Source code vulnerability detection method and device based on fusion code attribute graph and electronic equipment

Abstract

The invention provides a source code vulnerability detection method and device based on a fusion code attribute graph and electronic equipment, and the method comprises the steps: obtaining to-be-detected source code data, extracting the code representation of the source code data, and converting the code representation into the fusion code attribute graph; inputting the graph coding features of the fused code attribute graph into a vulnerability detection model to obtain a vulnerability detection result; and interpreting the vulnerability detection result based on the interpretable model to obtain a fine-grained interpretation result of the code statement related to the vulnerability in the vulnerability detection result. Compared with a traditional code attribute graph, the fusion code attribute graph has more advantages in the aspect of covering a grammar structure and a function calling relation, the context correlation of codes can be reflected more comprehensively, and support is provided for accurately recognizing complex code vulnerabilities; the interpretable model interprets the vulnerability detection result, points out code statements related to the vulnerability, provides a fine-grained interpretation result, and can help subsequent developers to quickly repair the vulnerability.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a source code vulnerability detection method, device and electronic device based on a fused code attribute graph. Background Art

[0002] Source code vulnerability detection is an important part of software security assurance and is of great significance for improving software security and reducing potential security threats.

[0003] In the existing technology, although traditional vulnerability detection methods, such as static analysis and dynamic analysis, can detect potential vulnerabilities in the code to a certain extent, these methods often have problems of low detection accuracy and poor interpretability when faced with complex cross-function vulnerabilities and advanced grammatical structures.

[0004] However, many current vulnerability detection models based on graph neural networks lack sufficient interpretability when providing detection results, and can often only provide coarse-grained detection results, making it difficult for users to fully trust the model's judgment. This lack of interpretability not only affects the actual application effect of the model, but may also cause potential security threats to be ignored, further increasing the security risks of the system. Summary of the invention

[0005] The present invention provides a source code vulnerability detection method, device and electronic device based on a fused code attribute graph, so as to solve the defect that the detection results of the traditional vulnerability detection method and the vulnerability detection model based on the graph neural network in the prior art lack interpretability.

[0006] The present invention provides a source code vulnerability detection method based on a fusion code attribute graph, comprising the following steps: Acquire source code data to be detected, extract code representation of the source code data, and convert the code representation into a fused code attribute graph; Inputting the graph encoding features of the fusion code attribute graph into a vulnerability detection model to obtain a vulnerability detection result output by the vulnerability detection model; The vulnerability detection result is interpreted based on an interpretable model to obtain a fine-grained interpretation result of the code statements related to the vulnerability in the vulnerability detection result.

[0007] According to a source code vulnerability detection method based on a fused code property graph provided by the present invention, the code representation of the source code data is extracted and converted into a fused code property graph, including: Using a source code analysis tool Joern to extract an abstract syntax tree from the source code data, and determining a code attribute graph based on the abstract syntax tree; Text recognition is performed on the source code data to obtain function call relations and natural control flow sequences, and the function call relations and the natural control flow sequences are added to the code attribute graph in the form of edges to obtain the fused code attribute graph.

[0008] According to a source code vulnerability detection method based on a fused code property graph provided by the present invention, the step of determining the graph encoding feature of the fused code property graph comprises: Using the GloVe model to embed information of nodes and edges of different dimensions in the fusion code attribute graph to obtain graph embedding features; Inputting the graph embedding feature into a sentence encoding network to obtain the graph encoding feature output by the sentence encoding network; The sentence encoding network includes a multi-dimensional feature network Muit-FN and a feature fusion network AMBG; The multi-dimensional feature network Muit-FN is used to determine the local natural word order features, grammatical structure features and context features of each sentence node in the graph embedding feature; The feature fusion network AMBG is used to perform feature fusion on the local natural word order feature, the grammatical structure feature and the context feature to obtain the graph coding feature.

[0009] According to a source code vulnerability detection method based on a fused code property graph provided by the present invention, the training step of the vulnerability detection model includes: Obtaining sample source code data and labeled vulnerabilities of the sample source code data, and determining an initial vulnerability detection model; Extracting a sample code representation of the sample source code data, and converting the sample code representation into a sample fusion code attribute graph; Inputting the sample graph encoding features of the sample fusion code attribute graph into the initial vulnerability detection model to obtain the vulnerability prediction result output by the initial vulnerability detection model; Based on the difference between the vulnerability prediction result and the label vulnerability, a target loss is determined, and based on the target loss, parameters of the initial vulnerability detection model are iterated to obtain the vulnerability detection model.

[0010] According to a source code vulnerability detection method based on a fusion code attribute graph provided by the present invention, the vulnerability detection model includes a program coding network, a fully connected layer and an activation layer; The program encoding network is constructed based on a multi-feature fusion model and a graph convolutional network.

[0011] According to a source code vulnerability detection method based on a fused code attribute graph provided by the present invention, the vulnerability detection result is interpreted based on an interpretable model to obtain a fine-grained interpretation result of the code statements related to the vulnerability in the vulnerability detection result, including: Inputting the vulnerability detection result and the graph encoding feature of the fusion code attribute graph into the interpretable model to obtain the fine-grained interpretation result output by the interpretable model; The interpretable model is built based on the graph neural network interpreter IGEW, and the graph neural network interpreter IGEW is obtained by adding a weight optimizer to the graph neural network interpreter GNNExplainer.

