Method and system for detecting and repairing security vulnerabilities of computer software

Abstract

The invention discloses a method and a system for detecting and repairing security vulnerabilities of computer software, and relates to the technical field of computer software security, and the key points of the technical scheme are as follows: performing feature extraction on the computer software through static feature extraction and dynamic feature extraction; the database module is used for extracting features of software, matching the extracted features with a known vulnerability feature library to detect whether security vulnerabilities exist in the software, judging a repair priority according to the severity of the detected vulnerabilities, determining a repair strategy according to the types of the vulnerabilities and performing repair, and storing the extracted software features, the detected vulnerability information and repair records by the database module. The vulnerability feature library is updated regularly; according to the method, the accuracy and the efficiency of vulnerability detection are improved in a mode of combining static feature extraction and dynamic feature extraction, the repair priority is judged according to the severity of the detected vulnerability, then the repair strategy is determined according to the vulnerability type, repair is performed, and the timeliness and the effect of repair are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of computer software security, and more specifically, to a method and system for detecting and repairing computer software security vulnerabilities. Background Art

[0002] With the rapid development of information technology, computer software has been widely used in various fields. However, security vulnerabilities in software bring huge risks to the system. These vulnerabilities may be exploited by malicious users or programs, resulting in unauthorized access, leakage of sensitive information or destruction of system stability. Therefore, timely detection and repair of computer software security vulnerabilities has become a vital task. Summary of the invention

[0003] In view of the deficiencies in the prior art, the object of the present invention is to provide a method and system for detecting and repairing computer software security vulnerabilities.

[0004] In a first aspect, the present invention provides a method for detecting and repairing computer software security vulnerabilities, comprising the following steps:

[0005] Static feature extraction is done through code review, abstract syntax tree analysis, and binary analysis;

[0006] Dynamic feature extraction is done through runtime monitoring and fuzz testing;

[0007] The extracted features are matched with the known vulnerability feature library to detect whether there are security vulnerabilities in the software. After feature matching, in-depth analysis and verification are performed;

[0008] Determine the repair priority based on the severity of the detected vulnerability, and then determine the repair strategy and perform repairs based on the vulnerability type;

[0009] The extracted software features, detected vulnerability information, and repair records are stored in the database, and the vulnerability feature library is updated regularly.

[0010] Preferably, static feature extraction is done through code review, abstract syntax tree analysis, and binary analysis, including:

[0011] Code review: clarify the scope of software code to be reviewed, review the software source code line by line, determine the logical structure of the code, the definition and use of variables, the calling relationship of functions, and record the problems found and potential security features;

[0012] Abstract syntax tree analysis: converting source code into an abstract syntax tree representation, identifying specific code patterns through the extracted abstract syntax tree structural features, and recording the features obtained through analysis;

[0013] Binary analysis: For software without source code, binary analysis is performed; the binary file to be analyzed is loaded using a disassembly tool. The disassembly tool automatically identifies the format and architecture of the binary file and converts it into assembly code. The disassembled assembly code is analyzed to find potential security vulnerabilities and extract features from the assembly code.

[0014] Preferably, dynamic feature extraction is accomplished through runtime monitoring and fuzz testing, including:

[0015] Runtime monitoring: deploy runtime monitoring tools in the software running environment to monitor the memory usage, CPU occupancy, network communication behavior and system calls in real time during the software running process. Based on the collected data, detect whether there is abnormal behavior and record the characteristics of the software at runtime;

[0016] Fuzz testing uses fuzz testing tools to generate a large amount of random input data, provides the generated test cases to the software for processing, observes the software's response, and records the software's behavioral characteristics when processing different test cases.

[0017] Preferably, the extracted features are matched with a known vulnerability feature library to detect whether there are security vulnerabilities in the software. After feature matching, in-depth analysis and verification are performed, including:

[0018] Establish a vulnerability feature library to collect known security vulnerability features; organize and classify the collected vulnerability features, establish a structured vulnerability feature library, and regularly update the vulnerability feature library;

[0019] Feature matching and vulnerability detection: the extracted software features are compared one by one with the features in the vulnerability feature library. A pattern matching algorithm can be used to determine whether there are matching features. If matching features are found, the matching vulnerability type and related information are recorded. At the same time, the preliminary vulnerability risk level is determined based on the degree and importance of the match.

