Security analysis method and device, electronic equipment, medium and program product

Abstract

The invention provides a security analysis method in a software research and development process. The security analysis method can be applied to the technical field of big data and the technical field of artificial intelligence. The method comprises the following steps: embedding a security analysis plug-in in an integrated development environment; scanning codes written by a user in the integrated development environment in real time through safety rule information preset in the safety analysis plug-in and a heuristic algorithm; identifying a target security problem in response to the security analysis plug-in, marking the target security problem by using the security analysis plug-in, and providing repair suggestion information; and responding to the condition that the user modifies the code based on the repair suggestion information, and utilizing the security analysis plug-in to re-scan the modified code to verify the modification effect.

Description

Technical Field

[0001] The present disclosure relates to the fields of big data technology and artificial intelligence, and more specifically to a security analysis method, device, equipment, medium and program product in a software development process. Background Art

[0002] As the scale and complexity of software development continue to increase, security in the software development process has gradually become a focus of attention in various industries. Traditional software development processes usually use a combination of static code analysis and manual security audits to detect and fix security vulnerabilities in the code. However, traditional static code analysis tools require developers to manually trigger them after the code is written, and cannot achieve real-time detection and feedback during the development process.

[0003] To solve the above problems, the existing technology has proposed a software security R&D platform based on a full lifecycle management architecture, which integrates R&D task management tools and security testing tools. However, the existing technology lacks an immediate detection and feedback mechanism, and security issues are often discovered in the late stages of development, resulting in high cost of problem repair. In addition, developers need to frequently switch between multiple systems, which increases operational complexity and reduces R&D efficiency. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a security analysis method, apparatus, device, medium and program product in the software development process.

[0005] According to a first aspect of the present disclosure, a security analysis method in a software development process is provided, including: obtaining requirement information input by a user, the requirement information including application requirement information and level requirement information; based on the application requirement information, generating preliminary recommendation results using a generative artificial intelligence content algorithm in combination with a pre-built security requirement knowledge graph library; based on the application requirement information, the level requirement information and the preliminary recommendation results, performing multi-level matching using a security requirement grading model to generate intermediate recommendation results; and displaying the intermediate recommendation results through a user interface, and generating security analysis results in the software development process in response to user interaction operations.

[0006] According to an embodiment of the present disclosure, before software development, the method also includes: establishing a security asset database, the security asset database including security asset information; obtaining demand data of the target software development project, using big data analysis technology to match and analyze the demand data and the security asset information to obtain candidate security assets; and performing risk assessment and preferential ranking of the candidate security assets through a recommendation model to provide a list of security assets that meet the security requirements of the target software development project.

[0007] According to an embodiment of the present disclosure, the method also includes: training an intelligent question and answer model based on a pre-built security specification knowledge base using natural language processing technology; and in response to obtaining security question information input by a user, calling the intelligent question and answer model to parse the security question information, matching the security specification information in the security specification knowledge base, so as to generate explanation suggestion information corresponding to the security question information.

[0008] According to an embodiment of the present disclosure, the real-time scanning of the code written by the user in the integrated development environment based on preset security rule information and heuristic algorithm specifically includes: loading a configuration file containing security rule information, initializing a scanning rule set based on the configuration file; expanding the scanning rule set based on the heuristic algorithm; and using the expanded scanning rule set to perform incremental scanning on the code.

[0009] According to an embodiment of the present disclosure, the heuristic algorithm-based expansion of the scanning rule set specifically includes: analyzing the context information of the code, wherein the context information includes variable dependencies, data flow paths, and call stacks; based on the analysis results, using heuristic algorithms to perform inference and pattern recognition to predict security vulnerabilities in the code; and dynamically generating supplementary rule data based on the prediction results to expand the scanning rule set.

[0010] According to an embodiment of the present disclosure, the security rule information includes static code rule information, and the real-time scanning of the code written by the user in the integrated development environment also includes: using the static code rule information to parse the code and the context information of the code line by line.

[0011] According to an embodiment of the present disclosure, the use of the static code rule information to parse the code and the context information of the code line by line specifically includes: using data flow analysis technology to track variable dependencies and data flow paths in the code; and detecting structured query language injection vulnerabilities in the variable flow process based on variable dependencies and data flow paths to obtain a first detection result.

[0012] According to an embodiment of the present disclosure, the code and the context information of the code are parsed line by line using the static code rule information, specifically including: parsing the call stack of the code using control flow analysis technology; and detecting the risk of cross-site scripting attacks in the control flow based on the parsing result of the call stack of the code to obtain a second detection result.

[0013] According to an embodiment of the present disclosure, the rescanning using the security analysis plug-in to verify the modification effect specifically includes: performing a differential scan on the modified code; comparing the result of the differential scan with the repair suggestion information to verify the repair status of the target security issue; and determining the modification effect based on the repair status.

[0014] A second aspect of the present disclosure provides a security analysis device in a software development process, including: an embedding module, used to embed a security analysis plug-in in an integrated development environment; a real-time scanning module, used to perform real-time scanning of codes written by users in the integrated development environment through security rule information and heuristic algorithms preset in the security analysis plug-in; a repair suggestion providing module, used to, in response to the security analysis plug-in identifying a target security issue, mark the target security issue using the security analysis plug-in and provide repair suggestion information; and a rescanning module, used to, in response to the user modifying the code based on the repair suggestion information, rescan the modified code using the security analysis plug-in to verify the modification effect.

[0015] According to an embodiment of the present disclosure, the repair suggestion providing module may include a question and answer module, and the question and answer module may include an intelligent question and answer model unit and a suggestion generating unit.

