A method, apparatus, device, and storage medium for generating vulnerability remediation solutions.

Abstract

This disclosure provides a method, apparatus, device, and storage medium for generating vulnerability remediation schemes, relating to the field of computer technology, particularly to the fields of large language models, data processing, and vulnerability remediation. The specific implementation scheme includes: obtaining the code to be remediated; determining the first similarity between the code to be remediated and each remediation case in a case library; extracting the remediation case corresponding to the code to be remediated from the case library based on the first similarity; and inputting the code to be remediated and its corresponding remediation case into a pre-trained first model to obtain a remediation scheme for the code to be remediated. This disclosure can improve the accuracy and generation efficiency of vulnerability code remediation schemes.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to the fields of large language models, data processing, and vulnerability repair. Background Technology

[0002] Vulnerable code refers to defects or errors existing in the source code. Once these defects are discovered and exploited by attackers, they can pose a serious security threat to software or systems, leading to a series of severe consequences such as data breaches, service interruptions, and even system crashes. Therefore, how to generate accurate remediation solutions based on vulnerable code is an urgent problem to be solved. Summary of the Invention

[0003] This disclosure provides a method, apparatus, device, and storage medium for generating vulnerability remediation solutions.

[0004] According to one aspect of this disclosure, a method for generating a vulnerability remediation solution is provided, comprising:

[0005] Obtain the code to be fixed;

[0006] Determine the first similarity between the code to be repaired and each repair case in the case library;

[0007] Based on the first similarity, extract the repair cases corresponding to the code to be repaired from the case library;

[0008] The code to be repaired and its corresponding repair case are input into a pre-trained first model to obtain a repair solution for the code to be repaired.

[0009] According to another aspect of this disclosure, a vulnerability remediation solution generation apparatus is provided, comprising:

[0010] The first acquisition module is used to acquire the code to be repaired.

[0011] The first determination module is used to determine the first similarity between the code to be repaired and each repair case in the case library;

[0012] The extraction module is used to extract repair cases corresponding to the code to be repaired from the case library based on the first similarity.

[0013] The first input module is used to input the code to be repaired and the corresponding repair case into the pre-trained first model to obtain the repair scheme for the code to be repaired.

[0014] According to another aspect of this disclosure, an electronic device is provided, comprising:

[0015] At least one processor; and

[0016] The memory is communicatively connected to the at least one processor; wherein,

[0017] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform any of the methods described in the present disclosure.

[0018] According to another aspect of this disclosure, a non-transitory computer-readable storage medium is provided storing computer instructions, wherein the computer instructions are used to cause the computer to perform any of the methods according to embodiments of this disclosure.

[0019] According to another aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements any of the methods according to embodiments of this disclosure.

[0020] This disclosure compares the similarity between the code to be repaired and various repair cases in the case library, determines the repair case corresponding to the code to be repaired based on the similarity, and finally generates a repair scheme using a pre-trained first model based on the code to be repaired and the corresponding repair case. It can be applied to various types of code to be repaired, and does not require continuous training of the first model, thus improving the efficiency of repair scheme generation.

[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0022] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0023] Figure 1 This is a schematic diagram illustrating an application scenario according to an embodiment of this disclosure;

[0024] Figure 2 This is a flowchart illustrating the implementation of a vulnerability remediation scheme generation method according to an embodiment of the present disclosure;

[0025] Figure 3 This is a schematic diagram of a process determined according to a case library of embodiments of this disclosure;

[0026] Figure 4 This is a flowchart illustrating a vulnerability remediation scheme generated according to an embodiment of the present disclosure;

[0027] Figure 5 This is a schematic diagram of the structure of a vulnerability remediation scheme generation apparatus 500 according to an embodiment of the present disclosure;

[0028] Figure 6This is a schematic diagram of the structure of a vulnerability remediation scheme generation apparatus 600 according to an embodiment of the present disclosure;

[0029] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement embodiments of the present disclosure is shown. Detailed Implementation

[0030] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0031] The term "and / or" in this disclosure indicates that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. The term "at least one" in this document means any combination of at least two of a plurality of options, such as including at least one of A, B, and C, which can mean including any one or more elements selected from the set of A, B, and C. The terms "first" and "second" in this document refer to and distinguish multiple similar technical terms, and do not imply a specific order or a limitation to only two. For example, "first feature" and "second feature" refer to two types / two features; the first feature can be one or more, and the second feature can also be one or more.

