Vulnerability repair scheme generation method and device, equipment and storage medium

Abstract

The invention provides a vulnerability repair scheme generation method and device, equipment and a storage medium, and relates to the technical field of computers, in particular to the technical fields of large language models, data processing, vulnerability repair and the like. According to the specific implementation scheme, a to-be-repaired code is obtained; respectively determining a first similarity between the to-be-repaired code and each repair case in a case library; according to the first similarity, extracting a repair case corresponding to the to-be-repaired code from a case library; and inputting the to-be-repaired code and the repair case corresponding to the to-be-repaired code into a pre-trained first model to obtain a repair scheme of the to-be-repaired code. The accuracy and the generation efficiency of the vulnerability code repair scheme can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to technical fields such as large language models, data processing, and vulnerability repair. Background Art

[0002] Vulnerability codes refer to defects or errors in source code. Once discovered and exploited by attackers, these defects may pose a serious security threat to the software or system, leading to a series of serious consequences such as data leakage, service interruption, and even system crash. Therefore, how to generate accurate repair solutions based on vulnerability codes is an urgent problem to be solved. Summary of the invention

[0003] The present invention provides a vulnerability repair solution generation method, device, equipment and storage medium.

[0004] According to one aspect of the present disclosure, a method for generating a vulnerability repair solution is provided, comprising:

[0005] Get the code to be repaired;

[0006] Determine the first similarity between the code to be repaired and each repair case in the case library respectively;

[0007] According to the first similarity, extracting a repair case corresponding to the code to be repaired from a case library;

[0008] The code to be repaired and the repair case corresponding to the code to be repaired are input into a pre-trained first model to obtain a repair solution for the code to be repaired.

[0009] According to another aspect of the present disclosure, a device for generating a vulnerability repair solution is provided, comprising:

[0010] A first acquisition module, used to acquire the code to be repaired;

[0011] A first determination module, used to respectively determine a first similarity between the code to be repaired and each repair case in the case library;

[0012] An extraction module, configured to extract, from a case library, a repair case corresponding to the code to be repaired according to the first similarity;

[0013] The first input module is used to input the code to be repaired and the repair case corresponding to the code to be repaired into a pre-trained first model to obtain a repair solution for the code to be repaired.

[0014] According to another aspect of the present disclosure, there is provided an electronic device, comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute any method in the embodiments of the present disclosure.

[0018] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any method according to the embodiments of the present disclosure.

[0019] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, which implements any method according to the embodiments of the present disclosure when executed by a processor.

[0020] The present invention compares the similarities between the code to be repaired and each repair case in the case library, determines the repair case corresponding to the code to be repaired based on the similarity, and finally generates a repair plan based on the code to be repaired and the corresponding repair case using a pre-trained first model. The invention can be applied to various types of codes to be repaired, and there is no need to continuously train the first model, thereby improving the efficiency of generating repair plans.

[0021] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0023] Figure 1 is a schematic diagram of an application scenario according to an embodiment of the present disclosure;

[0024] Figure 2 is a flowchart of a method for generating a vulnerability repair solution according to an embodiment of the present disclosure;

[0025] Figure 3 is a schematic diagram of a process for determining a case library according to an embodiment of the present disclosure;

[0026] Figure 4 is a schematic diagram of a process generated according to a vulnerability repair solution of an embodiment of the present disclosure;

[0027] Figure 5 is a structural diagram of a vulnerability repair solution generating device 500 according to an embodiment of the present disclosure;

[0028] Figure 6is a structural diagram of a vulnerability repair solution generating device 600 according to an embodiment of the present disclosure;

[0029] Figure 7 A schematic block diagram of an example electronic device 700 that may be used to implement embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0030] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0031] The “and / or” in the embodiments of the present disclosure indicates that three relationships may exist. For example, A and / or B may indicate the following three situations: A exists alone, A and B exist at the same time, and B exists alone. The term “at least one” herein indicates any combination of at least two of any one or more of a plurality of types. For example, at least one of A, B, and C may indicate any one or more elements selected from the set consisting of A, B, and C. The terms “first” and “second” herein refer to and distinguish between multiple similar technical terms, and do not mean to limit the order or to limit the meaning to only two. For example, the first feature and the second feature refer to two types / two features. The first feature may be one or more, and the second feature may also be one or more.

