A method and system for automatically generating and marking vulnerability programs

Abstract

This application belongs to the field of software security and vulnerability detection, and specifically discloses a method and system for automatically generating and annotating vulnerable programs, including: determining a vulnerability patch program for acquired vulnerability data, extracting code patterns containing specific types from the vulnerability patch program, and obtaining a screened vulnerability pattern; extracting the specific type of code pattern includes: extracting patch statements for a single modified block, generating symbolic patch statements, removing duplicate patch statements, identifying key variables, and describing vulnerability triggering statements; based on the vulnerability pattern, in combination with code analysis tools, accurately injecting the vulnerability pattern into a normal program to generate a vulnerable program containing a specific vulnerability type; and combining static analysis and a large language model to annotate the vulnerability type of the vulnerable program. This application can improve the detection accuracy of vulnerability detection models.

Description

Technical Field

[0001] The present application relates to the field of software security and vulnerability detection technology, and more specifically, to a method and system for automatically generating and annotating vulnerable programs. Background Art

[0002] As software systems increase in complexity and scale, software security issues are becoming increasingly prominent. Vulnerability detection technology has become a key means of ensuring software system security. Traditional vulnerability detection methods typically rely on experts manually writing rules and using static or dynamic analysis tools to detect potential vulnerabilities in the code. However, as software scale grows, the limitations of this approach become increasingly apparent: not only does it require extensive manual intervention, but the strong dependency of rules makes it difficult to detect new vulnerabilities. Furthermore, manually written rules may overlook certain complex vulnerability patterns, resulting in insufficient detection accuracy.

[0003] In recent years, deep learning-based vulnerability detection methods have attracted widespread attention. These methods improve detection efficiency by automatically learning vulnerability characteristics from large amounts of code samples, reducing reliance on manual rules. Deep learning models can model complex code structures, data flows, and control flows, automatically extracting potential vulnerability patterns in code, significantly improving the ability to detect unknown vulnerabilities. However, the effectiveness of deep learning methods depends on high-quality, large-scale vulnerability datasets that not only contain a sufficient number of samples but also accurately label the vulnerability types.

[0004] Currently, most mainstream vulnerability datasets are sourced from public vulnerability databases, such as the U.S. National Vulnerability Database (NVD), and security-related submission records from open source communities. While these datasets address data provenance issues to some extent, they still suffer from significant shortcomings: First, existing datasets often contain only a limited number of vulnerability samples, especially in multi-class vulnerability classification tasks, where samples of different vulnerability types are imbalanced. Second, many vulnerability datasets simply indicate the presence or absence of a vulnerability, without further annotations such as the specific vulnerability type and location. This results in existing deep learning models often being limited to binary classification, making it difficult to achieve more fine-grained vulnerability classification, thus limiting their effectiveness in practical applications.

[0005] Furthermore, existing vulnerability injection techniques also have significant limitations. Vulnerability injection involves injecting vulnerabilities into otherwise flawless programs to generate vulnerability samples for model training. Traditional vulnerability injection methods first employ taint analysis techniques and then simply remove security checks to generate vulnerable programs. However, these generated vulnerable programs differ significantly from the complex vulnerability programs found in the real world, lacking in code complexity and diversity. These generated vulnerable programs often fail to fully reflect the vulnerability characteristics found in real software, resulting in poor performance of vulnerability detection models trained on these data when faced with complex, real-world vulnerabilities.

[0006] Therefore, it is particularly important to develop a vulnerability program generation and annotation method that can generate high-quality, fine-grained vulnerability type annotations on a large scale to solve the problem that vulnerability detection models perform poorly when faced with complex actual vulnerabilities, resulting in insufficient detection accuracy of vulnerability detection models. Summary of the Invention

[0007] In response to the defects of the existing technology, the purpose of this application is to provide a method and system for automatically generating and annotating vulnerability programs, aiming to solve the problem that vulnerability detection models perform poorly when faced with complex actual vulnerabilities, resulting in insufficient detection accuracy of vulnerability detection models.

[0008] To achieve the above objectives, in a first aspect, the present application provides a method for automatically generating and annotating vulnerable programs, comprising:

[0009] Determining a vulnerability patch for the acquired vulnerability data, extracting a code pattern containing a specific type from the vulnerability patch to obtain a screened vulnerability pattern; extracting the specific type of code pattern includes: extracting a patch statement for a single modified block, generating a symbolic patch statement, removing duplicate patch statements, identifying key variables, and describing a vulnerability trigger statement;

[0010] Based on the vulnerability pattern, combined with code analysis tools, the vulnerability pattern is accurately injected into the normal program to generate a vulnerable program containing a specific vulnerability type;

[0011] Combine static analysis and large language models to label the vulnerability types of the vulnerable programs;

[0012] The large language model is built based on natural language processing and code semantic analysis to generate annotation results with contextual relevance and high credibility.

