Method and system for automatically generating and labeling vulnerability program

Abstract

The invention belongs to the field of software security and vulnerability detection, and particularly discloses a method and system for automatically generating and labeling a vulnerability program, and the method comprises the steps: determining a vulnerability repairing program of obtained vulnerability data, extracting a code mode containing a specific type from the vulnerability repairing program, and obtaining a screened vulnerability mode; the step of extracting the code mode of the specific type comprises the substeps of extracting a repair statement of a single modification block, generating a symbolized repair statement, removing repeated repair statements, identifying a key variable and describing a vulnerability triggering statement; according to the vulnerability mode, accurately injecting the vulnerability mode into a normal program in combination with a code analysis tool, and generating a vulnerability program containing a specific vulnerability type; and performing vulnerability type labeling on the vulnerability program in combination with static analysis and a large language model. According to the invention, the detection accuracy of the vulnerability detection model can be improved.

Description

Technical Field

[0001] The present application belongs to the technical field of software security and vulnerability detection, and more specifically, to a method and system for automatically generating and annotating vulnerable programs. Background Art

[0002] As the complexity and scale of software systems increase, software security issues are becoming increasingly prominent. Vulnerability detection technology has become one of the key means to ensure the security of software systems. Traditional vulnerability detection methods usually rely on experts to manually write rules and detect potential vulnerabilities in the code through static or dynamic analysis tools. However, as the scale of software grows, the limitations of this method gradually become apparent: not only does it require a lot of manual intervention, but it is also difficult to detect new vulnerabilities due to the strong dependence of the rules. In addition, manually written rules may ignore certain complex vulnerability patterns, resulting in insufficient detection accuracy.

[0003] In recent years, vulnerability detection methods based on deep learning have begun to attract widespread attention. These methods can improve detection efficiency by automatically learning vulnerability features from a large number of code samples and reducing reliance on manual rules. Deep learning models can model complex code structures, data flows, and control flows, and automatically extract potential vulnerability patterns in the code, which greatly improves the ability to detect unknown vulnerabilities. However, the effectiveness of deep learning methods depends on high-quality, large-scale vulnerability datasets that not only contain a sufficient number of samples, but also have accurate vulnerability type annotations.

[0004] At present, most mainstream vulnerability datasets come from public vulnerability databases, such as the U.S. National Vulnerability Database (NVD) and security-related submission records in the open source community. Although these datasets have solved the data source problem to a certain extent, they still have significant shortcomings: first, existing datasets often contain only limited vulnerability samples, especially in multi-class vulnerability classification tasks, where samples of different vulnerability types are unbalanced; second, many vulnerability data only mark whether there is a vulnerability, without further marking the specific type, location and other detailed information of the vulnerability. This results in existing deep learning models often only being able to perform binary classification, making it difficult to achieve more fine-grained vulnerability classification, thus affecting the effectiveness of the model in practical applications.

[0005] In addition, existing vulnerability injection technology also has significant limitations. Vulnerability injection refers to injecting vulnerabilities into normal programs without vulnerabilities to generate vulnerability samples for model training. Traditional vulnerability injection methods first use taint analysis technology, and then generate vulnerable programs by simply removing security checks. However, the generated vulnerable programs are far from complex vulnerable programs in the real world and lack code complexity and diversity. These generated vulnerable programs often cannot fully reflect the vulnerability characteristics in real software, resulting in poor performance of vulnerability detection models trained based on these data when facing complex actual vulnerabilities.

[0006] Therefore, it is particularly important to develop a vulnerability program generation and annotation method that can generate high-quality vulnerability types on a large scale with fine-grained vulnerability type annotations, so as to solve the problem that vulnerability detection models perform poorly when facing complex actual vulnerabilities, resulting in insufficient detection accuracy of vulnerability detection models. Summary of the invention

[0007] In view of the defects of the prior art, the purpose of this application is to provide a method and system for automatically generating and annotating vulnerability programs, aiming to solve the problem that the vulnerability detection model performs poorly when facing complex actual vulnerabilities, resulting in insufficient detection accuracy of the vulnerability detection model.