[0016] According to an embodiment of the present disclosure, the intelligent question-answering model unit can be used to perform semantic analysis and contextual understanding of the application requirement information using a generative artificial intelligence algorithm to obtain semantic features of user requirements.

[0017] According to an embodiment of the present disclosure, the suggestion generation unit can be used to respond to obtaining security question information input by a user, call the intelligent question and answer model to parse the security question information, match the security specification information in the security specification knowledge base, and generate explanation suggestion information corresponding to the security question information.

[0018] According to an embodiment of the present disclosure, the real-time scanning module can also be used to load a configuration file containing security rule information, initialize a scanning rule set based on the configuration file; expand the scanning rule set based on a heuristic algorithm; and use the expanded scanning rule set to perform incremental scanning on the code.

[0019] According to an embodiment of the present disclosure, the real-time scanning module can also be used to analyze the context information of the code, wherein the context information includes variable dependencies, data flow paths, and call stacks; based on the analysis results, heuristic algorithms are used for inference and pattern recognition to predict security vulnerabilities in the code; and supplementary rule data is dynamically generated based on the prediction results to expand the scanning rule set.

[0020] According to an embodiment of the present disclosure, the real-time scanning module may also be used to parse the code and the context information of the code line by line using the static code rule information.

[0021] According to an embodiment of the present disclosure, the real-time scanning module can also be used to utilize data flow analysis technology to track variable dependencies and data flow paths in the code; and to detect structured query language injection vulnerabilities in the variable flow process based on variable dependencies and data flow paths to obtain a first detection result.

[0022] According to an embodiment of the present disclosure, the real-time scanning module can also be used to utilize control flow analysis technology to parse the call stack of the code; and based on the parsing result of the call stack of the code, detect the risk of cross-site scripting attack in the control flow to obtain a second detection result.

[0023] According to an embodiment of the present disclosure, the repair suggestion providing module can also be used to perform differential scanning on the modified code; compare the results of the differential scanning with the repair suggestion information to verify the repair status of the target security issue; and determine the modification effect based on the repair status.

[0024] According to an embodiment of the present disclosure, the security analysis device may further include a security asset providing module, and the security asset providing module may include an asset library establishing unit, a candidate security asset acquiring unit, and a providing unit.

[0025] According to an embodiment of the present disclosure, the asset library establishing unit may be used to establish a secure asset database, and the secure asset database includes secure asset information.

[0026] According to an embodiment of the present disclosure, the candidate security asset acquisition unit can be used to acquire demand data of a target software development project, and use big data analysis technology to match and analyze the demand data and the security asset information to obtain candidate security assets.

[0027] According to an embodiment of the present disclosure, the providing unit may be used to perform risk assessment and preferential ranking on the candidate security assets through a recommendation model, and provide a list of security assets that meet the security requirements of the target software development project.

[0028] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0029] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0030] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor.

[0031] According to the embodiments of the present disclosure, problem repair is embedded in the development process by real-time detection and provision of repair suggestions during the coding process, thereby reducing the large amount of computing resources required for centralized operation of security analysis tools in the later stage, and facilitating efficient security analysis in the development stage; the security analysis function is integrated into the integrated development environment through a plug-in, and interacts directly with the development environment without the need for additional external tool calls, which greatly reduces the performance overhead of data transmission and multiple parsing between systems; developers can receive real-time security prompts and repair suggestions in the integrated development environment, avoiding the tedious operation of switching tools and improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0033] Figure 1 A schematic diagram showing an application scenario of a security analysis method, apparatus, device, medium, and program product in a software development process according to an embodiment of the present disclosure;

[0034] Figure 2 A flowchart schematically shows a security analysis method in a software development process according to an embodiment of the present disclosure;

[0035] Figure 3 A flowchart of a method for providing explanation suggestion information of a question and answer according to an embodiment of the present disclosure is schematically shown;

[0036] Figure 4 A flowchart of a method for providing secure assets according to an embodiment of the present disclosure is schematically shown;

[0037] Figure 5 A schematic diagram showing a structural block diagram of a security analysis device in a software development process according to an embodiment of the present disclosure; and

[0038] Figure 6 A block diagram of an electronic device suitable for implementing a security analysis method in a software development process according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0039] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0040] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0041] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0042] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0043] First, the technical terms described in this article are explained and described as follows.

[0044] An Integrated Development Environment (IDE) is a comprehensive tool platform for software development that integrates code editors, debuggers, compilers / interpreters, and other development-aiding tools into a unified user interface, providing developers with a convenient development experience.

[0045] Static code analysis: A method of discovering potential problems by analyzing the syntax and structure of source code before the software is compiled or run. It is usually used to detect security vulnerabilities, performance issues, and code standards.

[0046] Heuristic algorithm: An algorithm that quickly solves complex problems through empirical rules and approximation methods, usually used to reduce the search space or speed up the problem-solving process.

[0047] Differential scanning: A method that performs incremental detection only on the modified parts of the code, avoiding repeated scanning of the unmodified parts, saving computing resources and improving detection efficiency.

[0048] Big data analysis technology: technology for processing and analyzing large-scale data, using methods such as data mining, pattern recognition and machine learning to extract valuable features and rules from it.

[0049] Shifting security issues left: refers to a strategy of proactively discovering and resolving security issues in the early stages of software development (such as requirements analysis and code writing) to reduce repair costs and risks.

