Multi-view fused source code logic vulnerability detection method, system and device

Abstract

The invention belongs to the field of software security testing, and particularly relates to a multi-view fused source code logic vulnerability detection method, system and device. The method comprises the following steps: encoding a software source code into a fusion feature vector containing feature information of a tree view and a stream view; s2, a large number of fusion feature vectors are obtained, and a sample data set is formed after label information representing whether vulnerabilities exist or not is manually added; s3, selecting cross entropy loss as a loss function, dividing the sample data set into a training set and a test set, training and testing the CNN model, and storing model parameters of the network model meeting requirements; and S4, taking the stored network model as a vulnerability detection model, and performing vulnerability detection on the fusion feature vector after encoding the software source code to be identified. According to the method, the problems that feature information in a software code attribute graph cannot be fully extracted and utilized by an existing graph feature-based vulnerability detection scheme, so that the vulnerability detection precision and efficiency are insufficient are solved.

Description

Technical Field

[0001] The present invention belongs to the field of software testing, and in particular relates to a multi-view fusion source code logic vulnerability detection method, system and device. Background Art

[0002] Source code vulnerability detection is an important part of software supply chain security. Traditional software source code vulnerability detection methods have high false positive and false negative rates. Some existing static analysis methods often lead to high false positive rates for detecting non-vulnerable programs, and some dynamic detection methods still have high false negative rates. So far, these tools are still unreliable.

[0003] Software source code vulnerability detection methods based on deep learning are widely used, among which detection methods based on graph analysis show good accuracy. However, most of these methods directly analyze the graph and extract the features of the graph, which usually leads to a lot of overhead. For example, the graph representation of the software code obtained by the graph analysis method contains a large amount of information, most of which is irrelevant to the vulnerability features, which requires the model to identify the information related to the vulnerability features from a large amount of information, which increases the difficulty of model recognition. At the same time, if the function scale is large, the obtained graph representation will become relatively complex, which makes the scale of the deep learning neural network larger, which not only increases the cost of the solution, but also limits the practical value of the solution on low-computing power devices. In addition, due to the limited GPU memory and computing resources, the existing neural network models usually limit their input length, which may also make it difficult for the network model to directly extract enough feature information from the graph, resulting in some features that cannot be used by the model and are truncated, thereby greatly reducing the vulnerability recognition accuracy of the network model. Summary of the invention

[0004] In order to solve the problem that the existing vulnerability detection scheme based on graph features cannot fully extract and utilize the feature information in the software code property graph, which leads to insufficient vulnerability detection accuracy and efficiency, the present invention provides a source code logic vulnerability detection method, system and device with multi-view fusion.

[0005] The technical solution provided by the present invention is:

[0006] A multi-view fusion source code logic vulnerability detection method comprises the following steps:

[0007] S1: Encode the software source code into a fused feature vector containing the feature information of the tree view and the stream view. The process includes:

[0008] S11: Generate a code property graph CPG according to the software source code.

[0009] S12: Extract the corresponding edges and nodes from CPG and construct them into abstract syntax tree AST, control flow graph CFG and program dependency graph PDG respectively.

[0010] S13: According to preset rules, additional edges representing return, loop and jump operations are added between nodes in the abstract syntax tree AST, thereby obtaining an enhanced syntax tree EAST.

[0011] S14: Take the enhanced syntax tree EAST as the tree view, and generate the corresponding tree view features through the pre-trained code semantic encoding model.

[0012] S15: The control flow graph CFG and the program dependency graph PDG are used as flow views, and the corresponding flow view features are generated through the pre-trained code semantic encoding model.

[0013] S16: Average pooling is performed on the feature vectors of the tree view and the stream view, and then the feature vectors are concatenated to obtain the desired fused feature vector.

[0014] S2: Obtain a large number of fused feature vectors converted from software codes, manually add label information representing whether there is a vulnerability as sample data, and then form the required sample data set.

[0015] S3: Select cross entropy loss as the loss function, divide the sample data set into training set and test set, and use it to train and test a CNN model, and save the model parameters of the network model that meets the performance index requirements.

[0016] S4: The saved network model is used as a vulnerability detection model, and the software source code to be identified is encoded into the corresponding fusion feature vector and then input into the vulnerability detection model to achieve vulnerability detection.

[0017] As a further improvement of the present invention, in step S11, the software source code is converted into a corresponding code property graph CPG using a source code-based static analysis tool joern.

