Multi-view fusion source code logic vulnerability detection method, system and device

Abstract

The present invention belongs to the field of software security testing, and specifically relates to a method, system, and device for detecting logical vulnerabilities in source code using multi-view fusion. The method comprises: encoding the software source code into a fused feature vector containing feature information of a tree view and a stream view; S2: obtaining a large number of fused feature vectors, manually adding label information indicating whether a vulnerability exists to form a sample data set; S3: selecting cross entropy loss as the loss function, dividing the sample data set into a training set and a test set, training and testing the CNN model, and saving the model parameters of the network model that meets the requirements; S4: using the saved network model as a vulnerability detection model, and using it to perform vulnerability detection on the fused feature vector encoded after the software source code to be identified. The present invention solves the problem that existing vulnerability detection solutions based on graph features cannot fully extract and utilize the feature information in the software code attribute graph, thereby resulting in insufficient vulnerability detection accuracy and efficiency.

Description

Technical Field

[0001] The present invention belongs to the field of software testing, and in particular relates to a multi-view fusion source code logic vulnerability detection method, system and device. Background Art

[0002] Source code vulnerability detection is a crucial component of software supply chain security. Traditional software source code vulnerability detection methods suffer from high false positive and false negative rates. Some existing static analysis methods often result in high false positive rates for detecting non-vulnerable programs, while some dynamic detection methods also suffer from high false negative rates. To date, these tools remain unreliable.

[0003] Software source code vulnerability detection methods based on deep learning are widely used, among which detection methods based on graph analysis have demonstrated good accuracy. However, most of these methods directly analyze graphs and extract graph features, which often results in significant overhead. For example, the graph representation of software code obtained using graph analysis methods contains a large amount of information, much of which is irrelevant to vulnerability features. This requires the model to identify information related to vulnerability features from this large amount of information, increasing the difficulty of model recognition. At the same time, if the function scale is large, the resulting graph representation becomes relatively complex, which increases the scale of the deep learning neural network, increasing the cost of the solution and limiting its practical value on low-computing power devices. In addition, due to limited GPU memory and computing resources, existing neural network models often have restrictions on their input length. This can also make it difficult for the network model to directly extract sufficient feature information from the graph, resulting in some features being unusable by the model and being truncated, which in turn significantly reduces the vulnerability identification accuracy of the network model. Summary of the Invention

[0004] In order to solve the problem that existing graph feature-based vulnerability detection solutions cannot fully extract and utilize feature information in software code property graphs, which leads to insufficient vulnerability detection accuracy and efficiency, the present invention provides a multi-view fusion source code logic vulnerability detection method, system and device.

[0005] The technical solution provided by the present invention is:

[0006] A multi-view fusion source code logic vulnerability detection method includes the following steps:

[0007] S1: Encode the software source code into a fused feature vector containing feature information from the tree view and the stream view. The process includes:

[0008] S11: Generate a code property graph CPG based on the software source code.

[0009] S12: Extract the corresponding edges and nodes from the CPG and construct them into the abstract syntax tree AST, control flow graph CFG and program dependency graph PDG respectively.

[0010] S13: According to preset rules, additional edges representing return, loop and jump operations are added between nodes in the abstract syntax tree AST, thereby obtaining an enhanced syntax tree EAST.

[0011] S14: Use the enhanced syntax tree EAST as a tree view and generate the corresponding tree view features through the pre-trained code semantic encoding model.

[0012] S15: Use the control flow graph CFG and program dependency graph PDG as flow views, and generate corresponding flow view features through the pre-trained code semantic encoding model.

[0013] S16: Perform average pooling on the feature vectors of the tree view and the stream view and concatenate them to obtain the required fused feature vector.

[0014] S2: Obtain a large number of fused feature vectors converted from software code, manually add label information representing whether there is a vulnerability as sample data, and then form the required sample data set.

[0015] S3: Select cross entropy loss as the loss function, divide the sample data set into training set and test set, and use it to train and test a CNN model, and save the model parameters of the network model that meets the performance index requirements.

[0016] S4: The saved network model is used as a vulnerability detection model. The software source code to be identified is encoded into the corresponding fusion feature vector and then input into the vulnerability detection model to achieve vulnerability detection.

[0017] As a further improvement of the present invention, in step S11, the software source code is converted into a corresponding code property graph CPG using a source code-based static analysis tool joern.