[0013] Optionally, the method for determining the vulnerability pattern includes:

[0014] Extracting patch statements of a single modified block from a vulnerability patch program, and identifying variables related to the vulnerability based on the patch statements;

[0015] symbolically processing code snippets in standardized patch statements to remove duplication from the code snippets so as to facilitate pattern matching in the new program;

[0016] Identifying key variables of the vulnerability according to the patch statement, wherein the key variables are used to directly affect the triggering condition of the vulnerability;

[0017] Identify code locations that may cause security issues and classify the code locations according to code types to describe vulnerability triggering statements.

[0018] Optionally, based on the vulnerability pattern, in combination with a code analysis tool, the vulnerability pattern is precisely injected into a normal program to generate a vulnerable program containing a specific vulnerability type, including:

[0019] Clean the normal program to be injected, remove the comments and blank lines of the target program, and use code analysis tools to perform preliminary analysis of the variables and functions of the normal program;

[0020] Use syntax analysis tools to match the patch statements in the vulnerability pattern with code snippets in the target program to identify possible locations where vulnerabilities may be injected.

[0021] Perform semantic analysis on the matched code snippets to ensure that the code snippets are consistent with the logic in the vulnerability pattern;

[0022] After confirming the injection location through syntax matching and semantic matching, the target program is modified according to the corresponding vulnerability pattern to generate a program with real vulnerabilities.

[0023] Optionally, static analysis and a large language model are combined to label the vulnerability type of the vulnerable program, including:

[0024] Use static analysis to perform preliminary analysis on the generated vulnerable program, identify key variables, vulnerability triggering statements, and related control flows and data flows in the vulnerable program, and obtain preliminary static analysis results;

[0025] A large language model is used to perform deep semantic verification and supplement on the preliminary static analysis results to ensure the accuracy of vulnerability type labeling.

[0026] Optionally, the code injected by the vulnerability pattern is customized based on the following vulnerability types: buffer overflow, integer overflow, null pointer dereference, and use-after-free vulnerability types.

[0027] In a second aspect, the present application provides a system for automatically generating and annotating vulnerable programs, comprising:

[0028] A vulnerability pattern extraction module is configured to determine a vulnerability patch for the acquired vulnerability data, extract code patterns containing a specific type from the vulnerability patch, and obtain a selected vulnerability pattern; extracting the specific type of code pattern includes: extracting patch statements for a single modified block, generating symbolic patch statements, removing duplicate patch statements, identifying key variables, and describing vulnerability trigger statements;

[0029] A vulnerability program generation module is used to accurately inject the vulnerability pattern into a normal program based on the vulnerability pattern and in combination with a code analysis tool to generate a vulnerability program containing a specific vulnerability type;

[0030] A vulnerability program annotation module is used to annotate the vulnerability type of the vulnerable program by combining static analysis and a large language model;

[0031] The large language model is built based on natural language processing and code semantic analysis to generate annotation results with contextual relevance and high credibility.

[0032] Optionally, the vulnerability pattern extraction module includes:

[0033] A patch statement identification submodule is used to extract the patch statement of a single modified block from the vulnerability patch program and identify the variables related to the vulnerability based on the patch statement;

[0034] A symbolic processing submodule, used for standardizing code snippets in patch statements through symbolic processing;

[0035] a deduplication submodule, for deduplicating the code snippets to facilitate pattern matching in a new program;

[0036] A key variable identification submodule, configured to identify key variables of a vulnerability according to the patch statement, wherein the key variables are used to directly affect the triggering conditions of the vulnerability;

[0037] The vulnerability trigger statement description submodule is used to identify code locations that may cause security issues, classify the code locations according to code types, and describe the vulnerability trigger statements.

[0038] Optionally, the vulnerability program generation module includes:

[0039] The data preprocessing submodule is used to clean the normal program to be injected, remove comments and blank lines in the target program, and use code analysis tools to perform preliminary analysis on the variables and functions of the normal program;

[0040] The syntax matching submodule is used to match the patch statements in the vulnerability pattern with the code snippets in the target program through syntax analysis tools to identify the locations where the vulnerability may be injected;

[0041] The semantic matching submodule is used to perform semantic analysis on the matched code snippets to ensure that the code snippets are consistent with the logic in the vulnerability pattern;

[0042] The vulnerability injection submodule is used to modify the target program according to the corresponding vulnerability pattern after confirming the injection location through syntax matching and semantic matching, and generate a program with real vulnerabilities.