[0032] In the process of software development and maintenance, the existence of vulnerable code is a security risk that cannot be ignored. Vulnerable code, as defects or errors in the source code, provides attackers with potential intrusion paths, posing a serious threat to the normal operation of software or systems and data security. Therefore, how to generate accurate remediation solutions based on vulnerable code is an urgent problem to be solved.

[0033] Traditional vulnerability remediation solutions primarily rely on template libraries for vulnerability identification and remediation. However, this approach is limited by the limited coverage of template libraries, making it difficult to address the complex and ever-changing nature of vulnerabilities and resulting in poor generalization of remediation capabilities. As software scale and complexity continue to increase, traditional vulnerability remediation solutions are gradually revealing their inadequacies and failing to meet the ever-growing demands for software security.

[0034] To overcome the limitations of traditional methods, machine learning-based vulnerability remediation technology has emerged. This technology automatically identifies and generates remediation solutions for vulnerability code by training models, exhibiting a high level of intelligence and automation. However, machine learning-based remediation solution generation technology also faces some challenges. First, a large amount of high-quality remediation data is fundamental to training the model, but collecting this data is often difficult in practical applications. Second, even if sufficient data can be obtained for training, the model's remediation effectiveness and methods may still be unpredictable.

[0035] In recent years, with the rapid development of large-model technology, vulnerability remediation scheme generation techniques based on large models have been widely used. These schemes have relatively low requirements for training sample size, strong generalization ability, and can handle more complex vulnerability problems. However, existing large-model-based remediation schemes still have some shortcomings. For example, the controllability of remediation results and methods is poor, making it difficult to flexibly adjust according to actual needs. In addition, the fine-tuning and retraining process of large models consumes a lot of computing resources, making it difficult to achieve rapid iterative optimization.

[0036] To address the aforementioned issues, this disclosure proposes a method for generating vulnerability remediation solutions. Figure 1 This is a schematic diagram illustrating an application scenario according to an embodiment of this disclosure, such as... Figure 1 As shown in the illustration, the application scenario diagram of this disclosure embodiment may include, but is not limited to, a case library 110 and a remediation scheme generation device 120. The case library 110 and the remediation scheme generation device 120 can communicate via any type of wired or wireless network. Specifically, the case library 110 can be used to collect and store vulnerability code remediation cases; the remediation scheme generation device 120 can be used to receive the user's code to be remediated, determine similar remediation cases in the case library 110 based on the code to be remediated, and generate a remediation scheme for the code to be remediated based on the similar remediation cases. The remediation scheme generation device 120 may include an electronic device or server for providing backend management for the case library 110. Furthermore, this disclosure embodiment does not impose a specific limitation on the number of case libraries 110; for example, the application scenario diagram of this disclosure embodiment may include one or more case libraries 110.

[0037] Figure 2 This is a flowchart illustrating the implementation of a vulnerability remediation scheme generation method according to an embodiment of the present disclosure, including:

[0038] S210, Obtain the code to be repaired;

[0039] S220. Determine the first similarity between the code to be repaired and each repair case in the case library;

[0040] S230. Based on the first similarity, extract the repair cases corresponding to the code to be repaired from the case library;

[0041] S240. Input the code to be repaired and the corresponding repair case into the pre-trained first model to obtain the repair scheme for the code to be repaired.

[0042] This method determines repair cases for fixing the code to be repaired based on the similarity between the code to be repaired and each repair case in the case library. Finally, based on the code to be repaired and the repair cases, a repair scheme is generated using a pre-trained first model. In this embodiment, the repair scheme may include repair code or hints or methods for repairing the vulnerable code. Since this method does not use code repair templates, it can flexibly handle various types of vulnerable code, improving the versatility of the repair scheme generation. Furthermore, the first model used in this method does not require large-scale parameter adjustments to generate repair schemes for the code to be repaired, thus improving the efficiency of repair scheme generation.

[0043] In some implementations, the case library contains multiple repair cases;

[0044] The remediation case includes the vulnerability code and the remediation code.