[0018] As a further improvement of the present invention, in step S13, relative to the abstract syntax tree AST, the additional edges added to the enhanced syntax tree EAST include:

[0019] (1) Connect the return node in the AST and the function name node, denoted as the return edge RETURN TO.

[0020] (2) Add a serial edge between the nodes corresponding to all variables in the same line of code statement, which is recorded as the inter-layer cascade edge NEXT_TOKEN.

[0021] (3) Add a reverse edge between the nodes corresponding to all original edges and inter-layer cascade edges.

[0022] As a further improvement of the present invention, in step S14, a feature vector of a tree view is generated by a pre-trained GraphCodeBERT; and in step S15, a feature vector of a flow view is generated by a pre-trained CodeBERT.

[0023] As a further improvement of the present invention, in step S15, CodeBERT is first used to extract features of CFG and PDG respectively, and then the features of the two are concatenated to form a feature vector of the flow view.

[0024] As a further improvement of the present invention, in step S16, the feature vector of the tree view after average pooling is 1*768 dimensional; the feature vector of the stream view is 2*768 dimensional; and the fused feature vector is 3*768 dimensional.

[0025] As a further improvement of the present invention, in step S3, the CNN model includes 10 convolutional filter layers and 128 hidden layers, and ReLU is used as the activation function.

[0026] As a further improvement of the present invention, in step S4, the fused feature vector is divided into three channels and simultaneously input into the vulnerability detection model, and the vulnerability detection model is used to output a prediction result of whether the software source code corresponding to the fused feature vector contains a vulnerability.

[0027] The present invention also includes a multi-view fusion source code logic vulnerability detection system, which is designed based on the multi-view fusion source code logic vulnerability detection method as mentioned above; the multi-view fusion source code logic vulnerability detection system includes: a code acquisition unit, a CPG generation unit, a tree view generation unit, a stream view generation unit, a fusion feature generation unit and a vulnerability detection model.

[0028] Among them, the code acquisition unit is used to obtain the source code of the software to be tested; the CPG generation unit uses a preset static analysis tool to generate a corresponding code property graph based on the input source code. The tree view generation unit is used to extract the corresponding nodes and edges from the code property graph, construct an abstract syntax tree AST, and then add three types of attachment edges to the AST to obtain the enhanced syntax tree EAST as the required tree view. The flow view generation unit is used to extract the corresponding nodes and edges from the code property graph, and the constructed control flow graph CFG and program dependency graph PDG are used together as the required flow view.

[0029] The fusion feature generation unit is used to generate feature vectors corresponding to the tree view and the flow view using a pre-trained code semantic encoding model, and average pool the two and then perform feature concatenation to obtain the required fusion feature vector. The vulnerability detection model is obtained by training the CNN model using the source code logic vulnerability detection method of multi-view fusion as described above; the vulnerability detection model is used to generate a prediction result of whether the corresponding software code has a vulnerability based on the input fusion feature vector, and output it.

[0030] The present invention also provides a source code logic vulnerability detection device with multi-view fusion, which includes a memory, a processor, and a computer program stored in the memory and running in the processor. When the processor executes the computer program, a source code logic vulnerability detection system as described above is created, thereby realizing the detection of whether there are vulnerabilities in the input software source code.

[0031] The technical solution provided by the present invention has the following beneficial effects:

[0032] The vulnerability detection scheme provided by the present invention first uses the input source code to construct the CPG of the code. Then, on the one hand, the abstract syntax tree AST is decomposed from the CPG, and the enhanced syntax tree EAST is generated using the AST as a tree view, and its features are extracted. On the other hand, the control flow graph and program dependency graph are extracted from the CPG, and the feature vector of the corresponding flow view is generated. Next, the feature splicing of the extracted flow view and tree view feature vectors is performed, and the obtained fused feature vector is output to the trained CNN model, thereby realizing the detection of vulnerabilities released in the software code.

[0033] The solution of the present invention extracts the tree view and flow view in the CPG by classification, embeds them into vectors and inputs them into the model, so as to classify the semantic and syntactic features of the code, thereby making it easier for the model to extract relevant features and improve the efficiency and accuracy of vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 This is a flowchart of the steps of a multi-view fusion source code logic vulnerability detection method provided in Example 1 of the present invention.

[0035] Figure 2 This is a typical case diagram of the enhanced syntax tree generated according to the abstract syntax tree in Example 1 of the present invention.