[0043] Optionally, the vulnerability program marking module includes:

[0044] The static analysis submodule is used to perform preliminary analysis on the generated vulnerable program using static analysis, identify key variables, vulnerability triggering statements, and related control flows and data flows in the vulnerable program, and obtain preliminary static analysis results;

[0045] The large language model verification submodule is used to use the large language model to perform in-depth semantic verification and supplement the preliminary static analysis results to ensure the accuracy of vulnerability type annotation.

[0046] In a third aspect, the present application provides an electronic device comprising: at least one memory for storing programs; and at least one processor for executing the programs stored in the memory. When the program stored in the memory is executed, the processor is used to execute the method described in the first aspect or any possible implementation of the first aspect.

[0047] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the method described in the first aspect or any possible implementation of the first aspect.

[0048] In a fifth aspect, the present application provides a computer program product, which, when executed on a processor, enables the processor to execute the method described in the first aspect or any possible implementation of the first aspect.

[0049] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here.

[0050] In general, the above technical solutions conceived by this application have the following beneficial effects compared with the existing technologies:

[0051] (1) This application extracts patch statements from existing vulnerability patch programs, and performs symbolic processing and deduplication on them, obtains key variables in the vulnerability program and identifies the types of vulnerability triggering statements, making the vulnerability pattern universal and applicable; through syntax matching and semantic matching technology, it realizes automatic injection of vulnerability patterns and generates programs with multiple vulnerability types, greatly reducing the time and cost of manually generating vulnerability programs; combined with static analysis and large language model verification, it performs fine-grained type annotation on the generated vulnerability program to ensure the accuracy of vulnerability annotation, meet the needs of deep learning vulnerability detection models for high-quality training data, and thus improve the detection accuracy of vulnerability detection models.

[0052] (2) This application can not only significantly expand the scale and diversity of existing vulnerability datasets, but also improve the classification and generalization capabilities of vulnerability detection models through accurate vulnerability type labeling, further improving the effectiveness of the model in actual application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is one of the flow charts of the method for automatically generating and marking vulnerability programs provided in an embodiment of the present application;

[0054] Figure 2 This is the second flow chart of the method for automatically generating and marking vulnerability programs provided in an embodiment of the present application;

[0055] Figure 3 This is the third flow chart of the method for automatically generating and marking vulnerability programs provided in an embodiment of the present application;

[0056] Figure 4 This is the fourth flow chart of the method for automatically generating and marking vulnerability programs provided in an embodiment of the present application;

[0057] Figure 5 This is one of the structural diagrams of the device for automatically generating and marking vulnerability programs provided in an embodiment of the present application;

[0058] Figure 6 This is the second structural diagram of the device for automatically generating and marking vulnerability programs provided in an embodiment of the present application;

[0059] Figure 7 It is a structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0061] The term "and / or" as used herein describes an association between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. The symbol " / " as used herein indicates that the related objects are in an "or" relationship, for example, A / B means either A or B.

[0062] The terms "first" and "second" in this specification and claims are used to distinguish different objects rather than to describe a specific order of objects. For example, "first response message" and "second response message" are used to distinguish different response messages rather than to describe a specific order of response messages.

[0063] In the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0064] In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more, for example, multiple processing units means two or more processing units, etc.; multiple elements means two or more elements, etc.

[0065] The embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application.

[0066] Reference Figure 1 , this application provides a method for automatically generating and marking vulnerable programs, including:

[0067] S101. Determine a vulnerability patch program for the acquired vulnerability data, extract code patterns containing a specific type from the vulnerability patch program, and obtain a selected vulnerability pattern; extracting the specific type of code pattern includes: extracting patch statements for a single modified block, generating symbolic patch statements, removing duplicate patch statements, identifying key variables, and describing vulnerability trigger statements;

[0068] S102. Based on the vulnerability pattern, combined with code analysis tools, the vulnerability pattern is accurately injected into the normal program to generate a vulnerable program containing a specific vulnerability type;

[0069] S103. Combine static analysis and large language model to label the vulnerability type of the vulnerable program;

[0070] The large language model is built based on natural language processing and code semantic analysis to generate annotation results with contextual relevance and high credibility.

