Code vulnerability detection method and system, product, equipment and storage medium

Abstract

The invention discloses a code vulnerability detection method and system, a product, equipment and a storage medium, and relates to the field of software vulnerability detection.The code vulnerability detection method comprises the steps that multiple to-be-detected function code segments of a to-be-detected source code are input into a preset attribute graph generation script, and a code attribute graph of each to-be-detected function code segment is obtained, and extracting a to-be-detected code attribute triple representing semantic information of each to-be-detected function code segment from the target to-be-detected function code segment, and determining a vulnerability detection result of the to-be-detected function code segment corresponding to the target to-be-detected code attribute triple based on the similarity between the target to-be-detected code attribute triple and each vulnerability code attribute triple set. According to the method, the to-be-detected code attribute triples of the to-be-detected function code segments are extracted based on the code attribute graph, the semantic information of the to-be-detected function code segments is extracted, then vulnerability detection is performed based on the semantic information, and compared with the prior art, the code vulnerability detection precision under the condition that code form modification is large is improved.

Description

Technical Field

[0001] The present application relates to the technical field of software vulnerability detection, and in particular to a method, system, product, device and storage medium for detecting code vulnerabilities. Background Art

[0002] As the complexity of system functions increases, it is becoming more common for developers to copy or reuse existing open source code during the development process in order to improve the efficiency of system source code development. This behavior of copying or reusing open source code is called "code cloning". Since there may be vulnerabilities in open source code, when the above-mentioned "code cloning" behavior occurs, the developed system source code will also have vulnerabilities. At this time, attackers can attack the system through code vulnerabilities, causing security issues in the system.

[0003] In order to detect code vulnerabilities caused by code cloning, the existing technology searches for vulnerable function codes in open source code based on the security patch content in the open source code library, and obtains the vulnerability fingerprint of the vulnerable function code by abstracting and normalizing the vulnerable function code. Subsequently, the source code to be tested is split according to the function, and the obtained function code to be tested is also abstracted and normalized to obtain the code fingerprint of the function code to be tested. Finally, based on the consistency comparison results of the vulnerability fingerprint and the code fingerprint, it is determined whether the function code to be tested has the above-mentioned vulnerability.

[0004] However, in order to adapt to the corresponding system functions, developers will modify and adjust the open source code to varying degrees when copying or reusing the open source code, so that the open source code can adapt to the corresponding system functions in form without changing the semantics. Since the above modifications and adjustments do not change the semantics of the code, the adjusted source code still has vulnerabilities, but since the open source code before and after the modification is quite different in form, the difference between the vulnerability fingerprint and the code fingerprint is relatively large. If the existing method based on the consistency comparison of vulnerability fingerprints and code fingerprints is used for vulnerability detection, false detection will inevitably occur. It can be seen that the existing code vulnerability detection accuracy has the problem of low detection accuracy. Therefore, how to improve the accuracy of code vulnerability detection has become an urgent problem to be solved. Summary of the invention

[0005] In view of the above problems, this application provides a code vulnerability detection method, system, product, device and storage medium to achieve the purpose of improving the accuracy of code vulnerability detection. The specific solution is as follows:

[0006] The first aspect of the present application provides a method for detecting a code vulnerability, comprising:

[0007] Inputting a plurality of function code segments to be tested obtained after function splitting the source code to be tested into a preset property graph generation script respectively to obtain a code property graph of each of the function code segments to be tested;

[0008] Extracting a code attribute triple of each of the function code segments to be tested from a code attribute graph of each of the function code segments to be tested, wherein the code attribute triple represents semantic information of the function code segment to be tested, and the code attribute triple includes a condition code, a control flow relationship code, and a function result code in the function code segment to be tested;

[0009] The similarities between the target code attribute triplet to be tested and each set of vulnerability code attribute triplet in the preset vulnerability code library are calculated respectively, and the vulnerability detection result of the function code segment to be tested corresponding to the target code attribute triplet to be tested is determined based on the similarity, the vulnerability types of each set of vulnerability code attribute triplet are different, and the target code attribute triplet to be tested is any one of the code attribute triplet to be tested.

[0010] In a possible implementation, the process of building the preset vulnerability code library includes:

[0011] Extracting a plurality of source code combinations of the vulnerability types from a public data source based on vulnerability keywords, wherein the source code combinations include vulnerability source codes and vulnerability repair source codes corresponding to the same vulnerability types;

[0012] For each source code combination: extract at least one vulnerability function code segment from the vulnerability source code in the source code combination, and extract a vulnerability repair function code segment corresponding to the vulnerability function code segment from the vulnerability repair source code; input the vulnerability function code segment and the corresponding vulnerability repair function code segment into the preset property graph generation script respectively, to obtain a code property graph combination corresponding to the source code combination, the code property graph combination including: a code property graph of the vulnerability function code segment, and a code property graph of the vulnerability repair function code segment corresponding to the vulnerability function code segment; extract the vulnerability code property triple set corresponding to the source code combination from the code property graph combination;

[0013] The preset vulnerability code library is constructed based on the vulnerability code attribute triple set corresponding to the source code combination of each vulnerability type and the corresponding relationship between the vulnerability type and the source code combination.

[0014] In a possible implementation, extracting the vulnerability code attribute triple set corresponding to the source code combination from the code attribute graph combination includes:

[0015] Extracting an initial vulnerability triple from the code attribute graph of the vulnerability function code segment, and extracting an initial vulnerability repair triple from the code attribute graph of the vulnerability repair function code segment corresponding to the vulnerability function code segment, wherein both the initial vulnerability triple and the initial vulnerability repair triple include codes of condition type, control flow relationship type and function result type;

[0016] Extract the code that only exists in the initial vulnerability triple as a positive triple; extract the code that only exists in the initial vulnerability repair triple as a negative triple; extract the code that is common to the initial vulnerability triple and the initial vulnerability repair triple as a context triple;

[0017] The vulnerability code attribute triple set corresponding to the source code combination, including the positive triple, the negative triple and the context triple, is obtained.