[0036] Figure 3 This is a schematic diagram of the source code logic vulnerability detection method of multi-view fusion in Example 1 of the present invention.

[0037] Figure 4 This is a system architecture diagram of the multi-view fusion source code logic vulnerability detection system provided in Example 2 of the present invention.

[0038] Figure 5 The figure is a performance comparison chart between the invented CPG feature extraction method and the traditional scheme in the ablation experiment.

[0039] Figure 6 This is a performance comparison chart of the solution of the present invention when using CNN and MLP in the ablation experiment. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0041] Example 1

[0042] The present embodiment provides a source code logic vulnerability detection method with multi-view fusion, which still belongs to the detection method based on graph analysis. However, unlike the traditional method, when obtaining the code attribute graph corresponding to the software code, the present embodiment does not directly perform feature extraction and network model recognition; instead, it decomposes the tree view and flow view containing different feature information from the code attribute graph. Then, feature extraction is performed on the feature information contained in the two views, and finally, after obtaining the feature representation of the tree view and the flow view, the features of the two views are merged using the vector splicing method, and the obtained fused feature vector is used as the input of the deep learning network model for feature learning and vulnerability detection classification.

[0043] After adopting the solution provided in this embodiment, the network model can focus more on the core information related to the software logic function in the code attribute graph, eliminate the interference of a large amount of invalid information contained therein, and thus alleviate the problems of low vulnerability detection accuracy and excessive resource consumption in traditional solutions.

[0044] Specifically, Figure 1 As shown, the source code logic vulnerability detection method of multi-view fusion in this embodiment includes the following steps:

[0045] S1: Encode the software source code into a fused feature vector containing feature information of the tree view and the stream view. The fused feature vector is a new data type used in the present embodiment for training network models and implementing software vulnerability detection. The construction process of the fused feature vector includes:

[0046] S11: Generate a code property graph CPG according to the software source code.

[0047] The code property graph is a graph-based code representation method that provides a combined and concise representation of the code, consisting of elements from control flow and data flow as well as all feature information in the abstract syntax. The code property graph can provide additional context for syntactic and semantic results related to the source code. Like all graph-structured data, the format of the code property graph can be expressed as G = (V, E), where V represents the set of nodes and E is the set of edges between all nodes. In CPG, the node set V consists of types such as CallStatement, ReturnStatement, and ArithmeticExpression, and code fragments.

[0048] In practical applications, the joern tool (an advanced source code-based static analysis tool Joern) can be used to generate a code property graph (CPG) from the code. Of course, in other solutions, other tools with similar functions to joern can also be used to convert the software code into the corresponding code property graph.

[0049] S12: Extract the corresponding edges and nodes from CPG and construct them into abstract syntax tree AST, control flow graph CFG and program dependency graph PDG respectively.

[0050] As mentioned above, CPG is a kind of original graph structure data directly converted from source code. This type of data contains a lot of information related to the internal logic of the source code, including syntax, semantic information, data logic relationship, control process, etc. It is a huge and complex data set. In order to achieve better logic vulnerability detection, three types of core information are extracted from CPG in this embodiment, namely, abstract syntax tree AST, control flow graph CFG and program dependency graph PDG. Among them, the separated abstract syntax tree enters the branch of the tree view, while the control flow graph and program dependency graph enter the branch of the flow view.

[0051] S13: According to preset rules, additional edges representing return, loop and jump operations are added between nodes in the abstract syntax tree AST, thereby obtaining an enhanced syntax tree EAST.

[0052] The original abstract syntax tree only contains the relationship between variables. This embodiment enhances the abstract syntax tree by adding some additional edges for different purposes and adding more information to the syntax labels corresponding to the variables. Specifically, Figure 2 As shown, compared with the abstract syntax tree AST, the additional edges added to the enhanced syntax tree EAST include:

[0053] (1) Use the Return to edge to connect the “RETURN TO” function declaration, that is, connect the return node in the AST with the function name node, recorded as the return edge.

[0054] (2) Use the NEXT_TOKEN edge to connect all variables in the same code statement, that is, add a serial edge between the nodes corresponding to all variables in the same line of code statement, which is recorded as the inter-layer cascade edge.

[0055] (3) For all types of edges, we connect their respective backward edges (transposed adjacency matrices) to double the number of edges and edge types, i.e., add a backward edge between all nodes corresponding to the original edges and inter-layer cascade edges. Backward edges allow information to propagate faster in the model and lead to better model performance.