[0071] First, the embodiment of the present application collects known vulnerabilities and their patches from mainstream authoritative vulnerability websites such as NVD, CVE, and CNVD through S101 to ensure the integrity and accuracy of the data.

[0072] Standardize the collected vulnerability information, including the unified format and naming conventions of patch statements, to facilitate subsequent processing. Use static code analysis technology to extract code patterns related to specific vulnerability types.

[0073] Further, a patch statement of a single modified block is extracted from the vulnerability patch program, and variables related to the vulnerability are identified based on the patch statement;

[0074] symbolically processing code snippets in standardized patch statements to remove duplication from the code snippets so as to facilitate pattern matching in the new program;

[0075] Identifying key variables of the vulnerability according to the patch statement, wherein the key variables are used to directly affect the triggering condition of the vulnerability;

[0076] Identify code locations that may cause security issues and classify the code locations according to code types to describe vulnerability triggering statements.

[0077] Single Modification Block Extraction: Identify a single code segment based on the vulnerability patch pattern found. Extract the patch statements of a single modification block from the vulnerability patch program and identify the variables related to the vulnerability.

[0078] Standardized patches: Extracted patch statements are converted into a universal symbolic representation, removing specific implementation details from the code and forming a universal patch representation. The code in the standardized patch statements is symbolically processed and then deduplicated to facilitate pattern matching in new programs. Structural features (such as risky function calls and member accesses) are extracted from the patch statements to facilitate subsequent identification of similar patterns.

[0079] Code deduplication: Use hashing or semantic matching algorithms to deduplicate extracted patch statements to ensure uniqueness in the pattern library.

[0080] Key variable identification: Automatically analyzes variables in patch statements to determine which ones have the greatest impact on the vulnerability's cause and fix, and marks them as key variables. Based on extracted patch statements, we identify variables that are critical to the vulnerability and directly influence the vulnerability's triggering conditions.

[0081] Describe vulnerability triggering statements: Identify which statements can cause vulnerabilities to be triggered, identify code locations that may cause security issues, and classify and describe them according to code types.

[0082] Finally, based on the extracted key variables and vulnerability triggering statements, the patterns are evaluated and screened to ensure that only high-quality and highly applicable vulnerability patterns are retained.

[0083] Furthermore, S102 combines code analysis tools to precisely inject vulnerability patterns into normal programs. Based on the identified vulnerability patterns, automated tools are used to inject these patterns into safe and normal programs, generating high-quality vulnerability sample programs. This program injection process is then used to generate programs with specific vulnerability types.

[0084] Finally, S103 combines static analysis and a large language model to label vulnerability types. Static code analysis tools are used to inspect the generated program and identify potential vulnerabilities. A trained large language model, based on natural language processing and code semantic analysis, is used to understand the meaning of the code and generate labels. The large language model needs to be optimized based on the quality and scope of the training data to enhance its accuracy.

[0085] It should be noted that the training process of the large language model in the embodiment of the present application includes the following steps:

[0086] Sample collection: Extract samples from historical vulnerability and patch data and annotate them for training.

[0087] Model optimization: Iterate model parameters based on feedback to improve the model's ability to understand code and annotation accuracy, ensuring that the large language model can adapt to different types of vulnerability characteristics.

[0088] Reference Figure 2 , Figure 2 The figure shows a flow chart of a method for automatically generating and marking vulnerability programs disclosed in an embodiment of the present application, including the following steps:

[0089] (1) Vulnerability pattern extraction step: By analyzing the existing vulnerability data and its patch programs, the vulnerability patterns involved in vulnerability patching are extracted; vulnerability data and its patch programs can be obtained through mainstream authoritative vulnerability websites such as NVD, CVE, and CNVD.

[0090] (2) Vulnerable program generation step: Using the extracted vulnerability patterns, we find potential vulnerability injection locations through syntax matching and semantic matching techniques. Finally, we inject these patterns into a normal, non-vulnerable program to generate a program with a specific vulnerability.

[0091] (3) Vulnerability type labeling step: After the vulnerable program is generated, the program is deeply analyzed by combining static analysis and large language models, and the generated vulnerable program is accurately labeled with the vulnerability type.

[0092] The embodiments of the present application extract patch statements from existing vulnerability patch programs, perform symbolic processing and deduplication on them, obtain key variables in the vulnerability program and identify the vulnerability trigger statement types, so that the vulnerability pattern has universality and applicability; through syntax matching and semantic matching technology, automatic injection of vulnerability patterns is achieved, and programs with multiple vulnerability types are generated, which greatly reduces the time and cost of manually generating vulnerability programs; combined with static analysis and large language model verification, fine-grained type annotation is performed on the generated vulnerability program to ensure the accuracy of vulnerability annotation, meet the deep learning vulnerability detection model's demand for high-quality training data, and thus improve the detection accuracy of the vulnerability detection model.