[0018] In a possible implementation, respectively calculating the similarity between the target code attribute triplet to be tested and each set of vulnerability code attribute triplet in a preset vulnerability code library, and determining the vulnerability detection result of the function code segment to be tested corresponding to the target code attribute triplet to be tested based on the similarity, includes:

[0019] For each vulnerability code attribute triple set in the preset vulnerability code library:

[0020] Calculate a first similarity between the target code attribute triplet to be tested and the context triplet in the vulnerability code attribute triplet set, and determine whether the first similarity is greater than a first preset threshold, and if not, output a vulnerability detection result of the function code segment to be tested that does not have a vulnerability;

[0021] In the case where the first similarity is greater than the first preset threshold, calculating the second similarity between the target code attribute triplet to be tested and the positive triplet in the vulnerability code attribute triplet set, and determining whether the second similarity is greater than the second preset threshold, and if not, outputting the vulnerability detection result of the function code segment to be tested that does not have a vulnerability;

[0022] When the second similarity is greater than the second preset threshold, the third similarity between the target code attribute triplet to be tested and the negative triplet in the vulnerability code attribute triplet set is calculated, and it is determined whether the third similarity is less than the second similarity; if not, the output content is the vulnerability detection result of the function code segment to be tested that does not have a vulnerability; if so, the output content is the vulnerability detection result of the vulnerability type corresponding to the source code combination corresponding to the vulnerability code attribute triplet set.

[0023] The second aspect of the present application provides a code vulnerability detection system, comprising:

[0024] The property graph generation module is used to input the multiple function code segments to be tested obtained after function splitting the source code to be tested into a preset property graph generation script to obtain a code property graph of each of the function code segments to be tested;

[0025] A parameter extraction module, used to extract a code attribute triple of each of the function code segments to be tested from a code attribute graph of each of the function code segments to be tested, wherein the code attribute triple represents semantic information of the function code segment to be tested, and the code attribute triple includes a condition code, a control flow relationship code, and a function result code in the function code segment to be tested;

[0026] A vulnerability detection module is used to calculate the similarity between the target code attribute triple to be tested and each set of vulnerability code attribute triples in a preset vulnerability code library, and determine the vulnerability detection result of the function code segment to be tested corresponding to the target code attribute triple to be tested based on the similarity. The vulnerability types of each set of vulnerability code attribute triples are different, and the target code attribute triple to be tested is any one of the code attribute triples to be tested.

[0027] In a possible implementation, the code vulnerability detection system is further configured with a code library construction module, and the code library construction module is set to:

[0028] Extracting a plurality of source code combinations of the vulnerability types from a public data source based on vulnerability keywords, wherein the source code combinations include vulnerability source codes and vulnerability repair source codes corresponding to the same vulnerability types;

[0029] For each source code combination: extract at least one vulnerability function code segment from the vulnerability source code in the source code combination, and extract a vulnerability repair function code segment corresponding to the vulnerability function code segment from the vulnerability repair source code; input the vulnerability function code segment and the corresponding vulnerability repair function code segment into the preset property graph generation script respectively, to obtain a code property graph combination corresponding to the source code combination, the code property graph combination including: a code property graph of the vulnerability function code segment, and a code property graph of the vulnerability repair function code segment corresponding to the vulnerability function code segment; extract the vulnerability code property triple set corresponding to the source code combination from the code property graph combination;

[0030] The preset vulnerability code library is constructed based on the vulnerability code attribute triple set corresponding to the source code combination of each vulnerability type and the corresponding relationship between the vulnerability type and the source code combination.

[0031] In a possible implementation, when extracting the vulnerability code attribute triple set corresponding to the source code combination from the code attribute graph combination, the code library construction module is set to:

[0032] Extracting an initial vulnerability triple from the code attribute graph of the vulnerability function code segment, and extracting an initial vulnerability repair triple from the code attribute graph of the vulnerability repair function code segment corresponding to the vulnerability function code segment, wherein both the initial vulnerability triple and the initial vulnerability repair triple include codes of condition type, control flow relationship type and function result type;

[0033] Extract the code that only exists in the initial vulnerability triple as a positive triple; extract the code that only exists in the initial vulnerability repair triple as a negative triple; extract the code that is common to the initial vulnerability triple and the initial vulnerability repair triple as a context triple;

[0034] The vulnerability code attribute triple set corresponding to the source code combination, including the positive triple, the negative triple and the context triple, is obtained.

[0035] In a possible implementation, the vulnerability detection module is configured to:

[0036] For each vulnerability code attribute triple set in the preset vulnerability code library:

[0037] Calculate a first similarity between the target code attribute triplet to be tested and the context triplet in the vulnerability code attribute triplet set, and determine whether the first similarity is greater than a first preset threshold, and if not, output a vulnerability detection result of the function code segment to be tested that does not have a vulnerability;

[0038] In the case where the first similarity is greater than the first preset threshold, calculating the second similarity between the target code attribute triplet to be tested and the positive triplet in the vulnerability code attribute triplet set, and determining whether the second similarity is greater than the second preset threshold, and if not, outputting the vulnerability detection result of the function code segment to be tested that does not have a vulnerability;

[0039] When the second similarity is greater than the second preset threshold, the third similarity between the target code attribute triplet to be tested and the negative triplet in the vulnerability code attribute triplet set is calculated, and it is determined whether the third similarity is less than the second similarity; if not, the output content is the vulnerability detection result of the function code segment to be tested that does not have a vulnerability; if so, the output content is the vulnerability detection result of the vulnerability type corresponding to the source code combination corresponding to the vulnerability code attribute triplet set.

