vulnerability execution result set; Gather the mutation seeds corresponding to the vulnerability execution result set in the mutation seed set into a vulnerability seed set; Performing coverage statistics on the instrumentation execution result set to obtain an execution coverage set; According to the execution coverage set and the vulnerability seed set, mutation weights are assigned to the mutation seed set to obtain a mutation weight set; The mutation seed set is subjected to weighted mutation according to the mutation weight set to obtain an updated seed set.

7. The automatic source code vulnerability repair system according to claim 1, characterized in that: When the dynamic testing module uses the update seed set to perform dynamic vulnerability analysis on the source code to obtain dynamic code vulnerabilities, it includes: Compiling the source code to obtain a compiled execution program; Using the update seed set to trigger the compilation execution program to obtain a trigger execution result set; Perform vulnerability screening on the trigger execution result to obtain a dynamic vulnerability result set; Using the dynamic vulnerability result set to locate the vulnerability of the source code, and obtain dynamic vulnerability code; A dynamic vulnerability type is extracted from the dynamic vulnerability result set, and a dynamic code vulnerability is generated according to the dynamic vulnerability code and the dynamic vulnerability type.

8. The automatic source code vulnerability repair system according to claim 1, characterized in that: When the code repair module extracts vulnerability semantics and repairs the vulnerability of the annotated vulnerability code according to the integrated code graph to obtain the repair source code, it includes: Using the vulnerability-marking code to mark vulnerabilities in the integrated code graph, to obtain a marked code graph; Performing vector encoding on the annotation code graph to obtain annotation code features; Performing self-attention encoding on the annotated code features to obtain attention code semantics; Performing a multi-level feedforward operation on the attention code semantics to obtain a feedforward code feature; Performing residual connection on the feedforward code features to obtain residual code features; Performing feature normalization and feature activation operations on the residual code features to obtain a code patch; The code patch is used to repair the vulnerability of the marked vulnerability code to obtain a repair source code.

9. The automatic source code vulnerability repair system according to claim 1, characterized in that: When the code repair module performs vulnerability marking on the source code according to the static code vulnerability and the dynamic code vulnerability to obtain the marked vulnerability code, it includes: Extracting static vulnerability codes and static vulnerability types from the static code vulnerabilities; Extracting a dynamic vulnerability code and the dynamic vulnerability type from the dynamic code vulnerability; Using the static vulnerability type, annotating a portion of code corresponding to the static vulnerability code in the source code with a vulnerability type, to obtain a primary annotated vulnerability code; The dynamic vulnerability type is used to mark the vulnerability type of a portion of code corresponding to the dynamic vulnerability code in the source code to obtain a marked vulnerability code.

10. A method for automatically repairing source code vulnerabilities, characterized in that: The method comprises: Performing syntax analysis and dependency analysis on the pre-acquired source code respectively to obtain an abstract syntax graph and an abstract dependency graph; The abstract syntax graph and the abstract dependency graph are graph-integrated to obtain an integrated code graph, and the integrated code graph is used to perform static vulnerability analysis on the source code to obtain static code vulnerabilities, wherein the use of the integrated code graph to perform static vulnerability analysis on the source code to obtain static code vulnerabilities includes: selecting nodes in the integrated code graph one by one as target integration nodes, and using neighboring nodes of the target integration nodes in the integrated code graph as target neighboring nodes; using the following message passing formula and the target neighboring nodes to iteratively pass messages to the target integration node to obtain node message features: in, refers to the node message feature obtained by the target integration node v at the lth iteration, v refers to the target integration node, l is the iteration number index, u refers to the target neighborhood node, N(v) refers to the neighborhood of the target integration node v, exp is the exponential function symbol, σ is the activation function symbol, and a u,v is the attention vector between the target integration node v and the target neighborhood node u, T is the transposition symbol, It refers to the weight matrix of the target neighborhood node u at the lth iteration, It refers to the node feature of the target neighborhood node u at the l-1th iteration, ⊕ is the vector concatenation symbol, refers to the weight matrix of the target integration node v at the lth iteration, refers to the node feature of the target integration node v at the l-1th iteration, It refers to the weight matrix of the edge between the target integration node v and the target neighborhood node u at the lth iteration, e u,v refers to the feature vector corresponding to the edge between the target integration node v and the target neighborhood node u, b l refers to the bias coefficient at the lth iteration, k is the neighboring node in the neighborhood of the target integration node v, a k,v is the attention vector between the target integration node v and the neighborhood node k, refers to the weight matrix of the neighborhood node k at the lth iteration, refers to the node feature of the neighborhood node k at the l-1th iteration, refers to the weight matrix of the edge between the target integration node v and the neighboring node k at the lth iteration, e k,v It refers to the eigenvector corresponding to the edge between the target integration node v and the neighborhood node k, tanh is the symbol of the hyperbolic tangent function, It refers to the node features of the target integration node v at the lth iteration; performing multi-layer perceptron classification on the node message features to obtain node vulnerability features; performing feature activation on the node vulnerability features to obtain node vulnerability types; extracting static vulnerability types from the node vulnerability types of all target integration nodes in the integration code graph; extracting static vulnerability codes from the source code using the static vulnerability types, and generating static code vulnerabilities according to the static vulnerability codes and the static vulnerability types; Performing stub compilation on the source code to obtain an stub execution program, and performing seed screening and seed mutation on the stub execution program to obtain a mutation seed set; Using the stub execution program to update the coverage of the variant seed set to obtain an updated seed set, and using the updated seed set to perform dynamic vulnerability analysis on the source code to obtain dynamic code vulnerabilities; Vulnerabilities are annotated on the source code according to the static code vulnerabilities and the dynamic code vulnerabilities to obtain annotated vulnerability code, and vulnerability semantics are extracted and vulnerabilities are repaired on the annotated vulnerability code according to the integrated code graph to obtain repaired source code.

Images