[0045] In some implementations, the remediation case also includes at least one of the lines containing the vulnerability and the remediation knowledge.

[0046] In this embodiment of the disclosure, the case library is constructed by extensively collecting remediation cases from various sources. For each collected remediation case, it is necessary to organize it to obtain the necessary elements: the vulnerability code and the remediation code.

[0047] Vulnerable code refers to a source code segment that contains known vulnerabilities, while fix code is code that corrects those vulnerabilities.

[0048] To improve the accuracy of the remediation process, the remediation case also includes information about the line containing the vulnerability. This is typically achieved by marking the specific location of the vulnerability in the source code, which can be done through line numbers, code block identifiers, or other location mechanisms.

[0049] In addition to the basic vulnerabilities and fixes, remediation cases can also include extra remediation knowledge, such as descriptions of remediation strategies, classifications of vulnerability types, and impact analyses before and after remediation. This knowledge helps users or developers understand the nature of the vulnerability and the logic behind the remediation, and also helps the first model generate remediation solutions. Remediation knowledge can be embedded in the remediation cases in the form of comments, document links, or structured data.

[0050] The remediation cases in the case library can provide the first model with references on vulnerability remediation solutions, thereby improving the efficiency of vulnerability remediation solution generation.

[0051] In some implementations, a pre-trained second model is used to determine the case library.

[0052] In one example, a pre-trained second model is used to determine the case library, which includes:

[0053] The code fixes the data and is then fed into a pre-trained second model;

[0054] Determine whether the code repair data meets the preset standards. If the code repair data meets the preset standards, generate corresponding repair knowledge based on the code repair data.

[0055] The code repair data and repair knowledge are identified as repair cases;

[0056] Based on the repair cases, a case library was determined.

[0057] Figure 3 This is a schematic diagram of a process determined according to a case library of embodiments of this disclosure.

[0058] like Figure 3 As shown, the process of determining the case library mainly includes the following steps:

[0059] S301. Obtain code fix data, which may include the vulnerable code, the fix code, and the line where the vulnerability is located.

[0060] In embodiments of this disclosure, the sources of code repair data include, but are not limited to, the following:

[0061] (1) Digging from the code repository:

[0062] By establishing a connection with a code repository management system, access to the code repositories of relevant projects can be obtained. These repositories can be traversed to analyze different commit versions of each project. During the traversal, static code analysis tools or vulnerability scanners can be used to detect potential vulnerabilities in the code. Once a vulnerability is discovered, the code version in which the vulnerability is first detected can be recorded, and subsequent code versions that do not show vulnerabilities can be continuously monitored to obtain the corresponding patch code.

[0063] (2) Scan for vulnerable code and manually fix it:

[0064] The module collects known vulnerable code samples from various sources (vulnerability databases, security bulletins, etc.) and categorizes them. Each vulnerable code sample can be assigned to a professional developer for analysis, and a corresponding remediation plan can be designed based on the characteristics and impact of the vulnerable code. Once the remediation is completed, the module records the remediated code and integrates it with the original vulnerable code.

[0065] (3) Extracting vulnerability and fix code from open-source tutorials:

[0066] We collected tutorials and guides related to vulnerability remediation from open-source communities, security forums, and technical blogs. These tutorials included detailed vulnerability descriptions, reproduction steps, and remediation methods. For each collected tutorial, we extracted the vulnerable code and the remediation code, and then integrated the extracted content.

[0067] S302. Using the second model, determine whether the code repair data meets the standard. If the code repair data meets the standard, proceed to S303; otherwise, proceed to S306.

[0068] Based on the collected code repair data, preprocessing is required, including data cleaning and format standardization, to ensure the pre-trained second model can correctly parse and process it. The preprocessed code repair data is then input into the second model, which uses its own analytical capabilities to analyze and understand the input data. During analysis, the second model can identify vulnerability patterns in the code, evaluate the effectiveness of remediation solutions, and predict the quality and performance of the remediated code. Simultaneously, the second model also considers factors such as the code's contextual information and the overall project architecture to determine whether the code repair data conforms to standards.

[0069] S303. If the code repair data meets the standard, based on the code repair data, use the second model to generate corresponding repair knowledge.