[0020] In-depth analysis and verification: For situations where vulnerabilities may exist, debugging tools, dynamic analysis tools, and manual review can be used to conduct a more detailed inspection of the software to determine the existence of vulnerabilities and the type, location, and risk level of the vulnerabilities.

[0021] Preferably, the repair priority is determined according to the severity of the detected vulnerability, and then the repair strategy is determined and repaired according to the vulnerability type, including:

[0022] Assess the severity of the vulnerability. Assess the severity of the vulnerability based on the likelihood of the vulnerability being exploited, the scope of impact the vulnerability may cause, and the extent of the loss. Use the Common Vulnerability Scoring System standard to quantify the severity of the vulnerability and categorize it into high, medium, and low levels.

[0023] Prioritize repairs based on severity. High-severity vulnerabilities should be immediately prioritized for repair; medium-severity vulnerabilities should be given a higher priority and repair plans should be arranged as soon as possible; low-severity vulnerabilities can be repaired gradually if resources permit.

[0024] Determine the repair strategy and repair it according to the vulnerability type; the vulnerability types include input validation vulnerabilities, permission management vulnerabilities, encryption vulnerabilities, code injection vulnerabilities, buffer overflow vulnerabilities and logic vulnerabilities;

[0025] The repair strategy for the input validation vulnerability includes:

[0026] Strict input validation: perform comprehensive validation on all user input; use regular expressions or specific validation functions to ensure that the input meets expectations;

[0027] Filter special characters that may cause security vulnerabilities;

[0028] Adopt a whitelist mechanism to only allow input with specific formats and content, and reject input that does not match the whitelist;

[0029] The repair strategy for the permission management vulnerability includes:

[0030] The principle of least privilege ensures that users and processes have only the minimum permissions required to perform their tasks;

[0031] Review the allocation of permissions, regularly review the allocation of permissions for users and processes, and revoke unnecessary permissions in a timely manner;

[0032] Multi-factor authentication: For sensitive operations and critical resources, implement multi-factor authentication to increase security;

[0033] The repair strategy for the encryption vulnerability includes:

[0034] Upgrade encryption algorithms, evaluate the security of currently used encryption algorithms, and upgrade to more secure encryption algorithms in a timely manner;

[0035] Strengthen key management to ensure the generation, storage, distribution and destruction of encryption keys are safe and reliable;

[0036] Update keys regularly and replace encryption keys regularly to reduce the risk of key cracking;

[0037] The repair strategy for the code injection vulnerability includes:

[0038] Avoid dynamic code execution. Avoid dynamic code execution as much as possible. If dynamic code execution must be used, strictly validate and filter the input;

[0039] Parameterized queries, use parameterized queries to prevent SQL injection attacks when interacting with the database;

[0040] Input validation and filtering: strict validation and filtering of user input that may lead to code injection;

[0041] The repair strategy for the buffer overflow vulnerability includes:

[0042] Use safe string handling functions;

[0043] Bounds checking: strict boundary checking is performed when performing memory operations;

[0044] Static code analysis: Use static code analysis tools to detect buffer overflow vulnerabilities and fix them according to the tool's prompts;

[0045] The repair strategy for the logic vulnerability includes:

[0046] Review the business logic and carefully review the business logic of the software to find out where there may be logical loopholes;

[0047] Add verification steps. Add additional verification steps based on the logical vulnerabilities found;

[0048] Security testing: Conduct sufficient security testing to discover potential logic vulnerabilities;

[0049] Verify the repair results. After fixing the security vulnerability, re-test the software. In addition to security vulnerability detection, functional testing of the repaired software is also required. Invite users to perform acceptance testing on the software.

[0050] Preferably, the extracted software features, detected vulnerability information, and repair records are stored in a database, and the vulnerability feature library is updated regularly, including:

[0051] Store data in the database, determine the type of information that needs to be stored in the database, design the database table structure, select a database management system, and create a database based on the designed database structure; after the software feature extraction is completed, the extracted feature data is sorted and formatted according to the database table structure, and the software feature data is inserted into the software feature table using a database insert statement or database operation library. When a vulnerability is detected, the vulnerability information is sorted and inserted into the vulnerability information table. After the vulnerability is repaired, the repair record is inserted into the repair record table and associated with the corresponding vulnerability information to complete the data storage;

[0052] Update the vulnerability signature library regularly, pay attention to security bulletins and vulnerability databases, determine the update source, check the update source regularly, obtain new vulnerability information, and perform some tests and verifications after updating the vulnerability signature library to ensure the accuracy and effectiveness of the update.