[0093] Reference Figure 3 and Figure 4 , Figure 3 It is a flowchart of automated vulnerability pattern extraction; Figure 4 This is a flowchart for automatically generating vulnerabilities.

[0094] Optionally, based on the vulnerability pattern, in combination with a code analysis tool, the vulnerability pattern is precisely injected into a normal program to generate a vulnerable program containing a specific vulnerability type, including:

[0095] Clean the normal program to be injected, remove the comments and blank lines of the target program, and use code analysis tools to perform preliminary analysis of the variables and functions of the normal program;

[0096] Use syntax analysis tools to match the patch statements in the vulnerability pattern with code snippets in the target program to identify possible locations where vulnerabilities may be injected.

[0097] Perform semantic analysis on the matched code snippets to ensure that the code snippets are consistent with the logic in the vulnerability pattern;

[0098] After confirming the injection location through syntax matching and semantic matching, the target program is modified according to the corresponding vulnerability pattern to generate a program with real vulnerabilities.

[0099] Specifically, the specific steps of the vulnerability program generation program include:

[0100] (2.1) Data preprocessing: Clean the normal program to be injected, remove comments and blank lines, and then use code analysis tools to perform preliminary analysis of the variables and functions of the normal program;

[0101] (2.2) Syntax matching: Using syntax analysis tools, we match the patch statements in the vulnerability pattern with the code snippets in the target program to identify possible locations where vulnerabilities may be injected.

[0102] (2.3) Semantic matching: Perform semantic analysis on the matched code segments to ensure that the code segments are consistent with the logic in the vulnerability pattern;

[0103] (2.4) Vulnerability injection: After confirming the injection location through grammatical and semantic matching, the target program is modified according to the corresponding vulnerability pattern to generate a program with real vulnerabilities.

[0104] Specifically, in this embodiment, a simple script or text processing tool is first used to remove comments and blank lines from the target program. This step can improve the efficiency of the subsequent analysis process and ensure that only the core code is focused. For example, regular expressions or code formatting tools can be used to clean the code. Secondly, static analysis tools are used to analyze the program to identify and record the variables and functions in the program.

[0105] Through the clone detection tool, the patch statements in the vulnerability pattern are syntax-matched with the code snippets in the target program to identify the locations where the vulnerability may be injected; through the matching results, it is identified which code snippets may be similar to the vulnerability pattern, and these code snippets are potential injection vulnerability locations.

[0106] Furthermore, for possible vulnerability locations, in-depth semantic analysis is performed to verify whether the actual code logic is consistent with the logic in the vulnerability pattern. This can be achieved using techniques such as symbolic execution and data flow analysis. This ensures that the matching code snippets not only conform to the vulnerability pattern syntactically but also logically.

[0107] Finally, after confirming the vulnerability location through grammatical and semantic analysis, corresponding modifications can be made to inject the vulnerability pattern.

[0108] Optionally, static analysis and a large language model are combined to label the vulnerability type of the vulnerable program, including:

[0109] Use static analysis to perform preliminary analysis on the generated vulnerable program, identify key variables, vulnerability triggering statements, and related control flows and data flows in the vulnerable program, and obtain preliminary static analysis results;

[0110] A large language model is used to perform deep semantic verification and supplement on the preliminary static analysis results to ensure the accuracy of vulnerability type labeling.

[0111] Optionally, the code injected by the vulnerability pattern is customized based on the following vulnerability types: buffer overflow, integer overflow, null pointer dereference, and use-after-free vulnerability types.

[0112] Specifically, this embodiment includes two aspects: static analysis and large language model verification;

[0113] Static analysis: Use static analysis tools to perform preliminary analysis on the generated vulnerable program to identify key variables, vulnerability triggering statements, and related control flow and data flow in the program;

[0114] Perform a preliminary analysis of the generated vulnerable program to identify key variables, vulnerability triggering statements, and related control and data flows. This module first uses code slicing technology to extract code snippets related to the vulnerability. Then, based on the code's logical structure, it determines the code's behavior and identifies the possible vulnerability type, such as buffer overflow, integer overflow, or null pointer dereference.

[0115] Large language model verification: In-depth verification of static analysis results is performed using a large language model to further accurately label vulnerability types and ensure the accuracy of the annotations.