[0050] With the rapid development of software development technology and the complexity of application scenarios, software security issues have become an important factor affecting software quality and corporate competitiveness. In the process of software development, traditional security assurance methods usually rely on centralized detection and repair in the later stages of development, mainly through static code analysis tools and manual testing. This method is not only labor-intensive and inefficient, but also security issues discovered in the later stages of development often lead to higher repair costs and time delays. In addition, traditional methods lack real-time detection mechanisms during the development process, and security issues may lurk for a long time in the development stage, further increasing the risk of software systems.

[0051] In recent years, in order to improve the security of the software development process, some technical solutions have begun to explore the method of full life cycle management, by introducing security testing and evaluation mechanisms in multiple stages of software development to reduce the probability of security problems. For example, Document 1 (CN112016101A) provides a method and system for dynamically evaluating and improving software development security capabilities. This solution is based on a software security development platform based on a full life cycle management architecture, which integrates R&D task management tools and security testing tools, and realizes collaboration between different tools through data interface communication. The platform can dynamically obtain the task assignment information and security vulnerability data of R&D personnel to evaluate their R&D security capabilities, and push targeted learning materials when the capabilities are insufficient. However, although this solution has improved some limitations of traditional methods, it still has significant problems in practical applications.

[0052] First, the complexity of multi-system interaction in existing technologies is high. Developers need to frequently switch between different systems and tools, which increases the threshold for use and the complexity of operation, affecting R&D efficiency; second, the solution lacks a real-time detection and feedback mechanism, and fails to quickly locate and solve security issues in the development stage, which may cause security issues to continue to the later stage, increasing the difficulty of repair; third, the technology does not support "security issues left shift", and its main detection and repair functions are still concentrated in the later stage of development, making it difficult to give full play to the advantages of full life cycle management; finally, the existing technology does not consider the standardized management of enterprise-level security asset libraries and the improvement of asset reuse rates, and fails to effectively support the efficient use of security components and specifications in large-scale enterprise projects.

[0053] Based on this, an embodiment of the present disclosure provides a security analysis method in the software development process, the method comprising: embedding a security analysis plug-in in an integrated development environment; scanning the code written by the user in the integrated development environment in real time through the security rule information and heuristic algorithm preset in the security analysis plug-in; in response to the security analysis plug-in identifying the target security problem, marking the target security problem with the security analysis plug-in and providing repair suggestion information; and in response to the user modifying the code based on the repair suggestion information, rescanning the modified code with the security analysis plug-in to verify the modification effect. The security analysis method in the software development process provided by the present disclosure embeds the problem repair into the development process by real-time detection and providing repair suggestions during the coding process, reducing the large amount of computing resources required for the centralized operation of the security analysis tool in the later stage, and helping to complete efficient security analysis in the development stage; the security analysis function is integrated into the integrated development environment through the plug-in, interacting directly with the development environment, without the need for additional external tool calls, greatly reducing the performance overhead of data transmission and multiple parsing between systems; developers can receive real-time security prompts and repair suggestions in the integrated development environment, avoiding the cumbersome operation of switching tools, and improving the user experience.

[0054] It should be noted that the security analysis method, device, equipment, medium and program product in the software development process determined in the present disclosure can be used in the fields of big data technology and artificial intelligence technology, and can also be used in various fields other than the fields of big data technology and artificial intelligence technology. The application field of the security analysis method, device, equipment, medium and program product in the software development process provided by the embodiments of the present disclosure is not limited.

[0055] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0056] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0057] Figure 1 The application scenario diagram of the security analysis method, apparatus, device, medium and program product in the software development process according to the embodiment of the present disclosure is schematically shown.

[0058] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0059] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0060] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0061] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0062] It should be noted that the security analysis method in the software development process provided by the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the security analysis device in the software development process provided by the embodiment of the present disclosure can generally be set in the server 105. The security analysis method in the software development process provided by the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the security analysis device in the software development process provided by the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0063] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0064] The following will be based on Figure 1 The scene described by Figure 2 to Figure 4 The security analysis method in the software development process of the disclosed embodiment is described in detail.

[0065] Figure 2 The flowchart of the security analysis method in the software development process according to the embodiment of the present disclosure is schematically shown.

[0066] like Figure 2 As shown, the security analysis method in the software development process of this embodiment includes operations S210 to S240, and the transaction processing method can be executed by the server 105.

[0067] In operation S210, a security analysis plug-in is embedded in an integrated development environment (IDE). By embedding a security analysis plug-in in an integrated development environment, a secure development environment can be constructed. Specifically, the integrated development environment is a core tool for developers to write, debug, and test codes. By embedding a security analysis plug-in to construct a secure development environment, it not only has basic code editing functions, but also has real-time security detection capabilities, so that security management can be deeply integrated with the software development process, and the ability to discover and solve security problems early can be enhanced.

[0068] In the embodiments of the present disclosure, the security analysis plug-in may include a front-end user interaction module, a static code analysis module, a context information parsing module, a heuristic algorithm module, and a dynamic rule management module, etc. The security analysis plug-in may be integrated with an IDE, and as a built-in extension component of the IDE, its front-end user interaction module is responsible for presenting detection results and repair suggestions to developers in an intuitive manner, so that the coding behavior of developers can be monitored in real time, and security analysis can be started while developers are writing code, ensuring that problems are discovered and resolved at an early stage, thereby promoting the left shift of security issues.