[0032] In the process of software development and maintenance, the existence of vulnerability codes is a security risk that cannot be ignored. Vulnerability codes, as defects or errors in the source code, provide attackers with potential intrusion paths and can pose a serious threat to the normal operation and data security of software or systems. Therefore, how to generate accurate repair solutions based on vulnerability codes is an urgent problem to be solved.

[0033] Traditional vulnerability repair solutions mainly rely on methods such as template libraries to identify and repair vulnerabilities. However, the limitation of this method is that the template library has limited coverage and is difficult to cope with complex and changing vulnerability forms, resulting in weak generalization of repair capabilities. As software scale and complexity continue to increase, traditional vulnerability repair solutions have gradually exposed their shortcomings and are unable to meet the growing software security needs.

[0034] In order to overcome the limitations of traditional methods, vulnerability repair technology based on machine learning has emerged. This technology automatically identifies and generates vulnerability code repair solutions through training models, and has a high level of intelligence and automation. However, machine learning-based repair solution generation technology also faces some challenges. First, a large amount of high-quality repair data is the basis for training models, but in practical applications, it is often difficult to collect this data. Second, even if enough data can be obtained for training, the repair effect and repair means of the model may be uncontrollable.

[0035] In recent years, with the rapid development of big model technology, big model-based vulnerability repair solution generation technology has been widely used. These solutions have relatively low requirements for the number of training samples, strong generalization, and can handle more complex vulnerability problems. However, existing big model-based repair solutions still have some shortcomings. For example, the controllability of repair results and repair methods is poor, and it is difficult to flexibly adjust according to actual needs. In addition, the fine-tuning and retraining process of large models requires a lot of computing resources, making it difficult to achieve fast iterative optimization.

[0036] In order to solve the above problems, the present disclosure proposes a method for generating a vulnerability repair solution. Figure 1 is a schematic diagram of an application scenario according to an embodiment of the present disclosure, such as Figure 1 As shown, the application scenario diagram of the embodiment of the present disclosure may include but is not limited to a case library 110 and a repair solution generating device 120, and the case library 110 and the repair solution generating device 120 may communicate with each other through any type of wired or wireless network. Specifically, the case library 110 can be used to collect and store vulnerability code repair cases; the repair solution generating device 120 can be used to receive the user's code to be repaired, determine similar repair cases in the case library 110 based on the code to be repaired, and generate a repair solution for the code to be repaired based on the similar repair cases. The repair solution generating device 120 may include an electronic device or server for providing background management for the case library 110. In addition, the embodiment of the present disclosure does not specifically limit the number of case libraries 110. For example, the application scenario diagram of the embodiment of the present disclosure may include one or more case libraries 110.

[0037] Figure 2 It is a flowchart of a method for generating a vulnerability repair solution according to an embodiment of the present disclosure, including:

[0038] S210, obtaining the code to be repaired;

[0039] S220, respectively determining a first similarity between the code to be repaired and each repair case in the case library;

[0040] S230, extracting a repair case corresponding to the code to be repaired from a case library according to the first similarity;

[0041] S240: Input the code to be repaired and the repair case corresponding to the code to be repaired into a pre-trained first model to obtain a repair solution for the code to be repaired.

[0042] The method determines the repair case used to repair the code to be repaired based on the similarity between the code to be repaired and each repair case in the case library, and finally generates a repair plan based on the code to be repaired and the repair case using a pre-trained first model. In the embodiment of the present disclosure, the repair plan may include the repair code, and may also include prompts or means for repairing the vulnerability code. Since the method does not use a code repair template, the method can flexibly deal with various types of vulnerability codes, thereby improving the versatility of repair plan generation. At the same time, the first model used in the method does not need to adjust parameters on a large scale to generate a repair plan for the code to be repaired, thereby improving the efficiency of repair plan generation.

[0043] In some embodiments, the case library includes multiple repair cases;

[0044] The repair case contains vulnerability code and repair code.