[0012] The present invention also provides a source code vulnerability detection device based on a fusion code attribute graph, comprising the following units: An acquisition unit, configured to acquire source code data to be detected, extract code representation of the source code data, and convert the code representation into a fused code attribute graph; An input unit, used for inputting the graph coding features of the fusion code attribute graph into a vulnerability detection model to obtain a vulnerability detection result output by the vulnerability detection model; The interpretation unit is used to interpret the vulnerability detection result based on the interpretable model to obtain a fine-grained interpretation result of the code statement related to the vulnerability in the vulnerability detection result.

[0013] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the source code vulnerability detection method based on the fused code property graph as described above is implemented.

[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for detecting source code vulnerabilities based on a fused code property graph as described above is implemented.

[0015] The present invention also provides a computer program product, including a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned source code vulnerability detection methods based on a fused code property graph.

[0016] The source code vulnerability detection method, device and electronic device based on the fused code attribute graph provided by the present invention obtain the source code data to be detected, extract the code representation of the source code data, and convert the code representation into a fused code attribute graph; input the graph encoding features of the fused code attribute graph into the vulnerability detection model to obtain the vulnerability detection result output by the vulnerability detection model; interpret the vulnerability detection result based on the interpretable model to obtain the fine-grained interpretation result of the code statement related to the vulnerability in the vulnerability detection result. On the one hand, compared with the traditional code attribute graph, the fused code attribute graph has more advantages in covering the grammatical structure and function call relationship, and can more comprehensively reflect the context relevance of the code, providing support for the accurate identification of complex code vulnerabilities; on the other hand, the interpretable model interprets the vulnerability detection results, points out the code statements related to the vulnerability, and provides fine-grained interpretation results, which can help subsequent developers quickly fix the vulnerability. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 This is one of the flow charts of the source code vulnerability detection method based on the fusion code attribute graph provided by the present invention.

[0019] Figure 2 This is the second flow chart of the source code vulnerability detection method based on the fusion code attribute graph provided by the present invention.

[0020] Figure 3 It is a schematic diagram of the interpretable model provided by the present invention.

[0021] Figure 4 It is a schematic diagram of a vulnerability detection model based on the fusion of code attribute graph and attention mechanism built by the present invention.

[0022] Figure 5 It is a schematic diagram of the source code vulnerability fine-grained positioning method based on the explainability model constructed by the present invention.

[0023] Figure 6 It is a framework diagram of a program feature extraction strategy based on hierarchical semantic perception constructed by the present invention.

[0024] Figure 7 It is a structural schematic diagram of a source code vulnerability detection device based on a fused code attribute graph provided by the present invention.

[0025] Figure 8 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] In related technologies, as the scale and complexity of software development continue to increase, software security issues are becoming more and more serious, and vulnerabilities in source code have become a major challenge in the field of information security. Source code vulnerabilities may lead to serious consequences such as system attacks, data leaks, and service interruptions, which in turn cause huge economic losses to enterprises and individuals.

[0028] In order to cope with the increasingly common and difficult-to-detect software security risks, source code vulnerability detection technology has emerged. This research aims to improve the security of software by discovering and fixing potential vulnerabilities in software source code. Nowadays, facing the exponential growth trend of the number of officially released vulnerabilities, it is necessary to improve the intelligence of software vulnerability detection to ensure its efficiency and accuracy. This research involves technologies and methods such as static code analysis, symbolic execution, fuzz testing and vulnerability pattern recognition. Source code vulnerability detection is an important part of software security assurance, and is of great significance for improving software security and reducing potential security threats.

[0029] According to statistics released by the National Vulnerability Database (NVD), the number of software vulnerabilities announced in 2023 reached an unprecedented level, with a total of 28,829 vulnerabilities. Today, in the information technology environment in which we live, software vulnerabilities are everywhere, which has a significant impact on people's digital lives. Unfortunately, due to factors such as technical complexity, excessive code volume, and frequent changes in source code, it is almost impossible to completely eliminate software vulnerabilities, which has become a huge challenge in the software development process. However, timely discovery and patching of these vulnerabilities can significantly reduce the resulting security risks and prevent irreparable losses.

[0030] Therefore, how to effectively detect and fix vulnerabilities in source code has become a research topic that needs to be solved urgently. Although traditional vulnerability detection methods, such as static analysis and dynamic analysis, can detect potential vulnerabilities in the code to a certain extent, these methods often have problems with low detection accuracy and poor interpretability when facing complex cross-function vulnerabilities and advanced grammatical structures. In order to improve the accuracy and interpretability of vulnerability detection, researchers have begun to explore vulnerability detection methods based on graph neural networks (GNNs) in recent years.

[0031] Graph neural network is a deep learning model that can process graph structured data. It has gradually become an important tool for code analysis and vulnerability detection because of its ability to effectively capture the complex relationships between nodes in the graph and learn graph structure representation. However, traditional graph neural network models still face some challenges when applied to actual source code vulnerability detection.

[0032] (1) Although the traditional Code Property Graph (CPG) can express some grammatical structure information of the source code, it often has the problem of insufficient information expression when facing complex program structures such as function call relationships. In addition, cross-function vulnerabilities usually involve interactions between multiple functions. These complex cross-function relationships are difficult to be effectively tracked in traditional code property graphs, thus affecting the accuracy of vulnerability detection.