[0116] Initial static analysis results are deeply semantically verified and supplemented to ensure the accuracy of vulnerability type annotations. Combined with the code understanding capabilities of the large language model, potential vulnerability types can be more accurately identified. Especially in situations where multiple vulnerability types may coexist or intertwine, the large language model, based on the combination of natural language processing and code semantic analysis, can provide more contextually relevant and highly reliable annotation results.

[0117] The following describes the system for automatically generating and marking vulnerability programs provided by the present application. The system for automatically generating and marking vulnerability programs described below and the method for automatically generating and marking vulnerability programs described above can be referenced to each other.

[0118] Reference Figure 5 , this application provides a system for automatically generating and annotating vulnerability programs, including:

[0119] Vulnerability pattern extraction module 510 is configured to determine vulnerability patch programs for the acquired vulnerability data, extract code patterns containing specific types from the vulnerability patch programs, and obtain selected vulnerability patterns. Extracting specific code patterns includes extracting patch statements for a single modified block, generating symbolic patch statements, removing duplicate patch statements, identifying key variables, and describing vulnerability trigger statements.

[0120] A vulnerability program generation module 520 is used to accurately inject the vulnerability pattern into a normal program based on the vulnerability pattern and in combination with a code analysis tool to generate a vulnerability program containing a specific vulnerability type;

[0121] A vulnerability program marking module 530 is used to mark the vulnerability type of the vulnerable program by combining static analysis and a large language model;

[0122] The large language model is built based on natural language processing and code semantic analysis to generate annotation results with contextual relevance and high credibility.

[0123] Reference Figure 6 Optionally, the vulnerability pattern extraction module includes:

[0124] A patch statement identification submodule is used to extract the patch statement of a single modified block from the vulnerability patch program and identify the variables related to the vulnerability based on the patch statement;

[0125] A symbolic processing submodule, used for standardizing code snippets in patch statements through symbolic processing;

[0126] a deduplication submodule, for deduplicating the code snippets to facilitate pattern matching in a new program;

[0127] A key variable identification submodule, configured to identify key variables of a vulnerability according to the patch statement, wherein the key variables are used to directly affect the triggering conditions of the vulnerability;

[0128] The vulnerability trigger statement description submodule is used to identify code locations that may cause security issues, classify the code locations according to code types, and describe the vulnerability trigger statements.

[0129] Specifically, the patch statement identification submodule is used to extract the patch statement of a single modified block from the patch data;

[0130] The symbolic processing submodule is used to symbolize the extracted patch statements and unify the variable and function names in the code to filter out available vulnerability patterns.

[0131] The deduplication submodule is used to deduplicate the filtered vulnerability patterns, reduce the time required for the vulnerability program generation submodule, and improve the efficiency of the vulnerability program generation module;

[0132] Key variable identification submodule, used to identify variables that are critical to the vulnerability;

[0133] The vulnerability triggering statement description submodule is used to analyze and describe statements that may trigger vulnerabilities.

[0134] Furthermore, the vulnerability program generation module includes:

[0135] The data preprocessing submodule is used to clean the normal program to be injected, remove comments and blank lines in the target program, and use code analysis tools to perform preliminary analysis on the variables and functions of the normal program;

[0136] The syntax matching submodule is used to match the patch statements in the vulnerability pattern with the code snippets in the target program through syntax analysis tools to identify the locations where the vulnerability may be injected;

[0137] The semantic matching submodule is used to perform semantic analysis on the matched code snippets to ensure that the code snippets are consistent with the logic in the vulnerability pattern;

[0138] The vulnerability injection submodule is used to modify the target program according to the corresponding vulnerability pattern after confirming the injection location through syntax matching and semantic matching, and generate a program with real vulnerabilities.

[0139] Specifically, the data preprocessing submodule removes comments and blank lines in the target program, and then uses code analysis tools to analyze the variables and functions in the target program;

[0140] The syntax matching submodule identifies the possible locations where vulnerabilities may be injected by matching the patch statements in the vulnerability pattern with the code snippets in the target program;

[0141] The semantic matching submodule performs semantic analysis on the matched code segments to ensure that the matched code segments are consistent with the logic in the vulnerability pattern, especially in the use of variables and functions;

[0142] The vulnerability injection submodule, after confirming the injection location through syntax and semantic matching, injects the statements in the vulnerability pattern into the target program to generate a program with real vulnerabilities while ensuring the syntactic correctness of the vulnerability code.