[0008] To achieve the above objectives, in a first aspect, the present application provides a method for automatically generating and marking vulnerable programs, comprising: Determine a vulnerability patch program of the acquired vulnerability data, extract a code pattern containing a specific type from the vulnerability patch program, and obtain a screened vulnerability pattern; extracting the specific type of code pattern includes: extracting a patch statement of a single modified block, generating a symbolic patch statement, removing duplicate patch statements, identifying key variables, and describing a vulnerability trigger statement; According to the vulnerability pattern, in combination with code analysis tools, the vulnerability pattern is accurately injected into a normal program to generate a vulnerable program containing a specific vulnerability type; Combine static analysis and large language models to label the vulnerability types of the vulnerable programs; The large language model is established based on natural language processing and code semantic analysis, and is used to generate annotation results with contextual relevance and high credibility.

[0009] Optionally, the method for determining the vulnerability mode includes: Extracting a patch statement of a single modified block from a vulnerability patch program, and identifying variables related to the vulnerability based on the patch statement; By symbolically processing code snippets in the standardized patch statements, the code snippets are deduplicated so as to be pattern matched in the new program; Identifying key variables of the vulnerability according to the patch statement, wherein the key variables are used to directly affect the triggering condition of the vulnerability; Code locations that may cause security issues are identified, and the code locations are classified according to code types to describe vulnerability triggering statements.

[0010] Optionally, based on the vulnerability pattern, in combination with a code analysis tool, the vulnerability pattern is accurately injected into a normal program to generate a vulnerable program containing a specific vulnerability type, including: Clean the normal program that needs to be injected, remove the comments and blank lines of the target program, and use code analysis tools to perform preliminary analysis on the variables and functions of the normal program; Use syntax analysis tools to match the patch statements in the vulnerability pattern with the code snippets in the target program to identify possible locations where vulnerabilities may be injected; Perform semantic analysis on the matched code snippet to ensure that the code snippet is consistent with the logic in the vulnerability pattern; After confirming the injection location through syntax matching and semantic matching, the target program is modified according to the corresponding vulnerability pattern to generate a program with real vulnerabilities.

[0011] Optionally, static analysis and a large language model are combined to label the vulnerability type of the vulnerable program, including: Use static analysis to perform preliminary analysis on the generated vulnerable program, identify key variables, vulnerability triggering statements, and related control flows and data flows in the vulnerable program, and obtain preliminary static analysis results; A large language model is used to perform deep semantic verification and supplement on the preliminary static analysis results to ensure the accuracy of vulnerability type labeling.

[0012] Optionally, the code injected by the vulnerability pattern is customized based on the following vulnerability types: buffer overflow, integer overflow, null pointer dereference, and use-after-free vulnerability types.

[0013] In a second aspect, the present application provides a system for automatically generating and annotating vulnerability programs, including: A vulnerability pattern extraction module is used to determine the vulnerability patch program of the acquired vulnerability data, extract the code pattern containing the specific type from the vulnerability patch program, and obtain the screened vulnerability pattern; extracting the specific type of code pattern includes: extracting the patch statement of a single modified block, generating symbolic patch statements, removing repeated patch statements, identifying key variables, and describing the vulnerability trigger statement; A vulnerability program generation module is used to accurately inject the vulnerability pattern into a normal program according to the vulnerability pattern and in combination with a code analysis tool to generate a vulnerability program containing a specific vulnerability type; A vulnerability program annotation module is used to annotate the vulnerability type of the vulnerability program by combining static analysis and a large language model; The large language model is established based on natural language processing and code semantic analysis, and is used to generate annotation results with contextual relevance and high credibility.

[0014] Optionally, the vulnerability pattern extraction module includes: A patch statement identification submodule is used to extract the patch statement of a single modified block from the vulnerability patch program, and identify the variables related to the vulnerability based on the patch statement; A symbolic processing submodule, used for standardizing code snippets in patch statements through symbolic processing; A deduplication submodule, used for deduplicating the code snippets so as to perform pattern matching in a new program; A key variable identification submodule, used to identify key variables of the vulnerability according to the patch statement, wherein the key variables are used to directly affect the triggering conditions of the vulnerability; The vulnerability trigger statement description submodule is used to identify the code locations that may cause security issues, classify the code locations according to code types, and describe the vulnerability trigger statements.