[0033] (2) Traditional graph neural network models still face the challenge of insufficient feature expression capabilities due to the difficulty in retaining sufficient contextual information during the sampling process.

[0034] (3) In actual vulnerability detection, model interpretability is another crucial factor. Interpretability not only helps developers understand the model's detection results, but also helps them locate and fix vulnerabilities more accurately. However, many current vulnerability detection models based on graph neural networks lack sufficient interpretability when providing detection results. They can often only provide coarse-grained detection results, making it difficult for users to fully trust the model's judgment. This lack of interpretability not only affects the actual application effect of the model, but may also cause potential security threats to be ignored, further increasing the security risks of the system.

[0035] Based on the above problems, the present invention provides a source code vulnerability detection method based on fusion code attribute graph. Figure 1 This is one of the flow diagrams of the source code vulnerability detection method based on the fusion code attribute graph provided by the present invention. Figure 2 This is the second flow chart of the source code vulnerability detection method based on the fusion code attribute graph provided by the present invention, such as Figure 1 , Figure 2As shown, the method includes step 110 , step 120 and step 130 .

[0036] Step 110 , obtaining source code data to be detected, extracting code representation of the source code data, and converting the code representation into a fused code attribute graph.

[0037] Specifically, source code data to be detected may be obtained, and the source code data may be a set of experimental data obtained after screening a public vulnerability data set.

[0038] The source code data may be code data that has been preprocessed, that is, code data that has been subjected to data cleaning (deleting redundant information, simplifying the structure) and code normalization operations. It can be understood that performing data cleaning and code normalization operations on code data can improve data quality.

[0039] Then, the code representation of the source code data is extracted. Code representation conversion refers to converting the source code data from text representation to vector form for calculation and analysis of machine learning models. This conversion process needs to retain the semantic information of the source code data, such as data dependency and control dependency. Therefore, an intermediate representation is usually introduced as a "bridge" between the source code data and its corresponding vector representation. This intermediate representation is the code representation.

[0040] Here, the source code analysis tool Joern can be used to extract the program dependency graph PDG (Program Dependence Graph) and abstract syntax tree AST (Abstract Syntax Tree) corresponding to the function samples in the source code data.

[0041] The fused code attribute graph is a fusion graph that uses statement nodes as fusion points to obtain a code attribute graph that combines multi-dimensional semantic information such as abstract syntax tree, control flow graph, data dependency graph, control dependency graph, program dependency graph, function call relationship, natural control flow sequence, etc.

[0042] The fused code attribute graph enhances the context-related characteristics of the code and can fully reflect the structure and characteristics of the source code.

[0043] It is understandable that compared with the traditional code attribute graph, the fused code attribute graph has more advantages in covering the grammatical structure and function call relationship, and can more comprehensively reflect the contextual relevance of the code, providing support for the accurate identification of complex code vulnerabilities.

[0044] Step 120, inputting the graph coding features of the fusion code attribute graph into a vulnerability detection model to obtain a vulnerability detection result output by the vulnerability detection model.

[0045] Specifically, after obtaining the fused code attribute graph, the graph encoding features of the fused code attribute graph may be input into the vulnerability detection model to obtain the vulnerability detection result output by the vulnerability detection model.

[0046] Here, the vulnerability detection model can be GCAVD (Graph Convolutional Network with Combination Code Property Graph and Attention Mechanism for Vulnerability Detection Model), and the program detection model includes a program coding network, a fully connected layer, and an activation layer. Among them, the program coding network is constructed based on a multi-feature fusion model and a graph convolutional network.

[0047] Among them, the program encoding network can be MLF-GCN (Graph Convolutional Network based on Multi-layer Feature Fusion), and the program encoding network captures the global semantic information of the code by learning the dependencies between statement nodes.

[0048] The program coding network will use two levels of coding networks to learn local and global semantic information respectively, so as to more fully extract vulnerability features and improve the final vulnerability judgment ability.

[0049] It should be noted that the vulnerability detection model uses the self-attention mechanism, in which each element has three different representations: query, key, and value. Assume that the input sequence is L=[l 1 , ⋯ ,l 𝑛 ], the calculation process of the query vector 𝑄ue, key vector 𝐾ey and value vector 𝑉al is shown in formulas (1) to (3).

[0050] (1) (2) (3) Among them, 𝑊 𝑄ue , 𝑊 𝐾ey , 𝑊 𝑉al Trainable parameter matrices corresponding to the query vector 𝑄ue, key vector 𝐾ey and value vector 𝑉al respectively.

[0051] After the above three vectors are obtained, the weighting coefficient is obtained by performing a dot multiplication and normalization operation on the query vector 𝑄ue and the key vector 𝐾ey. Finally, the value vector D and the weighting coefficient are weighted and summed to obtain the final output representation Z. The calculation process is shown in formula (4).

[0052] (4) The core mechanism of graph convolutional neural networks lies in information propagation, that is, node features are continuously aggregated and updated through neighboring nodes, and each layer updates features based on the output of the previous layer. The feature update process is shown in formula (5).

[0053] (5) in, is the feature matrix of the jth layer, is the feature matrix of the next layer, is the adjacency matrix of graph CG plus self-connection, Du is is the degree matrix of , We is the learnable weight matrix, and 𝜎 is the activation function.