[0056] S14: Take the enhanced syntax tree EAST as the tree view, and generate the corresponding tree view features through the pre-trained code semantic encoding model.

[0057] In the branch corresponding to the tree view, this embodiment uses GraphCodeBERT to embed the obtained enhanced AST-based graph. GraphCodeBERT is a pre-trained model for programming languages, which takes into account the intrinsic structure of the code and the semantics of the code. GraphCodeBERT will first pre-process our enhanced AST-based graph to obtain source code tokens. Similar to the embedding method of Bert, GraphCodeBERT uses a combination of token embedding and position embedding when encoding words. It uses 12 transformer encoder layers to form the core network structure, and adopts a multi-head attention mechanism with 12 attention heads, including Feed Forward layer and Layer Normalization layer, etc. The embedding of the GraphCodeBERT pre-trained model can generate a corresponding feature vector, which contains the intrinsic structure and grammatical information of the source code program.

[0058] S15: The control flow graph CFG and the program dependency graph PDG are used as flow views, and the corresponding flow view features are generated through the pre-trained code semantic encoding model.

[0059] In the branch of the flow view, the obtained control flow graph and program dependency graph can be separately feature extracted, and then the extracted feature vectors can be fused. Because the program dependency graph and the control flow graph have the same vertices but different edges, the fused graph considers both their structural information and their vertex information. In practical applications, CodeBERT can be used to extract the features of the control flow graph and the data flow graph, and then their vectors can be merged together using the vector concatenation method.

[0060] In particular, considering that the program dependency graph and the control flow graph contain the same vertices but different edges, when generating the flow view feature vector, we can first use CodeBERT to extract the features of CFG and PDG respectively, and then concatenate the features of the two to form the feature vector of the flow view.

[0061] S16: Average pooling is performed on the feature vectors of the tree view and the stream view, and then the feature vectors are concatenated to obtain the desired fused feature vector.

[0062] For different views, the dimensions of the extracted feature vectors may be different. For example, the pre-trained GraphCodeBERT and CodeBERT models will generate n*1*768-dimensional feature vectors for n lines of code for each function, so n*1*768-dimensional vectors can be finally obtained in multiple views. Considering that the CNN model requires vector representations of the same size as input, this embodiment adopts an average pooling method to uniformly average pool feature vectors from different views of the same software source code into 1*768-dimensional vectors. After the vector fusion stage, the feature vectors of the tree view and the stream view are spliced ​​to generate a 3*768-dimensional feature vector for each function.

[0063] S2: Obtain a large number of fused feature vectors converted from software codes, manually add label information representing whether there is a vulnerability as sample data, and then form the required sample data set.

[0064] In actual application, the same method can be used to process all the test data of the source code at this stage, including the construction of tree view and flow view, as well as feature extraction and vector embedding, to obtain the corresponding fused feature vector. At the same time, the label information is added by the technicians according to the actual vulnerability inspection results of the source code.

[0065] S3: Select cross entropy loss as the loss function, divide the sample data set into training set and test set, and use it to train and test a CNN model, and save the model parameters of the network model that meets the performance index requirements.

[0066] In this embodiment, the CNN model used includes 10 convolutional filter layers and 128 hidden layers, and ReLU is used as the activation function. In the training phase of CNN, the loss function used in this embodiment for penalizing in the correct classification is the cross entropy loss (CEloss). The goal of CEloss is to minimize the distance between the anchor sample and the positive sample (i.e., closer in the embedding space) and maximize the distance between the anchor sample and the negative sample (further in the embedding space).

[0067] S4: The saved network model is used as a vulnerability detection model, and the software source code to be identified is encoded into the corresponding fusion feature vector and then input into the vulnerability detection model to achieve vulnerability detection.

[0068] In actual application, the fused feature vector generated by the source code is divided into three channels and input into the vulnerability detection model at the same time. The vulnerability detection model is used to output the prediction result of whether the software source code corresponding to the fused feature vector contains a vulnerability.

