Source code vulnerability detection method based on multi-dimensional feature fusion

Abstract

The invention discloses a source code vulnerability detection method based on multi-dimensional feature fusion, which comprises the following steps of: firstly representing a source code as a program dependency graph, and then slicing the program dependency graph to reduce complexity to obtain a slice dependency graph; then, the source code is converted into vector representation through naming standardization and a Doc2Vec technology, and semantic information is reserved; next, embedding learning is carried out on the slice image in the hyperbolic space and the Euclidean space respectively, vulnerability features under different perspectives are captured, and comprehensive and deep analysis of the source code is achieved by combining the hierarchical structure representation capability of the hyperbolic space and the local feature capture capability of the Euclidean space. And finally, designing a fusion strategy, effectively fusing the features extracted from the two spaces, and carrying out vulnerability classification prediction by a classification prediction module comprising a multi-layer perceptron. According to the method, comprehensive and deep analysis of the source code is realized, and potential vulnerabilities in the source code are identified and positioned more accurately.

Description

Technical Field

[0001] The present invention relates to the technical field of source code vulnerability detection, and in particular to a source code vulnerability detection method integrating multi-dimensional features. Background Art

[0002] Source code vulnerability detection is an important research direction in the field of software security. Its goal is to identify and fix defects in software that may cause security risks. With the continuous growth and complexity of software systems, it is becoming increasingly difficult to detect vulnerabilities manually, so automated vulnerability detection methods have received widespread attention. In recent years, vulnerability detection methods based on deep learning have become a research hotspot due to their powerful feature extraction capabilities. However, most existing deep learning methods rely on a single Euclidean space code embedding, which limits their ability to capture complex vulnerability patterns in code. Although deep learning technology has achieved great success in image processing, natural language processing and other fields, its potential has not yet been fully explored in the field of source code vulnerability detection. Source code has rich structural and semantic information, which is difficult to be fully captured by traditional Euclidean space embedding methods. Hyperbolic space, as a non-Euclidean geometric space, provides a new perspective for representation learning with its unique geometric properties. In particular, hyperbolic space shows superior performance when representing data with hierarchical structures and complex relationships. Summary of the invention

[0003] The purpose of the present invention is to overcome the shortcomings and deficiencies of the prior art and propose a source code vulnerability detection method based on multi-dimensional feature fusion. By combining the hierarchical structure representation capability of hyperbolic space and the local feature capture capability of Euclidean space, a comprehensive and in-depth analysis of the source code is achieved, and potential vulnerabilities in the source code can be more accurately identified and located.

[0004] To achieve the above object, the technical solution provided by the present invention is: a source code vulnerability detection method based on multi-dimensional feature fusion, comprising the following steps:

[0005] S1: Obtain the program dependency graph PDG of the source code and slice it to obtain a slice-level subgraph, called S-PDG, which provides a slice-level code graph for model training, enabling the model to predict vulnerabilities at a fine-grained level;

[0006] S2: Standardize and embed the S-PDG. Specifically, the code of the nodes in the S-PDG is standardized and the code token of each S-PDG node is embedded into the vector representation, thereby reducing the noise caused by the personalized naming of program variables and improving the retention of the original code semantics.

[0007] S3: Design a hyperbolic space embedding module for source code, called DHGCN, which includes a hyperbolic mapping layer, a hyperbolic graph convolutional neural network layer, and a global attention pooling layer. It uses a hyperbolic graph convolutional neural network to achieve deep mining of hierarchical features of code graphs based on hyperbolic space, and achieves hyperbolic embedding representation of code graphs with low distortion.

[0008] S4: Design a Euclidean space embedding module for source code, called DEGCN, which includes a graph convolution layer, a graph pooling layer, and a graph readout layer; use a graph convolutional neural network architecture that combines the graph convolution layer, the graph pooling layer, and the graph readout layer to perform the Euclidean embedding representation of the source code, where the graph convolution layer and the graph pooling layer are connected together and called a convolution pooling block;

[0009] S5: Design a vector fusion module to fuse the hyperbolic embedding representation with the Euclidean embedding representation to obtain the fused vector representation;

[0010] S6: The vector that combines the hyperbolic embedding representation and the Euclidean embedding representation is input into the classification prediction module containing the multi-layer perceptron to perform vulnerability classification prediction.

[0011] Further, the specific operation steps of step S1 are as follows:

[0012] S11: Considering the control dependency and data dependency of the source code, the Joern tool is used to generate the program dependency graph PDG;

[0013] S12: Use SVF to automatically identify system API calls, and use antlr to identify arithmetic operators, which are considered as the main slicer benchmarks, and code slicing is performed based on the slicer benchmarks;

[0014] S13: Iteratively traverse the PDG through the slicer reference point to perform forward and backward slicing: First, the nodes of S-PDG are obtained by forward and backward slicing starting from the slicer reference point; for forward slicing, forward traversal is performed along the PDG starting from the slicer reference point to obtain the forward slicing statement set S f ; For backward slicing, traverse the PDG from the slicing program reference point to include all visited statements to obtain the backward slicing statement set S b ; S f and S b The statements in are the final set of statements, namely S f ∪S b , they retain the control flow and data flow information of the source code and generate the nodes of S-PDG according to the final statement set; then, they connect S f ∪S bThe nodes in are used to generate the final S-PDG, thereby capturing the control dependencies and data dependencies of the program at the slice level.

[0015] Further, the specific operation steps of step S2 are as follows:

[0016] S21: Replace user-defined variable names and function names with symbolic names, and map each variable name and function name to a universal identifier and a separate index, that is, the user-defined function name and variable name are standardized into a unified index representation such as FUN0, FUN1, VAR0, VAR1;

[0017] S22: For each S-PDG constructed, a pre-trained Doc2Vec is used to perform unstructured code information, i.e., embedding of each standardized node code token on the S-PDG, where the Doc2Vec can encode the entire node code sentence of the S-PDG instead of a single code token into a fixed-length vector.