[0069] Specifically, the front-end user interaction module can be responsible for presenting the detection results and repair suggestions to the developers in an intuitive manner; the static code analysis module is used to load the preset security rule information library, parse the code line by line and match it with the rule library to detect common high-risk vulnerabilities; the context information parsing module can be responsible for analyzing and identifying potential hidden security issues; the heuristic algorithm module can infer and pattern recognize potential security issues of the code based on the analysis results of the context information; the dynamic rule management module can support dynamic updating and expansion of the rule library, and can generate new detection rules based on the prediction results of the heuristic algorithm and load them into the scanning process in real time.

[0070] Hereinafter, the embodiments of the present disclosure will be described in detail in conjunction with the functions of the security analysis plug-in.

[0071] In operation S220, the code written by the user in the integrated development environment is scanned in real time by the security rule information and heuristic algorithm preset in the security analysis plug-in. Specifically, the security analysis plug-in can combine the preset multi-level security rule information and heuristic algorithm to load, expand and apply the scanning rule set in real time to achieve high efficiency and comprehensiveness of code vulnerability detection.

[0072] In an embodiment of the present disclosure, a method for performing real-time scanning may include: loading a configuration file containing security rule information, initializing a scanning rule set based on the configuration file; expanding the scanning rule set based on a heuristic algorithm; and performing incremental scanning on the code using the expanded scanning rule set.

[0073] In an embodiment of the present disclosure, the security analysis plug-in can complete the initialization of the scanning rule set by loading a configuration file containing security rule information. The preset security rule information can be defined by enterprise security standards and industry best practices, covering a variety of high-risk security vulnerabilities such as structured query language injection (SQL injection), cross-site scripting (XSS), uncaught exceptions, and hard-coded passwords. Among them, SQL injection is a common network security vulnerability. The attacker inserts malicious SQL statements into the input field of the application to make the database perform unexpected operations, usually because the application does not properly filter or escape special characters when processing user input; XSS is a network security vulnerability. The attacker injects malicious script code into the web page, causing the script to be executed in the user's browser. This attack is often used to steal sensitive user information, forge user operations, or spread malicious code.

[0074] Furthermore, security rule information can be dynamically filtered and loaded according to project requirements to ensure the pertinence and efficiency of the scan. For example, in code scenarios related to database operations, the security analysis plug-in can prioritize loading rules related to SQL injection detection; and when processing front-end interactive code, the security analysis plug-in can prioritize adding XSS attack detection rules.

[0075] After completing the initialization of the scanning rule set, the security analysis plug-in can dynamically expand the scanning rule set using a heuristic algorithm. Specifically, the heuristic algorithm can predict potential security issues and generate supplementary rules by analyzing the context information of the code, including variable dependencies, data flow paths, and call stack structures.

[0076] According to the embodiments of the present disclosure, context information analysis can capture dynamic behaviors during code execution, such as the transfer relationship of variables between different functions or modules, the hierarchy and order of function calls, etc.

[0077] Based on the analysis results of context information, the security analysis plug-in can use heuristic algorithms to infer and identify patterns of potential security vulnerabilities in the code. The heuristic algorithm compares the security patterns of the existing rule base and combines the dynamic features in the context information to infer possible hidden security issues. For example, when there is a cross-module call in the process of passing variables but there is a lack of verification, the heuristic algorithm can infer that it may cause SQL injection risks; when the call stack shows that a function call has not been fully handled, the algorithm can infer that there is a potential risk of program crash.

[0078] Furthermore, heuristic algorithms can also combine variable dependencies and complex interactions in data flow paths to identify atypical risks in the code through pattern recognition technology, such as hidden vulnerabilities in dynamically generated SQL statements or uncovered security boundaries in conditional branches. Through this inference, heuristic algorithms can discover new or complex security issues that are difficult to cover with traditional static rule bases.

[0079] In an embodiment of the present disclosure, supplementary rule data may be dynamically generated based on the prediction results of the heuristic algorithm to expand the scanning rule set.

[0080] Specifically, the generation process of supplementary rules can include extracting key features from predicted vulnerabilities, defining detection conditions, and dynamically loading them into the scanning rule set. For example, when the heuristic algorithm predicts that a piece of code may have an XSS risk, the supplementary rules can verify whether the relevant output has been securely encoded; if it is predicted that a variable is used to construct an SQL query without verification, the generated rules can focus on detecting whether the variable has been parameterized.

[0081] According to the embodiments of the present disclosure, the adaptability of the security analysis plug-in to complex code scenarios can be significantly enhanced through the combination of context information analysis, heuristic algorithm prediction and dynamic rule generation. On the one hand, the multi-dimensional analysis of context information provides comprehensive code execution environment data, laying the foundation for vulnerability detection; on the other hand, the predictive ability of the heuristic algorithm makes up for the shortcomings of the traditional static rule base and can discover hidden problems in complex scenarios; in addition, the dynamically generated supplementary rules further improve the coverage of the rule set, making the scanning process both efficient and flexible.

[0082] After completing the expansion of the rule set, the security analysis plug-in can use the expanded scanning rule set to perform incremental scanning on the code. Specifically, incremental scanning is an efficient incremental detection method that focuses on the code parts that are newly added or modified by the user. The security analysis plug-in can capture the changes in the code in real time and only apply the expanded rule set to scan these changed areas, avoiding the waste of resources of full scanning.

[0083] For example, when a user adds a new code to process user input, the security analysis plug-in can instantly analyze the logic of the new code and detect whether there is a risk of SQL injection or cross-site scripting attack in combination with the expanded rule set.