[0069] In summary, since CPG contains a large amount of functional information, the existing solutions need to extract information related to vulnerability features from a large amount of irrelevant information when they are actually applied. The model faces great challenges in distinguishing relevant information, which affects the accuracy and hardware dependence of the solution. In order to alleviate the problem of low vulnerability detection accuracy and high resource consumption, this embodiment uses a multi-view fusion method based on CPG, combined with an enhanced abstract syntax tree, program dependency graph, and control flow graph for vulnerability detection. Figure 3 As shown in the figure, in actual application, the scheme first uses the input source code to build the CPG of the code. Next, on the one hand, the abstract syntax tree AST (tree view) is decomposed from the CPG, and then the AST builds a graph based on the enhanced AST, and its features are extracted using GraphCodeBERT. On the other hand, the control flow graph and program dependency graph are extracted from the CPG, and the feature vector of the corresponding flow view is generated. Then, all the extracted feature vectors are feature spliced ​​to obtain a fused feature vector containing all feature information. Finally, the trained CNN module is used to extract all the graph information contained in the fused feature vector, and the vulnerabilities contained therein are classified and detected.

[0070] Example 2

[0071] Based on the method of Example 1, this embodiment further provides a multi-view fusion source code logic vulnerability detection system, which is designed using the multi-view fusion source code logic vulnerability detection method of Example 1. The multi-view fusion source code logic vulnerability detection system provided in this embodiment is a computer program, which, when running, can receive software source code to be detected, and then use the method in Example 1 to transcode the software source code into a fusion feature map, and then implement vulnerability detection through a trained CNN model.

[0072] Specifically, Figure 4As shown, the multi-view fusion source code logic vulnerability detection system provided in this embodiment includes: a code acquisition unit, a CPG generation unit, a tree view generation unit, a flow view generation unit, a fusion feature generation unit and a vulnerability detection model. Among them, the code acquisition unit is used to obtain the source code of the software to be detected; the CPG generation unit uses a preset static analysis tool to generate a corresponding code attribute graph according to the input source code. The tree view generation unit is used to extract the corresponding nodes and edges from the code attribute graph, construct an abstract syntax tree AST, and then add three types of additional edges to the AST, and the obtained enhanced syntax tree EAST is used as the required tree view. The flow view generation unit is used to extract the corresponding nodes and edges from the code attribute graph, and the constructed control flow graph CFG and program dependency graph PDG are used together as the required flow view.

[0073] The fusion feature generation unit is used to generate feature vectors corresponding to the tree view and the flow view using a pre-trained code semantic encoding model, and average pool the two and then perform feature concatenation to obtain the required fusion feature vector. The vulnerability detection model is obtained by training the CNN model using the source code logic vulnerability detection method of multi-view fusion as described above; the vulnerability detection model is used to generate a prediction result of whether the corresponding software code has a vulnerability based on the input fusion feature vector, and output it.

[0074] Example 3

[0075] Based on the above-mentioned embodiment, this embodiment further provides a source code logic vulnerability detection device with multi-view fusion, which includes a memory, a processor, and a computer program stored in the memory and running in the processor. When the processor executes the computer program, a source code logic vulnerability detection system as described above is created, thereby realizing the detection of whether there are vulnerabilities in the input software source code.

[0076] The multi-view fusion source code logic vulnerability detection device provided in this embodiment is essentially a computer device for implementing the solution in Embodiment 1. The computer device can be an intelligent terminal capable of executing a program, a tablet computer, a laptop computer, a desktop computer, a rack server, a blade server, a tower server or a cabinet server (including an independent server or a server cluster composed of multiple servers), etc.

[0077] The computer device indicated in this embodiment includes at least but is not limited to: a memory and a processor that can be connected to each other through a system bus. Among them, the memory (i.e., a readable storage medium) includes a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a disk, an optical disk, etc. In some embodiments, the memory can be an internal storage unit of a computer device, such as a hard disk or a memory of the computer device. In other embodiments, the memory can also be an external storage device of a computer device, such as a plug-in hard disk equipped on the computer device, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. Of course, the memory can also include both the internal storage unit of the computer device and its external storage device. In this embodiment, the memory is generally used to store an operating system and various application software installed on the computer device. In addition, the memory can also be used to temporarily store various types of data that have been output or are to be output.

[0078] The processor may be a central processing unit (CPU), a graphics processing unit (GPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor is generally used to control the overall operation of a computer device. In this embodiment, the processor is used to run program codes stored in a memory or process data.