[0040] A third aspect of the present application provides a computer program product, comprising computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements the method for detecting code vulnerabilities in the first aspect or any implementation of the first aspect.

[0041] A fourth aspect of the present application provides an electronic device, comprising at least one processor and a memory connected to the processor, wherein:

[0042] The memory is used to store computer programs;

[0043] The processor is used to execute the computer program so that the electronic device can implement the method for detecting code vulnerabilities in the above-mentioned first aspect or any implementation manner of the first aspect.

[0044] A fifth aspect of the present application provides a computer storage medium, which carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can detect code vulnerabilities according to the first aspect or any implementation method of the first aspect.

[0045] By means of the above technical scheme, the present application provides a method, system, product, device and storage medium for detecting code vulnerabilities. By configuring the function splitting of the source code to be tested, the multiple function code segments to be tested are respectively input into the preset attribute graph generation script, and the code attribute graph of each function code segment to be tested is obtained, so as to realize the extraction of the code for vulnerability detection in each function code segment to be tested. Subsequently, by configuring the extraction of the code attribute triples to be tested including the conditional code, control flow relationship code and function result code in the function code segment to be tested from the code attribute graph, the extraction of the semantic information characterizing the function code segment to be tested in the function code segment to be tested is realized. Finally, by configuring the consistency comparison of the target code attribute triples to be tested and the sets of each vulnerability code attribute triples in the preset vulnerability code library, the vulnerability detection result of the function code segment to be tested corresponding to the target code attribute triples to be tested is determined based on the comparison result, so as to realize the vulnerability detection based on the semantic information, so that the present application, compared with the prior art, avoids the risk of false detection in the prior art when the code form adjustment or modification leads to a large difference in the form of the function code segment to be tested before and after the modification. It can be seen that this application improves the accuracy of code vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0047] Figure 1 A flowchart of a method for detecting code vulnerabilities provided by this application;

[0048] Figure 2 A code attribute diagram provided for this application;

[0049] Figure 3 A flowchart of a process for generating a set of vulnerability code attribute triples provided by the present application;

[0050] Figure 4 A block diagram of a code vulnerability detection system provided by the present application;

[0051] Figure 5 A schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION

[0052] The following describes the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation method section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0053] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0054] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0055] The first aspect of the present application provides a method for detecting code vulnerabilities, such as Figure 1 As shown, the detection method of this code vulnerability includes:

[0056] S101, inputting a plurality of function code segments to be tested obtained by function splitting the source code to be tested into a preset property graph generation script respectively to obtain a code property graph of each function code segment to be tested.

[0057] It should be noted that, in actual application scenarios, there are multiple implementation methods for performing function splitting on the source code to be tested to obtain multiple function code segments to be tested. An exemplary implementation is provided herein, including the following steps A1 to A2.

[0058] Step A1, traverse the source code to be tested based on the preset function list, and determine the function name in the source code to be tested that is consistent with the function name in the preset function list as the function name to be tested, and trigger step A2.

[0059] In a possible implementation, the preset function list stores function names of all functions provided by the programming language adopted by the source code to be tested.

[0060] Step A2, for each function name to be tested: search for a set of code block delimiters with the largest coverage after the function name to be tested, and determine the function name to be tested, the function condition corresponding to the function name to be tested, and the code between the code block delimiters as the function code segment to be tested corresponding to the function name to be tested.

[0061] In a possible implementation, the code block delimiter is a character used to clarify the scope of the function represented by the function name to be tested, such as curly braces and parentheses, and the search priority of curly braces is higher than that of parentheses.

[0062] In order to facilitate the understanding of the above step A2, a possible implementation of the present application is specifically described here:

[0063] Assume that the source code to be tested is as follows: if(x>MIN){int y=x*10;output(y);}. Assume that the current name of the function to be tested is "if" corresponding to "if(x>MIN)". For the function name to be tested, the following code block delimiters include a set of curly braces and three sets of parentheses. However, it can be seen from the coverage that the set of code block delimiters with the largest coverage is the curly braces. For the function name to be tested, the corresponding function code segment to be tested is the above source code to be tested, where x>MIN is the function condition corresponding to the function name to be tested.

[0064] Those skilled in the art can understand that, in actual application scenarios, the above-mentioned preset property graph generation script can be a script program obtained by adding a call function to the code analysis tool (JOERN). This application does not make too many restrictions and redundant descriptions on the specific construction process of the above-mentioned preset property graph generation script.

[0065] It should be noted that in actual application scenarios, the above code property graph (CPG) characterizes the structure, properties and relationship information of program code. This application configures the input of the code segment of the function to be tested into a preset property graph generation script to obtain the code property graph of the code segment of the function to be tested, thereby realizing the disassembly of different property codes in the function code to be tested, thereby facilitating the subsequent extraction of the property triples of the code to be tested.

[0066] S102. Extracting a code attribute triple of each function code segment to be tested from a code attribute graph of each function code segment to be tested, wherein the code attribute triple represents semantic information of the function code segment to be tested, and the code attribute triple includes conditional code, control flow relationship code and function result code in the function code segment to be tested.