[0053] In a second aspect, a computer software security vulnerability detection and repair system includes a static feature extraction module, a dynamic feature extraction module, a vulnerability detection module, a vulnerability repair module, and a database module;

[0054] The static feature extraction module includes code review, abstract syntax tree analysis and binary analysis;

[0055] The dynamic feature extraction module includes runtime monitoring and fuzz testing;

[0056] The vulnerability detection module matches the extracted features with the vulnerability feature library to detect vulnerabilities, and performs in-depth analysis and verification after feature matching;

[0057] The vulnerability repair module determines the repair priority according to the severity of the detected vulnerability, and then determines the repair strategy according to the vulnerability type and performs the repair;

[0058] The database module stores the extracted software features, detected vulnerability information, repair records and other data in the database, and regularly updates the vulnerability feature library.

[0059] Compared with the prior art, the present invention has the following beneficial effects:

[0060] 1. In the present invention, by combining static feature extraction and dynamic feature extraction, the software can be analyzed from multiple angles to discover vulnerabilities that are difficult to detect with traditional methods;

[0061] 2. In the present invention, by matching the extracted features with a known vulnerability feature library, it is possible to quickly and accurately determine whether there are security vulnerabilities in the software, thereby improving the efficiency of detection;

[0062] 3. In the present invention, by judging the repair priority according to the severity of the detected vulnerability, and then determining the repair strategy and performing the repair according to the vulnerability type, the timeliness and effect of the repair are improved, the risk loss is reduced, and the impact on the software function during the repair process is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 A flowchart of a computer software security vulnerability detection and repair method is proposed for the present invention;

[0064] Figure 2 The present invention proposes a flow chart of a computer software security vulnerability detection and repair system. DETAILED DESCRIPTION

[0065] Reference Figure 1 to Figure 2 .

[0066] The embodiment further illustrates a computer software security vulnerability detection and repair method and system proposed by the present invention.

[0067] Reference Figure 1 , a computer software security vulnerability detection and repair method, comprising the following steps:

[0068] Static feature extraction is done through code review, abstract syntax tree analysis, and binary analysis;

[0069] Dynamic feature extraction is done through runtime monitoring and fuzz testing;

[0070] The extracted features are matched with the known vulnerability feature library to detect whether there are security vulnerabilities in the software. After feature matching, in-depth analysis and verification are performed;

[0071] Determine the repair priority based on the severity of the detected vulnerability, and then determine the repair strategy and perform repairs based on the vulnerability type;

[0072] The extracted software features, detected vulnerability information, and repair records are stored in the database, and the vulnerability feature library is updated regularly.

[0073] Static feature extraction is done through code review, abstract syntax tree analysis, and binary analysis, including:

[0074] Code review: clarify the scope of software code to be reviewed, review the software source code line by line, determine the logical structure of the code, the definition and use of variables, and the calling relationship of functions, and record the problems and potential security features found, including code structure features, specific code patterns, and suspicious function calls;

[0075] Abstract syntax tree analysis: converting source code into an abstract syntax tree representation, identifying specific code patterns through the extracted abstract syntax tree structural features, and recording the features obtained through analysis, including specific abstract syntax tree node types and function call chains;

[0076] Binary analysis: For software without source code, binary analysis is performed; the binary file to be analyzed is loaded using a disassembly tool. The disassembly tool automatically identifies the format and architecture of the binary file and converts it into assembly code. The disassembled assembly code is analyzed to find potential security vulnerabilities and extract features from the assembly code, including specific instruction patterns and data structure features.