[0015] Optionally, the vulnerability program generation module includes: The data preprocessing submodule is used to clean the normal program to be injected, remove the comments and blank lines of the target program, and use the code analysis tool to perform preliminary analysis on the variables and functions of the normal program; The syntax matching submodule is used to match the patch statements in the vulnerability pattern with the code snippets in the target program through the syntax analysis tool to identify the locations where the vulnerability may be injected; The semantic matching submodule is used to perform semantic analysis on the matched code snippets to ensure that the logic of the code snippets is consistent with the vulnerability pattern; The vulnerability injection submodule is used to modify the target program according to the corresponding vulnerability pattern after confirming the injection location through syntax matching and semantic matching, and generate a program with real vulnerabilities.

[0016] Optionally, the vulnerability program marking module includes: The static analysis submodule is used to perform preliminary analysis on the generated vulnerable program using static analysis, identify key variables, vulnerability triggering statements, and related control flows and data flows in the vulnerable program, and obtain preliminary static analysis results; The large language model verification submodule is used to use the large language model to perform deep semantic verification and supplement the preliminary static analysis results to ensure the accuracy of vulnerability type annotation.

[0017] In a third aspect, the present application provides an electronic device comprising: at least one memory for storing programs; and at least one processor for executing the programs stored in the memory. When the program stored in the memory is executed, the processor is used to execute the method described in the first aspect or any possible implementation of the first aspect.

[0018] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the method described in the first aspect or any possible implementation of the first aspect.

[0019] In a fifth aspect, the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the method described in the first aspect or any possible implementation of the first aspect.

[0020] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here.

[0021] In general, the above technical solutions conceived by this application have the following beneficial effects compared with the prior art: (1) This application extracts patch statements from existing vulnerability patch programs, symbolizes and removes duplicates on them, obtains key variables in the vulnerable program and identifies the types of vulnerability triggering statements, making the vulnerability pattern universal and applicable; through syntax matching and semantic matching technology, it realizes automatic injection of vulnerability patterns and generates programs with multiple vulnerability types, greatly reducing the time and cost of manually generating vulnerable programs; combined with static analysis and large language model verification, it performs fine-grained type annotation on the generated vulnerable program to ensure the accuracy of vulnerability annotation, meet the needs of deep learning vulnerability detection models for high-quality training data, and thus improve the detection accuracy of vulnerability detection models.

[0022] (2) This application can not only significantly expand the scale and diversity of existing vulnerability datasets, but also improve the classification and generalization capabilities of vulnerability detection models through accurate vulnerability type annotation, thereby further improving the effectiveness of the model in actual application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is one of the flow charts of the method for automatically generating and marking vulnerability programs provided in the embodiment of the present application; Figure 2 This is the second flow chart of the method for automatically generating and marking vulnerability programs provided in the embodiment of the present application; Figure 3This is the third flow chart of the method for automatically generating and marking vulnerability programs provided in the embodiment of the present application; Figure 4 This is a fourth flow chart of the method for automatically generating and marking vulnerability programs provided in an embodiment of the present application; Figure 5 This is one of the structural schematic diagrams of the device for automatically generating and marking vulnerability programs provided in the embodiments of the present application; Figure 6 This is the second structural diagram of the device for automatically generating and marking vulnerability programs provided in the embodiment of the present application; Figure 7 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0025] The term "and / or" in this article is a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The symbol " / " in this article indicates that the associated objects are in an or relationship, for example, A / B means A or B.

[0026] The terms "first" and "second" in the specification and claims herein are used to distinguish different objects rather than to describe a specific order of the objects. For example, a first response message and a second response message are used to distinguish different response messages rather than to describe a specific order of the response messages.

[0027] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0028] In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more than two. For example, multiple processing units refer to two or more processing units, etc.; multiple elements refer to two or more elements, etc.

[0029] The embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application.

[0030] Reference Figure 1 The present application provides a method for automatically generating and marking vulnerable programs, including: S101. Determine a vulnerability patch program for the acquired vulnerability data, extract a code pattern containing a specific type from the vulnerability patch program, and obtain a screened vulnerability pattern; extracting a specific type of code pattern includes: extracting a patch statement for a single modified block, generating a symbolic patch statement, removing duplicate patch statements, identifying key variables, and describing a vulnerability trigger statement; S102. According to the vulnerability pattern, in combination with the code analysis tool, the vulnerability pattern is accurately injected into the normal program to generate a vulnerable program containing a specific vulnerability type; S103. Combine static analysis and large language model to label the vulnerability type of the vulnerable program; The large language model is established based on natural language processing and code semantic analysis, and is used to generate annotation results with contextual relevance and high credibility.