[0045] In some implementations, the repair case further includes at least one of a row where the vulnerability is located and repair knowledge.

[0046] In the disclosed embodiment, the case library is constructed by widely collecting repair cases from various sources. For each collected repair case, it is necessary to organize it to obtain the necessary elements: vulnerability code and repair code.

[0047] Vulnerable code refers to a source code fragment that contains a known vulnerability, and fixed code is the code that is corrected for the vulnerability.

[0048] To improve the accuracy of the repair process, the repair case also includes information about the line where the vulnerability is located. This is usually achieved by marking the specific location of the vulnerability in the source code, which can be achieved through line numbers, code block identifiers or other positioning mechanisms.

[0049] In addition to these basic vulnerabilities and repair codes, repair cases can also contain additional repair knowledge, such as descriptions of repair strategies, classifications of vulnerability types, and impact analysis before and after repairs. This knowledge helps users or developers understand the nature of vulnerabilities and repair logic, and also helps the first model generate repair solutions. Repair knowledge can be embedded in repair cases in the form of comments, document links, or structured data.

[0050] The repair cases in the case library can provide references for vulnerability repair solutions for the first model, thereby improving the efficiency of generating vulnerability repair solutions.

[0051] In some embodiments, the case library is determined using a pre-trained second model.

[0052] In one example, using a pre-trained second model, a case library is determined, including:

[0053] Inputting the code repair data into the pre-trained second model;

[0054] Determine whether the code repair data meets the preset standard, and if the code repair data meets the preset standard, generate corresponding repair knowledge based on the code repair data;

[0055] Identify code repair data and repair knowledge as repair cases;

[0056] Based on the repair cases, determine the case library.

[0057] Figure 3 It is a schematic diagram of a process of determining a case library according to an embodiment of the present disclosure.

[0058] like Figure 3 As shown in the figure, the process of determining the case library mainly includes the following steps:

[0059] S301. Obtain code repair data, where the code repair data may include vulnerability code, repair code, and the row where the vulnerability is located.

[0060] In the embodiments of the present disclosure, sources of code repair data include but are not limited to the following aspects:

[0061] (1) Mining from the code base:

[0062] By establishing a connection with the code base management system, you can access the code base of related projects, and analyze the different submitted versions of each project by traversing these code bases. During the traversal process, you can use static code analysis tools or vulnerability scanners to detect potential vulnerabilities in the code. Once a vulnerability is found, you can record the code version where the vulnerability was first detected, and continue to pay attention to subsequent code versions where the vulnerability is not detected to obtain the repair code corresponding to the vulnerability code.

[0063] (2) Scan the vulnerability code and manually intervene to repair it:

[0064] By collecting known vulnerability code samples from various channels (vulnerability databases, security bulletins, etc.) and classifying the samples, each vulnerability code sample can be assigned to a professional developer for analysis, and a corresponding repair plan can be designed based on the characteristics and impact of the vulnerability code. Once the repair is completed, the module will record the repaired code and integrate it with the original vulnerability code.

[0065] (3) Extract vulnerabilities and fix codes from open source tutorials:

[0066] We collect tutorials and guides related to vulnerability repair from open source communities, security forums, technical blogs, and other channels. These tutorials contain detailed vulnerability descriptions, reproduction steps, and repair methods. For each collected tutorial, we can extract the vulnerability code and repair code, and integrate the extracted content.

[0067] S302: Using the second model, determine whether the code repair data meets the standard. If the code repair data meets the standard, execute S303; if the code repair data does not meet the standard, execute S306.

[0068] Based on the code repair data collected above, the code repair data needs to be preprocessed, including data cleaning, format unification, etc., so that it can be correctly parsed and processed by the pre-trained second model. The preprocessed code repair data is input into the second model, and the second model uses its own thinking ability to analyze and understand the input data. During the analysis process, the second model can identify vulnerability patterns in the code, evaluate the effectiveness of the repair plan, and predict the quality and performance of the repaired code. At the same time, the second model will also consider factors such as the contextual information of the code and the overall architecture of the project to determine whether the code repair data meets the standards.

[0069] S303: When the code repair data meets the standard, generate corresponding repair knowledge based on the code repair data using the second model.