[0054] The source code to be detected is detected based on the vulnerability detection model to obtain the vulnerability detection results. The specific implementation process is as follows: A fully connected layer is used in combination with an activation layer (SoftMax layer) for prediction and classification to obtain vulnerability detection results. That is, a fully connected layer is used for dimensionality reduction to reduce the feature space size to two dimensions that matches the number of target categories, and then the SoftMax operation mechanism is executed to finally obtain and present the probability distribution results for each category.

[0055] The calculation process of the attention weight and the graph features after multi-layer feature fusion is shown in formulas (6) and (7). 1 , 𝑊 2 is a trainable parameter matrix, 𝜎 is a nonlinear activation function, and SoftMax is a normalization function.

[0056] (6) (7) It should be noted that in order to solve the problem of low accuracy of traditional graph neural networks in vulnerability detection, the embodiment of the present invention proposes a graph convolutional network (vulnerability detection model) based on multi-layer feature fusion based on the source code semantic feature extraction method of the fused code attribute graph, which can improve the homogeneity of node features when the GNN network is deepened. Secondly, the model will use two levels of encoding networks to learn local and global semantic information respectively, so as to more fully extract vulnerability features and improve the final vulnerability judgment ability.

[0057] Step 130, interpreting the vulnerability detection result based on the interpretable model to obtain a fine-grained interpretation result of the code statements related to the vulnerability in the vulnerability detection result.

[0058] Specifically, after obtaining the vulnerability detection results, the vulnerability detection results can be interpreted based on the interpretable model to obtain fine-grained interpretation results of the code statements related to the vulnerability in the vulnerability detection results.

[0059] Here, the interpretable model is built based on the graph neural network explainer IGEW (Improved Model of GNNExplainerbased on a Weighted Optimizer).

[0060] The GNNExplainer (Generating Explanations for GraphNeural Networks) was improved by adding a weight optimizer to obtain the IGEW model. The weight optimizer calculates the weight of each node based on the final edge mask after iterative optimization. For the explanation of vulnerability detection results, the higher the weight score of a node, the greater the possibility that it will become a vulnerable code line.

[0061] It is understandable that compared with traditional code attribute graphs, fused code attribute graphs have more advantages in covering grammatical structures and function call relationships, and can more comprehensively reflect the contextual relevance of the code, providing support for the accurate identification of complex code vulnerabilities. In addition, the inductive learning model (vulnerability detection model) combining the attention mechanism and the graph convolutional neural network can further improve the accuracy of vulnerability detection and solve the problem of over-smoothing of traditional graph neural networks when the depth increases. Finally, an interpretability model based on graph neural networks is introduced to pursue more transparent vulnerability detection results and more fine-grained explanations.

[0062] The method provided by the embodiment of the present invention obtains source code data to be detected, extracts code representation of the source code data, and converts the code representation into a fused code attribute graph; inputs the graph encoding features of the fused code attribute graph into a vulnerability detection model to obtain vulnerability detection results output by the vulnerability detection model; interprets the vulnerability detection results based on an interpretable model to obtain fine-grained interpretation results of code statements related to the vulnerability in the vulnerability detection results. On the one hand, compared with traditional code attribute graphs, fused code attribute graphs have more advantages in covering grammatical structures and function call relationships, and can more comprehensively reflect the contextual relevance of the code, providing support for accurately identifying complex code vulnerabilities; on the other hand, the interpretable model interprets the vulnerability detection results, points out the code statements related to the vulnerability, and provides fine-grained interpretation results, which can help subsequent developers quickly fix the vulnerability.

[0063] Based on the above embodiment, extracting the code representation of the source code data in step 110 and converting the code representation into a fused code attribute graph includes: Step 111, using a source code analysis tool Joern to extract an abstract syntax tree from the source code data, and determining a code attribute graph based on the abstract syntax tree; Step 112, perform text recognition on the source code data to obtain function call relations and natural control flow sequences, and add the function call relations and the natural control flow sequences to the code attribute graph in the form of edges to obtain the fused code attribute graph.

[0064] Specifically, the source code analysis tool Joern is used to extract the abstract syntax tree in the source code data, and based on the abstract syntax tree, the code property graph is determined.

[0065] For example, the source code analysis tool Joern is used to extract the abstract syntax tree in the source code data, and control analysis is performed on the abstract syntax tree to obtain a control flow graph (CFG).

[0066] The control flow graph CFG is constructed by traversing the abstract syntax tree, reflecting the flow control relationship between various basic structures in the program source code. In the control flow graph CFG, each statement in the program corresponds to a node in the graph, and the edges between the nodes represent the execution order between the statements.

[0067] Then, based on the control flow graph, the control dependency graph (CDG) and data dependency graph (DDG) are determined.

[0068] The control dependency graph is used to represent the control dependency relationship between basic blocks in a program. This relationship is caused by conditional branch instructions, which means whether a basic block can be executed depends on the calculation result of the condition. The data dependency graph is used to represent the data dependency relationship between statements in a program. When the value of a variable (or expression) in one statement is used or modified by another statement, data dependency occurs.

[0069] Furthermore, based on the control dependency graph and the data dependency graph, a program dependency graph (PDG) is determined.

[0070] For example, the nodes (representing basic blocks or instructions) in CDG and DDG are merged to ensure that each node appears only once in PDG. The control dependency edges in CDG and the data dependency edges in DDG are added to PDG. These edges represent the control dependency and data dependency relationships between basic blocks or instructions in the program.

[0071] It is important to note that conflicts or redundant dependencies may be encountered during the merge process. These need to be handled on a case-by-case basis to ensure the accuracy and consistency of the PDG.