[0018] As a further improvement of the present invention, in step S13, the additional edges added to the enhanced syntax tree EAST relative to the abstract syntax tree AST include:

[0019] (1) Connect the return node in the AST and the function name node, which is recorded as the return edge RETURN TO.

[0020] (2) Add a serial edge between the nodes corresponding to all variables in the same line of code statement, which is recorded as the inter-layer cascade edge NEXT_TOKEN.

[0021] (3) Add a reverse edge between all nodes corresponding to the original edges and inter-layer cascade edges.

[0022] As a further improvement of the present invention, in step S14, a feature vector of a tree view is generated by using a pre-trained GraphCodeBERT; and in step S15, a feature vector of a flow view is generated by using a pre-trained CodeBERT.

[0023] As a further improvement of the present invention, in step S15, the features of CFG and PDG are first extracted separately by CodeBERT, and then the features of the two are concatenated to form a feature vector of the flow view.

[0024] As a further improvement of the present invention, in step S16, the feature vector of the tree view after average pooling is 1*768-dimensional; the feature vector of the stream view is 2*768-dimensional; and the fused feature vector is 3*768-dimensional.

[0025] As a further improvement of the present invention, in step S3, the CNN model includes 10 convolutional filter layers and 128 hidden layers, and uses ReLU as the activation function.

[0026] As a further improvement of the present invention, in step S4, the fused feature vector is divided into three channels and simultaneously input into the vulnerability detection model, and the vulnerability detection model is used to output a prediction result of whether the software source code corresponding to the fused feature vector contains a vulnerability.

[0027] The present invention also includes a multi-view fusion source code logic vulnerability detection system, which is designed based on the multi-view fusion source code logic vulnerability detection method as described above; the multi-view fusion source code logic vulnerability detection system includes: a code acquisition unit, a CPG generation unit, a tree view generation unit, a stream view generation unit, a fusion feature generation unit and a vulnerability detection model.

[0028] The code acquisition unit is used to obtain the source code of the software to be tested; the CPG generation unit uses a preset static analysis tool to generate a corresponding code property graph based on the input source code. The tree view generation unit is used to extract the corresponding nodes and edges from the code property graph, construct an abstract syntax tree (AST), and then add three types of attachment edges to the AST to obtain the enhanced syntax tree (EAST) as the required tree view. The flow view generation unit is used to extract the corresponding nodes and edges from the code property graph, and the constructed control flow graph (CFG) and program dependency graph (PDG) together serve as the required flow view.

[0029] The fusion feature generation unit uses a pre-trained code semantic encoding model to generate feature vectors corresponding to the tree view and flow view. It then performs average pooling and feature concatenation on the two to obtain the desired fused feature vector. The vulnerability detection model is trained using the aforementioned multi-view fusion source code logic vulnerability detection method using a CNN model. Based on the input fused feature vector, the vulnerability detection model generates and outputs a prediction of whether the corresponding software code has a vulnerability.

[0030] The present invention also provides a multi-view fusion source code logic vulnerability detection device, comprising a memory, a processor, and a computer program stored in the memory and executed by the processor. When the processor executes the computer program, it creates the aforementioned source code logic vulnerability detection system, thereby detecting vulnerabilities in the input software source code.

[0031] The technical solution provided by the present invention has the following beneficial effects:

[0032] The vulnerability detection solution provided by the present invention first uses the input source code to construct the CPG of the code. Then, on the one hand, the abstract syntax tree AST is decomposed from the CPG, and the AST is used to generate the enhanced syntax tree EAST as a tree view, and its features are extracted. On the other hand, the control flow graph and program dependency graph are extracted from the CPG, and the feature vector of the corresponding flow view is generated. Next, the feature vectors of the extracted flow view and tree view are spliced, and the obtained fused feature vector is output to the trained CNN model, thereby realizing the detection of vulnerabilities released in the software code.

[0033] The solution of the present invention extracts the tree view and flow view in CPG by classification, embeds them into vectors and inputs them into the model, thereby classifying the semantic and syntactic features of the code, making it easier for the model to extract relevant features and improving the efficiency and accuracy of vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 This is a flowchart of the steps of a multi-view fusion source code logic vulnerability detection method provided in Example 1 of the present invention.

[0035] Figure 2 This is a typical case diagram of the enhanced syntax tree generated based on the abstract syntax tree in Example 1 of the present invention.