[0018] Further, in step S3, the specific conditions of the hyperbolic mapping layer, the hyperbolic graph convolutional neural network layer, and the global attention pooling layer are as follows:

[0019] a. Hyperbolic mapping layer:

[0020] The input of DHGCN includes the structured and unstructured information of S-PDG, namely the adjacency matrix and the node feature vector matrix. The node features after code standardization and embedding in step S2 are still Euclidean features. It is necessary to map the node feature vectors in Euclidean space to hyperbolic space. The hyperbolic mapping layer maps the node feature vector matrix of S-PDG to hyperbolic space. The transformation operation in the hyperbolic mapping layer is as follows:

[0021]

[0022] In the formula, is the node feature vector in Euclidean space, is the node feature vector in the hyperbolic space after mapping; c is the curvature of the hyperbolic space; represents the exponential mapping from Euclidean space to hyperbolic space, based on the origin o, let represents the origin in a hyperbolic space of curvature c and dimension d; Representation vector The Euclidean norm of ; cosh and sinh are the hyperbolic cosine and hyperbolic sine functions respectively;

[0023] b. Hyperbolic graph convolutional neural network layer:

[0024] After the hyperbolic space representation of the node feature vector is obtained by the hyperbolic mapping layer, it is input into the hyperbolic graph convolutional neural network layer for further processing. The hyperbolic graph convolutional neural network layer includes a hyperbolic layer, a hyperbolic aggregation layer, and a hyperbolic activation layer. The message passing in the hyperbolic graph convolutional neural network layer is as follows:

[0025]

[0026] In the formula, h i is the node feature vector after the hyperbolic layer is updated, h i ′ is the node feature vector after the hyperbolic aggregation layer, h i ″ is the node feature vector after activation by the hyperbolic activation layer; j∈N(i) represents the neighbor node j of node i; h j is the node feature vector of node i’s neighbor node j after being updated by the hyperbolic layer; W is the weight matrix of the hyperbolic transformation; It is a logarithmic mapping; represents the Möbius vector multiplication in hyperbolic space; N(i) is the set of neighbor nodes of node i, |N(i)| is the number of neighbor nodes of node i; σ is the activation function in Euclidean space;

[0027] The hyperbolic graph convolutional neural network layer preserves the tree structure of the code graph with low distortion. In this way, the hyperbolic graph convolutional neural network layer smoothly converts the Euclidean features into hyperbolic embeddings that preserve the node hierarchy. Attention aggregation is performed in the hyperbolic space, which can pay more attention to nodes with high-level structures in the program code.

[0028] DHGCN can stack multiple hyperbolic graph convolutional neural network layers. At each layer, the hyperbolic graph convolutional neural network layer transforms and aggregates the embeddings of neighbors in the tangent space of the central node, and projects the results into a hyperbolic space with different curvatures. The hyperbolic embedding results of the last layer are input into the global attention pooling layer.

[0029] c. Global attention pooling layer:

[0030] The node feature vector of the hyperbolic embedding obtained after the output of the last layer of the hyperbolic graph convolutional neural network layer is input into the global attention pooling layer for further processing. The global attention pooling layer can extract global information from the hyperbolic embedding hidden representation of the code graph output by the hyperbolic graph convolutional neural network layer, rather than just being limited to the local area. By calculating weights and weighted aggregation, the global attention pooling layer can reduce the complexity of the input to a global representation, thereby improving computational efficiency. By modeling the global context, the global attention pooling layer also helps reduce the overfitting of the model to local noise. The processing of the global attention pooling layer is as follows:

[0031]

[0032] Where V H is the graph feature after global attention pooling, that is, the graph embedding vector finally obtained by the hyperbolic graph convolutional neural network; N is the total number of nodes in S-PDG; x i is the eigenvector of the ith node; ⊙ represents the Hadamard product; h gate is a gated graph sequence neural network, h Θ is another optional neural network used to transform node features before the attention weights are applied to them. Here, a linear layer is used for simple transformation; h gate The output of is normalized on the nodes in the graph through the softmax function to obtain the attention weights of each node, and then these attention weights are combined with h Θ The processed node features are subjected to Hadamard product operation, and finally the nodes in S-PDG are summed according to the index to obtain the weighted feature representation of S-PDG for the next step of vector fusion.

[0033] Further, in step S4, the specific conditions of the graph convolution layer, graph pooling layer, and graph readout layer are as follows:

[0034] a. Graph convolution layer:

[0035] The batch of S-PDGs obtained in step S2 is used as the input of the Euclidean space embedding module, including structured information and unstructured information, namely the adjacency matrix and the node vector matrix; first, the input data is sent to the graph convolution layer, and the propagation rules guiding the feature conversion of the graph convolution layer are as follows:

[0036]

[0037] In the formula, represents the output feature of the l-th layer node v, R represents the real number set, d (l) represents the dimension, N(v) represents the neighboring nodes of node v, represents the output feature of the l-1th layer node v, represents the output features of node v’s neighbor node ω, represents the d of the lth layer (l-1) Line d (l) The weight matrix of the columns; σ(·) is the activation function;

[0038] b. Graph pooling layer:

[0039] The purpose of the graph pooling layer is to reduce the size of the original graph by applying a pooling ratio k∈(0,1], which means that a graph with N nodes will have kN nodes after the graph pooling layer, and kN is rounded up, thereby reducing the subsequent computation in the network. It just calculates the learnable vector after each pooling operation. The projection score removes N-kN nodes, and the projection score is also used as a gating value to make the gradient flow into Therefore, for the remaining nodes, the degree of feature retention will be proportional to their scores;