[0070] For code remediation data that meets the standards, a second model can be used for analysis to extract or summarize useful information and knowledge related to the code remediation data. This knowledge can include common vulnerability patterns, remediation strategies, code refactoring suggestions, etc.

[0071] For example:

[0072] #Vulnerable code: Lack of user input validation poses a risk of SQL injection.

[0073] query="SELECT*FROM users WHERE username=""+user_input+"'"

[0074] #Remediation Case: Using Parameterized Queries to Prevent SQL Injection

[0075] query="SELECT*FROM users WHERE username="?"

[0076] cursor.execute(query,(user_input,))

[0077] The analysis results of the second model are as follows:

[0078] #Repair Knowledge

[0079] SQL injection is a common security vulnerability that can be prevented by using parameterized queries or prepared statements. When writing SQL queries, avoid directly concatenating user input; instead, use parameterized queries to ensure that user input is processed correctly.

[0080] S304. Each code repair data and its corresponding repair knowledge shall be identified as a repair case.

[0081] S305. Based on each repair case, determine the case library.

[0082] Each repair case is stored in a case library to define the case library.

[0083] S306. Discard non-compliant code to repair data.

[0084] By employing the above methods, low-quality or unacceptable code repair data can be filtered out, thereby improving the accuracy and reliability of the generated repair knowledge. By utilizing code repair data and repair knowledge to identify repair cases, a data foundation can be provided for generating repair solutions.

[0085] Figure 4 This is a flowchart illustrating the generation of a vulnerability remediation scheme according to an embodiment of the present disclosure.

[0086] like Figure 4 As shown, the generation of remediation cases for vulnerable code mainly includes the following steps:

[0087] S401. Obtain the user's code to be fixed.

[0088] S402. Determine the first similarity between the code to be repaired and the case to be repaired.

[0089] In some implementations, determining a first similarity between the code to be fixed and the case to be fixed includes:

[0090] Determine the similarity between the code to be fixed and the vulnerable code in the fix case.

[0091] In some implementations, determining the first similarity between the code to be fixed and the vulnerable code in the fix case includes:

[0092] Determine N feature types, where N is a positive integer;

[0093] Identify N primary features of the code to be repaired, each primary feature corresponding to a feature type; and identify N secondary features of the vulnerable code, each secondary feature corresponding to a feature type.

[0094] For N feature types, determine the similarity between the first feature and the second feature of each feature type to obtain N second similarity values;

[0095] The first similarity is determined based on N second similarities and the weights corresponding to N feature types.

[0096] In this step, N feature types need to be identified and defined for comparing the similarity between codes. These feature types can be based on various attributes of the code, including but not limited to:

[0097] (1) Syntax structure: such as the structure of code blocks, the use of control flow statements, etc.

[0098] (2) Variables and functions: the naming, type, and scope of variables, as well as the definition, parameters, and return value of functions;

[0099] (3) Data manipulation: Operations such as reading, modifying, and deleting data;

[0100] (4) Exception handling: Methods of exception capture and handling;

[0101] (5) External dependencies: The code's dependencies on external libraries or frameworks.

[0102] For each feature type, the corresponding first feature needs to be extracted from the code to be fixed, for example:

[0103] (1) Based on the characteristics of the syntax structure, the control flow graph of the code to be repaired can be extracted, including the position and type of conditional statements and loop statements;

[0104] (2) Based on the characteristics of variables and functions, the names, types, and scopes of all variables in the code to be repaired, as well as the names, parameter lists, and return value types of all functions, can be listed.

[0105] (3) Based on the characteristics of data operations, the type of data operation (such as assignment, comparison, arithmetic operation, etc.) and its context can be recorded.

[0106] (4) Based on the characteristics of exception handling, all exception capture points and exception handling logic can be listed.

[0107] (5) Based on the characteristics of external dependencies, the names and versions of all external libraries and frameworks that the code to be fixed depends on can be listed.

[0108] Similarly, for each feature type, a corresponding second feature needs to be extracted from the vulnerable code. The extraction methods for these second features are the same as those used in the code to be patched, ensuring that both have the same benchmark for comparison. In embodiments of this disclosure, the methods for extracting the first and second features may include lexical analysis, syntax analysis, data flow analysis, etc.