[0036] Figure 3 This is a schematic diagram of the principle of the source code logic vulnerability detection method using multi-view fusion in Example 1 of the present invention.

[0037] Figure 4 This is a system architecture diagram of the multi-view fusion source code logic vulnerability detection system provided in Example 2 of the present invention.

[0038] Figure 5 The figure is a performance comparison chart between the invented CPG feature extraction method and the traditional scheme in the ablation experiment.

[0039] Figure 6 This is a performance comparison chart of the solution of the present invention when using CNN and MLP in the ablation experiment. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0041] Example 1

[0042] This embodiment provides a source code logic vulnerability detection method that integrates multiple views. This method still belongs to the detection method based on graph analysis. However, unlike traditional methods, this embodiment does not directly perform feature extraction and network model recognition when obtaining the code attribute graph corresponding to the software code; instead, it decomposes the tree view and flow view containing different feature information from the code attribute graph. Feature extraction is then performed on the feature information contained in the two views. Finally, after obtaining the feature representation of the tree view and the flow view, the features of the two views are merged using a vector splicing method, and the obtained fused feature vector is used as the input of the deep learning network model for feature learning and vulnerability detection classification.

[0043] After adopting the solution provided in this embodiment, the network model can focus more on the core information related to the software logical functions in the code attribute graph, eliminate the interference of a large amount of invalid information contained therein, and thus alleviate the problems of low vulnerability detection accuracy and excessive resource consumption in traditional solutions.

[0044] Specifically, if Figure 1 As shown, the source code logic vulnerability detection method of multi-view fusion in this embodiment includes the following steps:

[0045] S1: Encode the software source code into a fused feature vector containing feature information from the tree view and the stream view. The fused feature vector is a new data type used in this embodiment for training network models and implementing software vulnerability detection. The construction process of the fused feature vector includes:

[0046] S11: Generate a code property graph CPG based on the software source code.

[0047] The code property graph is a graph-based code representation method that provides a combinatorial and concise representation of code, consisting of elements from control flow and data flow, as well as all feature information in the abstract syntax. The code property graph can provide additional context for the syntactic and semantic results related to the source code. Like all graph-structured data, the format of the code property graph can be expressed as G = (V, E), where V represents the set of nodes and E is the set of edges between all nodes. In CPG, the node set V consists of types such as CallStatement, ReturnStatement, and ArithmeticExpression, as well as code fragments.

[0048] In practical applications, the joern tool (an advanced source code-based static analysis tool) can be used to generate a code property graph (CPG) from the code. Of course, in other solutions, other tools with similar functions to joern can also be used to convert the software code into the corresponding code property graph.

[0049] S12: Extract the corresponding edges and nodes from the CPG and construct them into the abstract syntax tree AST, control flow graph CFG and program dependency graph PDG respectively.

[0050] As previously described, CPG is a type of raw graph-structured data directly converted from source code. This type of data contains a wealth of information related to the source code's inherent logic, including syntax, semantics, data logical relationships, control processes, and more. It is a large and complex data set. To better detect logical vulnerabilities, this embodiment extracts three core types of information from CPG: the abstract syntax tree (AST), the control flow graph (CFG), and the program dependency graph (PDG). The extracted abstract syntax tree enters the tree view branch, while the control flow graph and program dependency graph enter the flow view branch.

[0051] S13: According to preset rules, additional edges representing return, loop and jump operations are added between nodes in the abstract syntax tree AST, thereby obtaining an enhanced syntax tree EAST.

[0052] The original abstract syntax tree only contains the relationship between variables. This embodiment enhances the abstract syntax tree by adding some additional edges for different purposes and adding more information to the syntax labels corresponding to the variables. Specifically, Figure 2 As shown in the figure, compared with the abstract syntax tree AST, the additional edges added to the enhanced syntax tree EAST include:

[0053] (1) Use the Return to edge to connect the “RETURN TO” function declaration, that is, connect the return node in the AST with the function name node, which is recorded as the return edge.

[0054] (2) Use the NEXT_TOKEN edge to connect all variables in the same code statement, that is, add a serial edge between the nodes corresponding to all variables in the same line of code statement, which is recorded as the inter-layer cascade edge.

[0055] (3) For all edge types, we connect their respective backward edges (transposed adjacency matrices), doubling the number of edges and edge types. That is, we add a backward edge between all nodes corresponding to the original edges and inter-layer cascade edges. Backward edges allow information to propagate faster in the model and lead to better model performance.