[0031] First, the embodiment of the present application collects known vulnerabilities and their patches from mainstream authoritative vulnerability websites such as NVD, CVE, and CNVD through S101 to ensure the integrity and accuracy of the data.

[0032] Standardize the collected vulnerability information, including the unified format and naming of patch statements, to facilitate subsequent processing. Use static code analysis technology to extract code patterns related to specific vulnerability types.

[0033] Further, a patch statement of a single modified block is extracted from the vulnerability patch program, and a variable related to the vulnerability is identified based on the patch statement; By symbolically processing code snippets in the standardized patch statements, the code snippets are deduplicated so as to be pattern matched in the new program; Identifying key variables of the vulnerability according to the patch statement, wherein the key variables are used to directly affect the triggering condition of the vulnerability; Code locations that may cause security issues are identified, and the code locations are classified according to code types to describe vulnerability triggering statements.

[0034] Single Modification Block Extraction: Identify a single code segment for the vulnerability patching pattern found. Extract the patch statements of a single modification block from the vulnerability patch program and identify the variables related to the vulnerability. Standardized patches: Convert the extracted patch statements into a universal symbolic representation to remove specific implementation details in the code and form a universal patch representation. The code in the standardized patch statements is symbolized and then deduplicated for pattern matching in the new program. By analyzing the patch statements, structural features (such as risky function calls, member accesses, etc.) are extracted to facilitate subsequent identification of similar patterns.

[0035] Code deduplication: Use hashing algorithms or semantic matching algorithms to deduplicate extracted patch statements to ensure uniqueness in the pattern library.

[0036] Key variable identification: Automatically analyze the variables in the patch statements, determine which variables have a greater impact on the cause and repair of the vulnerability, and mark them as key variables. Identify the variables that are critical to the vulnerability based on the extracted patch statements. These variables can directly affect the triggering conditions of the vulnerability.

[0037] Describe vulnerability trigger statements: Identify which statements can cause vulnerabilities to be triggered, identify code locations that may cause security issues, and classify and describe them according to code types.

[0038] Finally, based on the extracted key variables and vulnerability triggering statements, the patterns are evaluated and screened to ensure that only vulnerability patterns with high quality and strong applicability are retained.

[0039] Furthermore, S102 is combined with code analysis tools to accurately inject vulnerability patterns into normal programs. Based on the selected vulnerability patterns, these patterns are injected into safe and normal programs through automated tools to generate high-quality vulnerability sample programs. Programs with specific vulnerability types are generated using the program injection process. Finally, S103 combines static analysis and a large language model to annotate vulnerability types. On the one hand, static code analysis tools are used to check the generated program and annotate potential vulnerabilities. On the other hand, a trained large language model is used. This model is based on natural language processing and code semantic analysis, and can understand the meaning of the code and generate labels for it. The large language model needs to be optimized according to the quality and scope of the training data to enhance its accuracy.

[0040] It should be noted that the training process of the large language model in the embodiment of the present application includes the following steps: Sample collection: Extract samples from historical vulnerability and patch data and annotate them for training.

[0041] Model optimization: Iterate model parameters based on feedback to improve the model's ability to understand the code and the accuracy of annotation, ensuring that the large language model can adapt to different types of vulnerability features.

[0042] Reference Figure 2 , Figure 2 The figure is a flow chart of a method for automatically generating and marking vulnerability programs disclosed in an embodiment of the present application, comprising the following steps: (1) Vulnerability pattern extraction step: By analyzing the existing vulnerability data and its patches, the vulnerability patterns involved in vulnerability patching are extracted; vulnerability data and its patches can be obtained through mainstream authoritative vulnerability websites such as NVD, CVE, and CNVD.

[0043] (2) Vulnerable program generation step: Use the extracted vulnerability patterns to find potential vulnerability injection locations through syntax matching and semantic matching techniques. Finally, inject these patterns into normal non-vulnerable programs to generate programs with specific vulnerabilities; (3) Vulnerability type labeling step: After the vulnerable program is generated, the program is deeply analyzed by combining static analysis and large language models to accurately label the vulnerability type of the generated vulnerable program.