[0040] represents the node feature matrix; represents the node features of each node after being processed by the graph convolution layer, and A represents the adjacency matrix of the graph; the transformation principle of the graph pooling layer that calculates the pooled graph (F′, A′) from the input graph (F, A) is expressed as:

[0041]

[0042] In the formula, F′ and A′ represent the graph feature matrix and the graph adjacency matrix after the output of the graph pooling layer, respectively. Denotes F according to the learnable vector The projection score of the graph after deleting N-kN nodes, ||·|| represents the L2 norm, represents a pooling operation with a pooling ratio of k∈(0,1], ⊙ represents broadcast element multiplication, is an index operation, which uses the node at the specified index;

[0043] c. Image readout layer:

[0044] In order to generate a fixed-length representation of the entire graph for graph classification tasks, a graph readout layer is introduced to flatten the features of all nodes. Following the traditional convolutional neural network, global average pooling and global maximum pooling are performed to enhance the performance of the module representation; the operation of the graph readout layer is performed after each interleaved graph convolution layer and graph pooling layer, i.e., convolutional pooling block, and finally the summaries of all convolutional pooling blocks are aggregated together; the lth convolutional pooling block (F (l) ,A (l) )'s output graph vector It is expressed as follows:

[0045]

[0046] In the formula, represents the feature vector of node i, represents the feature vector of node j, N (l) represents the number of nodes on the graph, | represents a serial operation; F (l) , A (l)They represent the node feature matrix and adjacency matrix of the input graph of the lth convolutional pooling block respectively; finally, the vector embedded in the Euclidean space by S-PDG is calculated as the sum of all convolutional pooling blocks, that is, For the next step of vector fusion, V E It represents the output result of the graph readout layer, that is, the graph embedding vector obtained in the Euclidean space using the graph convolutional neural network framework, and L represents the number of convolutional pooling blocks.

[0047] Further, in step S5, the graph embedding vector V obtained by using the hyperbolic graph convolutional neural network in the hyperbolic space is H , and the graph embedding vector V obtained using the graph convolutional neural network framework in Euclidean space E Further fusion is performed; in this fusion work, two trainable weight fusion parameters w1 and w2 are set, and the stochastic gradient descent algorithm is used according to the model for automatic training adjustment. Formally, the fusion representation is calculated as:

[0048]

[0049] Where V weight represents the fusion vector obtained after weighted fusion, and denotes the i-th eigenvector in the graph embedding vector matrix obtained by the hyperbolic space embedding module and the i-th eigenvector in the graph embedding vector matrix obtained by the Euclidean space embedding module, respectively, v i Indicates that the weight fusion parameters w1 and w2 are fused and The result after this fusion; in the specific implementation of this fusion work, V H and V E The dimensions are all equal to 256, otherwise they need to be padded to the same length.

[0050] Further, in step S6, the vector V that combines the hyperbolic embedding representation and the Euclidean embedding representation is finally weight The input contains a classification prediction module with a multi-layer perceptron for final prediction, which allows the detection of high-order relationships between features. Each hidden layer in the multi-layer perceptron contains a linear layer, a ReLU activation function layer, and a Dropout layer. Finally, a softmax layer is used to output the probability of the class label, i.e., the vulnerability classification result.

[0051] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0052] 1. The present invention effectively improves the performance of vulnerability detection.

[0053] 2. The present invention extracts slices from source code, generates a slice representation of the program dependency graph, i.e., S-PDG, and maps the user-defined variable names and function names in the slices to standard symbol names for naming normalization, and uses Doc2Vec to convert each statement of the source code, i.e., the token of each node on the S-PDG, into a vector representation. This reduces the interference of sample redundant information on vulnerability detection, reduces the noise caused by personalized naming of program variables, and improves the retention of the original code semantics.

[0054] 3. A weighted fusion strategy is designed to fuse the code features extracted from hyperbolic space and Euclidean space to obtain more comprehensive code semantic information.

[0055] In summary, the present invention effectively reduces the distortion when processing the structure information of the program source code graph. By converting the source code into a slice dependency graph containing data and control dependencies, namely S-PDG, and encoding its nodes and edges, the present invention embeds the slice graph in hyperbolic space and Euclidean space respectively to capture vulnerability features from different perspectives, and effectively fuses the features extracted from the two spaces, thereby achieving accurate vulnerability prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 It is a framework diagram of the method of the present invention; in the figure, CWE119, CWE476, and CWE120 are different source code vulnerability types, PDG is a program dependency graph, S-PDG is a slice-level subgraph of the program dependency graph, CDE is a control dependency edge, DDE is a data dependency edge, Slice Point is a program slice reference point, Symbolization and Embedding is code standardization and embedding, Token is a code token, Vector is an embedded vector representation of the corresponding code token, Void, Fun1, and VAR1 are index representations of standardized custom function names and variable names, Graph Edges is the edge of S-PDG, and Graph Nodes is the node of S-PDG, graph_hid_dhgcn is the output result of the hyperbolic space embedding module, graph_hid_degcn is the output result of the Euclidean space embedding module, graph_hid_dehgcn is the output result after the fusion of graph_hid_dhgcn and graph_hid_degcn, Linear is the linear layer of the multi-layer perceptron, Softmax is the softmax function; 1 / 0 represents the detection result, that is, 1 represents the detection of a vulnerability, and 0 represents the detection of no vulnerability.

[0057] Figure 2 Schematic diagram of S-PDG analysis; in the figure, the solid arrows CDE are control dependency edges, and the dotted arrows DDE are data dependency edges. bThe set of statements generated for backward slicing, S f The set of statements generated for forward slicing, S f ∪S b is the final slicing statement set, and node 5 is the program slicing reference point.