[0143] Optionally, the vulnerability program marking module includes:

[0144] The static analysis submodule is used to perform preliminary analysis on the generated vulnerable program using static analysis, identify key variables, vulnerability triggering statements, and related control flows and data flows in the vulnerable program, and obtain preliminary static analysis results;

[0145] The large language model verification submodule is used to use the large language model to perform in-depth semantic verification and supplement the preliminary static analysis results to ensure the accuracy of vulnerability type annotation.

[0146] Furthermore, the vulnerability annotation module includes:

[0147] The static analysis submodule performs preliminary analysis on the generated vulnerable program, identifying key variables, vulnerability-triggering statements, and related control and data flows. This module first uses code slicing technology to extract code snippets related to the vulnerability. It then determines code behavior based on the code's logical structure and identifies possible vulnerability types, such as buffer overflow, integer overflow, or null pointer dereference.

[0148] The large language model verification submodule performs in-depth semantic verification and supplementation on preliminary static analysis results to ensure the accuracy of vulnerability type annotations. Combined with the large language model's code understanding capabilities, potential vulnerability types can be more precisely identified. Especially in situations where multiple vulnerability types may coexist or intertwine, the large language model, based on a combination of natural language processing and code semantic analysis, can provide more contextually relevant and highly reliable annotation results.

[0149] It is understandable that the detailed functional implementation of each of the above units / modules can be found in the introduction of the aforementioned method embodiment, and will not be repeated here.

[0150] It should be understood that the above-mentioned device is used to execute the method in the above-mentioned embodiment. The implementation principle and technical effect of the corresponding program module in the device are similar to those described in the above-mentioned method. The working process of the device can refer to the corresponding process in the above-mentioned method and will not be repeated here.

[0151] Based on the methods in the above embodiments, an embodiment of the present application provides an electronic device, which may include: a processor (Processor) 710, a communication interface (Communications Interface) 720, a memory (Memory) 730, and a communication bus 740, wherein the processor 710, the communication interface 720, and the memory 730 communicate with each other via the communication bus 740. The processor 710 can call the logic instructions in the memory 730 to execute the methods in the above embodiments.

[0152] In addition, the logic instructions in the aforementioned memory 730 can be implemented in the form of a software functional unit and, when sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the portion that contributes to the prior art, or the portion of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application.

[0153] Based on the method in the above embodiment, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the method in the above embodiment.

[0154] Based on the method in the above embodiment, an embodiment of the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the method in the above embodiment.

[0155] It is understood that the processor in the embodiments of the present application may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0156] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and storage medium can be located in an ASIC.

[0157] The above embodiments can be implemented in whole or in part using software, hardware, firmware, or any combination thereof. When implemented using software, they can be implemented in whole or in part in the form of a computer program product. The computer program product comprises one or more computer instructions. When loaded and executed on a computer, the computer program instructions fully or partially produce the processes or functions described in the embodiments of this application. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted via the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be magnetic media (e.g., floppy disk, hard disk, tape), optical media (e.g., DVD), or semiconductor media (e.g., solid-state drive (SSD)).

[0158] It will be understood that the various numerical numbers involved in the embodiments of the present application are merely distinctions for the convenience of description and are not intended to limit the scope of the embodiments of the present application.

[0159] It is easy for those skilled in the art to understand that the above is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A method for automatically generating and marking vulnerable programs, characterized in that: include: Determining a vulnerability patch for the acquired vulnerability data, extracting a code pattern containing a specific type from the vulnerability patch to obtain a screened vulnerability pattern; Extracting specific types of code patterns includes: extracting patch statements for a single modified block, generating symbolic patch statements, removing duplicate patch statements, identifying key variables, and describing vulnerability triggering statements; Based on the vulnerability pattern, combined with code analysis tools, the vulnerability pattern is accurately injected into the normal program to generate a vulnerable program containing a specific vulnerability type; Combine static analysis and large language models to label the vulnerability types of the vulnerable programs; The large language model is built based on natural language processing and code semantic analysis to generate annotation results with contextual relevance and high credibility. Based on the vulnerability pattern, combined with code analysis tools, the vulnerability pattern is accurately injected into the normal program to generate a vulnerable program containing specific vulnerability types, including: Clean the normal program to be injected, remove the comments and blank lines of the target program, and use code analysis tools to perform preliminary analysis of the variables and functions of the normal program; Use syntax analysis tools to match the patch statements in the vulnerability pattern with code snippets in the target program to identify possible locations where vulnerabilities may be injected. Perform semantic analysis on the matched code snippets to ensure that the code snippets are consistent with the logic in the vulnerability pattern; After confirming the injection location through syntax matching and semantic matching, the target program is modified according to the corresponding vulnerability pattern to generate a program with real vulnerabilities.