[0072] Furthermore, based on the program dependency graph, a code property graph is determined.

[0073] Finally, text recognition is performed on the source code data to obtain function call relations and natural control flow sequences, and the function call relations and natural control flow sequences are added to the code attribute graph in the form of edges to obtain a fused code attribute graph.

[0074] Based on the above embodiment, the step of determining the graph coding feature of the fusion code attribute graph includes: Step 210, using the GloVe model to embed information of nodes and edges of different dimensions in the fusion code attribute graph to obtain graph embedding features; Step 220, inputting the graph embedding feature into a sentence encoding network to obtain the graph encoding feature output by the sentence encoding network; The sentence encoding network includes a multi-dimensional feature network Muit-FN and a feature fusion network AMBG; The multi-dimensional feature network Muit-FN is used to determine the local natural word order features, grammatical structure features and context features of each sentence node in the graph embedding feature; The feature fusion network AMBG is used to perform feature fusion on the local natural word order feature, the grammatical structure feature and the context feature to obtain the graph coding feature.

[0075] Specifically, the GloVe (Global Vectors for Word Representation) model is used to embed the information of nodes and edges of different dimensions in the fusion code attribute graph to obtain graph embedding features.

[0076] Then, the graph embedding features can be input into the sentence encoding network to obtain the graph encoding features output by the sentence encoding network.

[0077] Among them, the sentence encoding network includes the multi-dimensional feature network Muit-FN (Multidimensional Feature Network) and the feature fusion network AMBG (BiGRU with Attention Mechanism).

[0078] Here, the multi-dimensional feature network Muit-FN is used to determine the local natural word order features, grammatical structure features, and context features of each sentence node in the graph embedding feature; The feature fusion network AMBG is used to fuse local natural word order features, grammatical structure features and context features to obtain graph encoding features.

[0079] Here, the local natural word order features, grammatical structure features and context features are integrated, which can be splicing the local natural word order features, grammatical structure features and context features, or they can be weighted by using an attention mechanism and then splicing them together. The embodiment of the present invention does not make any specific limitation on this.

[0080] Based on the above embodiment, the training step of the vulnerability detection model includes: Step 310, obtaining sample source code data and label vulnerabilities of the sample source code data, and determining an initial vulnerability detection model; Step 320, extracting a sample code representation of the sample source code data, and converting the sample code representation into a sample fusion code attribute graph; Step 340, inputting the sample graph encoding features of the sample fusion code attribute graph into the initial vulnerability detection model to obtain the vulnerability prediction result output by the initial vulnerability detection model; Step 350, based on the difference between the vulnerability prediction result and the label vulnerability, determine the target loss, and iterate the parameters of the initial vulnerability detection model based on the target loss to obtain the vulnerability detection model.

[0081] Specifically, in order to better obtain the vulnerability detection model, training can be performed based on the following steps: First, obtain sample source code data and labeled vulnerabilities of the sample source code data, and determine an initial vulnerability detection model.

[0082] Here, the parameters of the initial vulnerability detection model may be pre-set or randomly generated, and the embodiment of the present invention does not specifically limit this.

[0083] Then, a sample code representation of the sample source code data is extracted, and the sample code representation is converted into a sample fusion code attribute graph.

[0084] That is, the source code analysis tool Joern is used to extract the abstract syntax tree in the sample source code data, and control analysis is performed on the abstract syntax tree to obtain a control flow graph.

[0085] The control flow graph is constructed by traversing the abstract syntax tree, reflecting the flow control relationship between various basic structures in the sample source code data. In the control flow graph, each statement in the program corresponds to a node in the graph, and the edges between the nodes represent the execution order between the statements.

[0086] Then, based on the control flow graph, a control dependency graph and a data dependency graph are determined.

[0087] The control dependency graph is used to represent the control dependency relationship between basic blocks in a program. This relationship is caused by conditional branch instructions, which means whether a basic block can be executed depends on the calculation result of the condition. The data dependency graph is used to represent the data dependency relationship between statements in a program. When the value of a variable (or expression) in one statement is used or modified by another statement, data dependency occurs.

[0088] Further, based on the control dependency graph and the data dependency graph, a program dependency graph is determined.

[0089] For example, the nodes (representing basic blocks or instructions) in CDG and DDG are merged to ensure that each node appears only once in PDG. The control dependency edges in CDG and the data dependency edges in DDG are added to PDG. These edges represent the control dependency and data dependency relationships between basic blocks or instructions in the program.

[0090] Furthermore, based on the program dependency graph, a code property graph is determined.

[0091] Finally, text recognition is performed on the sample source code data to obtain sample function call relations and sample natural control flow sequences, and the sample function call relations and sample natural control flow sequences are added to the code attribute graph in the form of edges to obtain the sample fusion code attribute graph.

[0092] Furthermore, the sample graph encoding features of the sample fusion code attribute graph are input into the initial vulnerability detection model to obtain the vulnerability prediction results output by the initial vulnerability detection model.

[0093] Finally, after obtaining the vulnerability detection results, the target loss can be determined based on the difference between the vulnerability prediction results and the labeled vulnerabilities, and the parameters of the initial vulnerability detection model can be iterated based on the target loss. The initial vulnerability detection model after the parameter iteration is used as the vulnerability detection model.