[0067] It should be noted that, in actual application scenarios, the above-mentioned condition code (Condition Code) is a code that represents the triggering condition for triggering the execution of a function. The above-mentioned control flow relationship code is a code used to represent the order of function execution. The above-mentioned function structure code is a code used to represent the return value after the function is executed. The above-mentioned condition code can determine the role and triggering condition of the function code segment to be tested, the above-mentioned control flow relationship can determine the specific execution action represented by the function code segment to be tested, and the above-mentioned function result code can determine the execution result of the function code segment to be tested. It can be seen that the above-mentioned triple of the code attribute to be tested, including the condition code, control flow relationship code and function result code in the function code segment to be tested, can represent the semantics of the function code segment to be tested.

[0068] In order to facilitate the understanding of the above code attribute graph, a possible implementation of this application is specifically described here:

[0069] Assume that the code segment of the function to be tested is: int x = intput(); if (x>MIN) {int y = x*10; output (y);}, the semantics of the code segment of the function to be tested is: when the value of variable x is greater than the minimum value (MIN), define the value of variable y as the product of variable x and 10, and output the value of y. The code attribute diagram of the code segment of the function to be tested is as follows Figure 2 As shown, the control flow of the function code segment to be tested includes the following components: ENTRY represents the starting end of the function code segment to be tested, DECL1 represents the first variable definition of the function code segment to be tested, PRED represents the judgment condition of the function code segment to be tested, DECL2 represents the second variable definition of the function code segment to be tested, CALL represents the function result of the function code segment to be tested, and EXIT represents the terminal end of the function code segment to be tested. Since the function code segment to be tested lacks the execution code when PRED does not meet the judgment condition, it will directly jump to EXIT when PRED does not meet the judgment condition.

[0070] From the semantics of the code segment of the function to be tested, it can be seen that the grammatical relationship in the figure includes: DECL1 includes the variable definition function "int" and the assignment function "=", and the associated variables of the assignment function "=" include the assignment object variable "x" and the assignment result (CALL) "input()"; PRED includes the judgment function ">", and the associated variables of the judgment function ">" include the variable "x" and the minimum value "MIN"; DECL2 includes the variable definition function "int" and the assignment function "=", and the associated variables of the assignment function "=" include the assignment object variable "y" and the assignment result function "*", as well as the associated variables "x" and "10" of the assignment result function "*"; CALL includes the output function "output" and the output function value (ARG), and the output function value calls the value of the variable "y" in DECL2. Since DECL2 needs to rely on "x" in DECL1 to calculate "y", DECL2 and DECL1 have a data dependency relationship. Similarly, since y in CALL is obtained in DECL2, CALL and DECL2 have a data dependency relationship. Since both DECL2 and CALL need to be triggered when PRED meets the conditions, both DECL2 and CALL have a control dependency relationship with PRED.

[0071] It should be noted that in actual application scenarios, since the code attribute graph carries the full information of the code segment of the function to be tested, if vulnerability detection is performed based on the code attribute graph, the existence of redundant information will lead to a decrease in the efficiency and accuracy of vulnerability detection. However, this solution removes redundant data and improves the efficiency and accuracy of vulnerability detection by configuring the code attribute triples to be extracted from the code attribute graph of each code segment of the function to be tested, which represents the semantic information of each code segment of the function to be tested.

[0072] S103, respectively calculating the similarity between the target code attribute triple to be tested and each vulnerability code attribute triple set in the preset vulnerability code library, and determining the vulnerability detection result of the function code segment to be tested corresponding to the target code attribute triple to be tested based on the similarity, wherein the vulnerability types of each vulnerability code attribute triple set are different, and the target code attribute triple to be tested is any one of the code attribute triples to be tested.

[0073] It should be noted that, in actual application scenarios, the above-mentioned vulnerability code attribute triple set is similar to the above-mentioned test code attribute triple, and includes code for semantic information of the vulnerability code that characterizes the corresponding vulnerability type. Therefore, the present application configures the target test code attribute triple and each vulnerability code attribute triple set in the preset vulnerability code library to perform consistency comparison, and determines the vulnerability detection result of the test function code segment corresponding to the target test code attribute triple based on the comparison result, thereby realizing vulnerability detection based on semantic information and avoiding the risk of false detection in the prior art when the code form is adjusted or modified, resulting in a large difference in the form of the test function code segment before and after the modification.

[0074] The present application configures the multiple function code segments to be tested obtained after function splitting of the source code to be tested to be input into the preset attribute graph generation script respectively, obtains the code attribute graph of each function code segment to be tested, and realizes the extraction of the code for vulnerability detection in each function code segment to be tested. Subsequently, by configuring to extract the test code attribute triples including the conditional code, control flow relationship code and function result code in the function code segment to be tested from the code attribute graph, the extraction of the semantic information characterizing the function code segment to be tested in the function code segment to be tested is realized. Finally, by configuring to compare the consistency of the target code attribute triples to be tested with the sets of vulnerability code attribute triples in the preset vulnerability code library, and determining the vulnerability detection result of the function code segment to be tested corresponding to the target code attribute triples to be tested based on the comparison results, the vulnerability detection based on semantic information is realized, so that compared with the prior art, the present application avoids the risk of false detection in the prior art when the code form is adjusted or modified, resulting in a large difference in the form of the function code segment to be tested before and after the modification. It can be seen that the present application improves the accuracy of code vulnerability detection.