2. The method for automatically generating and marking vulnerable programs according to claim 1, characterized in that: The method for determining the vulnerability pattern includes: Extracting patch statements of a single modified block from the vulnerability patch program, and identifying variables related to the vulnerability based on the patch statements; symbolically processing code snippets in standardized patch statements to remove duplication from the code snippets so as to facilitate pattern matching in the new program; Identifying key variables of the vulnerability according to the patch statement, wherein the key variables are used to directly affect the triggering condition of the vulnerability; Identify code locations that may cause security issues and classify the code locations according to code types to describe vulnerability triggering statements.

3. The method for automatically generating and marking vulnerable programs according to claim 1, characterized in that: Combine static analysis and large language models to label the vulnerability types of the vulnerable programs, including: Use static analysis to perform preliminary analysis on the generated vulnerable program, identify key variables, vulnerability triggering statements, and related control flows and data flows in the vulnerable program, and obtain preliminary static analysis results; A large language model is used to perform deep semantic verification and supplement on the preliminary static analysis results to ensure the accuracy of vulnerability type labeling.

4. The method for automatically generating and marking vulnerable programs according to claim 1, wherein: The code injected by the vulnerability pattern is customized based on the following vulnerability types: buffer overflow, integer overflow, null pointer dereference, and use-after-free.

5. A system for automatically generating and marking vulnerable programs, characterized in that: include: A vulnerability pattern extraction module is used to determine a vulnerability patch for the acquired vulnerability data, extract code patterns containing specific types from the vulnerability patch, and obtain a selected vulnerability pattern; Extracting specific types of code patterns includes: extracting patch statements for a single modified block, generating symbolic patch statements, removing duplicate patch statements, identifying key variables, and describing vulnerability triggering statements; A vulnerability program generation module is used to accurately inject the vulnerability pattern into a normal program based on the vulnerability pattern and in combination with a code analysis tool to generate a vulnerability program containing a specific vulnerability type; A vulnerability program annotation module is used to annotate the vulnerability type of the vulnerable program by combining static analysis and a large language model; The large language model is built based on natural language processing and code semantic analysis to generate annotation results with contextual relevance and high credibility. The vulnerability program generation module includes: The data preprocessing submodule is used to clean the normal program to be injected, remove comments and blank lines in the target program, and use code analysis tools to perform preliminary analysis on the variables and functions of the normal program; The syntax matching submodule is used to match the patch statements in the vulnerability pattern with the code snippets in the target program through syntax analysis tools to identify the locations where the vulnerability may be injected; The semantic matching submodule is used to perform semantic analysis on the matched code snippets to ensure that the code snippets are consistent with the logic in the vulnerability pattern; The vulnerability injection submodule is used to modify the target program according to the corresponding vulnerability pattern after confirming the injection location through syntax matching and semantic matching, and generate a program with real vulnerabilities.

6. The system for automatically generating and marking vulnerable programs according to claim 5, characterized in that: The vulnerability pattern extraction module includes: A patch statement identification submodule is used to extract the patch statement of a single modified block from the vulnerability patch program and identify the variables related to the vulnerability based on the patch statement; A symbolic processing submodule, used for standardizing code snippets in patch statements through symbolic processing; a deduplication submodule, for deduplicating the code snippets to facilitate pattern matching in a new program; A key variable identification submodule, configured to identify key variables of a vulnerability according to the patch statement, wherein the key variables are used to directly affect the triggering conditions of the vulnerability; The vulnerability trigger statement description submodule is used to identify code locations that may cause security issues, classify the code locations according to code types, and describe the vulnerability trigger statements.

7. The system for automatically generating and marking vulnerable programs according to claim 5, characterized in that: The vulnerability program marking module includes: The static analysis submodule is used to perform preliminary analysis on the generated vulnerable program using static analysis, identify key variables, vulnerability triggering statements, and related control flows and data flows in the vulnerable program, and obtain preliminary static analysis results; The large language model verification submodule is used to use the large language model to perform in-depth semantic verification and supplement the preliminary static analysis results to ensure the accuracy of vulnerability type annotation.

8. An electronic device, characterized in that: include: at least one memory for storing a computer program; At least one processor is used to execute the program stored in the memory. When the program stored in the memory is executed, the processor is used to execute the method according to any one of claims 1 to 4.

Images