[0094] It can be understood that the greater the difference between the vulnerability prediction result and the label vulnerability, the greater the target loss; the smaller the difference between the vulnerability prediction result and the label vulnerability, the smaller the target loss.

[0095] Based on the above embodiment, step 130 includes: Step 131, inputting the vulnerability detection result and the graph coding feature of the fusion code attribute graph into the interpretable model to obtain the fine-grained interpretation result output by the interpretable model; The interpretable model is built based on the graph neural network interpreter IGEW, and the graph neural network interpreter IGEW is obtained by adding a weight optimizer to the graph neural network interpreter GNNExplainer.

[0096] Specifically, the vulnerability detection results and the graph encoding features of the fused code property graph can be input into the interpretable model to obtain the fine-grained interpretation results of the interpretable model output.

[0097] Figure 3 is a schematic diagram of the interpretable model provided by the present invention, such as Figure 3 As shown, the interpretable model is built based on the graph neural network interpreter IGEW, which is obtained by adding a weight optimizer to the graph neural network interpreter GNNExplainer.

[0098] For example, the graph encoding features of the fusion code attribute graph are converted into a node feature matrix, and then edge masking is performed using an edge mask generation algorithm. The weight optimizer of the interpretable model is used to generate important node sequences, and finally the final interpretation result is obtained.

[0099] It can be understood that the weight optimizer calculates the weight of each node based on the final edge mask after iterative optimization. Regarding the interpretation of vulnerability detection results, the higher the weight score of a node, the greater the possibility that it will become a vulnerable code line.

[0100] The method provided by the embodiment of the present invention aims to solve the problem that the current coarse-grained source code vulnerability detection results lack interpretability. According to the vulnerability detection task objectives, the interpretable model GNNExplainer is improved, and a weight optimizer is added to obtain the IGEW model. IGEW is used as an interpretable model to further analyze the coarse-grained vulnerability detection results of the vulnerability detection model, point out the code statements related to the vulnerability, and provide fine-grained interpretation results, which can help subsequent developers quickly fix the vulnerability.

[0101] Based on any of the above embodiments, Figure 4 is a schematic diagram of a vulnerability detection model based on the fusion of code attribute graph and attention mechanism built by the present invention, Figure 5is a schematic diagram of a source code vulnerability fine-grained location method based on an explainability model constructed by the present invention, such as Figure 4 , Figure 5 As shown, the method includes: The first step is to obtain the source code data to be tested, use the source code analysis tool Joern to extract the abstract syntax tree in the source code data, and determine the code attribute graph based on the abstract syntax tree.

[0102] In the second step, text recognition is performed on the source code data to obtain function call relations and natural control flow sequences, and the function call relations and natural control flow sequences are added to the code attribute graph in the form of edges to obtain a fused code attribute graph.

[0103] In the third step, the GloVe model is used to embed the information of nodes and edges of different dimensions in the fusion code attribute graph to obtain graph embedding features.

[0104] The fourth step is to input the graph embedding features into the sentence encoding network to obtain the graph encoding features output by the sentence encoding network, wherein the sentence encoding network includes a multi-dimensional feature network Muit-FN and a feature fusion network AMBG; the multi-dimensional feature network Muit-FN is used to determine the local natural word order features, grammatical structure features, and context features of each sentence node in the graph embedding features. The feature fusion network AMBG is used to fuse the local natural word order features, grammatical structure features, and context features to obtain the graph encoding features.

[0105] The fifth step is the training step of the vulnerability detection model, including: obtaining sample source code data and labeled vulnerabilities of the sample source code data, and determining the initial vulnerability detection model; extracting the sample code representation of the sample source code data, and converting the sample code representation into a sample fusion code attribute graph; inputting the sample graph encoding features of the sample fusion code attribute graph into the initial vulnerability detection model to obtain the vulnerability prediction results output by the initial vulnerability detection model; determining the target loss based on the difference between the vulnerability prediction results and the labeled vulnerabilities, and iterating the parameters of the initial vulnerability detection model based on the target loss to obtain the vulnerability detection model.

[0106] Among them, the vulnerability detection model includes a program coding network, a fully connected layer and an activation layer; the program coding network is built based on a multi-feature fusion model and a graph convolutional network.

[0107] In the sixth step, the graph encoding features of the fused code attribute graph are input into the vulnerability detection model to obtain the vulnerability detection results output by the vulnerability detection model.

[0108] In the seventh step, the vulnerability detection results and the graph encoding features of the fused code attribute graph are input into the interpretable model to obtain the fine-grained interpretation results of the interpretable model output.

[0109] Here, the interpretable model is built based on the graph neural network interpreter IGEW, which is obtained by adding a weight optimizer to the graph neural network interpreter GNNExplainer.

[0110] The method provided by the embodiment of the present invention first uses a new intermediate representation of source code, the fused code attribute graph, for source code semantic feature extraction. By adding function call relationships and natural control flow sequences to the code attribute graph in the form of edges, the fused code attribute graph enhances the context-related characteristics of the code and can fully reflect the structure and characteristics of the source code. Two levels of encoding networks are used to learn the local and global semantic information of the fused code attribute graph respectively, and a graph neural network inductive learning model based on an attention mechanism and a fused code attribute graph is used to obtain vulnerability detection results. The present invention can greatly save the cost of code auditing, help developers identify and fix potential security issues more quickly, thereby improving repair efficiency and system security.