[0077] Dynamic feature extraction is done through runtime monitoring and fuzz testing, including:

[0078] Runtime monitoring: Deploy runtime monitoring tools in the software running environment to monitor the memory usage, CPU occupancy, network communication behavior and system calls in real time during the software running process. Based on the collected data, detect whether there is abnormal behavior and record the characteristics of the software at runtime, including the time when the abnormal behavior occurs and the related system call sequence;

[0079] Fuzz testing uses fuzz testing tools to generate a large amount of random input data, provides the generated test cases to the software for processing, observes the software's response, and records the software's behavioral characteristics when processing different test cases, including whether crashes, abnormal outputs, and security warnings occur.

[0080] The extracted features are matched with the known vulnerability feature library to detect whether there are security vulnerabilities in the software. After feature matching, in-depth analysis and verification are performed, including:

[0081] Establish a vulnerability feature library to collect known security vulnerability features, including vulnerability types, trigger conditions, and impact scope; organize and classify the collected vulnerability features, establish a structured vulnerability feature library, and regularly update the vulnerability feature library to ensure that it contains the latest discovered security vulnerabilities;

[0082] Feature matching and vulnerability detection: the extracted software features are compared one by one with the features in the vulnerability feature library. A pattern matching algorithm can be used to determine whether there are matching features. If matching features are found, the matching vulnerability type and related information are recorded. At the same time, the preliminary vulnerability risk level is determined based on the degree and importance of the match.

[0083] In-depth analysis and verification: For cases where vulnerabilities may exist, debugging tools, dynamic analysis tools, and manual review can be used to conduct a more detailed inspection of the software to determine the existence of vulnerabilities and the type, location, and risk level of the vulnerabilities.

[0084] Determine the repair priority based on the severity of the detected vulnerability, and then determine the repair strategy based on the vulnerability type and perform the repair, including:

[0085] Assess the severity of the vulnerability. Assess the severity of the vulnerability based on the likelihood of the vulnerability being exploited, the scope of impact the vulnerability may cause, and the extent of the loss. Use the Common Vulnerability Scoring System standard to quantify the severity of the vulnerability and categorize it into high, medium, and low levels.

[0086] Prioritize repairs based on severity. High-severity vulnerabilities should be immediately prioritized for repair, as they may pose a significant threat to system security and business operations. Medium-severity vulnerabilities should be given a higher priority and repair plans should be arranged as soon as possible. Low-severity vulnerabilities can be repaired gradually as resources permit.

[0087] Determine the repair strategy based on the vulnerability type; the vulnerability types include input validation vulnerabilities, permission management vulnerabilities, encryption vulnerabilities, code injection vulnerabilities, buffer overflow vulnerabilities, and logic vulnerabilities;

[0088] The repair strategy for the input validation vulnerability includes:

[0089] Strict input validation: perform comprehensive validation on all user input, including data type, length, format, etc. For example, for a username input box in a user registration form, only letters, numbers, and specific symbols are allowed, and the length is limited to a certain range. Use regular expressions or specific validation functions to ensure that the input meets expectations; for example, use regular expressions to verify that the format of the email address is correct.

[0090] Filter special characters, such as single quotes and semicolons in SQL injection and special characters in cross-site scripting attacks. <script>、等标签；可以使用转义函数对这些特殊字符进行处理，使其在输出时不会被解释为恶意代码；

[0091] 采用白名单机制，只允许特定格式和内容的输入，拒绝不符合白名单的输入；例如，在文件上传功能中，只允许特定的文件类型和大小的文件上传；

[0092] 所述权限管理漏洞的修复策略，包括：

[0093] 最小权限原则，确保用户和进程只拥有执行其任务所需的最小权限；例如，一个普通用户不应该具有管理员权限，一个应用程序只需要访问其所需的特定资源的权限；

[0094] 审查权限分配，定期审查用户和进程的权限分配，及时撤销不必要的权限；例如，在员工离职后，及时撤销其在系统中的权限；

[0095] 多因素身份验证，对于敏感操作和关键资源，实施多因素身份验证，增加安全性；例如，除了用户名和密码外，还需要手机验证码、指纹识别等额外的验证方式；

[0096] 所述加密漏洞的修复策略，包括：

[0097] 升级加密算法，评估当前使用的加密算法的安全性，及时升级到更安全的加密算法；例如，对于密码存储，从弱加密算法如MD5升级到更强大的哈希算法如bcrypt；