[0044] The embodiment of the present application extracts patch statements from existing vulnerability patch programs, symbolizes and deduplicates them, obtains key variables in the vulnerability program and identifies the vulnerability trigger statement type, so that the vulnerability pattern has universality and applicability; through syntax matching and semantic matching technology, automatic injection of vulnerability patterns is realized, and programs with multiple vulnerability types are generated, which greatly reduces the time and cost of manually generating vulnerability programs; combined with static analysis and large language model verification, fine-grained type annotation is performed on the generated vulnerability program to ensure the accuracy of vulnerability annotation, meet the needs of deep learning vulnerability detection models for high-quality training data, and thus improve the detection accuracy of the vulnerability detection model.

[0045] Reference Figure 3 and Figure 4 , Figure 3 It is a flowchart of automated vulnerability pattern extraction; Figure 4 It is a flowchart of automatically generating vulnerabilities.

[0046] Optionally, based on the vulnerability pattern, in combination with a code analysis tool, the vulnerability pattern is accurately injected into a normal program to generate a vulnerable program containing a specific vulnerability type, including: Clean the normal program that needs to be injected, remove the comments and blank lines of the target program, and use code analysis tools to perform preliminary analysis on the variables and functions of the normal program; Use syntax analysis tools to match the patch statements in the vulnerability pattern with the code snippets in the target program to identify possible locations where vulnerabilities may be injected; Perform semantic analysis on the matched code snippet to ensure that the code snippet is consistent with the logic in the vulnerability pattern; After confirming the injection location through syntax matching and semantic matching, the target program is modified according to the corresponding vulnerability pattern to generate a program with real vulnerabilities.

[0047] Specifically, the specific steps of the vulnerability program generation program include: (2.1) Data preprocessing: Clean the normal program to be injected, remove the comments and blank lines, and then use the code analysis tool to perform preliminary analysis on the variables and functions of the normal program; (2.2) Syntax matching: Syntax matching is performed between the patch statements in the vulnerability pattern and the code snippets in the target program through syntax analysis tools to identify the locations where the vulnerability may be injected; (2.3) Semantic matching: Perform semantic analysis on the matched code segments to ensure that the code segments are consistent with the logic in the vulnerability pattern; (2.4) Vulnerability injection: After confirming the injection location through syntax and semantic matching, the target program is modified according to the corresponding vulnerability pattern to generate a program with real vulnerabilities. Specifically, in this embodiment, a simple script or text processing tool is first used to remove comments and blank lines in the target program. This step can improve the efficiency of the subsequent analysis process and ensure that only the core code part is focused. For example, regular expressions or code formatting tools can be used to clean the code. Secondly, a static analysis tool is used to analyze the program to identify and record the variables and functions in the program.

[0048] Through the clone detection tool, the patch statements in the vulnerability pattern are syntax matched with the code snippets in the target program to identify the locations where the vulnerability may be injected; through the matching results, it is identified which code snippets may be similar to the vulnerability pattern, and these code snippets are potential injection vulnerability locations.

[0049] Furthermore, for possible vulnerability locations, in-depth semantic analysis is performed to verify whether the actual logic of the code is consistent with the logic in the vulnerability pattern. Technologies such as symbolic execution and data flow analysis can be used to ensure that the matching code snippets not only conform to the vulnerability pattern syntactically, but also logically.

[0050] Finally, after confirming the vulnerability location through grammatical and semantic analysis, corresponding modifications can be made to inject the vulnerability pattern.

[0051] Optionally, static analysis and a large language model are combined to label the vulnerability type of the vulnerable program, including: Use static analysis to perform preliminary analysis on the generated vulnerable program, identify key variables, vulnerability triggering statements, and related control flows and data flows in the vulnerable program, and obtain preliminary static analysis results; A large language model is used to perform deep semantic verification and supplement on the preliminary static analysis results to ensure the accuracy of vulnerability type labeling.

[0052] Optionally, the code injected by the vulnerability pattern is customized based on the following vulnerability types: buffer overflow, integer overflow, null pointer dereference, and use-after-free vulnerability types.

[0053] Specifically, this embodiment includes two aspects: static analysis and large language model verification; Static analysis: Use static analysis tools to perform preliminary analysis on the generated vulnerable program to identify key variables, vulnerability triggering statements, and related control flows and data flows in the program; Perform a preliminary analysis on the generated vulnerable program to identify key variables, vulnerability triggering statements, and related control flows and data flows in the vulnerable program. This module first uses code slicing technology to extract code snippets related to the vulnerability, and then determines the code behavior based on the code logic structure to determine possible vulnerability types, such as buffer overflow, integer overflow, or null pointer dereference. Large language model verification: Use a large language model to deeply verify static analysis results, further accurately annotate vulnerability types, and ensure the accuracy of annotations.