[0056] S14: Use the enhanced syntax tree EAST as a tree view and generate the corresponding tree view features through the pre-trained code semantic encoding model.

[0057] In the branch corresponding to the tree view, this embodiment uses GraphCodeBERT to embed the obtained enhanced AST-based graph. GraphCodeBERT is a pre-trained model for programming languages, which takes into account the intrinsic structure of the code and the semantics of the code. GraphCodeBERT will first pre-process our enhanced AST-based graph to obtain source code tokens. Similar to the embedding method of Bert, GraphCodeBERT uses a combination of token embedding and position embedding when encoding words. It uses 12 transformer encoder layers to form the core network structure, and adopts a multi-head attention mechanism with 12 attention heads, including a Feed Forward layer and a Layer Normalization layer, etc. The embedding of the GraphCodeBERT pre-trained model can generate a corresponding feature vector, which contains the intrinsic structure and grammatical information of the source code program.

[0058] S15: Use the control flow graph CFG and program dependency graph PDG as flow views, and generate corresponding flow view features through the pre-trained code semantic encoding model.

[0059] In the branch of the flow view, features can be extracted from the control flow graph and program dependency graph separately, and then the extracted feature vectors can be fused. Because the program dependency graph and the control flow graph share vertices but different edges, the fused graph considers both their structural information and their vertex information. In practical applications, CodeBERT can be used to extract features from the control flow graph and data flow graph, and then their vectors can be merged using vector concatenation.

[0060] In particular, considering that the program dependency graph and the control flow graph contain the same vertices but different edges, when generating the flow view feature vector, we can first use CodeBERT to extract the features of CFG and PDG respectively, and then concatenate the features of the two to form the feature vector of the flow view.

[0061] S16: Perform average pooling on the feature vectors of the tree view and the stream view and concatenate them to obtain the required fused feature vector.

[0062] The dimensions of the extracted feature vectors may vary for different views. For example, the pre-trained GraphCodeBERT and CodeBERT models generate an n*1*768-dimensional feature vector for each function's n lines of code, resulting in n*1*768-dimensional vectors across multiple views. Considering that CNN models require vector representations of the same size as input, this embodiment uses an average pooling method to uniformly average pool feature vectors from different views of the same software source code into a 1*768-dimensional vector. After a vector fusion phase, the feature vectors from the tree view and stream view are concatenated to generate a 3*768-dimensional feature vector for each function.

[0063] S2: Obtain a large number of fused feature vectors converted from software code, manually add label information representing whether there is a vulnerability as sample data, and then form the required sample data set.

[0064] In actual applications, this stage can use the same method to process all acquired source code test data, including the construction of tree and flow views, as well as feature extraction and vector embedding, to obtain the corresponding fused feature vector. Simultaneously, label information is added by technicians based on the actual vulnerability inspection results of the source code.

[0065] S3: Select cross entropy loss as the loss function, divide the sample data set into training set and test set, and use it to train and test a CNN model, and save the model parameters of the network model that meets the performance index requirements.

[0066] In this embodiment, the CNN model used includes 10 convolutional filter layers and 128 hidden layers, and uses ReLU as the activation function. During the training phase of the CNN, the loss function used in this embodiment to penalize the correct classification is the cross entropy loss (CEloss). The goal of CEloss is to minimize the distance between the anchor sample and the positive sample (i.e., closer in the embedding space) and maximize the distance between the anchor sample and the negative sample (farther in the embedding space).

[0067] S4: The saved network model is used as a vulnerability detection model. The software source code to be identified is encoded into the corresponding fusion feature vector and then input into the vulnerability detection model to achieve vulnerability detection.

[0068] In actual application, the fused feature vector generated by the source code is divided into three channels and input into the vulnerability detection model at the same time. The vulnerability detection model is used to output the prediction result of whether the software source code corresponding to the fused feature vector contains a vulnerability.