[0111] Based on any of the above embodiments, Figure 6 This is a program feature extraction strategy framework diagram based on hierarchical semantic perception constructed by the present invention, such as Figure 6 As shown in the figure, the sentence encoding network includes a multi-dimensional feature network Muit-FN and a feature fusion network AMBG; the multi-dimensional feature network Muit-FN is used to determine the local natural word order features, grammatical structure features, and context features of each sentence node in the graph embedding feature. The feature fusion network AMBG is used to fuse the local natural word order features, grammatical structure features, and context features to obtain graph encoding features (local semantic features of sentences).

[0112] Then the local semantic features of the sentence are input into the program encoding network to obtain the global semantic features of the program.

[0113] The source code vulnerability detection device based on the fused code attribute graph provided by the present invention is described below. The source code vulnerability detection device based on the fused code attribute graph described below and the source code vulnerability detection method based on the fused code attribute graph described above can be referred to each other.

[0114] Based on any of the above embodiments, the present invention provides a source code vulnerability detection device based on a fusion code attribute graph. Figure 7 is a schematic diagram of the structure of a source code vulnerability detection device based on a fusion code attribute graph provided by the present invention, such as Figure 7 As shown, the device comprises: An acquisition unit 710 is used to acquire source code data to be detected, extract code representation of the source code data, and convert the code representation into a fused code attribute graph; An input unit 720, used to input the graph coding features of the fusion code attribute graph into a vulnerability detection model to obtain a vulnerability detection result output by the vulnerability detection model; The interpretation unit 730 is used to interpret the vulnerability detection result based on the interpretable model to obtain a fine-grained interpretation result of the code statement related to the vulnerability in the vulnerability detection result.

[0115] The device provided by the embodiment of the present invention obtains source code data to be detected, extracts code representation of the source code data, and converts the code representation into a fused code attribute graph; inputs the graph encoding features of the fused code attribute graph into a vulnerability detection model to obtain vulnerability detection results output by the vulnerability detection model; interprets the vulnerability detection results based on an interpretable model to obtain fine-grained interpretation results of code statements related to the vulnerability in the vulnerability detection results. On the one hand, compared with traditional code attribute graphs, fused code attribute graphs have more advantages in covering grammatical structures and function call relationships, and can more comprehensively reflect the contextual relevance of the code, providing support for accurately identifying complex code vulnerabilities; on the other hand, the interpretable model interprets the vulnerability detection results, points out the code statements related to the vulnerability, and provides fine-grained interpretation results, which can help subsequent developers quickly fix the vulnerability.

[0116] Based on any of the foregoing embodiments, the acquisition unit 710 is specifically configured to: Using a source code analysis tool Joern to extract an abstract syntax tree from the source code data, and determining a code attribute graph based on the abstract syntax tree; Text recognition is performed on the source code data to obtain function call relations and natural control flow sequences, and the function call relations and the natural control flow sequences are added to the code attribute graph in the form of edges to obtain the fused code attribute graph.

[0117] Based on any of the above embodiments, it further includes a graph coding feature determination unit, wherein the graph coding feature determination unit is specifically used to: Using the GloVe model to embed information of nodes and edges of different dimensions in the fusion code attribute graph to obtain graph embedding features; Inputting the graph embedding feature into a sentence encoding network to obtain the graph encoding feature output by the sentence encoding network; The sentence encoding network includes a multi-dimensional feature network Muit-FN and a feature fusion network AMBG; The multi-dimensional feature network Muit-FN is used to determine the local natural word order features, grammatical structure features and context features of each sentence node in the graph embedding feature; The feature fusion network AMBG is used to perform feature fusion on the local natural word order feature, the grammatical structure feature and the context feature to obtain the graph coding feature.

[0118] Based on any of the above embodiments, it further includes a training unit, wherein the training unit is specifically used to: Obtaining sample source code data and labeled vulnerabilities of the sample source code data, and determining an initial vulnerability detection model; Extracting a sample code representation of the sample source code data, and converting the sample code representation into a sample fusion code attribute graph; Inputting the sample graph encoding features of the sample fusion code attribute graph into the initial vulnerability detection model to obtain the vulnerability prediction result output by the initial vulnerability detection model; Based on the difference between the vulnerability prediction result and the label vulnerability, a target loss is determined, and based on the target loss, parameters of the initial vulnerability detection model are iterated to obtain the vulnerability detection model.

[0119] Based on any of the above embodiments, the vulnerability detection model includes a program coding network, a fully connected layer, and an activation layer; The program encoding network is constructed based on a multi-feature fusion model and a graph convolutional network.

[0120] Based on any of the above embodiments, the interpretation unit 730 is specifically configured to: Inputting the vulnerability detection result and the graph encoding feature of the fusion code attribute graph into the interpretable model to obtain the fine-grained interpretation result output by the interpretable model; The interpretable model is built based on the graph neural network interpreter IGEW, and the graph neural network interpreter IGEW is obtained by adding a weight optimizer to the graph neural network interpreter GNNExplainer.

[0121] Figure 8 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 8As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute a source code vulnerability detection method based on a fused code attribute graph, the method comprising: obtaining source code data to be detected, extracting the code representation of the source code data, and converting the code representation into a fused code attribute graph; inputting the graph encoding features of the fused code attribute graph into a vulnerability detection model to obtain a vulnerability detection result output by the vulnerability detection model; interpreting the vulnerability detection result based on an interpretable model to obtain a fine-grained interpretation result of the code statements related to the vulnerability in the vulnerability detection result.