[0075] In a possible implementation, the construction process of the preset vulnerability code library includes:

[0076] Extract source code combinations of multiple vulnerability types from public data sources based on vulnerability keywords, where the source code combinations include vulnerability source code and vulnerability repair source code corresponding to the same vulnerability type;

[0077] For each source code combination: extract at least one vulnerability function code segment from the vulnerability source code in the source code combination, and extract the vulnerability repair function code segment corresponding to the vulnerability function code segment from the vulnerability repair source code; input the vulnerability function code segment and its corresponding vulnerability repair function code segment into a preset property graph generation script respectively, to obtain a code property graph combination corresponding to the source code combination, the code property graph combination including: a code property graph of the vulnerability function code segment, and a code property graph of the vulnerability repair function code segment corresponding to the vulnerability function code segment; extract a set of vulnerability code attribute triples corresponding to the source code combination from the code property graph combination;

[0078] A preset vulnerability code library is constructed based on the vulnerability code attribute triple set corresponding to the source code combination of each vulnerability type and the correspondence between the vulnerability type and the source code combination.

[0079] It should be noted that, in actual application scenarios, the above-mentioned public data source may be a management platform for open source codes.

[0080] It should be noted that, in actual application scenarios, one source code combination may correspond to at least one code attribute graph combination.

[0081] It should be noted that, in actual application scenarios, there are multiple implementation methods for extracting source code combinations of multiple vulnerability types from public data sources based on vulnerability keywords. An exemplary implementation is provided here, including the following steps B1 to B3.

[0082] Step B1: access the submission log of the public data source, and search for submission record identifiers with vulnerability keywords in the submission log.

[0083] In a possible implementation, the above vulnerability keywords can be vulnerability numbers defined in the Common Vulnerabilities and Exposures (CVE) system. For example, the vulnerability keyword "CVE-2020-22253" represents a backdoor vulnerability, the vulnerability keyword "CVE-2020-16898" represents a remote code execution vulnerability, and the vulnerability keyword "CWE-122" represents a heap buffer overflow vulnerability.

[0084] In a possible implementation, the submission record is a record file when the public data source uploads the open source code information to the open source party.

[0085] Step B2: Search the public data source for the submission file corresponding to the submission record identifier obtained in step B1, wherein the submission file includes at least the vulnerability type, vulnerability source code, and vulnerability repair source code, wherein the vulnerability repair source code contains modification record annotations. Step B3 is triggered.

[0086] Step B3, extracting the vulnerability type, vulnerability source code and vulnerability repair source code from the submitted file found in step B2.

[0087] It should be noted that in actual application scenarios, since developers perform operations to repair vulnerabilities in open source codes during the use of open source codes. Such operations will result in large differences in the form of the code before and after the modification. In addition, since the repair operation for vulnerabilities of a specific vulnerability type has a specific solution idea, that is, different developers have similar repair logic for vulnerabilities of a specific vulnerability type, therefore, this application extracts a set of vulnerability code attribute triples corresponding to a source code combination including vulnerability source code and vulnerability repair source code corresponding to the same vulnerability type through configuration, so that the obtained set of vulnerability code attribute triples includes both the semantic information of the original open source code and the semantic information of the open source code after the vulnerability repair, thereby improving the detection accuracy of vulnerabilities in the modified code segment of the function to be tested.

[0088] In a possible implementation, a set of vulnerability code attribute triples corresponding to the source code combination is extracted from the code attribute graph combination, including:

[0089] Extracting an initial vulnerability triple from the code attribute graph of the vulnerability function code segment, and extracting an initial vulnerability repair triple from the code attribute graph of the vulnerability repair function code segment corresponding to the vulnerability function code segment, wherein both the initial vulnerability triple and the initial vulnerability repair triple include codes of condition type, control flow relationship type, and function result type;

[0090] Extract the code that only exists in the initial vulnerability triple as positive triples; extract the code that only exists in the initial vulnerability repair triple as negative triples; extract the code common to the initial vulnerability triple and the initial vulnerability repair triple as context triples;

[0091] A vulnerability code attribute triple set including positive triples, negative triples and context triples corresponding to the source code combination is obtained.

[0092] It should be noted that, in actual application scenarios, the above-mentioned acquisition of the vulnerability code attribute triple set based on the initial vulnerability triple and the initial vulnerability repair triple can be implemented by a preset extraction script. Here, the execution logic of the preset extraction script to obtain the vulnerability code attribute triple set is briefly described:

[0093] Assume that the vulnerable function code segment is: {int x = intput(); if (x> MIN) {int y = x*10; output (y);}}, the vulnerable function code segment has a vulnerability of the vulnerability type "not detecting whether y is out of bounds". The corresponding vulnerability repair function code segment is: {int x = intput(); if (x> MIN) {int y = x*10; if (y< MAX); output (y);}}, and the vulnerability repair function code segment fixes the above "not detecting whether y is out of bounds" vulnerability by adding the "if (y< MAX)" code.

[0094] Assume that the above initial vulnerability triples are set V, and the above initial vulnerability repair triples are set P.

[0095] Then the remaining set after subtracting the P set from the V set is determined as the above-mentioned positive triple (PT set), that is: PT = VP. The remaining set after subtracting the V set from the P set is determined as the above-mentioned negative triple (NT set), that is: NT = PV. Finally, the intersection of the PT set and the NT set is determined as the above-mentioned context triple (CT set), that is: CT = PT∩NT.

[0096] After the above processing, the obtained vulnerability code attribute triple set can be shown in Table 1 below.

[0097] Table 1

[0098]

[0099] The data in each triplet are, in order, a condition code, a control flow relationship code, and a function result code.

[0100] In order to facilitate the understanding of the above process of obtaining the vulnerability code attribute triple set, a possible implementation of the present application is specifically described here:

[0101] like Figure 3 As shown, it is a flowchart of the process of generating a vulnerability code attribute triple set. It is assumed that only one vulnerability function code segment and its corresponding vulnerability repair function code segment are extracted from the source code combination. The specific operation steps are as follows:

[0102] Step S301, extracting a target vulnerability function code segment from the vulnerability source code of the target source code combination, and extracting a target vulnerability repair function code segment corresponding to the target vulnerability function code segment from the vulnerability repair source code of the target source code combination, and triggering steps S302 and S303.