[0054] The preliminary static analysis results are deeply semantically verified and supplemented to ensure the accuracy of vulnerability type annotation. Combined with the code understanding ability of the large language model, potential vulnerability types can be more accurately identified. Especially in the case where multiple vulnerability types may coexist or intertwine, the large language model can provide more contextually relevant and highly reliable annotation results based on the combination of natural language processing and code semantic analysis.

[0055] The system for automatically generating and marking vulnerability programs provided by the present application is described below. The system for automatically generating and marking vulnerability programs described below and the method for automatically generating and marking vulnerability programs described above can be referenced to each other.

[0056] Reference Figure 5 , the present application provides a system for automatically generating and marking vulnerability programs, including: The vulnerability pattern extraction module 510 is used to determine the vulnerability patch program of the acquired vulnerability data, extract the code pattern containing the specific type from the vulnerability patch program, and obtain the selected vulnerability pattern; extracting the code pattern of the specific type includes: extracting the patch statement of a single modified block, generating symbolic patch statements, removing repeated patch statements, identifying key variables and describing vulnerability trigger statements; A vulnerability program generation module 520 is used to accurately inject the vulnerability pattern into a normal program according to the vulnerability pattern and in combination with a code analysis tool to generate a vulnerability program containing a specific vulnerability type; A vulnerability program marking module 530 is used to mark the vulnerability type of the vulnerability program by combining static analysis and a large language model; The large language model is established based on natural language processing and code semantic analysis, and is used to generate annotation results with contextual relevance and high credibility.

[0057] Reference Figure 6 Optionally, the vulnerability pattern extraction module includes: A patch statement identification submodule is used to extract the patch statement of a single modified block from the vulnerability patch program, and identify the variables related to the vulnerability based on the patch statement; A symbolic processing submodule, used for standardizing code snippets in patch statements through symbolic processing; A deduplication submodule, used for deduplicating the code snippets so as to perform pattern matching in a new program; A key variable identification submodule, used to identify key variables of the vulnerability according to the patch statement, wherein the key variables are used to directly affect the triggering conditions of the vulnerability; The vulnerability trigger statement description submodule is used to identify the code locations that may cause security issues, classify the code locations according to code types, and describe the vulnerability trigger statements.

[0058] Specifically, a patch statement identification submodule is used to extract a patch statement of a single modified block from the patch data; The symbolic processing submodule is used to symbolize the extracted patch statements and unify the variable and function names in the code to filter out available vulnerability patterns. The deduplication submodule is used to deduplicate the filtered vulnerability patterns, reduce the time required for the vulnerability program generation submodule, and improve the efficiency of the vulnerability program generation module; The key variable identification submodule is used to identify variables that are critical to the vulnerability; The vulnerability triggering statement description submodule is used to analyze and describe statements that may trigger vulnerabilities.

[0059] Furthermore, the vulnerability program generation module includes: The data preprocessing submodule is used to clean the normal program to be injected, remove the comments and blank lines of the target program, and use the code analysis tool to perform preliminary analysis on the variables and functions of the normal program; The syntax matching submodule is used to match the patch statements in the vulnerability pattern with the code snippets in the target program through the syntax analysis tool to identify the locations where the vulnerability may be injected; The semantic matching submodule is used to perform semantic analysis on the matched code snippets to ensure that the logic of the code snippets is consistent with the vulnerability pattern; The vulnerability injection submodule is used to modify the target program according to the corresponding vulnerability pattern after confirming the injection location through syntax matching and semantic matching, and generate a program with real vulnerabilities.

[0060] Specifically, the data preprocessing submodule removes comments and blank lines in the target program, and then uses a code analysis tool to analyze the variables and functions in the target program; The syntax matching submodule identifies the possible locations where vulnerabilities may be injected by matching the patch statements in the vulnerability pattern with the code snippets in the target program. The semantic matching submodule performs semantic analysis on the matched code segments to ensure that the matched code segments are consistent with the logic in the vulnerability pattern, especially in the use of variables and functions; The vulnerability injection submodule, after confirming the injection location through syntax and semantic matching, injects the statements in the vulnerability pattern into the target program to generate a program with a real vulnerability while ensuring the syntactic correctness of the vulnerability code.