[0109] For each feature type, the similarity between the first feature and the second feature needs to be calculated. The similarity calculation method can be based on various strategies, such as string matching, structural matching, and numerical comparison.

[0110] After calculating the similarity between the first and second features, a weight needs to be assigned to the similarity of each feature type. This weight reflects the importance of that feature type in determining code similarity. The weight assignment can be based on experience, model analysis, or data-driven methods.

[0111] After determining the weights, a weighted average method can be used to calculate the first similarity. Specifically, the similarity of each feature type is multiplied by its corresponding weight, and then these weighted similarities are summed to obtain the total first similarity. The formula for calculating the first similarity is:

[0112]

[0113] In this formula, s represents the first similarity score, and w i The weight s represents the similarity of the i-th feature. i This represents the similarity of the i-th feature.

[0114] Using the above method, by identifying multiple feature types, the similarity between the code to be repaired and the vulnerable code in the repair plan can be evaluated from multiple angles or dimensions. This allows us to find repair cases suitable for generating repair plans, providing a basis for the generation of repair plans.

[0115] S403. Based on the first similarity between the code to be repaired and the vulnerability codes in the case library, determine the repair cases, and generate a repair plan based on the code to be repaired and the repair cases.

[0116] In this step, based on the first similarity scores, the best-matching repair cases are selected. To achieve this, multiple factors need to be considered to ensure that the selected repair cases are both highly similar in numerical terms and secure in terms of security.

[0117] First, an initial screening is conducted based on the first similarity score. These scores, calculated using the method described above, reflect the degree of similarity between the code to be patched and the vulnerable code in each patching case across multiple features. By setting a threshold, vulnerable code and its corresponding patching case whose first similarity score exceeds this threshold will be included in further consideration.

[0118] However, relying solely on similarity scores for filtering is insufficient. Even if two code snippets are structurally highly similar, if one contains a serious security vulnerability, it is clearly inappropriate to use it as a remediation case. Therefore, in addition to the initial screening, we need to further consider the security of the remediation cases in the case library.

[0119] Specifically, this process requires a security analysis of each remediation case. This includes checking whether the code in the remediation case contains known vulnerabilities and whether it has undergone security testing. Through these analyses, a comprehensive understanding of the security performance of each candidate remediation case can be obtained, ensuring that the final selected remediation cases are not only highly similar in numerical values ​​but also have high reliability in terms of security.

[0120] After identifying the repair case, the repair case and the code to be repaired can be combined to form a complete prompt message. This prompt message contains specific information about the code to be repaired and also incorporates the content from the repair case, providing a basis for generating a repair solution.

[0121] Finally, the prompt information is input into the first model, a pre-trained artificial intelligence model capable of generating vulnerability code remediation solutions. Upon receiving the prompt information, the first model generates a remediation solution corresponding to the code to be repaired based on its content. For simple vulnerability code, the first model can be used directly for processing; for complex vulnerability code, the Low-Rank Adaptation (LoRA) method can be used to fine-tune the first model.

[0122] S404. Determine whether the user has adopted the remediation plan generated by the first model. If the user has adopted the remediation plan, the vulnerable code is considered to be fixable, and the process ends; if the user has not adopted the remediation plan, proceed to S405.

[0123] In some implementations, if the repair solution is not adopted, the user obtains the self-repair code modified based on the code to be repaired;

[0124] The code to be repaired and the self-repairing code are used to build new code repair data, and the case library is updated based on the new code repair data.

[0125] S405. If the user does not adopt a repair solution, obtain the user's self-repair code and construct new code repair data based on the code to be repaired.

[0126] By monitoring user behavior regarding the recommended fix, it can be determined whether the fix has been adopted. If a user does not adopt the recommended fix within a certain period and the code problem persists, the fix is ​​considered not adopted. In this case, the user is asked to provide their own modifications based on the code to be fixed (i.e., self-healing code), and the code to be fixed and the self-healing code are combined to form new code fix data.

[0127] S406. Determine whether the new code repair data meets the preset standards. If it does, proceed to S407; otherwise, end the process.