[0098] 加强密钥管理，确保加密密钥的生成、存储、分发和销毁过程安全可靠；例如，使用安全的随机数生成器生成密钥，将密钥存储在安全的硬件设备中，使用加密通道分发密钥等；

[0099] 定期更新密钥，定期更换加密密钥，以降低密钥被破解的风险；例如，每隔一段时间(如几个月)更换一次数据库加密密钥；

[0100] 所述代码注入漏洞的修复策略，包括：

[0101] 避免动态代码执行，尽量避免使用eval()等函数进行动态代码执行，因为这类函数可能会执行用户输入的恶意代码；如果必须使用动态代码执行，要对输入进行严格的验证和过滤；

[0102] 参数化查询，在与数据库交互时，使用参数化查询来防止SQL注入攻击；参数化查询将用户输入作为参数传递给数据库引擎，而不是直接拼接在SQL语句中，从而避免了SQL注入的风险；

[0103] 输入验证和过滤，对可能导致代码注入的用户输入进行严格的验证和过滤，去除可能被解释为代码的字符和命令；例如，在命令执行函数中，对用户输入的命令进行白名单验证；

[0104] 所述缓冲区溢出漏洞修复策略，包括：

[0105] 使用安全的字符串处理函数，在C和C++等语言中，使用安全的字符串处理函数如strncpy、strncat等代替不安全的函数如strcpy、strcat；这些安全函数可以限制复制或连接的字符数量，防止缓冲区溢出；

[0106] 边界检查，在进行内存操作时，进行严格的边界检查，确保不会超出缓冲区的范围；可以在代码中添加断言或其他检查机制，以确保缓冲区的大小不会被超出；

[0107] 静态代码分析，使用静态代码分析工具来检测缓冲区溢出漏洞，并根据工具的提示进行修复；这些工具可以分析代码的结构和逻辑，找出潜在的缓冲区溢出风险；

[0108] 所述逻辑漏洞修复策略，包括：

[0109] 审查业务逻辑，仔细审查软件的业务逻辑，找出可能存在逻辑漏洞的地方；例如，在电子商务系统中，检查订单处理、支付流程等是否存在可以被利用的逻辑漏洞；

[0110] 增加验证步骤，根据发现的逻辑漏洞，增加额外的验证步骤；例如，在用户身份验证过程中，增加多因素身份验证、验证码等，防止身份验证绕过；

[0111] 安全测试，进行充分的安全测试，包括黑盒测试和白盒测试，以发现潜在的逻辑漏洞；可以使用渗透测试工具和技术，模拟攻击者的行为，尝试利用逻辑漏洞进行攻击；

[0112] 验证修复结果，在修复安全漏洞后，对软件进行重新检测，确保安全漏洞已经被成功修复；除了安全漏洞检测，还需要对修复后的软件进行功能测试，确保软件的功能没有受到影响；邀请用户对软件进行验收测试，保软件满足用户的需求，并且没有安全问题。

[0113] 将提取的软件特征、检测到的漏洞信息、修复记录存储到数据库中，并定期更新漏洞特征库，包括：

[0114] 存储数据到数据库，确定数据库中需要存储的信息类型,设计数据库表结构,选择数据库管理系统,根据设计的数据库结构创建数据库；软件特征提取完成后，将提取的特征数据按照数据库表结构进行整理和格式化，使用数据库插入语句或数据库操作库，将软件特征数据插入到软件特征表中，当检测到漏洞时，将漏洞信息整理并插入到漏洞信息表中，在进行漏洞修复后，将修复记录插入到修复记录表中，并与对应的漏洞信息关联，完成数据的存储；

[0115] 定期更新漏洞特征库，关注安全公告和漏洞数据库，确定更新来源，定期检查更新来源，获取新的漏洞信息，在更新漏洞特征库后，进行一些测试和验证，确保更新的准确性和有效性。