[0079] Simulation test

[0080] In order to verify the performance and advantages of the multi-view fusion source code logic vulnerability detection method provided by the present invention, the technicians formulated an experimental plan and simulated and tested the relevant schemes. The contents of the test experiment are as follows:

[0081] 1. Experimental Setup

[0082] This experiment uses Pytorch 2.0.1 to implement the method of the present invention. The dataset used in the experiment comes from REVEAL, which contains 20,494 non-vulnerable functions and 2,240 vulnerable functions. These programs come from two open source projects: Linux Debian Kernel and Chromium (Chrome's open source project). Linux Debian Kernel and Chromiums (Chrome's open source project) are two popular and well-maintained public projects that represent various security issues in two important programming domains (operating system browsers). Both projects have a large number of public vulnerability reports.

[0083] In addition, the ratio of non-vulnerable and vulnerable functions in the dataset selected for this experiment is about 9:1, which is similar to the ratio of vulnerable programs to non-vulnerable programs in the real world. In addition, this experiment also uses the QEMU dataset and the SARD dataset (a project maintained by the National Institute of Standards and Technology (NIST) of the United States, including 12,303 vulnerable functions and 21,057 non-vulnerable functions).

[0084] In the training phase of the network model, the loss function uses cross entropy loss. The training process uses the Adam optimizer to train CNN, and the learning rate is set to 0.001.

[0085] 2. Performance comparison test

[0086] In order to evaluate the actual performance of the scheme of the present invention, this experiment also selected several state-of-the-art vulnerability detection methods as the control group for comparison with the scheme of the present invention. The control group schemes include: Reveal, VulCNN, Design, SyseVR, VulDeepecker, Russell et al. This experiment performs performance tests on the scheme of the present invention and the control group scheme on the REVEAL dataset and the Sard dataset, and uses four widely used indicators to evaluate the vulnerability detection performance of each scheme. The four evaluation indicators include: Accuracy, Precision, Recall, and F1 score.

[0087] Among them, accuracy refers to the proportion of all test cases that are correctly classified. Precision refers to the ratio of correctly predicted vulnerable samples to samples predicted as vulnerable. Recall refers to the ratio of correctly predicted vulnerable samples to all vulnerable samples. The F1 score evaluates the overall effect by considering precision and recall.

[0088] In the performance control experiment, the performance of the present invention and other control group solutions on the REVEAL dataset is shown in Table 1:

[0089] Table 1: Performance test results of different schemes on the REVEAL dataset

[0090]

[0091] From the analysis of the data in the table, it can be found that the proposed method achieves 90.48% and 77.22% accuracy and precision respectively. Compared with the Reveal scheme, the proposed method can improve the accuracy, precision and F1 score by 8.71%, 45.67% and 21.71% respectively. However, in terms of recall, the proposed method is 7.47% lower than Reveal, which is due to the imbalanced ratio of vulnerability and non-vulnerability functions in the Reveal dataset (vulnerability functions only account for 9% of all functions), as well as the uneven number of test categories and too much data noise, resulting in poor recall performance of the method. Compared with the design, the accuracy is improved by 2.99%, the precision is improved by 45.67%, the recall is improved by 17.02%, and the F1 score is improved by 29.42%. Compared with the other two methods, our method also has significant advantages. In summary, compared with other state-of-the-art methods, our method has made significant improvements in four widely used indicators.

[0092] Furthermore, this experiment continued to compare the present invention with the control group on the Sard data set, and the obtained experimental data are shown in Table 2:

[0093] Table 2: Performance test results of different schemes on the Sard dataset

[0094]

[0095] By analyzing the data in Table 2, it can be found that the scheme of the present invention also has a more significant advantage on another data set. In summary, compared with other state-of-the-art methods, the method of the present invention has significant improvements in four widely used indicators. In all four indicators, the method of the present invention is almost superior to the token-based method (Russell et al.) and the slice + token-based method. This is because the graph-based model learns the semantic dependencies between each node along the way through various graphs, and the graph can highly retain the semantic and syntactic information of the code, which enables the graph-based pattern to make accurate predictions. However, the token- and slice-based methods cannot fully retain the semantic information of the program, which may cause the model to be unable to make correct predictions. Therefore, the graph-based method is significantly superior to the slice- and token-based methods.

[0096] 3. Ablation Experiment

[0097] The technical solution provided by the present invention includes two core elements: one is feature extraction and feature fusion of CPG, and the other is learning and training the extracted fusion feature vector using CNN model. In order to study the contribution of the two to the outstanding performance achieved by the final solution, the technicians specified the following ablation experiment.

[0098] 3.1: Different feature extraction methods

[0099] This experiment used two methods to process CPG and compared them to explore the impact of the CPG processing method of the tree view + stream view adopted by the present invention on the performance of the solution.