[0084] According to the embodiments of the present disclosure, incremental scanning not only improves the real-time performance of scanning, but also significantly reduces the consumption of computing resources, so that the security analysis plug-in can continuously and efficiently detect security issues during the development process. In addition, the results of incremental scanning can be fed back to developers in real time to help them quickly locate and fix problems, further promoting the early discovery and resolution of security issues in the development stage.

[0085] Furthermore, in the process of real-time scanning of the code written by the user in the integrated development environment, it may also include: parsing the code and the context information of the code line by line using the static code rule information included in the security rule information.

[0086] Specifically, data flow analysis technology can be combined to track variable dependencies and data flow paths in the code. Variable dependency analysis focuses on the relationship between variable definition, assignment, and use, and can clearly describe the source of the variable and its interaction with other variables. For example, if a variable comes directly from user input, its subsequent flow in the code can be tracked to determine whether it has undergone necessary security processing.

[0087] The analysis of data flow paths can further expand the scope of variable dependencies, covering the transfer paths of variables in function calls, module interactions, and conditional branches, thereby revealing data flow behaviors across modules or under complex logic. For example, when a variable is directly embedded in an SQL query statement without verification, data flow analysis can accurately locate the path where the problem occurs and the scope of impact. Based on the analysis of data flow paths, the security analysis plug-in can detect SQL injection vulnerabilities in the process of variable flow and record them as the first detection result. Based on the first detection result, detailed risk descriptions and repair suggestions can be provided later.

[0088] In an embodiment of the present disclosure, the security analysis plug-in can also use control flow analysis technology to parse the call stack structure of the code. The call stack describes the call hierarchy and order of the function, reflecting the execution path and control relationship of the code logic. By parsing the call stack, the security analysis plug-in can capture potential problems in complex call chains, such as unhandled exceptions, resource leaks, or security risks in data transfer between functions. In addition, control flow analysis can also combine conditional branches and loop structures to comprehensively parse the logical flow path of the code. For example, when user input in the code is directly embedded into the HTML output without security coding processing, the security analysis plug-in can locate the risk source through the analysis of the call stack and generate relevant detection results of XSS attacks. Based on the results of the control flow analysis, the security analysis plug-in can mark the risk of cross-site scripting attacks in the control flow and record it as a second detection result. Based on the second detection result, detailed risk descriptions and repair suggestions can also be provided later.

[0089] It should be noted that the embodiments of "combining data flow analysis technology to track variable dependencies and data flow paths in the code" and "using control flow analysis technology to parse the call stack structure of the code" here can be flexibly selected to be used alone or in combination to meet the needs of different application scenarios.

[0090] For example, when detecting SQL injection vulnerabilities, data flow analysis technology is sufficient to locate problems in the variable flow path without the need for complex call stack parsing; while when detecting XSS attacks or logical vulnerabilities, control flow analysis technology can better capture potential risks in the execution path. However, in some complex scenarios, the combination of these two technologies can significantly improve the comprehensiveness and accuracy of detection. For example, when variables flow in multiple layers of function calls and are controlled by conditional branches or loop logic at the same time, using only data flow analysis or control flow analysis may not cover all risk points. By combining the two technologies, the dependencies and logical control paths of variables can be analyzed at the same time, thereby fully revealing potential security risks.

[0091] In operation S230 , in response to the security analysis plug-in identifying a target security issue, the security analysis plug-in is used to mark the target security issue and provide repair suggestion information.

[0092] Specifically, when the security analysis plug-in detects a target security issue through real-time scanning or incremental scanning, the marking and prompting mechanism can be immediately activated. In this process, the security analysis plug-in can directly highlight or otherwise significantly mark the problematic code in the IDE's code window, such as visually marking the code lines or variables with potential risks in different colors. The visual marking method can intuitively show developers the specific location of the problem, making it easier to quickly understand and operate.

[0093] In an embodiment of the present disclosure, the security analysis plug-in can generate a detailed description for each marked security issue, including the type of issue, risk level, and its potential impact on the system. For example, for a detected SQL injection vulnerability, the security analysis plug-in can describe how the vulnerability may lead to database data leakage or malicious tampering.

[0094] Furthermore, the security analysis plug-in can provide targeted repair suggestion information for each target security issue based on the preset rule base and context information analysis. Specifically, the repair suggestion can include the repair method of the problem and sample code or actionable steps. For example, for SQL injection problems, the security analysis plug-in can suggest developers to use parameterized queries and provide code templates on how to implement parameterized queries; for XSS attacks and XSS risks, the security analysis plug-in can suggest HTML encoding of the output and provide specific examples of using the encoding function.

[0095] In addition, the embodiments of the present disclosure also provide an intelligent question-and-answer system based on a security specification knowledge base and natural language processing technology to provide developers with convenient and immediate security support and improve security awareness and efficiency in the software development process.

[0096] Figure 3The flowchart of the method for providing explanation suggestion information of questions and answers according to an embodiment of the present disclosure is schematically shown.

[0097] like Figure 3 As shown, the method for providing explanation suggestion information of a question and answer in this embodiment may include operations S310 to S320.

[0098] In operation S310, an intelligent question-answering model is trained using natural language processing technology based on a pre-built security specification knowledge base.

[0099] The security specification knowledge base can be a highly structured collection of information that covers a wide range of security standards and best practices, industry security specifications, and internal corporate security policies and implementation guidelines. The security specification knowledge base can be systematically organized and classified to break down security standards into specific items and rules to ensure that it can fully cover security issues that may be encountered in software development. For example, the security specification knowledge base can include specific steps for SQL injection protection, defense strategies for XSS attacks, and best practices for user data encryption. In addition, the security specification knowledge base can be further updated regularly based on industry trends and corporate needs to ensure the timeliness and applicability of the content.