[0070] For code repair data that meets the standards, the second model can be used to analyze and extract or summarize useful information and knowledge related to the code repair data. This knowledge may include common vulnerability patterns, repair strategies, code refactoring suggestions, etc.

[0071] For example:

[0072] #Vulnerability code: User input is not validated, there is a risk of SQL injection

[0073] query="SELECT*FROM users WHERE username=""+user_input+"'"

[0074] #Fixed case: Use parameterized queries to prevent SQL injection

[0075] query="SELECT*FROM users WHERE username="?"

[0076] cursor.execute(query,(user_input,))

[0077] The analysis results of the second model are:

[0078] #Repair Knowledge

[0079] SQL injection is a common security vulnerability that can be prevented by using parameterized queries or prepared statements. When writing SQL queries, avoid directly concatenating user input and instead use parameterized queries to ensure that user input is properly processed.

[0080] S304: Determine each code repair data and corresponding repair knowledge as a repair case.

[0081] S305: Determine a case library based on each repair case.

[0082] Each repair case is stored in the case library to determine the case library.

[0083] S306: Discard code repair data that does not meet the standards.

[0084] Through the above methods, low-quality or non-compliant code repair data can be filtered out, thereby improving the accuracy and reliability of the generated repair knowledge. By using code repair data and repair knowledge to determine repair cases, a data basis can be provided for the generation of repair solutions.

[0085] Figure 4 It is a flowchart of a vulnerability repair solution generated according to an embodiment of the present disclosure.

[0086] like Figure 4 As shown in the figure, the generation of repair cases for vulnerable codes mainly includes the following steps:

[0087] S401, obtaining the user's code to be repaired.

[0088] S402: Determine a first similarity between the code to be repaired and the repair case.

[0089] In some implementations, determining a first similarity between the code to be repaired and the repair case includes:

[0090] Determine the similarity between the code to be fixed and the vulnerable code in the fixed case.

[0091] In some implementations, determining a first similarity between the code to be repaired and the vulnerability code in the repair case includes:

[0092] Determine N feature types, where N is a positive integer;

[0093] Determine N first features of the code to be repaired, each first feature corresponds to a feature type; and determine N second features of the vulnerability code, each second feature corresponds to a feature type;

[0094] For N feature types, respectively determine the similarity between the first feature and the second feature of the feature type to obtain N second similarities;

[0095] The first similarity is determined based on the N second similarities and the weights corresponding to the N feature types.

[0096] In this step, it is necessary to identify and define N feature types for comparing the similarity between codes. These feature types can be based on various attributes of the code, including but not limited to:

[0097] (1) Syntactic structure: such as the structure of code blocks, the use of control flow statements, etc.

[0098] (2) Variables and functions: variable naming, types, and scope, as well as function definitions, parameters, and return values;

[0099] (3) Data operations: operations such as reading, modifying, and deleting data;

[0100] (4) Exception handling: How to capture and handle exceptions;

[0101] (5) External dependencies: The code’s dependency on external libraries or frameworks.

[0102] For each feature type, the corresponding first feature needs to be extracted from the code to be repaired, for example:

[0103] (1) Based on the features of the grammatical structure, the control flow graph of the code to be repaired can be extracted, including the location and type of conditional statements and loop statements;

[0104] (2) Based on the characteristics of variables and functions, the names, types, and scopes of all variables in the code to be repaired, as well as the names, parameter lists, and return value types of all functions can be listed.

[0105] (3) Based on the characteristics of data operations, the type of data operation (such as assignment, comparison, arithmetic operation, etc.) and its context can be recorded.

[0106] (4) According to the characteristics of exception handling, all exception capture points and exception handling logic can be listed.

[0107] (5) Based on the characteristics of external dependencies, the names and versions of all external libraries and frameworks that the code to be repaired depends on can be listed.

[0108] Similarly, for each feature type, the corresponding second feature needs to be extracted from the vulnerability code. The extraction method of these second features is the same as the extraction method in the code to be repaired, so that the two have the same benchmark when compared. In the embodiment of the present disclosure, the method of extracting the first feature and the second feature may include lexical analysis, grammatical analysis, data flow analysis, etc.