[0100] First, in the experiment of the present invention, the source code was standardized according to the design method, and the source code was converted into a CPG graph using the Joern tool. Then, the CPG was split to obtain the required abstract syntax tree, control flow graph, and code dependency graph. The abstract syntax tree was enhanced into a graph based on the enhanced abstract syntax tree using the corresponding rules, as the tree view of the present invention, and the present invention used the pre-trained GraphCodeBERT for feature extraction and vector embedding. The control flow graph and the program dependency graph are used as the flow view part, and the present invention uses CodeBERT for embedding. Finally, the tree view and flow view vectors are fused using the vector fusion method and sent to CNN for training and prediction.

[0101] In the second experiment, a method without splitting CPG was used. After obtaining the code attribute map of the source code using the Joern tool, CodeBERT was directly used to extract features and embed the vector into CPG without extracting the tree view and flow view. Then, the obtained source code feature vector was sent to CNN with the same parameter configuration for training and prediction.

[0102] In this experiment, the final performance test results of the two solutions are as follows: Figure 5 Analysis Figure 5 The data show that in the first 100 rounds of training and prediction of the Sard dataset, the method of the present invention is superior to the traditional CPG processing method in terms of efficiency and accuracy. This proves that the method of extracting feature information from CPG of the present invention is superior to the traditional method in terms of efficiency and accuracy.

[0103] The reason why the present invention can achieve this advantage is that CPG contains a large amount of code semantics and grammatical information. If CPG is simply vector embedded and sent to CNN for feature learning and training, it is difficult for the model to extract features related to the vulnerability function from a large amount of irrelevant and complex information, resulting in low model efficiency and accuracy. The scheme of the present invention classifies and extracts the tree view and flow view in CPG, and embeds them into the vector and then inputs them into the model, which is equivalent to simply classifying the semantic and syntactic features of the code and then inputting them into the model, which will make it easier for the model to extract relevant features and improve the efficiency and accuracy of vulnerability detection.

[0104] 3.2: Different neural network models

[0105] This experiment studies the different effects of using different models for training on the vulnerability detection performance of the final solution under the same method. Specifically, this experiment studies two widely used classifier models, convolutional neural network (CNN) and multi-layer perceptron (MLP). For the CNN model, this experiment used a model with 10 convolutional filter layers and 128 hidden layers. For the MLP model, this experiment used a network model with 3 fully connected layers (i.e. linear layers) and 2 ReLU activation layers, and finally used a sigmoid activation layer to output the result as a binary classification.

[0106] This experiment uses the same process to process the source code on the Sard and Qemu datasets. After using the same feature extraction method to obtain the feature vectors of the source code, these feature vectors are fed into the CNN classifier and the MLP classifier for feature learning and training. The performance of the final solution is as follows: Figure 6 shown.

[0107] analyze Figure 6 It can be seen from the data that the results of training and prediction using the CNN model are slightly better than those of the MLP model overall. The CNN model seems to be more balanced in the overall value of the evaluation indicators, while the MLP model shows polarization in the evaluation indicators of the SARD dataset (i.e., higher accuracy but lower recall).

[0108] The reason for the above phenomenon is that the structure of the MLP model is relatively simple, it is easy to fall into the local minimum, and it is impossible to find the global optimal solution. And the fully connected layer of MLP ensures that each neuron is connected to all neurons in the previous layer, so that the local features of the data cannot be utilized. CNN can extract local features through local connections and weight sharing, which is impossible for MLP. In addition, the difficulty of the MLP model in processing high-dimensional data can also be one of the reasons. According to the experimental results, in practical applications, CNN should be selected as the network model required for feature training and classification in the present invention.

[0109] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A multi-view fusion source code logic vulnerability detection method, characterized in that: It includes the following steps: S1: Encode the software source code into a fused feature vector containing the feature information of the tree view and the stream view. The process includes: S11: Generate a code property graph CPG based on the software source code; S12: extract the corresponding edges and nodes from CPG and construct them into abstract syntax tree AST, control flow graph CFG and program dependency graph PDG respectively; S13: according to a preset rule, additional edges representing return, loop and jump operations are added between nodes in the abstract syntax tree AST, thereby obtaining an enhanced syntax tree EAST; S14: Take the enhanced syntax tree EAST as the tree view, and generate the corresponding tree view features through the pre-trained code semantic encoding model; S15: The control flow graph CFG and the program dependency graph PDG are used as flow views, and the corresponding flow view features are generated through the pre-trained code semantic encoding model; S16: average pooling the feature vectors of the tree view and the stream view and concatenating them to obtain a desired fused feature vector; S2: Obtain a large number of fused feature vectors converted from software codes, manually add label information representing whether there is a vulnerability as sample data, and then form the required sample data set; S3: Select cross entropy loss as the loss function, divide the sample data set into a training set and a test set, and use it to train and test a CNN model, and save the model parameters of the network model that meets the performance index requirements; S4: The saved network model is used as a vulnerability detection model, and the software source code to be identified is encoded into a corresponding fusion feature vector and then input into the vulnerability detection model, thereby realizing vulnerability detection.