[0100] Based on the security specification knowledge base, the natural language processing technology (NLP) can be used to train the intelligent question-answering model. The training of the intelligent question-answering model can include semantic understanding, feature extraction, and question-answer matching. As a result, the intelligent question-answering model can accurately parse complex user questions and extract the core semantics of the questions.

[0101] In operation S320, in response to obtaining the security question information input by the user, the intelligent question-answering model is called to parse the security question information, and the security specification information in the security specification knowledge base is matched to generate explanation suggestion information corresponding to the security question information.

[0102] During operation, the intelligent question-answering system can respond to security question information input by users and parse the user input by calling the intelligent question-answering model to match the security specification information in the knowledge base.

[0103] Specifically, when a user enters a question or keyword, the system can first use the intelligent question-answering model to perform word segmentation, semantic understanding, and intent analysis on the input to extract the core content of the question. For example, for the question "How to prevent cross-site scripting attacks?", the system can identify the core intent as "preventing XSS attacks." Furthermore, the system can search for matching security specification entries in the knowledge base based on the extracted core content, and generate explanation suggestion information corresponding to the user's question. Feedback can be given to the user in a friendly form. The explanation suggestion information may include a specific description of the security specification, implementation suggestions, and auxiliary content such as sample code.

[0104] For example, for the protection against SQL injection, the system can return the following information: "Best practices for preventing SQL injection include: 1) using parameterized queries to avoid directly concatenating user input; 2) strictly validating and filtering user input; 3) limiting database user permissions; 4) performing regular security audits." In addition, the system can also provide more detailed content based on user needs, such as directly returning code examples or citing relevant security standard sections.

[0105] Return to reference Figure 2 In operation S240, in response to the user modifying the code based on the repair suggestion information, the modified code is rescanned using the security analysis plug-in to verify the modification effect. Specifically, the modified code can be differentially scanned; the result of the differential scan is compared with the repair suggestion information to verify the repair status of the target security issue; and the modification effect is verified based on the repair degree.

[0106] According to an embodiment of the present disclosure, differential scanning performs incremental detection on the modified code portion, rather than performing a full scan of the entire code base. Through differential scanning, the security analysis plug-in can accurately capture the parts that developers have added or adjusted in the code, and focus on detecting whether these areas introduce new security issues or whether previous vulnerabilities have been successfully fixed. For example, when developers modify the user input processing logic to solve the SQL injection problem, differential scanning will focus on the relevant code snippets to verify whether the input has been parameterized or strictly verified. Compared with full scanning, differential scanning greatly reduces resource consumption, while significantly improving the real-time performance of detection.

[0107] After verifying the repair status, the security analysis plug-in can further evaluate the modification status and modification effect based on the repair status. The evaluation of the repair status can include a thorough analysis of the security issues and their impact on the overall security of the system. Specifically, the security analysis plug-in can check whether the repaired code has completely eliminated the source of the vulnerability, or whether there is still a potential risk of variants. For example, for code that fixes an XSS attack vulnerability, the security analysis plug-in can verify whether all related output paths have been securely coded, rather than just fixing one path.

[0108] Furthermore, the verification of the repair effect can also comprehensively consider whether the code performance, maintainability and overall security are affected by the repair. For repairs that meet expectations, they can be marked as repaired and the specific operation process and results of the repair can be recorded to facilitate subsequent feedback and optimize the security analysis plug-in; for repairs that do not fully meet expectations, new suggestions can also be generated to help developers further optimize.

[0109] According to the embodiments of the present disclosure, real-time security scanning of the code is achieved through the security analysis plug-in in the integrated development environment, combined with preset static code rule information and heuristic algorithms. This real-time detection mechanism enables developers to discover and fix potential security issues in the coding stage, such as SQL injection, cross-site scripting attacks and other high-risk vulnerabilities, thereby moving the traditional security detection focused on the testing stage to the development stage, greatly reducing the cost of later repairs, improving development efficiency, and promoting the left shift of security issues, ensuring that security is guaranteed from the initial stage of the software life cycle.

[0110] In the embodiments of the present disclosure, in order to provide efficient security asset support before software development, a process of establishing a security asset database and optimizing the selection of candidate security assets through a recommendation model to provide security assets is also provided.

[0111] Figure 4 The flowchart of the method for providing secure assets according to an embodiment of the present disclosure is schematically shown.

[0112] like Figure 4 As shown, the method for providing secure assets in this embodiment may include operations S410 to S430.

[0113] In operation S410, a security asset database is established, and the security asset database includes security asset information. Specifically, the security asset information may include open source components, security tools, framework libraries, and enterprise-owned security modules, etc., and may also include detailed contents such as functional descriptions, security ratings, compatibility information, and historical usage data of these assets.

[0114] In operation S420, demand data of the target software development project is obtained, and a matching analysis is performed on the demand data and the security asset information using big data analysis technology to obtain candidate security assets.

[0115] In an embodiment of the present disclosure, the requirement data may be provided by project developers, which may include the project's development language, framework type, functional module requirements, security standard requirements, and relevant data of historical projects, etc., so as to clarify the specific requirements of the target software development project for security assets.