[0061] Optionally, the vulnerability program marking module includes: The static analysis submodule is used to perform preliminary analysis on the generated vulnerable program using static analysis, identify key variables, vulnerability triggering statements, and related control flows and data flows in the vulnerable program, and obtain preliminary static analysis results; The large language model verification submodule is used to use the large language model to perform deep semantic verification and supplement the preliminary static analysis results to ensure the accuracy of vulnerability type annotation.

[0062] Furthermore, the vulnerability annotation module includes: The static analysis submodule is used to perform preliminary analysis on the generated vulnerable program and identify key variables, vulnerability triggering statements, and related control flows and data flows in the vulnerable program. This module first uses code slicing technology to extract code snippets related to the vulnerability, and then judges the code behavior based on the code logic structure to determine the possible vulnerability type, such as buffer overflow, integer overflow, or null pointer dereference, etc. The large language model verification submodule is used to perform in-depth semantic verification and supplementation on the preliminary static analysis results to ensure the accuracy of vulnerability type annotation. Combined with the code understanding ability of the large language model, potential vulnerability types can be more accurately identified. Especially in the case where multiple vulnerability types may coexist or intertwine, the large language model can provide more contextually relevant and highly reliable annotation results based on the combination of natural language processing and code semantic analysis.

[0063] It can be understood that the detailed functional implementation of each of the above-mentioned units / modules can be found in the introduction of the aforementioned method embodiment, and will not be repeated here.

[0064] It should be understood that the above-mentioned device is used to execute the method in the above-mentioned embodiment. The implementation principle and technical effect of the corresponding program module in the device are similar to those described in the above-mentioned method. The working process of the device can refer to the corresponding process in the above-mentioned method, which will not be repeated here.

[0065] Based on the method in the above embodiment, the embodiment of the present application provides an electronic device, which may include: a processor (Processor) 710, a communication interface (Communications Interface) 720, a memory (Memory) 730 and a communication bus 740, wherein the processor 710, the communication interface 720, and the memory 730 communicate with each other through the communication bus 740. The processor 710 can call the logic instructions in the memory 730 to execute the method in the above embodiment.

[0066] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application.

[0067] Based on the method in the above embodiment, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the method in the above embodiment.

[0068] Based on the method in the above embodiment, an embodiment of the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the method in the above embodiment.

[0069] It is understandable that the processor in the embodiment of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0070] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC.

[0071] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions may be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

[0072] It should be understood that the various numerical numbers involved in the embodiments of the present application are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application.

[0073] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for automatically generating and marking vulnerable programs, characterized in that: include: Determine a vulnerability patch for the acquired vulnerability data, extract a code pattern containing a specific type from the vulnerability patch, and obtain a screened vulnerability pattern; Extracting specific types of code patterns includes: extracting patch statements for a single modified block, generating symbolic patch statements, removing duplicate patch statements, identifying key variables, and describing vulnerability trigger statements; According to the vulnerability pattern, in combination with code analysis tools, the vulnerability pattern is accurately injected into a normal program to generate a vulnerable program containing a specific vulnerability type; Combine static analysis and large language models to label the vulnerability types of the vulnerable programs; The large language model is established based on natural language processing and code semantic analysis, and is used to generate annotation results with contextual relevance and high credibility.

2. The method for automatically generating and marking vulnerable programs according to claim 1, characterized in that: The method for determining the vulnerability mode includes: Extracting a patch statement of a single modified block from the vulnerability patch program, and identifying variables related to the vulnerability based on the patch statement; By symbolically processing code fragments in the standardized patch statements, the code fragments are deduplicated so as to be pattern matched in the new program; Identifying key variables of the vulnerability according to the patch statement, wherein the key variables are used to directly affect the triggering condition of the vulnerability; Code locations that may cause security issues are identified, and the code locations are classified according to code types to describe vulnerability triggering statements.