[0058] Figure 3 It is the structural diagram of the hyperbolic space embedding module. In the figure, the HGCN layer is the hyperbolic graph convolutional neural network layer, and graph_hid_dhgcn is the output result of the hyperbolic space embedding module.

[0059] Figure 4 It is the structural diagram of the Euclidean space embedding module. In the figure, graph_hid_degcn is the output result of the Euclidean space embedding module. DETAILED DESCRIPTION

[0060] The present invention is further described in detail below in conjunction with embodiments and drawings, but the embodiments of the present invention are not limited thereto.

[0061] like Figure 1 As shown, this embodiment discloses a source code vulnerability detection method of multi-dimensional feature fusion, and designs a hyperbolic space embedding module and a Euclidean space embedding module as a base model for feature extraction, which includes the following steps:

[0062] 1) Analyze S-PDG:

[0063] Considering control dependency and data dependency, the Joern tool is used to generate the program dependency graph PDG, and the slicing criteria are defined. Code slicing is performed based on the slicing criteria. The slicing graph S-PDG of each program is constructed by forward and backward traversal analysis of PDG.

[0064] Slicing criteria: This paper selects system API calls as the main slicing program benchmarks because they are widely used in applications and are easily abused, and are one of the main causes of vulnerabilities. In addition, for some vulnerabilities that occur when arithmetic operators are applied, code statements containing arithmetic operators are further selected as program slicing benchmarks to supplement system API calls. This paper uses SVF to automatically identify system API calls and uses antlr to identify arithmetic operators, namely +, -, *, / , %; bitwise operators &, |, ∧, ~, <<, >>; compound assignment expressions, namely +=, -=, *=, / =, %=, >>=, <<=, &=, ∧=, |= and increment / decrement expressions ++, –. For these identified code statements, this paper regards them as the benchmarks for code slicing, namely, slicing criteria.

[0065] Detailed operation process: Figure 2 As shown:

[0066] The process involves three main steps: First, the source code is parsed using the Joern tool to generate a program dependency graph (PDG), as shown in Figure (a), where each node represents a code statement and the edge represents the control or data dependency between statements. Next, as shown in Figure (b), starting from the specified program slice reference point, forward and backward traversals are performed along the PDG to construct a set of program slice nodes. Finally, as shown in Figure (c), the control flow and data flow information are combined to generate an S-PDG that accurately captures the program structure. The key to this process is to accurately identify and extract code snippets related to potential vulnerabilities for in-depth analysis.

[0067] 2) Standardization and embedding:

[0068] For each S-PDG constructed, this paper first uses Doc2Vec to perform unstructured code information, that is, embedding of code tokens for each node on the S-PDG. In order to reduce the noise caused by personalized naming of program variables and improve the retention of original code semantics, this paper normalizes the code tokens into a standardized symbolic form before embedding. User-defined variables and functions are replaced with symbolic names, that is, each variable and function is mapped to a universal identifier and a separate index, namely FUN0, FUN1, VAR0, VAR1. After standardization, this paper uses Doc2Vec to convert the code token sequence of each S-PDG node, that is, the program statement, into a vector.

[0069] 3) Benefiting from the expressive power of hyperbolic embedding and Euclidean embedding, this paper combines hyperbolic representation and Euclidean representation for vulnerability detection. A hyperbolic space embedding module for source code is designed, called DHGCN. A hyperbolic graph convolutional neural network is used to implement deep mining of hierarchical features of code graphs based on hyperbolic space, and a hyperbolic embedding representation of code graphs is implemented with low distortion. A Euclidean space embedding module for source code is designed, called DEGCN. A graph convolutional neural network architecture combining graph convolutional layers, graph pooling layers, and graph readout layers is used to perform Euclidean embedding representation of source code.

[0070] Hyperbolic space embedding module, as shown in the attached Figure 3 The specific situation is as follows:

[0071] a. Hyperbolic mapping layer:

[0072] The input of DHGCN includes the structured and unstructured information of S-PDG, namely the adjacency matrix and the node vector matrix. The node features after code standardization and embedding are still Euclidean features, and the node feature vectors in Euclidean space need to be mapped to the hyperbolic space. The hyperbolic mapping layer maps the node feature vector matrix of S-PDG to the hyperbolic space. The transformation operation in the hyperbolic mapping layer is as follows:

[0073]

[0074] In the formula, is the node feature vector in Euclidean space, is the node feature vector in the hyperbolic space after mapping; c is the curvature of the hyperbolic space; represents the exponential mapping from Euclidean space to hyperbolic space, based on the origin o, let represents the origin in a hyperbolic space of curvature c and dimension d; Representation vector The Euclidean norm of ; cosh and sinh are the hyperbolic cosine and hyperbolic sine functions, respectively.

[0075] b. Hyperbolic graph convolutional neural network layer:

[0076] After the hyperbolic space representation of the node feature vector is obtained by the hyperbolic mapping layer, it is input into the hyperbolic graph convolutional neural network layer for further processing. The hyperbolic graph convolutional neural network layer includes a hyperbolic layer, a hyperbolic aggregation layer, and a hyperbolic activation layer. The message passing in the hyperbolic graph convolutional neural network layer is as follows:

[0077]

[0078] In the formula, is the feature vector of node i after being mapped by the hyperbolic mapping layer, h i is the updated eigenvector of the hyperbolic layer, h i ′ is the eigenvector after the hyperbolic aggregation layer is aggregated, h i ″ is the feature vector after the hyperbolic activation layer is activated; h j is the node feature vector of node i’s neighbor node j after being updated by the hyperbolic layer; W is the weight matrix of the hyperbolic transformation; c is the curvature in the hyperbolic space; and They are exponential mapping and logarithmic mapping respectively; Represents a Möbius in hyperbolic space Vector multiplication; N(i) is the set of neighbor nodes of node i, |N(i)| is the number of neighbor nodes of node i; σ is the activation function in Euclidean space, such as ReLU activation function.