[0116] In the embodiments of the present disclosure, big data analysis technology can be used to match and analyze the demand data and the security asset information in the security asset database. Specifically, by extracting the features in the target software development project requirements and performing pattern matching with the information in the security asset database, candidate security assets that meet the project requirements can be screened out. For example, for projects that require high-performance encryption functions, security modules with mature encryption algorithms can be prioritized; for front-end projects that require rapid development, security components that are highly compatible with specific front-end frameworks can be recommended. Through multi-dimensional feature comparisons using big data analysis technology, it can be ensured that the preliminary selection results of candidate assets can cover the basic needs of the project.

[0117] In operation S430, the candidate security assets are risk evaluated and prioritized by using a recommendation model to provide a list of security assets that meet the security requirements of the target software development project.

[0118] After obtaining the candidate security assets, the recommendation model can be used to further conduct risk assessment and prioritize the candidate assets. The recommendation model can combine the historical usage data, security scores, and project requirements of the candidate assets, and use machine learning algorithms to quantitatively analyze the adaptability of each candidate asset. For example, the recommendation model can combine the compatibility data of the asset to evaluate whether it is suitable for a specific development language and framework; or, it can combine the failure rate of historical projects and user feedback data to evaluate the stability of the asset; or, it can also evaluate whether the asset has the latest security vulnerabilities through real-time risk scoring. Based on the comprehensive evaluation results, the recommendation model can prioritize the candidate assets and generate a list of security assets that meet the security requirements of the target software development project. The list of security assets can be sorted by priority, and come with reasons for recommendation and usage suggestions, so that the R&D team can quickly select and integrate security assets.

[0119] Based on the above-mentioned security analysis method in the software development process, the present disclosure also provides a security analysis device in the software development process. Figure 5 The device is described in detail.

[0120] Figure 5 The structural block diagram of the security analysis device in the software development process according to the embodiment of the present disclosure is schematically shown.

[0121] like Figure 5 As shown, the security analysis device 500 in the software development process of this embodiment includes an embedding module 510 , a real-time scanning module 520 , a repair suggestion providing module 530 and a rescanning module 540 .

[0122] The embedding module 510 may be used to embed the security analysis plug-in in the integrated development environment. In one embodiment, the embedding module 510 may be used to perform the operation S210 described above, which will not be described in detail here.

[0123] The real-time scanning module 520 can be used to perform real-time scanning on the code written by the user in the integrated development environment through the security rule information and heuristic algorithm preset in the security analysis plug-in. In one embodiment, the real-time scanning module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0124] The repair suggestion providing module 530 may be used to, in response to the security analysis plug-in identifying the target security issue, mark the target security issue using the security analysis plug-in and provide repair suggestion information. In one embodiment, the repair suggestion providing module 530 may be used to perform the operation S230 described above, which will not be described in detail here.

[0125] The rescanning module 540 may be used to respond to the user modifying the code based on the repair suggestion information, and use the security analysis plug-in to rescan the modified code to verify the modification effect. In one embodiment, the rescanning module 540 may be used to perform the operation S240 described above, which will not be repeated here.

[0126] According to an embodiment of the present disclosure, the repair suggestion providing module 530 may include a question and answer module, and the question and answer module may include an intelligent question and answer model unit and a suggestion generating unit.

[0127] The intelligent question answering model unit can be used to perform semantic analysis and context understanding of the application requirement information using a generative artificial intelligence algorithm to obtain user requirement semantic features. In one embodiment, the intelligent question answering model unit can be used to perform the operation S310 described above, which will not be repeated here.

[0128] The suggestion generation unit may be used to, in response to obtaining security question information input by a user, call the intelligent question-answering model to parse the security question information, match the security specification information in the security specification knowledge base, and generate explanation suggestion information corresponding to the security question information. In one embodiment, the suggestion generation unit may be used to perform operation S320 described above, which will not be described in detail here.

[0129] According to an embodiment of the present disclosure, the real-time scanning module 520 can also be used to load a configuration file containing security rule information, initialize a scanning rule set based on the configuration file; expand the scanning rule set based on a heuristic algorithm; and perform incremental scanning on the code using the expanded scanning rule set.

[0130] According to an embodiment of the present disclosure, the real-time scanning module 520 can also be used to analyze the context information of the code, wherein the context information includes variable dependencies, data flow paths, and call stacks; based on the analysis results, heuristic algorithms are used for inference and pattern recognition to predict security vulnerabilities of the code; and supplementary rule data is dynamically generated based on the prediction results to expand the scanning rule set.

[0131] According to an embodiment of the present disclosure, the real-time scanning module 520 may also be used to parse the code and the context information of the code line by line using the static code rule information.

[0132] According to an embodiment of the present disclosure, the real-time scanning module 520 can also be used to utilize data flow analysis technology to track variable dependencies and data flow paths in the code; and to detect structured query language injection vulnerabilities in the variable flow process based on variable dependencies and data flow paths to obtain a first detection result.

[0133] According to an embodiment of the present disclosure, the real-time scanning module 520 can also be used to utilize control flow analysis technology to parse the call stack of the code; and based on the parsing result of the call stack of the code, detect the risk of cross-site scripting attack in the control flow to obtain a second detection result.

[0134] According to an embodiment of the present disclosure, the repair suggestion providing module 530 can also be used to perform differential scanning on the modified code; compare the results of the differential scanning with the repair suggestion information to verify the repair status of the target security issue; and determine the modification effect based on the repair status.

[0135] According to an embodiment of the present disclosure, the security analysis device 500 may further include a security asset providing module, which may include an asset library establishing unit, a candidate security asset acquiring unit, and a providing unit.

[0136] The asset library establishment unit may be used to establish a secure asset database, and the secure asset database includes secure asset information. In one embodiment, the asset library establishment unit may be used to perform the operation S410 described above, which will not be described in detail here.