[0109] For each feature type, it is necessary to calculate the similarity between the first feature and the second feature. The similarity calculation method can be based on a variety of strategies, such as string matching, structure matching, and numerical comparison.

[0110] After calculating the similarity between the first feature and the second feature, a weight needs to be assigned to the similarity of each feature type, which reflects the importance of the feature type in determining the code similarity. The weight assignment can be based on experience, model analysis or data-driven methods.

[0111] After the weights are determined, the first similarity can be calculated using a weighted average method. Specifically, the similarity of each feature type is multiplied by its corresponding weight, and then these weighted similarities are added together to obtain the total first similarity. The calculation formula for the first similarity is:

[0112]

[0113] In this formula, s is the first similarity, w i represents the weight of the similarity of the i-th feature, s i Represents the similarity of the i-th feature.

[0114] Using the above method, by determining multiple feature types, the similarity between the code to be repaired and the vulnerability code in the repair solution can be evaluated from multiple angles or dimensions, so that repair cases suitable for generating repair solutions can be found, providing a basis for generating repair solutions.

[0115] S403: Determine a repair case according to the first similarity between the code to be repaired and each vulnerability code in the case library, and generate a repair plan based on the code to be repaired and the repair case.

[0116] In this step, based on each first similarity, the repair case that best matches the code to be repaired is screened out. To achieve this goal, multiple factors need to be considered comprehensively so that the screened repair cases can be highly similar in value and have security guarantees.

[0117] First, a preliminary screening is performed based on the values ​​of the first similarity. These values ​​can be calculated by the above calculation method, reflecting the similarity between the code to be repaired and the vulnerability code in each repair case in multiple features. By setting a threshold, as long as the first similarity value exceeds the threshold, the vulnerability code and the repair case to which it belongs will be included in the scope of further consideration.

[0118] However, it is not enough to rely solely on similarity values ​​for screening. Because even if two code snippets are highly similar in structure, if one of them has a serious security vulnerability, it is obviously inappropriate to use it as a repair case. Therefore, based on the preliminary screening, we also need to further consider the security of the repair cases in the case library.

[0119] Specifically, in this process, each repair case needs to be subjected to security analysis, which includes checking whether the code in the repair case has known vulnerabilities, whether it has undergone security testing, etc. Through these analyses, the security performance of each candidate repair case can be fully understood, so that the final repair cases are not only highly similar in value, but also have high reliability in terms of security.

[0120] After the repair case is determined, the repair case and the code to be repaired can be combined to form a complete prompt information, which contains the specific information of the code to be repaired and also incorporates the content in the repair case, providing a basis for generating a repair plan.

[0121] Finally, the prompt information is input into the first model, which is a pre-trained artificial intelligence model that has the ability to generate vulnerability code repair solutions. After receiving the prompt information, the first model generates a repair solution corresponding to the code to be repaired based on the content of the prompt information. For simple vulnerability codes, the first model can be used directly for processing. For complex vulnerability codes, the low-rank adaptation (LoRA) method can be used to fine-tune the first model.

[0122] S404: Determine whether the user adopts the repair solution generated by the first model. If the user adopts the repair solution, it is considered that the vulnerability code can be repaired, and the process ends; if the user does not adopt the repair solution, execute S405.

[0123] In some implementations, when the repair solution is not adopted, obtaining a self-repair code modified by a user based on the code to be repaired;

[0124] The code to be repaired and the self-repairing code are constructed into new code repair data, and the case library is updated based on the new code repair data.

[0125] S405: If the user does not adopt the repair solution, obtain the user's self-repair code, and construct new code repair data based on the code to be repaired.

[0126] By monitoring the user's behavior on the repair solution, it can be determined whether the repair solution is adopted. If the user does not adopt the recommended repair solution within a period of time and the code problem still exists, the repair solution is considered not adopted. In this case, the user is requested to obtain the modifications they made based on the code to be repaired, that is, the self-repair code, and the code to be repaired and the self-repair code are constructed into new code repair data.

[0127] S406: Determine whether the new code repair data meets the preset standard. If yes, execute S407; if no, end the process.