[0079] The hyperbolic graph convolutional neural network layer preserves the tree structure of the code graph with low distortion. In this way, the hyperbolic graph convolutional neural network layer smoothly converts Euclidean features into hyperbolic embeddings that preserve the node hierarchy. Attention aggregation in the hyperbolic space can pay more attention to nodes with high-level structures in the program code.

[0080] DHGCN can stack multiple hyperbolic graph convolution layers. At each layer, the hyperbolic graph convolutional neural network layer transforms and aggregates the embeddings of the neighbors in the tangent space of the central node, and projects the results into a hyperbolic space with different curvatures. In this method, two layers of hyperbolic graph convolution layers are stacked, and the hyperbolic embedding result of the last layer is used for the next step of processing.

[0081] c. Global attention pooling layer:

[0082] The node feature vector of the hyperbolic embedding obtained after the output of the last layer of hyperbolic graph convolution layer is input into the global attention pooling layer for further processing. The global attention pooling layer can extract global information from the hyperbolic embedding hidden representation of the code graph output by the hyperbolic graph convolution layer, rather than just being limited to the local area. By calculating weights and weighted aggregation, this layer can reduce the complexity of the input to a global representation, thereby improving computational efficiency. By modeling the global context, the global attention pooling layer also helps reduce the model's overfitting to local noise. The processing of the global attention pooling layer is as follows:

[0083]

[0084] Where V H is the graph feature after global attention pooling, that is, the graph embedding vector finally obtained by the hyperbolic graph convolutional neural network; N is the total number of nodes in S-PDG; x i is the eigenvector of the ith node; ⊙ represents the Hadamard product; h gate is a gated graph sequence neural network, h Θ is another optional neural network used to transform node features before the attention weights are applied to them. Here, a linear layer is used for simple transformation; h gate The output of is normalized on the nodes in the graph through the softmax function to obtain the attention weights of each node, and then these attention weights are combined with h Θ The processed node features are subjected to Hadamard product operation, and finally the nodes in S-PDG are summed according to the index to obtain the weighted feature representation of S-PDG for the next step of vector fusion.

[0085] Euclidean space embedding module, as shown in the attached Figure 4 The specific situation is as follows:

[0086] a. Graph convolution layer:

[0087] The obtained batch of S-PDGs are used as the input of the Euclidean space embedding module, including structured information and unstructured information, namely the adjacency matrix and the node vector matrix. First, the input data is fed into the graph convolution layer. The general propagation rule guiding the feature transformation of the graph convolution layer is as follows:

[0088]

[0089] In the formula, represents the output feature of the l-th layer node v, R represents the real number set, d (l) represents the dimension, N(v) represents the neighboring nodes of node v, represents the output feature of the l-1th layer node v, represents the output features of node v’s neighbor node ω, represents the d of the lth layer (l-1) Line d (l) The weight matrix of the columns; σ(·) is the activation function;

[0090] b. Graph pooling layer:

[0091] The purpose of the graph pooling layer is to reduce the size of the original graph by applying a pooling ratio k∈(0,1], which means that a graph with N nodes will have kN nodes after the graph pooling layer, where kN is rounded up, so

[0092] Reduce the amount of subsequent computation in the network. It simply calculates the learnable vector after each pooling operation. Projection

[0093] The projection score is also used as a gating value to make the gradient flow into Therefore, for the remaining nodes, the degree of feature retention will be proportional to their scores;

[0094] represents the node feature matrix; represents the node features of each node after being processed by the graph convolution layer, and A represents the adjacency matrix of the graph; the transformation principle of the graph pooling layer that calculates the pooled graph (F′, A′) from the input graph (F, A) is expressed as:

[0095]

[0096] In the formula, F′ and A′ represent the graph feature matrix and the graph adjacency matrix after the output of the graph pooling layer, respectively. Denotes F according to the learnable vector The projection score of the graph after deleting N-kN nodes, ||·|| represents the L2 norm, represents a pooling operation with a pooling ratio of k∈(0,1], ⊙ represents broadcast element multiplication, is an index operation, which uses The node at the specified index.

[0097] c. Image readout layer:

[0098] In order to generate a fixed-length representation of the entire graph for graph classification tasks, a graph readout layer is introduced to flatten the features of all nodes. Following the traditional convolutional neural network, global average pooling and global maximum pooling are performed to enhance the performance of the module representation; the operation of the graph readout layer is performed after each interleaved graph convolution layer and graph pooling layer, i.e., convolutional pooling block, and finally the summaries of all convolutional pooling blocks are aggregated together; the lth convolutional pooling block (F (l) ,A (l) )'s output graph vector It is expressed as follows:

[0099]

[0100] In the formula, represents the feature vector of node i, represents the feature vector of node j, N (l) represents the number of nodes on the graph, || represents the serial operation; F (l) , A (l) They represent the input graph and adjacency matrix of the lth convolutional pooling block respectively; finally, the vector embedded in the Euclidean space by S-PDG is calculated as the sum of all convolutional pooling blocks, that is, For the next step of vector fusion, V E It represents the output result of the graph readout layer, that is, the graph embedding vector obtained in the Euclidean space using the graph convolutional neural network framework, and L represents the number of convolutional pooling blocks.

[0101] 4) Finally, the vector fusion module and classification prediction module were designed.