[0103] Step S302: Input the target vulnerability function code segment into a preset property graph generation script to obtain the code property graph of the target vulnerability function code segment, and trigger step S304.

[0104] Step S303: input the target vulnerability repair function code segment into a preset property graph generation script to obtain a code property graph of the target vulnerability repair function code segment, and trigger step S304.

[0105] Step S304, obtaining a code attribute graph combination including a code attribute graph of a target vulnerability function code segment and a code attribute graph of a target vulnerability repair function code segment, and triggering steps S305 and S306.

[0106] Step S305: extract the initial vulnerability triplet from the code attribute graph of the target vulnerability function code segment. And trigger step S307

[0107] Step S306, extracting the initial vulnerability repair triplet from the code attribute graph of the target vulnerability repair function code segment, and triggering step S307.

[0108] Step S307: extract the code that only exists in the initial vulnerability triple as a positive triple; extract the code that only exists in the initial vulnerability repair triple as a negative triple; extract the code that is common to the initial vulnerability triple and the initial vulnerability repair triple as a context triple. Step S308 is triggered.

[0109] Step S308: Determine a set including positive triples, negative triples, and context triples as a set of vulnerability code attribute triples corresponding to the target source code combination.

[0110] In a possible implementation, the similarities between the target code attribute triplet and each vulnerability code attribute triplet set in the preset vulnerability code library are calculated respectively, and the vulnerability detection result of the function code segment to be tested corresponding to the target code attribute triplet to be tested is determined based on the similarity, including:

[0111] For each vulnerability code attribute triple set in the preset vulnerability code library:

[0112] Calculate the first similarity between the target code attribute triplet and the context triplet in the vulnerability code attribute triplet set, and determine whether the first similarity is greater than a first preset threshold, if not, output the vulnerability detection result of the function code segment under test that does not have a vulnerability;

[0113] When the first similarity is greater than the first preset threshold, the second similarity between the target code attribute triple and the positive triple in the vulnerability code attribute triple set is calculated, and it is determined whether the second similarity is greater than the second preset threshold. If not, the output content is the vulnerability detection result of the function code segment to be tested that does not have the vulnerability;

[0114] When the second similarity is greater than the second preset threshold, the third similarity between the target code attribute triplet to be tested and the negative triplet in the vulnerability code attribute triplet set is calculated, and it is determined whether the third similarity is less than the second similarity. If not, the output content is the vulnerability detection result of the function code segment to be tested that does not have a vulnerability; if so, the output content is the vulnerability detection result of the vulnerability type corresponding to the source code combination corresponding to the vulnerability code attribute triplet set.

[0115] It should be noted that in actual application scenarios, since the vulnerability code has data dependence or control dependence on the context code, if the first similarity between the target code to be tested attribute triple and the context triple is not greater than the first preset threshold, then the function code segment to be tested corresponding to the target code to be tested attribute triple does not have the data dependence or control dependency relationship required for the existence of the vulnerability code. Therefore, the present application improves the vulnerability detection efficiency by configuring the output of the vulnerability detection result of the function code segment to be tested that does not have a vulnerability when the first similarity is not greater than the first preset threshold.

[0116] The second aspect of the present application provides a code vulnerability detection system, such as Figure 4 As shown, the code vulnerability detection system includes:

[0117] The property graph generation module 401 is used to input multiple function code segments to be tested obtained after function splitting the source code to be tested into a preset property graph generation script to obtain a code property graph of each function code segment to be tested;

[0118] A parameter extraction module 402 is used to extract a code attribute triple of each function code segment to be tested from a code attribute graph of each function code segment to be tested, wherein the code attribute triple represents semantic information of the function code segment to be tested, and the code attribute triple includes a condition code, a control flow relationship code, and a function result code in the function code segment to be tested;

[0119] The vulnerability detection module 403 is used to calculate the similarity between the target code attribute triple to be tested and each vulnerability code attribute triple set in the preset vulnerability code library, and determine the vulnerability detection result of the function code segment to be tested corresponding to the target code attribute triple to be tested based on the similarity. The vulnerability types of each vulnerability code attribute triple set are different, and the target code attribute triple to be tested is any one of the code attribute triples to be tested.

[0120] In one possible implementation, the above Figure 4 The code vulnerability detection system shown is also configured with a code library construction module, which is set to:

[0121] Extract source code combinations of multiple vulnerability types from public data sources based on vulnerability keywords, where the source code combinations include vulnerability source code and vulnerability repair source code corresponding to the same vulnerability type;

[0122] For each source code combination: extract at least one vulnerability function code segment from the vulnerability source code in the source code combination, and extract the vulnerability repair function code segment corresponding to the vulnerability function code segment from the vulnerability repair source code; input the vulnerability function code segment and its corresponding vulnerability repair function code segment into a preset property graph generation script respectively, to obtain a code property graph combination corresponding to the source code combination, the code property graph combination including: a code property graph of the vulnerability function code segment, and a code property graph of the vulnerability repair function code segment corresponding to the vulnerability function code segment; extract a set of vulnerability code attribute triples corresponding to the source code combination from the code property graph combination;

[0123] A preset vulnerability code library is constructed based on the vulnerability code attribute triple set corresponding to the source code combination of each vulnerability type and the correspondence between the vulnerability type and the source code combination.