[0116] 参照图2，一种计算机软件安全漏洞检测修复系统，包括静态特征提取模块、动态特征提取模块、漏洞检测模块、漏洞修复模块以及数据库模块；

[0117] 所述静态特征提取模块包括代码审查、抽象语法树分析和二进制分析；

[0118] 所述动态特征提取模块包括运行时监测和模糊测试；

[0119] 所述漏洞检测模块将提取的特征与漏洞特征库进行匹配以检测漏洞，特征匹配后进行深入分析和验证；

[0120] 所述漏洞修复模块根据检测到的漏洞的严重程度判断修复优先级，再根据漏洞类型确定修复策略并进行修复；

[0121] 所述数据库模块将提取的软件特征、检测到的漏洞信息、修复记录等数据存储到数据库中，并定期更新漏洞特征库。

[0122] 以上所述仅是本发明的优选实施方式，本发明的保护范围并不仅局限于上述实施例，凡属于本发明思路下的技术方案均属于本发明的保护范围。应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理前提下的若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。< / script>

Claims

1. A computer software security vulnerability detection and repair method, characterized in that: The following steps are involved: Static feature extraction is done through code review, abstract syntax tree analysis, and binary analysis; Dynamic feature extraction is done through runtime monitoring and fuzz testing; The extracted features are matched with the known vulnerability feature library to detect whether there are security vulnerabilities in the software. After feature matching, in-depth analysis and verification are performed; Determine the repair priority based on the severity of the detected vulnerability, and then determine the repair strategy and perform repairs based on the vulnerability type; The extracted software features, detected vulnerability information, and repair records are stored in the database, and the vulnerability feature library is updated regularly.

2. A computer software security vulnerability detection and repair method according to claim 1, characterized in that: Static feature extraction is done through code review, abstract syntax tree analysis, and binary analysis, including: Code review: clarify the scope of software code to be reviewed, review the software source code line by line, determine the logical structure of the code, the definition and use of variables, the calling relationship of functions, and record the problems found and potential security features; Abstract syntax tree analysis: converting source code into an abstract syntax tree representation, identifying specific code patterns through the extracted abstract syntax tree structural features, and recording the features obtained through analysis; Binary analysis: For software without source code, binary analysis is performed; the binary file to be analyzed is loaded using a disassembly tool. The disassembly tool automatically identifies the format and architecture of the binary file and converts it into assembly code. The disassembled assembly code is analyzed to find potential security vulnerabilities and extract features from the assembly code.

3. According to claim 2, a computer software security vulnerability detection and repair method is described, wherein dynamic feature extraction is completed through runtime monitoring and fuzz testing, comprising: Runtime monitoring: deploy runtime monitoring tools in the software running environment to monitor the memory usage, CPU occupancy, network communication behavior and system calls in real time during the software running process. Based on the collected data, detect whether there is abnormal behavior and record the characteristics of the software at runtime; Fuzz testing uses fuzz testing tools to generate a large amount of random input data, provides the generated test cases to the software for processing, observes the software's response, and records the software's behavioral characteristics when processing different test cases.

4. A computer software security vulnerability detection and repair method according to claim 3, characterized in that: The extracted features are matched with the known vulnerability feature library to detect whether there are security vulnerabilities in the software. After feature matching, in-depth analysis and verification are performed, including: Establish a vulnerability feature library to collect known security vulnerability features; organize and classify the collected vulnerability features, establish a structured vulnerability feature library, and regularly update the vulnerability feature library; Feature matching and vulnerability detection: the extracted software features are compared one by one with the features in the vulnerability feature library. A pattern matching algorithm can be used to determine whether there are matching features. If matching features are found, the matching vulnerability type and related information are recorded. At the same time, the preliminary vulnerability risk level is determined based on the degree and importance of the match. In-depth analysis and verification: For situations where vulnerabilities may exist, debugging tools, dynamic analysis tools, and manual review can be used to conduct a more detailed inspection of the software to determine the existence of vulnerabilities and the type, location, and risk level of the vulnerabilities.