[0102] The specific operation steps of the vector fusion module are as follows:

[0103] For the graph embedding vector V obtained using a hyperbolic graph convolutional neural network in hyperbolic space H , and the graph embedding vector V obtained using the graph convolutional neural network framework in Euclidean space E Further fusion is performed; in this fusion work, two trainable weight fusion parameters w1 and w2 are set, and the stochastic gradient descent algorithm is used according to the model for automatic training adjustment. Formally, the fusion representation is calculated as:

[0104]

[0105] Where V weight represents the fusion vector obtained after weighted fusion, and denotes the i-th eigenvector in the graph embedding vector matrix obtained by the hyperbolic space embedding module and the i-th eigenvector in the graph embedding vector matrix obtained by the Euclidean space embedding module, respectively, v iIndicates that the weight fusion parameters w1 and w2 are fused and The result after this fusion; in the specific implementation of this fusion work, V H and V E The dimensions are all equal to 256, otherwise they need to be padded to the same length.

[0106] The specific operation steps of the classification prediction module are as follows:

[0107] Finally, the vector V that represents the entire graph is a fusion of the hyperbolic embedding representation and the Euclidean embedding representation. weight The final prediction is made by the classification prediction module containing a multi-layer perceptron. It allows the detection of high-order relationships between features. Each hidden layer in the multi-layer perceptron contains a linear layer, a ReLU activation function layer, and a Dropout layer. Finally, the softmax layer is used to output the probability of the class label, that is, the vulnerability classification result. It is worth noting that most of the parameters in the neural network are automatically updated through backpropagation during the training process.

[0108] This paper leverages data from multiple sources to ensure the diversity and adequacy of vulnerability examples. These studies mainly involve a large number of function samples collected from SARD and NVD, as well as non-vulnerable and vulnerable function samples extracted from six open source software, including Asterisk, FFmpeg, LibPNG, LibTiFF, Pidgin, and VLC Media Player. In addition, open source C / C++ functions collected from Big-Vul, a widely used real vulnerability dataset, are also included. These functions are marked by static analysis to build the dataset. In the end, this paper used 5311 vulnerable functions and 5926 non-vulnerable functions from the collected data, and extracted 21508 vulnerable slices and 21052 non-vulnerable slices from them.

[0109] Marking S-PDG. Vulnerability detection in this paper is performed at the S-PDG slice level, not at the file or function level. As described in step S1, each constructed PDG is first sliced ​​to generate multiple slices, namely S-PDGs, provided that a program may have multiple benchmarks, which determines the number of S-PDGs. Then, statement-level labels are further used to mark vulnerable / safe S-PDGs. According to the labeling method of SARD, if the sample is extracted from a "good" program, this paper marks it as "0", i.e., non-vulnerable, and if it is extracted from a "bad" or "mixed" program, this paper marks it as "1", i.e., vulnerable. As long as it contains a vulnerable statement marked by SARD, it is "1", i.e., vulnerable, otherwise it is "0", i.e., non-vulnerable. In addition, in order to compare with existing deep learning-based methods, this paper further processes the sample code and marks vulnerabilities at the function level, i.e., if there is a vulnerable statement in a function, the function is marked as vulnerable, so as to compare with these existing methods.

[0110] Handling duplicate / conflicting samples. Duplicate S-PDGs may exist because different programs may have the same code logic and structure, resulting in the same slicing statements and structures. Duplicate samples can lead to overfitting and artificially inflate performance metrics because training data may leak into the validation set. This paper removes duplicate S-PDGs in the dataset by comparing nodes sorted by line number and spatial and temporal edges proportional to the size of the S-PDG.

[0111] In order to comprehensively evaluate the effectiveness of this method in detecting common C / C++ vulnerabilities, this paper selected three traditional rule-based static vulnerability detection tools and three advanced model-based vulnerability detection methods as baselines. These baseline methods include rule-based vulnerability detection methods Infer, RATS, Flawfinder and model-based vulnerability detection methods Devign, SySeVR, and Vuldetexp.

[0112] Compared with traditional rule-based vulnerability detection tools, the use of neural network models to automatically mine and learn vulnerability patterns in training samples can better adapt to unknown vulnerability types and complex code structures. They improve the accuracy of detection and reduce false reports by learning the characteristics and context of the source code. Compared with existing model-based vulnerability detection methods, the strategy of fusing hyperbolic representation and Euclidean representation is more advantageous. The hyperbolic space can better capture the hierarchy and nested relationship of the code, while the Euclidean space effectively characterizes the local features and dependencies of the code. By fusing the representations of these two spaces, the present invention can comprehensively analyze the source code from different angles, thereby more accurately detecting potential vulnerabilities.

[0113] Experimental conclusion: In view of the problem that most existing deep learning methods rely on single Euclidean space code embedding, which limits their ability to capture complex vulnerability patterns in the code, this paper proposes a source code vulnerability detection method with multi-dimensional feature fusion. Experimental evaluation using data collected from multiple sources shows that the use of the method of the present invention has a certain improvement in the accuracy of source code vulnerability detection, which is better than existing methods. In the next study, we will focus on building a more comprehensive and higher-quality vulnerability dataset to improve the training effect and generalization ability of the model. Secondly, this study will explore more advanced machine learning and deep learning techniques to further improve the performance of the vulnerability detection model. Finally, we plan to expand the scope of research and predict more auxiliary information, such as vulnerability type, impact range and vulnerability location, in order to provide a more comprehensive vulnerability analysis.