[0137] The candidate security asset acquisition unit can be used to acquire the demand data of the target software development project, and use big data analysis technology to match and analyze the demand data and the security asset information to obtain candidate security assets. In one embodiment, the candidate security asset acquisition unit can be used to perform the operation S420 described above, which will not be repeated here.

[0138] The providing unit may be used to perform risk assessment and optimization ranking of the candidate security assets through a recommendation model, and provide a list of security assets that meet the security requirements of the target software development project. In one embodiment, the providing unit may be used to perform the operation S430 described above, which will not be described in detail here.

[0139] According to an embodiment of the present disclosure, any multiple modules of the embedded module 510, the real-time scanning module 520, the repair suggestion providing module 530 and the rescanning module 540 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the embedded module 510, the real-time scanning module 520, the repair suggestion providing module 530 and the rescanning module 540 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in a suitable combination of any of them. Alternatively, at least one of the embedding module 510, the real-time scanning module 520, the repair suggestion providing module 530 and the rescanning module 540 may be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function may be performed.

[0140] Figure 6 A block diagram of an electronic device suitable for implementing a security analysis method in a software development process according to an embodiment of the present disclosure is schematically shown.

[0141] like Figure 6 As shown, the electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 to a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0142] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0143] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the input / output (I / O) interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0144] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0145] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 602 and / or RAM 603 described above and / or one or more memories other than ROM 602 and RAM 603.

[0146] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program includes a program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the security analysis method in the software development process provided by the embodiment of the present disclosure.

[0147] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 601. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0148] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0149] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by a computer program module.

[0150] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0151] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0152] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0153] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A security analysis method in the software development process, characterized in that: The method comprises: Embed security analysis plug-ins in integrated development environments; Scanning the code written by the user in the integrated development environment in real time through the security rule information and heuristic algorithm preset in the security analysis plug-in; In response to the security analysis plug-in identifying a target security issue, marking the target security issue using the security analysis plug-in and providing repair suggestion information; and In response to the user modifying the code based on the repair suggestion information, the modified code is rescanned using the security analysis plug-in to verify the modification effect.

2. The method according to claim 1, characterized in that Prior to software development, the method further includes: Establishing a secure asset database, wherein the secure asset database includes secure asset information; Obtaining demand data of the target software development project, and using big data analysis technology to match and analyze the demand data with the security asset information to obtain candidate security assets; and The candidate security assets are risk assessed and prioritized through the recommendation model to provide a list of security assets that meet the security requirements of the target software development project.

3. The method according to claim 1, characterized in that The method further comprises: Using natural language processing technology to train intelligent question-answering models based on a pre-built knowledge base of safety regulations; and In response to obtaining security question information input by a user, the intelligent question-answering model is called to parse the security question information, and the security specification information in the security specification knowledge base is matched to generate explanation suggestion information corresponding to the security question information.

4. The method according to any one of claims 1 to 3, characterized in that: The real-time scanning of the code written by the user in the integrated development environment based on the preset security rule information and the heuristic algorithm specifically includes: Loading a configuration file containing security rule information, and initializing a scanning rule set based on the configuration file; Expanding the scanning rule set based on a heuristic algorithm; and Incrementally scan your code with an expanded set of scanning rules.

5. The method according to claim 4, characterized in that The step of expanding the scanning rule set based on the heuristic algorithm specifically includes: Analyzing context information of the code, wherein the context information includes variable dependencies, data flow paths, and call stacks; Based on the analysis results, use heuristic algorithms to perform inference and pattern recognition to predict security vulnerabilities in the code; and Supplementary rule data is dynamically generated based on the prediction result, and the scanning rule set is expanded based on the supplementary rule data.

6. The method according to claim 5, characterized in that The security rule information includes static code rule information, and the real-time scanning of the code written by the user in the integrated development environment also includes: The static code rule information is used to parse the code and the context information of the code line by line.

7. The method according to claim 6, characterized in that The utilizing the static code rule information to parse the code and the context information of the code line by line specifically includes: Use data flow analysis techniques to track variable dependencies and data flow paths in the code; and The structured query language injection vulnerability in the variable flow process is detected based on the variable dependency relationship and the data flow path to obtain the first detection result.

8. The method according to claim 6 or 7, characterized in that: The utilizing the static code rule information to parse the code and the context information of the code line by line specifically includes: Analyze the code call stack using control flow analysis techniques; and Based on the parsing result of the code call stack, the cross-site scripting attack risk in the control flow is detected to obtain a second detection result.

9. The method according to any one of claims 1 to 3, 5 to 7, characterized in that: The rescanning of the modified code using the security analysis plug-in to verify the modification effect specifically includes: Perform differential scanning on the modified code; Comparing the result of the differential scan with the repair suggestion information to verify the repair status of the target security issue; and A modification effect is determined based on the repair status.

10. A security analysis device in the software development process, characterized in that: The device comprises: Embedding module, used to: embed security analysis plug-ins in integrated development environments; A real-time scanning module, used to: perform real-time scanning on the code written by the user in the integrated development environment through the security rule information and heuristic algorithm preset in the security analysis plug-in; a remediation suggestion providing module, configured to: in response to the security analysis plug-in identifying a target security issue, mark the target security issue using the security analysis plug-in and provide remediation suggestion information; and The rescanning module is used to: in response to the user modifying the code based on the repair suggestion information, rescan the modified code using the security analysis plug-in to verify the modification effect.

11. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

13. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images