[0128] Based on the new code repair data, the second model described above can be used to determine whether the code repair data meets the preset standards.

[0129] S407. Based on the new code repair data, generate corresponding repair knowledge, and integrate the code repair data and repair knowledge into repair cases, and update them to the case library.

[0130] If the code repair data meets the preset standards, repair knowledge for the code repair data is generated, and the code repair data and repair knowledge are integrated into a new repair case, which is then updated to the case library.

[0131] By combining user-provided self-healing code with code to be repaired, new code repair data can be created. This data can then be used to update the case library, which not only enriches the diversity of the case library but also improves the accuracy of repair solution generation when similar vulnerable code is encountered.

[0132] This disclosure also proposes a vulnerability remediation scheme generation device. Figure 5 This is a schematic diagram of a vulnerability remediation scheme generation apparatus 500 according to an embodiment of the present disclosure, including:

[0133] The first acquisition module 510 is used to acquire the code to be repaired;

[0134] The first determining module 520 is used to determine the first similarity between the code to be repaired and each repair case in the case library;

[0135] The extraction module 530 is used to extract the repair cases corresponding to the code to be repaired from the case library based on the first similarity.

[0136] The first input module 540 is used to input the code to be repaired and the corresponding repair case into the pre-trained first model to obtain the repair scheme for the code to be repaired.

[0137] In some implementations, the case library contains multiple repair cases;

[0138] The remediation case includes the vulnerability code and the remediation code.

[0139] In some implementations, the remediation case also includes at least one of the lines containing the vulnerability and the remediation knowledge.

[0140] In some implementations, the first determining module 520 is used for:

[0141] Determine the similarity between the code to be fixed and the vulnerable code in the fix case.

[0142] In some implementations, the first determining module 520 is used for:

[0143] Determine N feature types, where N is a positive integer;

[0144] Identify N primary features of the code to be repaired, each primary feature corresponding to a feature type; and identify N secondary features of the vulnerable code, each secondary feature corresponding to a feature type.

[0145] For N feature types, determine the similarity between the first feature and the second feature of each feature type to obtain N second similarity values;

[0146] The first similarity is determined based on N second similarities and the weights corresponding to N feature types.

[0147] This disclosure also proposes a vulnerability remediation scheme generation device. Figure 6 This is a schematic diagram of a vulnerability remediation scheme generation apparatus 600 according to an embodiment of the present disclosure. In some embodiments, it further includes:

[0148] The second determination module 650 is used to determine the case library using a pre-trained second model.

[0149] In some implementations, the second determining module is used for:

[0150] The code fixes the data and is then fed into a pre-trained second model;

[0151] Determine whether the code repair data meets the preset standards. If the code repair data meets the preset standards, generate corresponding repair knowledge based on the code repair data.

[0152] The code repair data and repair knowledge are identified as repair cases;

[0153] Based on the repair cases, a case library was determined.

[0154] In some embodiments, the hole repair scheme generation device 600 further includes:

[0155] The second acquisition module 660 is used to acquire the self-repair code modified by the user based on the code to be repaired when the repair solution is not adopted.

[0156] Update module 670, which is used to build new code repair data from the code to be repaired and the self-repairing code, and update the case library based on the new code repair data.

[0157] The specific functions and examples of each module and submodule of the apparatus in this disclosure can be found in the relevant descriptions of the corresponding steps in the above method embodiments, and will not be repeated here.

[0158] The acquisition, storage, and application of personal information by users involved in this technical solution comply with relevant laws and regulations and do not violate public order and good morals.

[0159] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0160] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0161] like Figure 7 As shown, device 700 includes a computing unit 701, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 702 or a computer program loaded from storage unit 708 into random access memory (RAM) 703. RAM 703 may also store various programs and data required for the operation of device 700. The computing unit 701, ROM 702, and RAM 703 are interconnected via bus 704. Input / output (I / O) interface 705 is also connected to bus 704.