[0128] Based on the new code repair data, the second model may be used to determine whether the code repair data meets a preset standard.

[0129] S407: Generate corresponding repair knowledge based on the new code repair data, integrate the code repair data and the repair knowledge into a repair case, and update it to the case library.

[0130] When the code repair data meets the preset standard, the repair knowledge of the code repair data is generated, and the code repair data and the repair knowledge are integrated into a new repair case, which is finally updated into the case library.

[0131] By combining the self-repair code provided by the user with the code to be repaired, new code repair data can be created and the case library can be updated based on this data. This not only enriches the diversity of the case library, but also improves the accuracy of repair solution generation when encountering similar vulnerability codes.

[0132] The disclosed embodiment also provides a device for generating a vulnerability repair solution. Figure 5 is a schematic diagram of the structure of a vulnerability repair solution generating device 500 according to an embodiment of the present disclosure, comprising:

[0133] A first acquisition module 510 is used to acquire the code to be repaired;

[0134] A first determination module 520, used to respectively determine a first similarity between the code to be repaired and each repair case in the case library;

[0135] An extraction module 530, configured to extract a repair case corresponding to the code to be repaired from a case library according to the first similarity;

[0136] The first input module 540 is used to input the code to be repaired and the repair case corresponding to the code to be repaired into a pre-trained first model to obtain a repair solution for the code to be repaired.

[0137] In some embodiments, the case library includes multiple repair cases;

[0138] The repair case contains vulnerability code and repair code.

[0139] In some implementations, the repair case further includes at least one of a row where the vulnerability is located and repair knowledge.

[0140] In some implementations, the first determining module 520 is configured to:

[0141] Determine the similarity between the code to be fixed and the vulnerable code in the fixed case.

[0142] In some implementations, the first determining module 520 is configured to:

[0143] Determine N feature types, where N is a positive integer;

[0144] Determine N first features of the code to be repaired, each first feature corresponds to a feature type; and determine N second features of the vulnerability code, each second feature corresponds to a feature type;

[0145] For N feature types, respectively determine the similarity between the first feature and the second feature of the feature type to obtain N second similarities;

[0146] The first similarity is determined based on the N second similarities and the weights corresponding to the N feature types.

[0147] The disclosed embodiment also provides a device for generating a vulnerability repair solution. Figure 6 6 is a schematic diagram of a vulnerability repair solution generating device 600 according to an embodiment of the present disclosure. In some implementations, it also includes:

[0148] The second determination module 650 is used to determine the case library using a pre-trained second model.

[0149] In some implementations, the second determining module is configured to:

[0150] Inputting the code repair data into the pre-trained second model;

[0151] Determine whether the code repair data meets the preset standard, and if the code repair data meets the preset standard, generate corresponding repair knowledge based on the code repair data;

[0152] Identify code repair data and repair knowledge as repair cases;

[0153] Based on the repair cases, determine the case library.

[0154] In some implementations, the hole repair solution generating device 600 further includes:

[0155] The second acquisition module 660 is used to acquire the self-repair code modified by the user based on the code to be repaired when the repair solution is not adopted;

[0156] The updating module 670 is used to construct the to-be-repaired code and the self-repairing code into new code repair data, and update the case library based on the new code repair data.

[0157] For the description of specific functions and examples of each module and submodule of the device in the embodiment of the present disclosure, reference can be made to the relevant description of the corresponding steps in the above method embodiment, which will not be repeated here.

[0158] In the technical solution disclosed in the present invention, the acquisition, storage and application of personal information of users involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0159] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0160] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0161] like Figure 7 As shown, the device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the device 700 can also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0162] A number of components in the device 700 are connected to the I / O interface 705, including: an input unit 706, such as a keyboard, a mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the device 700 to exchange data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0163] The computing unit 701 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 701 performs the various methods and processes described above, such as detection methods. For example, in some embodiments, the detection method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 700 via ROM 702 and / or communication unit 709. When the computer program is loaded into RAM 703 and executed by the computing unit 701, one or more steps of the detection method described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to perform the detection method in any other appropriate manner (e.g., by means of firmware).