3. The method for automatically generating and marking vulnerable programs according to claim 1, characterized in that: According to the vulnerability pattern, combined with the code analysis tool, the vulnerability pattern is accurately injected into the normal program to generate a vulnerable program containing specific vulnerability types, including: Clean the normal program that needs to be injected, remove the comments and blank lines of the target program, and use code analysis tools to perform preliminary analysis on the variables and functions of the normal program; Use syntax analysis tools to match the patch statements in the vulnerability pattern with the code snippets in the target program to identify possible locations where vulnerabilities may be injected; Perform semantic analysis on the matched code snippet to ensure that the code snippet is consistent with the logic in the vulnerability pattern; After confirming the injection location through syntax matching and semantic matching, the target program is modified according to the corresponding vulnerability pattern to generate a program with real vulnerabilities.

4. The method for automatically generating and marking vulnerable programs according to claim 1, characterized in that: Combine static analysis and large language models to label the vulnerability types of the vulnerable programs, including: Use static analysis to perform preliminary analysis on the generated vulnerable program, identify key variables, vulnerability triggering statements, and related control flows and data flows in the vulnerable program, and obtain preliminary static analysis results; A large language model is used to perform deep semantic verification and supplement on the preliminary static analysis results to ensure the accuracy of vulnerability type labeling.

5. The method for automatically generating and marking vulnerable programs according to claim 1, characterized in that: The code injected by the vulnerability mode is customized based on the following vulnerability types: buffer overflow, integer overflow, null pointer dereference, and use-after-free.

6. A system for automatically generating and marking vulnerable programs, characterized in that: include: A vulnerability pattern extraction module is used to determine a vulnerability patch for the acquired vulnerability data, extract a code pattern containing a specific type from the vulnerability patch, and obtain a screened vulnerability pattern; Extracting specific types of code patterns includes: extracting patch statements for a single modified block, generating symbolic patch statements, removing duplicate patch statements, identifying key variables, and describing vulnerability trigger statements; A vulnerability program generation module is used to accurately inject the vulnerability pattern into a normal program according to the vulnerability pattern and in combination with a code analysis tool to generate a vulnerability program containing a specific vulnerability type; A vulnerability program annotation module is used to annotate the vulnerability type of the vulnerability program by combining static analysis and a large language model; The large language model is established based on natural language processing and code semantic analysis, and is used to generate annotation results with contextual relevance and high credibility.

7. The system for automatically generating and marking vulnerable programs according to claim 6, characterized in that: The vulnerability pattern extraction module includes: A patch statement identification submodule is used to extract the patch statement of a single modified block from the vulnerability patch program, and identify the variables related to the vulnerability based on the patch statement; A symbolic processing submodule, used for standardizing code snippets in patch statements through symbolic processing; A deduplication submodule, used for deduplicating the code snippets so as to perform pattern matching in a new program; A key variable identification submodule, used to identify key variables of the vulnerability according to the patch statement, wherein the key variables are used to directly affect the triggering conditions of the vulnerability; The vulnerability trigger statement description submodule is used to identify the code locations that may cause security issues, classify the code locations according to code types, and describe the vulnerability trigger statements.

8. The system for automatically generating and marking vulnerable programs according to claim 6, characterized in that: The vulnerability program generation module includes: The data preprocessing submodule is used to clean the normal program to be injected, remove the comments and blank lines of the target program, and use the code analysis tool to perform preliminary analysis on the variables and functions of the normal program; The syntax matching submodule is used to match the patch statements in the vulnerability pattern with the code snippets in the target program through the syntax analysis tool to identify the locations where the vulnerability may be injected; The semantic matching submodule is used to perform semantic analysis on the matched code snippets to ensure that the logic of the code snippets is consistent with the vulnerability pattern; The vulnerability injection submodule is used to modify the target program according to the corresponding vulnerability pattern after confirming the injection location through syntax matching and semantic matching, and generate a program with real vulnerabilities.

9. The system for automatically generating and marking vulnerable programs according to claim 6, characterized in that: The vulnerability program annotation module includes: The static analysis submodule is used to perform preliminary analysis on the generated vulnerable program using static analysis, identify key variables, vulnerability triggering statements, and related control flows and data flows in the vulnerable program, and obtain preliminary static analysis results; The large language model verification submodule is used to use the large language model to perform deep semantic verification and supplement the preliminary static analysis results to ensure the accuracy of vulnerability type annotation.

10. An electronic device, characterized in that: include: at least one memory for storing a computer program; At least one processor is used to execute the program stored in the memory. When the program stored in the memory is executed, the processor is used to execute the method according to any one of claims 1 to 5.

Images