[0162] Multiple components in device 700 are connected to I / O interface 705, including: input unit 706, such as keyboard, mouse, etc.; output unit 707, such as various types of monitors, speakers, etc.; storage unit 708, such as disk, optical disk, etc.; and communication unit 709, such as network card, modem, wireless transceiver, etc. Communication unit 709 allows device 700 to exchange / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0163] The computing unit 701 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above, such as detection methods. For example, in some embodiments, the detection method may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on device 700 via ROM 702 and / or communication unit 709. When the computer program is loaded into RAM 703 and executed by the computing unit 701, one or more steps of the detection method described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to perform the detection method by any other suitable means (e.g., by means of firmware).

[0164] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0165] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0166] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0167] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0168] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0169] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0170] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0171] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for generating a vulnerability remediation solution, comprising: The code fixes the data and is then fed into a pre-trained second model; The second model is used to determine whether the code repair data meets the preset standard. If the code repair data meets the preset standard, corresponding repair knowledge is generated based on the code repair data. The code repair data and the repair knowledge are identified as repair cases, and a case library is determined based on the repair cases. Obtain the code to be fixed; Determine the first similarity between the code to be repaired and each repair case in the case library; Based on the first similarity, extract the repair cases corresponding to the code to be repaired from the case library; The code to be repaired and the corresponding repair case are input into a pre-trained first model to obtain a repair scheme for the code to be repaired.

2. The method according to claim 1, wherein, The case library contains multiple of the aforementioned repair cases; The remediation case includes the vulnerability code and the remediation code.

3. The method according to claim 2, wherein, The remediation case also includes at least one of the lines containing the vulnerability and the remediation knowledge.

4. The method according to claim 2 or 3, wherein, Determining the first similarity between the code to be repaired and the repair case includes: Determine the similarity between the code to be repaired and the vulnerable code in the repair case.

5. The method according to claim 4, wherein, Determining the first similarity between the code to be repaired and the vulnerable code in the repair case includes: Determine N feature types, where N is a positive integer; N first features of the code to be repaired are determined, each first feature corresponding to a feature type; and N second features of the vulnerable code are determined, each second feature corresponding to a feature type. For each of the N feature types, the similarity between the first feature and the second feature of that feature type is determined to obtain N second similarities; The first similarity is determined based on the N second similarities and the weights corresponding to the N feature types.

6. The method according to claim 1, further comprising: If the repair solution is not adopted, obtain the self-repair code modified by the user based on the code to be repaired; The code to be repaired and the self-repairing code are used to construct new code repair data, and the case library is updated based on the new code repair data.

7. A vulnerability remediation solution generation device, comprising: The second determination module is used to input the code repair data into the pre-trained second model; The second model is used to determine whether the code repair data meets a preset standard. If the code repair data meets the preset standard, corresponding repair knowledge is generated based on the code repair data. The code repair data and the repair knowledge are identified as repair cases, and a case library is determined based on the repair cases. The first acquisition module is used to acquire the code to be repaired. The first determining module is used to determine the first similarity between the code to be repaired and each repair case in the case library; The extraction module is used to extract repair cases corresponding to the code to be repaired from the case library based on the first similarity. The first input module is used to input the code to be repaired and the corresponding repair case into a pre-trained first model to obtain a repair scheme for the code to be repaired.

8. The apparatus according to claim 7, wherein, The case library contains multiple of the aforementioned repair cases; The remediation case includes the vulnerability code and the remediation code.

9. The apparatus according to claim 8, wherein, The remediation case also includes at least one of the lines containing the vulnerability and the remediation knowledge.

10. The apparatus according to claim 8 or 9, wherein, The first determining module is used for: Determine the similarity between the code to be repaired and the vulnerable code in the repair case.

11. The apparatus according to claim 10, wherein, The first determining module is used for: Determine N feature types, where N is a positive integer; N first features of the code to be repaired are determined, each first feature corresponding to a feature type; and N second features of the vulnerable code are determined, each second feature corresponding to a feature type. For each of the N feature types, the similarity between the first feature and the second feature of that feature type is determined to obtain N second similarities; The first similarity is determined based on the N second similarities and the weights corresponding to the N feature types.

12. The apparatus according to claim 7, further comprising: The second acquisition module is used to acquire self-repair code modified by the user based on the code to be repaired when the repair solution is not adopted; The update module is used to construct new code repair data from the code to be repaired and the self-repairing code, and update the case library based on the new code repair data.

13. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-6.

14. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-6.

15. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1-6.

Images