[0069] In summary, since CPG contains a large amount of functional information, existing solutions need to extract information related to vulnerability features from a large amount of irrelevant information when applied in practice. The model faces huge challenges in distinguishing relevant information, which affects the accuracy and hardware dependence of the solution. In order to alleviate the problems of low vulnerability detection accuracy and high resource consumption, this embodiment uses a multi-view fusion method based on CPG, combined with an enhanced abstract syntax tree, program dependency graph and control flow graph for vulnerability detection. Figure 3 As shown in the figure, when this scheme is actually applied, the input source code is first used to build the CPG of the code. Next, on the one hand, the abstract syntax tree AST (tree view) is decomposed from the CPG, and then the AST is used to build a graph based on the enhanced AST, and its features are extracted using GraphCodeBERT. On the other hand, the control flow graph and program dependency graph are extracted from the CPG, and the feature vector of the corresponding flow view is generated. Then, all the extracted feature vectors are feature spliced ​​to obtain a fused feature vector containing all the feature information. Finally, a trained CNN module is used to extract all the graph information contained in the fused feature vector, and the vulnerabilities contained therein are classified and detected.

[0070] Example 2

[0071] Based on the method of Example 1, this embodiment further provides a multi-view fusion source code logic vulnerability detection system, which is designed using the multi-view fusion source code logic vulnerability detection method of Example 1. The multi-view fusion source code logic vulnerability detection system provided in this embodiment is a computer program that, when running, can receive software source code to be detected, then use the method of Example 1 to transcode the software source code into a fused feature map, and then implement vulnerability detection using a trained CNN model.

[0072] Specifically, if Figure 4As shown, the multi-view fusion source code logic vulnerability detection system provided by this embodiment includes: a code acquisition unit, a CPG generation unit, a tree view generation unit, a flow view generation unit, a fusion feature generation unit and a vulnerability detection model. Among them, the code acquisition unit is used to obtain the source code of the software to be detected; the CPG generation unit uses a preset static analysis tool to generate a corresponding code attribute graph according to the input source code. The tree view generation unit is used to extract the corresponding nodes and edges from the code attribute graph, construct an abstract syntax tree AST, and then add three types of additional edges to the AST to obtain an enhanced syntax tree EAST as the required tree view. The flow view generation unit is used to extract the corresponding nodes and edges from the code attribute graph, and the constructed control flow graph CFG and program dependency graph PDG are used together as the required flow views.

[0073] The fusion feature generation unit uses a pre-trained code semantic encoding model to generate feature vectors corresponding to the tree view and flow view. It then performs average pooling and feature concatenation on the two to obtain the desired fused feature vector. The vulnerability detection model is trained using the aforementioned multi-view fusion source code logic vulnerability detection method using a CNN model. Based on the input fused feature vector, the vulnerability detection model generates and outputs a prediction of whether the corresponding software code has a vulnerability.

[0074] Example 3

[0075] Building on the previous embodiment, this embodiment further provides a source code logic vulnerability detection device using multi-view fusion, comprising a memory, a processor, and a computer program stored in the memory and executed by the processor. When the processor executes the computer program, it creates the aforementioned source code logic vulnerability detection system, thereby detecting vulnerabilities in the input software source code.

[0076] The multi-view fusion source code logic vulnerability detection device provided in this embodiment is essentially a computer device used to implement the solution in Example 1. The computer device can be a smart terminal capable of executing programs, a tablet computer, a laptop computer, a desktop computer, a rack server, a blade server, a tower server, or a cabinet server (including a standalone server or a server cluster consisting of multiple servers).

[0077] The computer device described in this embodiment includes at least, but is not limited to, a memory and a processor that can be interconnected via a system bus. The memory (i.e., a readable storage medium) includes flash memory, a hard disk, a multimedia card, a card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic storage, a magnetic disk, an optical disk, and the like. In some embodiments, the memory can be an internal storage unit of the computer device, such as the hard disk or internal memory of the computer device. In other embodiments, the memory can also be an external storage device of the computer device, such as a plug-in hard disk equipped with the computer device, a smart media card (SMC), a secure digital (SD) card, a flash memory card, and the like. Of course, the memory can also include both the internal storage unit of the computer device and its external storage devices. In this embodiment, the memory is generally used to store the operating system and various application software installed on the computer device. In addition, the memory can also be used to temporarily store various types of data that have been output or are about to be output.

[0078] In some embodiments, the processor may be a central processing unit (CPU), a graphics processing unit (GPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor is generally used to control the overall operation of the computer device. In this embodiment, the processor is used to run program code stored in the memory or process data.