5. A computer software security vulnerability detection and repair method according to claim 4, characterized in that: Determine the repair priority based on the severity of the detected vulnerability, and then determine the repair strategy based on the vulnerability type and perform the repair, including: Assess the severity of the vulnerability. Assess the severity of the vulnerability based on the likelihood of the vulnerability being exploited, the scope of impact the vulnerability may cause, and the extent of the loss. Use the Common Vulnerability Scoring System standard to quantify the severity of the vulnerability, dividing it into high, medium, and low levels; Prioritize repairs based on severity. High-severity vulnerabilities should be immediately prioritized for repair; medium-severity vulnerabilities should be given a higher priority and repair plans should be arranged as soon as possible; low-severity vulnerabilities can be repaired gradually if resources permit. Determine the repair strategy and repair it according to the vulnerability type; the vulnerability types include input validation vulnerabilities, permission management vulnerabilities, encryption vulnerabilities, code injection vulnerabilities, buffer overflow vulnerabilities and logic vulnerabilities; The repair strategy for the input validation vulnerability includes: Strict input validation: perform comprehensive validation on all user input; use regular expressions or specific validation functions to ensure that the input meets expectations; Filter special characters that may cause security vulnerabilities; Adopt a whitelist mechanism to only allow input with specific formats and content, and reject input that does not match the whitelist; The repair strategy for the permission management vulnerability includes: The principle of least privilege ensures that users and processes have only the minimum permissions required to perform their tasks; Review the allocation of permissions, regularly review the allocation of permissions for users and processes, and revoke unnecessary permissions in a timely manner; Multi-factor authentication: For sensitive operations and critical resources, implement multi-factor authentication to increase security; The repair strategy for the encryption vulnerability includes: Upgrade encryption algorithms, evaluate the security of currently used encryption algorithms, and upgrade to more secure encryption algorithms in a timely manner; Strengthen key management to ensure the generation, storage, distribution and destruction of encryption keys are safe and reliable; Update keys regularly and replace encryption keys regularly to reduce the risk of key cracking; The repair strategy for the code injection vulnerability includes: Avoid dynamic code execution. Avoid dynamic code execution as much as possible. If dynamic code execution must be used, strictly validate and filter the input; Parameterized queries, use parameterized queries to prevent SQL injection attacks when interacting with the database; Input validation and filtering: strict validation and filtering of user input that may lead to code injection; The repair strategy for the buffer overflow vulnerability includes: Use safe string handling functions; Bounds checking: strict boundary checking is performed when performing memory operations; Static code analysis: Use static code analysis tools to detect buffer overflow vulnerabilities and fix them according to the tool's prompts; The repair strategy for the logic vulnerability includes: Review the business logic and carefully review the business logic of the software to find out where there may be logical loopholes; Add verification steps. Add additional verification steps based on the logical vulnerabilities found; Security testing: Conduct sufficient security testing to discover potential logic vulnerabilities; Verify the repair results. After fixing the security vulnerability, re-test the software. In addition to security vulnerability detection, functional testing of the repaired software is also required. Invite users to perform acceptance testing on the software.

6. A computer software security vulnerability detection and repair method according to claim 5, characterized in that: The extracted software features, detected vulnerability information, and repair records are stored in the database, and the vulnerability feature library is updated regularly, including: Store data in the database, determine the type of information that needs to be stored in the database, design the database table structure, select a database management system, and create a database based on the designed database structure; after the software feature extraction is completed, the extracted feature data is sorted and formatted according to the database table structure, and the software feature data is inserted into the software feature table using a database insert statement or database operation library. When a vulnerability is detected, the vulnerability information is sorted and inserted into the vulnerability information table. After the vulnerability is repaired, the repair record is inserted into the repair record table and associated with the corresponding vulnerability information to complete the data storage; Update the vulnerability signature library regularly, pay attention to security bulletins and vulnerability databases, determine the update source, check the update source regularly, obtain new vulnerability information, and perform some tests and verifications after updating the vulnerability signature library to ensure the accuracy and effectiveness of the update.

7. A computer software security vulnerability detection and repair system, applied to a computer software security vulnerability detection and repair method according to claims 1-6, characterized in that: It includes static feature extraction module, dynamic feature extraction module, vulnerability detection module, vulnerability repair module and database module; The static feature extraction module includes code review, abstract syntax tree analysis and binary analysis; The dynamic feature extraction module includes runtime monitoring and fuzz testing; The vulnerability detection module matches the extracted features with the vulnerability feature library to detect vulnerabilities, and performs in-depth analysis and verification after feature matching; The vulnerability repair module determines the repair priority according to the severity of the detected vulnerability, and then determines the repair strategy according to the vulnerability type and performs the repair; The database module stores the extracted software features, detected vulnerability information, repair records and other data in the database, and regularly updates the vulnerability feature library.

Images