[0114] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. A source code vulnerability detection method based on multi-dimensional feature fusion, characterized in that: The following steps are involved: S1: Obtain the program dependency graph PDG of the source code and slice it to obtain a slice-level subgraph, called S-PDG, which provides a slice-level code graph for model training, enabling the model to predict vulnerabilities at a fine-grained level; S2: Standardize and embed the S-PDG. Specifically, the code of the nodes in the S-PDG is standardized and the code token of each S-PDG node is embedded into the vector representation, thereby reducing the noise caused by the personalized naming of program variables and improving the retention of the original code semantics. S3: Design a hyperbolic space embedding module for source code, called DHGCN, which includes a hyperbolic mapping layer, a hyperbolic graph convolutional neural network layer, and a global attention pooling layer. It uses a hyperbolic graph convolutional neural network to achieve deep mining of hierarchical features of code graphs based on hyperbolic space, and achieves hyperbolic embedding representation of code graphs with low distortion. S4: Design a Euclidean space embedding module for source code, called DEGCN, which includes a graph convolution layer, a graph pooling layer, and a graph readout layer; use a graph convolutional neural network architecture that combines the graph convolution layer, the graph pooling layer, and the graph readout layer to perform the Euclidean embedding representation of the source code, where the graph convolution layer and the graph pooling layer are connected together and called a convolution pooling block; S5: Design a vector fusion module to fuse the hyperbolic embedding representation with the Euclidean embedding representation to obtain the fused vector representation; S6: The vector that combines the hyperbolic embedding representation and the Euclidean embedding representation is input into the classification prediction module containing the multi-layer perceptron to perform vulnerability classification prediction.

2. According to the multi-dimensional feature fusion source code vulnerability detection method of claim 1, it is characterized in that: The specific operation steps of step S1 are as follows: S11: Considering the control dependency and data dependency of the source code, the Joern tool is used to generate the program dependency graph PDG; S12: Use SVF to automatically identify system API calls, and use antlr to identify arithmetic operators, which are considered as the main slicer benchmarks, and code slicing is performed based on the slicer benchmarks; S13: Iteratively traverse the PDG through the slicer reference point to perform forward and backward slicing: First, the nodes of S-PDG are obtained by forward and backward slicing starting from the slicer reference point; for forward slicing, forward traversal is performed along the PDG starting from the slicer reference point to obtain the forward slicing statement set S f ; For backward slicing, traverse the PDG from the slicing program base point to include all visited statements to obtain the backward slicing statement set S. b ; S f and S b The statements in are the final set of statements, namely They retain the control flow and data flow information of the source code and generate the nodes of the S-PDG according to the final statement set; then, they connect the nodes according to the edges of the PDG. The nodes in are used to generate the final S-PDG, thereby capturing the control dependencies and data dependencies of the program at the slice level.

3. The source code vulnerability detection method based on multi-dimensional feature fusion according to claim 2 is characterized in that: The specific operation steps of step S2 are as follows: S21: Replace user-defined variable names and function names with symbolic names, and map each variable name and function name to a universal identifier and a separate index, that is, the user-defined function name and variable name are standardized into a unified index representation such as FUN0, FUN1, VAR0, VAR1; S22: For each S-PDG constructed, a pre-trained Doc2Vec is used to perform unstructured code information, i.e., embedding of each standardized node code token on the S-PDG, where the Doc2Vec can encode the entire node code sentence of the S-PDG instead of a single code token into a fixed-length vector.

4. The source code vulnerability detection method based on multi-dimensional feature fusion according to claim 3 is characterized in that: In step S3, the specific conditions of the hyperbolic mapping layer, the hyperbolic graph convolutional neural network layer, and the global attention pooling layer are as follows: a. Hyperbolic mapping layer: The input of DHGCN includes the structured and unstructured information of S-PDG, namely the adjacency matrix and the node feature vector matrix. The node features after code standardization and embedding in step S2 are still Euclidean features. It is necessary to map the node feature vectors in Euclidean space to hyperbolic space. The hyperbolic mapping layer maps the node feature vector matrix of S-PDG to hyperbolic space. The transformation operation in the hyperbolic mapping layer is as follows: In the formula, is the node feature vector in Euclidean space, is the node feature vector in the hyperbolic space after mapping; c is the curvature of the hyperbolic space; represents the exponential mapping from Euclidean space to hyperbolic space, based on the origin o, let represents the origin in a hyperbolic space of curvature c and dimension d; Representation vector The Euclidean norm of ; cosh and sinh are the hyperbolic cosine and hyperbolic sine functions respectively; b. Hyperbolic graph convolutional neural network layer: After the hyperbolic space representation of the node feature vector is obtained by the hyperbolic mapping layer, it is input into the hyperbolic graph convolutional neural network layer for further processing. The hyperbolic graph convolutional neural network layer includes a hyperbolic layer, a hyperbolic aggregation layer, and a hyperbolic activation layer. The message passing in the hyperbolic graph convolutional neural network layer is as follows: In the formula, h i is the node feature vector after the hyperbolic layer is updated, h i ′ is the node feature vector after the hyperbolic aggregation layer, h i ″ is the node feature vector after activation by the hyperbolic activation layer; j∈N(i) represents the neighbor node j of node i; h j is the node feature vector of node i’s neighbor node j after being updated by the hyperbolic layer; W is the weight matrix of the hyperbolic transformation; It is a logarithmic mapping; represents the Möbius vector multiplication in hyperbolic space; N(i) is the set of neighbor nodes of node i, |N(i)| is the number of neighbor nodes of node i; σ is the activation function in Euclidean space; The hyperbolic graph convolutional neural network layer preserves the tree structure of the code graph with low distortion. In this way, the hyperbolic graph convolutional neural network layer smoothly converts the Euclidean features into hyperbolic embeddings that preserve the node hierarchy. Attention aggregation is performed in the hyperbolic space, which can pay more attention to nodes with high-level structures in the program code. DHGCN can stack multiple hyperbolic graph convolutional neural network layers. At each layer, the hyperbolic graph convolutional neural network layer transforms and aggregates the embeddings of neighbors in the tangent space of the central node, and projects the results into a hyperbolic space with different curvatures. The hyperbolic embedding results of the last layer are input into the global attention pooling layer. c. Global attention pooling layer: The node feature vector of the hyperbolic embedding obtained after the output of the last layer of the hyperbolic graph convolutional neural network layer is input into the global attention pooling layer for further processing. The global attention pooling layer can extract global information from the hyperbolic embedding hidden representation of the code graph output by the hyperbolic graph convolutional neural network layer, rather than just being limited to the local area. By calculating weights and weighted aggregation, the global attention pooling layer can reduce the complexity of the input to a global representation, thereby improving computational efficiency. By modeling the global context, the global attention pooling layer also helps reduce the overfitting of the model to local noise. The processing of the global attention pooling layer is as follows: Where V H is the graph feature after global attention pooling, that is, the graph embedding vector finally obtained by the hyperbolic graph convolutional neural network; N is the total number of nodes in S-PDG; x i is the eigenvector of the ith node; ⊙ represents the Hadamard product; h gate is a gated graph sequence neural network, h Θ is another optional neural network used to transform node features before the attention weights are applied to them. Here, a linear layer is used for simple transformation; h gate The output of is normalized on the nodes in the graph through the softmax function to obtain the attention weights of each node, and then these attention weights are combined with h Θ The processed node features are subjected to Hadamard product operation, and finally the nodes in S-PDG are summed according to the index to obtain the weighted feature representation of S-PDG for the next step of vector fusion.