[0079] Simulation test

[0080] In order to verify the performance and advantages of the multi-view fusion source code logic vulnerability detection method provided by the present invention, technicians developed an experimental plan and simulated and tested the relevant solutions. The test experiment content is as follows:

[0081] 1. Experimental Setup

[0082] This experiment used PyTorch 2.0.1 to implement the methods of this invention. The dataset used during the experiment was from REVEAL, which contains 20,494 non-vulnerable functions and 2,240 vulnerable functions. These programs come from two open source projects: the Linux Debian kernel and Chromium (Chrome's open source project). The Linux Debian kernel and Chromium (Chrome's open source project) are two popular and well-maintained public projects that represent a variety of security issues in two important programming domains: operating systems and browsers. Both projects have a large number of publicly available vulnerability reports.

[0083] In addition, the ratio of non-vulnerable and vulnerable functions in the dataset selected for this experiment is about 9:1, which is similar to the ratio of vulnerable programs to non-vulnerable programs in the real world. In addition, this experiment also uses the QEMU dataset and the SARD dataset (a project maintained by the National Institute of Standards and Technology (NIST) of the United States, which includes 12,303 vulnerable functions and 21,057 non-vulnerable functions).

[0084] During the training phase of the network model, the loss function uses cross entropy loss. The Adam optimizer is used to train CNN, and the learning rate is set to 0.001.

[0085] 2. Performance comparison test

[0086] To evaluate the real-world performance of our solution, this experiment also selected several state-of-the-art vulnerability detection methods as a control group for comparison with our solution. These control groups included Reveal, VulCNN, Design, SyseVR, VulDeepecker, and Russell et al. Our solution and the control group were tested on the REVEAL and Sard datasets, respectively. Four widely used metrics were used to evaluate the vulnerability detection performance of each solution: accuracy, precision, recall, and F1 score.

[0087] Accuracy refers to the proportion of all test cases correctly classified. Precision refers to the ratio of correctly predicted vulnerable samples to samples predicted as vulnerable. Recall refers to the ratio of correctly predicted vulnerable samples to all vulnerable samples. The F1 score evaluates the overall performance by taking into account both precision and recall.

[0088] In the performance control experiment, the performance of the present invention and other control solutions on the REVEAL dataset is shown in Table 1:

[0089] Table 1: Performance test results of different schemes on the REVEAL dataset

[0090]

[0091] Analyzing the data in the table, we find that our proposed method achieves 90.48% accuracy and 77.22% precision, respectively. Compared to the Reveal approach, our proposed method improves accuracy, precision, and F1 score by 8.71%, 45.67%, and 21.71%, respectively. However, in terms of recall, our proposed method is 7.47% lower than Reveal. This is due to the imbalance in the ratio of vulnerable and non-vulnerable functions in the Reveal dataset (vulnerable functions only account for 9% of all functions), the uneven number of test categories, and excessive data noise, resulting in poor recall performance. Compared to the design, our proposed method improves accuracy by 2.99%, precision by 45.67%, recall by 17.02%, and F1 score by 29.42%. Our method also exhibits significant advantages over the other two methods. In summary, our method achieves significant improvements on four widely used metrics compared to other state-of-the-art methods.

[0092] Furthermore, this experiment continued to compare the present invention with the control group on the Sard dataset, and the experimental data obtained are shown in Table 2:

[0093] Table 2: Performance test results of different schemes on the Sard dataset

[0094]

[0095] Analyzing the data in Table 2, it can be found that the solution of the present invention also has a more significant advantage on another dataset. In summary, compared with other state-of-the-art methods, the method of the present invention has made significant improvements in four widely used indicators. In all four indicators, the method of the present invention is almost superior to the token-based method (Russell et al.) and the slice + token-based method. This is because the graph-based model learns the semantic dependencies between each node along the way through various graphs, and the graph can highly retain the semantic and syntactic information of the code, which enables the graph-based pattern to make accurate predictions. However, the token- and slice-based methods cannot fully retain the semantic information of the program, which may cause the model to be unable to make correct predictions. Therefore, the graph-based method is significantly better than the slice- and token-based methods.

[0096] 3. Ablation Experiment

[0097] The technical solution provided by this invention includes two core elements: feature extraction and fusion of CPGs, and learning and training the extracted fused feature vectors using a CNN model. To investigate the contribution of these two elements to the outstanding performance achieved by the final solution, the following ablation experiments were conducted.

[0098] 3.1: Different feature extraction methods

[0099] This experiment uses two methods to process CPG and compares them to explore the impact of the tree view + stream view CPG processing method adopted by the present invention on the performance of the solution.