[0164] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0165] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0166] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0167] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0168] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0169] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0170] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0171] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for generating a vulnerability repair solution, comprising: Get the code to be repaired; respectively determining a first similarity between the code to be repaired and each repair case in the case library; Extracting, from the case library, a repair case corresponding to the code to be repaired according to the first similarity; The code to be repaired and the repair case corresponding to the code to be repaired are input into a pre-trained first model to obtain a repair solution for the code to be repaired.

2. The method according to claim 1, wherein: The case library contains a plurality of the repair cases; The repair case contains vulnerability code and repair code.

3. The method according to claim 2, wherein: The repair case also includes at least one of the row where the vulnerability is located and repair knowledge.

4. The method according to claim 2 or 3, wherein: Determining a first similarity between the code to be repaired and the repair case includes: Determine the similarity between the code to be repaired and the vulnerability code in the repair case.

5. The method according to claim 4, wherein: The determining a first similarity between the code to be repaired and the vulnerability code in the repair case includes: Determine N feature types, where N is a positive integer; Determine N first features of the code to be repaired, each of the first features corresponds to one of the feature types; and determine N second features of the vulnerability code, each of the second features corresponds to one of the feature types; For the N feature types, respectively determine the similarity between the first feature and the second feature of the feature type to obtain N second similarities; The first similarity is determined based on the N second similarities and weights corresponding to the N feature types.

6. The method according to claim 1 or 5, further comprising: The case library is determined using a pre-trained second model.

7. The method according to claim 6, wherein: The method of using the pre-trained second model to determine the case library includes: Inputting code repair data into the pre-trained second model; Determining whether the code repair data meets a preset standard, and generating the corresponding repair knowledge based on the code repair data if the code repair data meets the preset standard; Determine the code repair data and the repair knowledge as the repair case; Based on the repair case, the case library is determined.

8. The method according to claim 7, further comprising: If the repair solution is not adopted, obtaining a self-repair code modified by a user based on the code to be repaired; The code to be repaired and the self-repairing code are constructed into new code repairing data, and the case library is updated based on the new code repairing data.

9. A vulnerability repair solution generating device, comprising: A first acquisition module, used to acquire the code to be repaired; A first determination module, used to respectively determine a first similarity between the code to be repaired and each repair case in the case library; An extraction module, configured to extract, from the case library, a repair case corresponding to the code to be repaired according to the first similarity; The first input module is used to input the code to be repaired and the repair case corresponding to the code to be repaired into a pre-trained first model to obtain a repair solution for the code to be repaired.

10. The device according to claim 9, wherein: The case library contains a plurality of the repair cases; The repair case contains vulnerability code and repair code.

11. The device according to claim 10, wherein: The repair case also includes at least one of the row where the vulnerability is located and repair knowledge.

12. The device according to claim 10 or 11, wherein: The first determining module is used to: Determine the similarity between the code to be repaired and the vulnerability code in the repair case.

13. The device according to claim 12, wherein: The first determining module is used to: Determine N feature types, where N is a positive integer; Determine N first features of the code to be repaired, each of the first features corresponds to one of the feature types; and determine N second features of the vulnerability code, each of the second features corresponds to one of the feature types; For the N feature types, respectively determine the similarity between the first feature and the second feature of the feature type to obtain N second similarities; The first similarity is determined based on the N second similarities and weights corresponding to the N feature types.

14. The device according to claim 9 or 13, further comprising: The second determination module is used to determine the case library using a pre-trained second model.

15. The device according to claim 14, wherein: The second determining module is used to: Inputting code repair data into the pre-trained second model; Determining whether the code repair data meets a preset standard, and generating the corresponding repair knowledge based on the code repair data if the code repair data meets the preset standard; Determine the code repair data and the repair knowledge as the repair case; Based on the repair case, the case library is determined.

16. The apparatus according to claim 15, further comprising: A second acquisition module is used to acquire a self-repair code modified by a user based on the code to be repaired when the repair solution is not adopted; An updating module is used to construct the code to be repaired and the self-repairing code into new code repair data, and update the case library based on the new code repair data.

17. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 8.

18. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-8.

19. A computer program product, comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 8.

Images