5. The method for detecting source code vulnerabilities by multi-dimensional feature fusion according to claim 4, characterized in that: In step S4, the details of the graph convolution layer, graph pooling layer, and graph readout layer are as follows: a. Graph convolution layer: The batch of S-PDGs obtained in step S2 is used as the input of the Euclidean space embedding module, including structured information and unstructured information, namely the adjacency matrix and the node vector matrix; first, the input data is sent to the graph convolution layer, and the propagation rules guiding the feature conversion of the graph convolution layer are as follows: In the formula, represents the output feature of the l-th layer node v, R represents the real number set, d (l) represents the dimension, N(v) represents the neighboring nodes of node v, represents the output feature of the l-1th layer node v, represents the output features of node v’s neighbor node ω, represents the d of the lth layer (l-1) Line d (l) The weight matrix of the columns; σ(·) is the activation function; b. Graph pooling layer: The purpose of the graph pooling layer is to reduce the size of the original graph by applying a pooling ratio k∈(0,1], which means that a graph with N nodes will have kN nodes after the graph pooling layer, and kN is rounded up, thereby reducing the subsequent computation in the network. It just calculates the learnable vector after each pooling operation. The projection score removes N-kN nodes, and the projection score is also used as a gating value to make the gradient flow into Therefore, for the remaining nodes, the degree of feature retention will be proportional to their scores; represents the node feature matrix; represents the node features of each node after being processed by the graph convolution layer, and A represents the adjacency matrix of the graph; the transformation principle of the graph pooling layer that calculates the pooled graph (F′, A′) from the input graph (F, A) is expressed as: In the formula, F′ and A′ represent the graph feature matrix and the graph adjacency matrix after the output of the graph pooling layer, respectively. Denotes F according to the learnable vector The projection score of the graph after deleting N-kN nodes, ||·|| represents the L2 norm, represents a pooling operation with a pooling ratio of k∈(0,1], ⊙ represents broadcast element multiplication, is an index operation, which uses the node at the specified index; c. Image readout layer: In order to generate a fixed-length representation of the entire graph for graph classification tasks, a graph readout layer is introduced to flatten the features of all nodes. Following the traditional convolutional neural network, global average pooling and global maximum pooling are performed to enhance the performance of the module representation; the operation of the graph readout layer is performed after each interleaved graph convolution layer and graph pooling layer, i.e., convolutional pooling block, and finally the summaries of all convolutional pooling blocks are aggregated together; the lth convolutional pooling block (F (l) ,A (l) )'s output graph vector It is expressed as follows: In the formula, represents the feature vector of node i, represents the feature vector of node j, N (l) represents the number of nodes on the graph, || represents the serial operation; F (l) , A (l) They represent the node feature matrix and adjacency matrix of the input graph of the lth convolutional pooling block respectively; finally, the vector embedded in the Euclidean space by S-PDG is calculated as the sum of all convolutional pooling blocks, that is, For the next step of vector fusion, V E It represents the output result of the graph readout layer, that is, the graph embedding vector obtained in the Euclidean space using the graph convolutional neural network framework, and L represents the number of convolutional pooling blocks.

6. The method for detecting source code vulnerabilities by multi-dimensional feature fusion according to claim 5, characterized in that: In step S5, the graph embedding vector V is obtained using the hyperbolic graph convolutional neural network in the hyperbolic space. H , and the graph embedding vector V obtained using the graph convolutional neural network framework in Euclidean space E Further fusion is performed; in this fusion work, two trainable weight fusion parameters w1 and w2 are set, and the stochastic gradient descent algorithm is used according to the model for automatic training adjustment. Formally, the fusion representation is calculated as: Where V weight represents the fusion vector obtained after weighted fusion, and denotes the i-th eigenvector in the graph embedding vector matrix obtained by the hyperbolic space embedding module and the i-th eigenvector in the graph embedding vector matrix obtained by the Euclidean space embedding module, respectively, v i Indicates that the weight fusion parameters w1 and w2 are fused and The result after this fusion; in the specific implementation of this fusion work, V H and V E The dimensions are all equal to 256, otherwise they need to be padded to the same length.

7. The method for detecting source code vulnerabilities by multi-dimensional feature fusion according to claim 6, characterized in that: In step S6, the vector V that combines the hyperbolic embedding representation and the Euclidean embedding representation is finally weight The input contains a classification prediction module of a multi-layer perceptron for final prediction, which allows the detection of high-order relationships between features. Each hidden layer in the multi-layer perceptron contains a linear layer, a ReLU activation function layer and a Dropout layer. Finally, a softmax layer is used to output the probability of the class label, that is, the vulnerability classification result.

Images