[0100] First, in the experiment of the present invention, the source code was standardized according to the design method and converted into a CPG graph using the Joern tool. Then, the CPG was split to obtain the required abstract syntax tree, control flow graph, and code dependency graph. The abstract syntax tree was enhanced into a graph based on the enhanced abstract syntax tree using the corresponding rules. As the tree view of the present invention, the present invention uses the pre-trained GraphCodeBERT for feature extraction and vector embedding. The control flow graph and program dependency graph are used as the flow view part, and the present invention uses CodeBERT for embedding. Finally, the tree view and flow view vectors are fused using the vector fusion method and sent to the CNN for training and prediction.

[0101] In the second experiment, we used a method that did not split the CPG. After obtaining the source code attribute map using the Joern tool, we directly used CodeBERT to extract features and embed the vectors into the CPG without extracting the tree view and flow view. The obtained source code feature vectors were then sent to a CNN with the same parameter configuration for training and prediction.

[0102] In this experiment, the final performance test results of the two solutions are as follows: Figure 5 Analysis Figure 5 The data shows that in the first 100 rounds of training and prediction on the Sard dataset, the method of the present invention outperforms the traditional CPG processing method in terms of efficiency and accuracy. This proves that the method of extracting feature information from CPG in the present invention is superior to the traditional method in terms of efficiency and accuracy.

[0103] The present invention achieves this advantage because CPG contains a large amount of code semantics and syntactic information. If CPG is simply vector-embedded and sent to CNN for feature learning and training, it will be difficult for the model to extract features related to the vulnerability function from a large amount of irrelevant and complex information, resulting in low model efficiency and accuracy. The present invention classifies and extracts the tree view and flow view in CPG, embeds them into vectors, and inputs them into the model. This is equivalent to simply classifying the semantic and syntactic features of the code and then inputting them into the model. This will make it easier for the model to extract relevant features and improve the efficiency and accuracy of vulnerability detection.

[0104] 3.2: Different neural network models

[0105] This experiment used the same method to study the different effects of using different training models on the vulnerability detection performance of the final solution. Specifically, this experiment studied two widely used classifier models: convolutional neural networks (CNNs) and multilayer perceptrons (MLPs). For the CNN model, this experiment used a model with 10 convolutional filter layers and 128 hidden layers. For the MLP model, this experiment used a network model with 3 fully connected layers (i.e., linear layers) and 2 ReLU activation layers. Finally, a sigmoid activation layer was used to output the results as binary classification.

[0106] This experiment uses the same process to process source code on the Sard and Qemu datasets. After using the same feature extraction method to obtain the feature vectors of the source code, these feature vectors are fed into the CNN classifier and the MLP classifier for feature learning and training. The final performance of the solution is as follows: Figure 6 shown.

[0107] analyze Figure 6 It can be seen from the data that the results of training and prediction using the CNN model are slightly better than those of the MLP model overall. The CNN model seems to be more balanced in the overall value of the evaluation indicators, while the MLP model shows polarization in the evaluation indicators of the SARD dataset (i.e., higher accuracy but lower recall).

[0108] Analysis shows that the reason for the above phenomenon is that the structure of the MLP model is relatively simple, which makes it easy to fall into local minima and unable to find the global optimal solution. In addition, the fully connected layer of the MLP ensures that each neuron is connected to all neurons in the previous layer, making it impossible to utilize the local features of the data. CNN can extract local features through local connections and weight sharing, which is impossible for MLP. In addition, the difficulty of the MLP model in processing high-dimensional data may also be one of the reasons. According to the experimental results, in practical applications, CNN should be selected as the network model required for feature training and classification in the present invention.