2. The method for detecting source code logic vulnerabilities by multi-view fusion as claimed in claim 1, characterized in that: In step S11, the software source code is converted into a corresponding code property graph CPG using the source code-based static analysis tool joern.

3. The method for detecting source code logic vulnerabilities by fusion of multiple views as claimed in claim 2, characterized in that: In step S13, relative to the abstract syntax tree AST, the additional edges added to the enhanced syntax tree EAST include: (1) Connect the return node in the AST and the function name node, denoted as the return edge RETURN TO; (2) Add a serial edge between the nodes corresponding to all variables in the same line of code statement, which is recorded as the inter-layer cascade edge NEXT_TOKEN; (3) Add a reverse edge between the nodes corresponding to all original edges and inter-layer cascade edges.

4. The method for detecting source code logic vulnerabilities by fusion of multiple views as claimed in claim 3, characterized in that: In step S14, a feature vector of a tree view is generated by using the pre-trained GraphCodeBERT; in step S15, a feature vector of a flow view is generated by using the pre-trained CodeBERT.

5. The method for detecting source code logic vulnerabilities by fusion of multiple views as claimed in claim 4, characterized in that: In step S15, CodeBERT is used to extract the features of CFG and PDG respectively, and then the features of the two are concatenated to form a feature vector of the flow view.

6. The method for detecting source code logic vulnerabilities by fusion of multiple views as claimed in claim 5, characterized in that: The feature vector of the tree view after average pooling in step S16 is 1*768 dimensional; the feature vector of the stream view is 2*768 dimensional; and the fused feature vector is 3*768 dimensional.

7. The method for detecting source code logic vulnerabilities by fusion of multiple views as claimed in claim 6, characterized in that: In step S3, the CNN model includes 10 convolutional filter layers and 128 hidden layers, and uses ReLU as the activation function.

8. The method for detecting source code logic vulnerabilities by fusion of multiple views as claimed in claim 7, characterized in that: In step S4, the fused feature vector is divided into three channels and simultaneously input into the vulnerability detection model, and the vulnerability detection model is used to output a prediction result of whether the software source code corresponding to the fused feature vector contains a vulnerability.

9. A multi-view fusion source code logic vulnerability detection system, characterized by: The method is designed based on the multi-view fusion source code logic vulnerability detection method according to any one of claims 1 to 8; the multi-view fusion source code logic vulnerability detection system comprises: A code acquisition unit, which is used to acquire the source code of the software to be tested; A CPG generation unit, which uses a preset static analysis tool to generate a corresponding code property graph according to the input source code; A tree view generation unit, which is used to extract corresponding nodes and edges from the code attribute graph, construct an abstract syntax tree AST, and then add three types of attachment edges to the AST to obtain an enhanced syntax tree EAST as the required tree view; A flow view generation unit, which is used to extract corresponding nodes and edges from the code attribute graph, and construct a control flow graph CFG and a program dependency graph PDG as the required flow view; A fusion feature generation unit, which is used to generate feature vectors corresponding to the tree view and the stream view using a pre-trained code semantic encoding model, and first average pool the two and then perform feature concatenation to obtain the required fusion feature vector; A vulnerability detection model, which is obtained by training a CNN model through the multi-view fusion source code logic vulnerability detection method as described in any one of claims 1 to 8; the vulnerability detection model is used to generate a prediction result of whether the corresponding software code has a vulnerability based on the input fusion feature vector, and output it.

10. A source code logic vulnerability detection device with multi-view fusion, comprising a memory, a processor, and a computer program stored in the memory and running in the processor, characterized in that: When the processor executes the computer program, it creates the source code logic vulnerability detection system as described in claim 9, thereby realizing the detection of whether there are vulnerabilities in the input software source code.

Images