[0124] In a possible implementation, when extracting the vulnerability code attribute triple set corresponding to the source code combination from the code attribute graph combination, the code library construction module is set to:

[0125] Extracting an initial vulnerability triple from the code attribute graph of the vulnerability function code segment, and extracting an initial vulnerability repair triple from the code attribute graph of the vulnerability repair function code segment corresponding to the vulnerability function code segment, wherein both the initial vulnerability triple and the initial vulnerability repair triple include codes of condition type, control flow relationship type, and function result type;

[0126] Extract the code that only exists in the initial vulnerability triple as positive triples; extract the code that only exists in the initial vulnerability repair triple as negative triples; extract the code common to the initial vulnerability triple and the initial vulnerability repair triple as context triples;

[0127] A vulnerability code attribute triple set including positive triples, negative triples and context triples corresponding to the source code combination is obtained.

[0128] In a possible implementation, the vulnerability detection module 403 is configured to:

[0129] For each vulnerability code attribute triple set in the preset vulnerability code library:

[0130] Calculate the first similarity between the target code attribute triplet and the context triplet in the vulnerability code attribute triplet set, and determine whether the first similarity is greater than a first preset threshold, if not, output the vulnerability detection result of the function code segment under test that does not have a vulnerability;

[0131] When the first similarity is greater than the first preset threshold, the second similarity between the target code attribute triple and the positive triple in the vulnerability code attribute triple set is calculated, and it is determined whether the second similarity is greater than the second preset threshold. If not, the output content is the vulnerability detection result of the function code segment to be tested that does not have the vulnerability;

[0132] When the second similarity is greater than the second preset threshold, the third similarity between the target code attribute triplet to be tested and the negative triplet in the vulnerability code attribute triplet set is calculated, and it is determined whether the third similarity is less than the second similarity. If not, the output content is the vulnerability detection result of the function code segment to be tested that does not have a vulnerability; if so, the output content is the vulnerability detection result of the vulnerability type corresponding to the source code combination corresponding to the vulnerability code attribute triplet set.

[0133] A third aspect of the present application provides a computer program product, including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements the method for detecting code vulnerabilities in the above-mentioned first aspect or any implementation method of the first aspect.

[0134] A fourth aspect of the present application provides an electronic device, comprising at least one processor and a memory connected to the processor, wherein:

[0135] The memory is used to store computer programs;

[0136] The processor is used to execute a computer program so that the electronic device can implement the method for detecting code vulnerabilities in the first aspect or any implementation of the first aspect.

[0137] A fifth aspect of the present application provides a computer storage medium, which carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can detect code vulnerabilities according to the first aspect or any implementation method of the first aspect.

[0138] The structural diagram of the electronic device provided in the fourth aspect of the present application is as follows Figure 5 The electronic devices in the embodiments of the present application may include but are not limited to fixed terminals such as mobile phones, notebook computers, PDAs (personal digital assistants), PADs (tablet computers), desktop computers, and the like. Figure 5The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0139] like Figure 5 As shown, the electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 into a random access memory (RAM) 503. When the electronic device is powered on, various programs and data required for the operation of the electronic device are also stored in the RAM 503. The processing device 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0140] Typically, the following devices may be connected to the I / O interface 505: an input device 506 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 508 including, for example, a memory card, a hard disk, etc.; and a communication device 509. The communication device 509 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although Figure 5 An electronic device having various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0141] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0142] Through the description of the above implementation mode, the technical personnel in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including application-specific integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented with corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits, etc. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a magnetic disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0143] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0144] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

Claims

1. A method for detecting code vulnerabilities, characterized in that: include: Inputting a plurality of function code segments to be tested obtained after function splitting the source code to be tested into a preset property graph generation script respectively to obtain a code property graph of each of the function code segments to be tested; Extracting a code attribute triple of each of the function code segments to be tested from a code attribute graph of each of the function code segments to be tested, wherein the code attribute triple represents semantic information of the function code segment to be tested, and the code attribute triple includes a condition code, a control flow relationship code, and a function result code in the function code segment to be tested; The similarities between the target code attribute triplet to be tested and each set of vulnerability code attribute triplet in the preset vulnerability code library are calculated respectively, and the vulnerability detection result of the function code segment to be tested corresponding to the target code attribute triplet to be tested is determined based on the similarity, the vulnerability types of each set of vulnerability code attribute triplet are different, and the target code attribute triplet to be tested is any one of the code attribute triplet to be tested.

2. The method for detecting code vulnerabilities according to claim 1, characterized in that: The construction process of the preset vulnerability code library includes: Extracting a plurality of source code combinations of the vulnerability types from a public data source based on vulnerability keywords, wherein the source code combinations include vulnerability source codes and vulnerability repair source codes corresponding to the same vulnerability types; For each source code combination: extract at least one vulnerability function code segment from the vulnerability source code in the source code combination, and extract a vulnerability repair function code segment corresponding to the vulnerability function code segment from the vulnerability repair source code; input the vulnerability function code segment and the corresponding vulnerability repair function code segment into the preset property graph generation script respectively, to obtain a code property graph combination corresponding to the source code combination, the code property graph combination including: a code property graph of the vulnerability function code segment, and a code property graph of the vulnerability repair function code segment corresponding to the vulnerability function code segment; extract the vulnerability code property triple set corresponding to the source code combination from the code property graph combination; The preset vulnerability code library is constructed based on the vulnerability code attribute triple set corresponding to the source code combination of each vulnerability type and the corresponding relationship between the vulnerability type and the source code combination.