[0109] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A multi-view fusion source code logic vulnerability detection method, characterized by: It includes the following steps: S1: Encode the software source code into a fused feature vector containing feature information from the tree view and the stream view. The process includes: S11: Generate a code property graph CPG based on the software source code; S12: Extract the corresponding edges and nodes from CPG and construct them into abstract syntax tree AST, control flow graph CFG and program dependency graph PDG respectively; S13: According to a preset rule, additional edges representing return, loop and jump operations are added between nodes in the abstract syntax tree AST, thereby obtaining an enhanced syntax tree EAST; S14: Use the enhanced syntax tree EAST as a tree view and generate the corresponding tree view features through the pre-trained code semantic encoding model; S15: Use the control flow graph (CFG) and program dependency graph (PDG) as flow views, and generate corresponding flow view features through the pre-trained code semantic encoding model; S16: performing average pooling on the feature vectors of the tree view and the stream view, and then concatenating them to obtain a desired fused feature vector; S2: Obtain the fused feature vector converted from the software code, manually add label information indicating whether there is a vulnerability as sample data, and then form the required sample data set; S3: Select cross entropy loss as the loss function, divide the sample data set into training set and test set, and use it to train and test a CNN model, saving the model parameters of the network model that meets the performance index requirements; S4: The saved network model is used as a vulnerability detection model, and the software source code to be identified is encoded into a corresponding fusion feature vector and then input into the vulnerability detection model, thereby realizing vulnerability detection.

2. The multi-view fusion source code logic vulnerability detection method according to claim 1, characterized in that: In step S11, the software source code is converted into a corresponding code property graph CPG using the source code-based static analysis tool joern.

3. The method for detecting source code logic vulnerabilities by multi-view fusion according to claim 2, wherein: In step S13, relative to the abstract syntax tree AST, the additional edges added to the enhanced syntax tree EAST include: (1) Connect the return node in the AST and the function name node, which is recorded as the return edge RETURN TO; (2) Add a serial edge between the nodes corresponding to all variables in the same line of code statement, which is recorded as the inter-layer cascade edge NEXT_TOKEN; (3) Add a reverse edge between all nodes corresponding to the original edges and inter-layer cascade edges.

4. The method for detecting source code logic vulnerabilities by multi-view fusion according to claim 3, wherein: In step S14, the feature vector of the tree view is generated by the pre-trained GraphCodeBERT; in step S15, the feature vector of the flow view is generated by the pre-trained CodeBERT.

5. The method for detecting source code logic vulnerabilities by multi-view fusion according to claim 4, characterized in that: In step S15, CodeBERT is used to extract the features of CFG and PDG respectively, and then the features of the two are concatenated to form the feature vector of the flow view.

6. The method for detecting source code logic vulnerabilities by multi-view fusion according to claim 5, wherein: The feature vector of the tree view after average pooling in step S16 is 1*768 dimensional; the feature vector of the stream view is 2*768 dimensional; and the fused feature vector is 3*768 dimensional.

7. The method for detecting source code logic vulnerabilities by multi-view fusion according to claim 6, wherein: In step S3, the CNN model includes 10 convolutional filter layers and 128 hidden layers, and uses ReLU as the activation function.

8. The method for detecting source code logic vulnerabilities by multi-view fusion according to claim 7, wherein: In step S4, the fused feature vector is divided into three channels and simultaneously input into the vulnerability detection model, and the vulnerability detection model is used to output a prediction result of whether the software source code corresponding to the fused feature vector contains a vulnerability.

9. A multi-view fusion source code logic vulnerability detection system, characterized by: The method is designed based on the multi-view fusion source code logic vulnerability detection method according to any one of claims 1 to 8; the multi-view fusion source code logic vulnerability detection system comprises: A code acquisition unit, which is used to obtain the source code of the software to be tested; A CPG generation unit, which uses a preset static analysis tool to generate a corresponding code property graph based on the input source code; A tree view generation unit is used to extract corresponding nodes and edges from the code attribute graph, construct an abstract syntax tree (AST), and then add three types of attachment edges to the AST to obtain an enhanced syntax tree (EAST) as the required tree view; A flow view generation unit is used to extract corresponding nodes and edges from the code attribute graph, and construct a control flow graph CFG and a program dependency graph PDG as the required flow view; A fusion feature generation unit is used to generate feature vectors corresponding to the tree view and the stream view using a pre-trained code semantic encoding model, and perform average pooling and feature concatenation on the two to obtain the required fusion feature vector; A vulnerability detection model is obtained by training a CNN model using the multi-view fusion source code logic vulnerability detection method described in any one of claims 1 to 8; the vulnerability detection model is used to generate a prediction result of whether the corresponding software code has a vulnerability based on the input fusion feature vector and output it.

10. A multi-view fusion source code logic vulnerability detection device, comprising a memory, a processor, and a computer program stored in the memory and executed in the processor, characterized in that: When the processor executes the computer program, it creates the source code logic vulnerability detection system as claimed in claim 9, thereby detecting whether there are vulnerabilities in the input software source code.

Images