[0122] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0123] On the other hand, the present invention also provides a computer program product, which includes a computer program, and the computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the source code vulnerability detection method based on the fused code attribute graph provided by the above methods, and the method includes: obtaining source code data to be detected, and extracting the code representation of the source code data, and converting the code representation into a fused code attribute graph; inputting the graph encoding features of the fused code attribute graph into a vulnerability detection model to obtain the vulnerability detection result output by the vulnerability detection model; interpreting the vulnerability detection result based on an interpretable model to obtain a fine-grained interpretation result of the code statement related to the vulnerability in the vulnerability detection result.

[0124] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the source code vulnerability detection method based on a fused code attribute graph provided by the above-mentioned methods, the method comprising: obtaining source code data to be detected, extracting a code representation of the source code data, and converting the code representation into a fused code attribute graph; inputting the graph encoding features of the fused code attribute graph into a vulnerability detection model to obtain a vulnerability detection result output by the vulnerability detection model; interpreting the vulnerability detection result based on an interpretable model to obtain a fine-grained interpretation result of the code statements related to the vulnerability in the vulnerability detection result.

[0125] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0126] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0127] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A source code vulnerability detection method based on a fusion code attribute graph, characterized in that: include: Acquire source code data to be detected, extract code representation of the source code data, and convert the code representation into a fused code attribute graph; Inputting the graph encoding features of the fusion code attribute graph into a vulnerability detection model to obtain a vulnerability detection result output by the vulnerability detection model; The vulnerability detection result is interpreted based on an interpretable model to obtain a fine-grained interpretation result of the code statements related to the vulnerability in the vulnerability detection result.

2. The source code vulnerability detection method based on the fusion code attribute graph according to claim 1 is characterized in that: The extracting the code representation of the source code data and converting the code representation into a fused code attribute graph includes: Using a source code analysis tool Joern to extract an abstract syntax tree from the source code data, and determining a code attribute graph based on the abstract syntax tree; Text recognition is performed on the source code data to obtain function call relations and natural control flow sequences, and the function call relations and the natural control flow sequences are added to the code attribute graph in the form of edges to obtain the fused code attribute graph.

3. The source code vulnerability detection method based on the fusion code attribute graph according to claim 1 is characterized in that: The step of determining the graph coding feature of the fusion code attribute graph comprises: Using the GloVe model to embed information of nodes and edges of different dimensions in the fusion code attribute graph to obtain graph embedding features; Inputting the graph embedding feature into a sentence encoding network to obtain the graph encoding feature output by the sentence encoding network; The sentence encoding network includes a multi-dimensional feature network Muit-FN and a feature fusion network AMBG; The multi-dimensional feature network Muit-FN is used to determine the local natural word order features, grammatical structure features and context features of each sentence node in the graph embedding feature; The feature fusion network AMBG is used to perform feature fusion on the local natural word order feature, the grammatical structure feature and the context feature to obtain the graph coding feature.

4. The source code vulnerability detection method based on the fusion code attribute graph according to any one of claims 1 to 3, characterized in that: The training steps of the vulnerability detection model include: Obtaining sample source code data and labeled vulnerabilities of the sample source code data, and determining an initial vulnerability detection model; Extracting a sample code representation of the sample source code data, and converting the sample code representation into a sample fusion code attribute graph; Inputting the sample graph encoding features of the sample fusion code attribute graph into the initial vulnerability detection model to obtain the vulnerability prediction result output by the initial vulnerability detection model; Based on the difference between the vulnerability prediction result and the label vulnerability, a target loss is determined, and based on the target loss, parameters of the initial vulnerability detection model are iterated to obtain the vulnerability detection model.

5. The source code vulnerability detection method based on the fusion code attribute graph according to claim 4 is characterized in that: The vulnerability detection model includes a program encoding network, a fully connected layer, and an activation layer; The program encoding network is constructed based on a multi-feature fusion model and a graph convolutional network.

6. The source code vulnerability detection method based on the fused code attribute graph according to any one of claims 1 to 3, characterized in that: The step of interpreting the vulnerability detection result based on the interpretable model to obtain a fine-grained interpretation result of the code statements related to the vulnerability in the vulnerability detection result includes: Inputting the vulnerability detection result and the graph encoding feature of the fusion code attribute graph into the interpretable model to obtain the fine-grained interpretation result output by the interpretable model; The interpretable model is built based on the graph neural network interpreter IGEW, and the graph neural network interpreter IGEW is obtained by adding a weight optimizer to the graph neural network interpreter GNNExplainer.

7. A source code vulnerability detection device based on a fusion code attribute graph, characterized in that: include: An acquisition unit, configured to acquire source code data to be detected, extract code representation of the source code data, and convert the code representation into a fused code attribute graph; An input unit, used for inputting the graph coding features of the fusion code attribute graph into a vulnerability detection model to obtain a vulnerability detection result output by the vulnerability detection model; The interpretation unit is used to interpret the vulnerability detection result based on the interpretable model to obtain a fine-grained interpretation result of the code statement related to the vulnerability in the vulnerability detection result.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for detecting source code vulnerabilities based on a fused code property graph as described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the source code vulnerability detection method based on the fused code property graph as described in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the source code vulnerability detection method based on the fused code property graph as described in any one of claims 1 to 6 is implemented.

Images