3. The method for detecting code vulnerabilities according to claim 2, characterized in that: The step of extracting the vulnerability code attribute triple set corresponding to the source code combination from the code attribute graph combination includes: Extracting an initial vulnerability triple from the code attribute graph of the vulnerability function code segment, and extracting an initial vulnerability repair triple from the code attribute graph of the vulnerability repair function code segment corresponding to the vulnerability function code segment, wherein both the initial vulnerability triple and the initial vulnerability repair triple include codes of condition type, control flow relationship type and function result type; Extract the code that only exists in the initial vulnerability triple as a positive triple; extract the code that only exists in the initial vulnerability repair triple as a negative triple; extract the code that is common to the initial vulnerability triple and the initial vulnerability repair triple as a context triple; The vulnerability code attribute triple set corresponding to the source code combination, including the positive triple, the negative triple and the context triple, is obtained.

4. The method for detecting code vulnerabilities according to claim 3, characterized in that: The respectively calculating the similarity between the target code attribute triplet and each set of vulnerability code attribute triplet in the preset vulnerability code library, and determining the vulnerability detection result of the function code segment to be tested corresponding to the target code attribute triplet based on the similarity, comprises: For each vulnerability code attribute triple set in the preset vulnerability code library: Calculate a first similarity between the target code attribute triplet to be tested and the context triplet in the vulnerability code attribute triplet set, and determine whether the first similarity is greater than a first preset threshold, and if not, output a vulnerability detection result of the function code segment to be tested that does not have a vulnerability; In the case where the first similarity is greater than the first preset threshold, calculating the second similarity between the target code attribute triplet to be tested and the positive triplet in the vulnerability code attribute triplet set, and determining whether the second similarity is greater than the second preset threshold, and if not, outputting the vulnerability detection result of the function code segment to be tested that does not have a vulnerability; When the second similarity is greater than the second preset threshold, the third similarity between the target code attribute triplet to be tested and the negative triplet in the vulnerability code attribute triplet set is calculated, and it is determined whether the third similarity is less than the second similarity; if not, the output content is the vulnerability detection result of the function code segment to be tested that does not have a vulnerability; if so, the output content is the vulnerability detection result of the vulnerability type corresponding to the source code combination corresponding to the vulnerability code attribute triplet set.

5. A code vulnerability detection system, characterized in that: include: The property graph generation module is used to input the multiple function code segments to be tested obtained after function splitting the source code to be tested into a preset property graph generation script to obtain a code property graph of each of the function code segments to be tested; A parameter extraction module, used to extract a code attribute triple of each of the function code segments to be tested from a code attribute graph of each of the function code segments to be tested, wherein the code attribute triple represents semantic information of the function code segment to be tested, and the code attribute triple includes a condition code, a control flow relationship code, and a function result code in the function code segment to be tested; A vulnerability detection module is used to calculate the similarity between the target code attribute triple to be tested and each set of vulnerability code attribute triples in a preset vulnerability code library, and determine the vulnerability detection result of the function code segment to be tested corresponding to the target code attribute triple to be tested based on the similarity. The vulnerability types of each set of vulnerability code attribute triples are different, and the target code attribute triple to be tested is any one of the code attribute triples to be tested.

6. The code vulnerability detection system according to claim 5, characterized in that: The code vulnerability detection system is further configured with a code library construction module, and the code library construction module is set to: Extracting a plurality of source code combinations of the vulnerability types from a public data source based on vulnerability keywords, wherein the source code combinations include vulnerability source codes and vulnerability repair source codes corresponding to the same vulnerability types; For each source code combination: extract at least one vulnerability function code segment from the vulnerability source code in the source code combination, and extract a vulnerability repair function code segment corresponding to the vulnerability function code segment from the vulnerability repair source code; input the vulnerability function code segment and the corresponding vulnerability repair function code segment into the preset property graph generation script respectively, to obtain a code property graph combination corresponding to the source code combination, the code property graph combination including: a code property graph of the vulnerability function code segment, and a code property graph of the vulnerability repair function code segment corresponding to the vulnerability function code segment; extract the vulnerability code property triple set corresponding to the source code combination from the code property graph combination; The preset vulnerability code library is constructed based on the vulnerability code attribute triple set corresponding to the source code combination of each vulnerability type and the corresponding relationship between the vulnerability type and the source code combination.

7. The code vulnerability detection system according to claim 6, characterized in that: When extracting the vulnerability code attribute triple set corresponding to the source code combination from the code attribute graph combination, the code library construction module is set to: Extracting an initial vulnerability triple from the code attribute graph of the vulnerability function code segment, and extracting an initial vulnerability repair triple from the code attribute graph of the vulnerability repair function code segment corresponding to the vulnerability function code segment, wherein both the initial vulnerability triple and the initial vulnerability repair triple include codes of condition type, control flow relationship type and function result type; Extract the code that only exists in the initial vulnerability triple as a positive triple; extract the code that only exists in the initial vulnerability repair triple as a negative triple; extract the code that is common to the initial vulnerability triple and the initial vulnerability repair triple as a context triple; The vulnerability code attribute triple set corresponding to the source code combination, including the positive triple, the negative triple and the context triple, is obtained.

8. A computer program product, characterized in that It comprises computer-readable instructions, and when the computer-readable instructions are executed on an electronic device, the electronic device implements the method for detecting a code vulnerability as claimed in any one of claims 1 to 4.

9. An electronic device, characterized in that: The method comprises at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program so that the electronic device can implement the code vulnerability detection method as described in any one of claims 1 to 4.

10. A computer storage medium, characterized in that: The storage medium carries one or more computer programs, and when the one or more computer programs are executed by an electronic device, the electronic device can implement the code vulnerability detection method as described in any one of claims 1 to 4.

Images