Code vulnerability detection method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of vulnerability detection, and discloses a code vulnerability detection method and device, which are applied to performing vulnerability testing on a to-be-tested code, and the method comprises the following steps: acquiring vulnerability information and / or path information in a process of testing the to-be-tested code by using multiple test data; according to each piece of vulnerability information and / or each piece of path information, at least one piece of target test data is selected from the multiple pieces of test data according to a preset rule, and the vulnerability information and the path information corresponding to the at least one piece of target test data meet the preset rule; generating at least one test case based on the target test data and historical vulnerability data, wherein a historical code corresponding to the historical vulnerability data is the same as the to-be-tested code in type; the to-be-tested code is tested through the at least one test case, a test result is obtained, and the test result comprises the vulnerability data of the to-be-tested code, so that the technical effect of improving the code vulnerability detection efficiency and quality is achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability detection, and in particular to a method, device, computer equipment and storage medium for detecting code vulnerabilities. Background Art

[0002] At present, the traditional detection of code vulnerabilities relies on manual review, so the detection efficiency is low, it is greatly affected by subjective factors, and it is difficult to scale up, which leads to limitations and challenges when dealing with large-scale projects. With the growth of project scale and the shortening of development cycle, the traditional manual review method is increasingly unsuitable for the needs of modern software development. Therefore, how to improve the efficiency and quality of code vulnerability detection is an urgent problem to be solved. Summary of the invention

[0003] In view of this, the present invention provides a code vulnerability detection method, apparatus, computer equipment, and storage medium to solve the problem of how to improve the efficiency and quality of code vulnerability detection.

[0004] In a first aspect, the present invention provides a method for detecting code vulnerabilities, the method being applied to perform vulnerability testing on a code to be tested, the method comprising:

[0005] Acquire vulnerability information and / or path information in the process of testing the code to be tested using multiple test data, where one test data corresponds to one vulnerability information and / or one path information;

[0006] According to each of the above vulnerability information and / or each of the above path information, at least one target test data is selected from the multiple test data according to a preset rule, and the above vulnerability information and the above path information corresponding to the at least one target test data meet the above preset rule;

[0007] Generate at least one test case based on the target test data and the historical vulnerability data, where the historical code corresponding to the historical vulnerability data is of the same type as the code to be tested;

[0008] The code to be tested is tested using the at least one test case to obtain a test result, wherein the test result includes vulnerability data of the code to be tested.

[0009] A method for detecting code vulnerabilities provided by the present invention obtains vulnerability information and / or path information during the testing process of a code to be tested using multiple test data, selects at least one target test data that meets the preset rules from multiple test data according to each vulnerability information and / or path information, generates at least one test case based on the target test data and historical vulnerability data of the same type as the code to be tested, tests the code to be tested using the at least one test case, and obtains a test result including the vulnerability data of the target code to be tested. By combining multiple test data and historical vulnerability information, the code to be tested is screened using preset rules and test case generation is used to test the code to obtain vulnerability data, thereby significantly improving the accuracy, efficiency and comprehensiveness of code vulnerability detection, thereby achieving the technical effect of improving the efficiency and quality of code vulnerability detection.

[0010] In an optional implementation manner, the selecting at least one target test data from the plurality of test data according to each of the vulnerability information, each of the path information and a preset rule includes:

[0011] Based on each of the vulnerability information and / or each of the path information, determine a fitness parameter of each of the test data, wherein the fitness parameter includes at least one of the following parameters: a test speed parameter, a test richness parameter, and a test depth parameter;

[0012] According to each of the fitness parameters and the preset weight, determine the fitness value of each of the test data, one test data corresponds to one fitness value;

[0013] Compare each of the above fitness values ​​with the fitness threshold, and count all target fitness values ​​greater than the above fitness threshold, and determine the at least one target test data according to the relationship between each target fitness value and the test data.

[0014] The method provided in this embodiment can more accurately select test data that meets the requirements by analyzing the fitness of test data based on vulnerability information, path information and preset rules. The most representative target test data can be efficiently screened out by quantitatively evaluating the test data through fitness parameters. According to the fitness parameters of the test data, optimization is performed in combination with preset weights to ensure that the specific requirements of different test targets are met. Avoid the interference of redundant test data, thereby improving the efficiency and quality of the test.

[0015] In an optional implementation, the vulnerability information includes: vulnerability triggering time, number of vulnerability categories, and the path information includes: test path length, test path depth;

[0016] The determination of the fitness parameter of each of the test data based on each of the vulnerability information and / or each of the path information includes:

[0017] Selecting a minimum vulnerability triggering time from the vulnerability triggering times of the above-mentioned multiple test data; and determining a test speed parameter of each of the above-mentioned test data according to each of the above-mentioned vulnerability triggering times and the above-mentioned minimum vulnerability triggering time;

[0018] Alternatively, according to the number of vulnerability categories of each of the above test data, the total number of vulnerability categories of the above multiple test data is determined; and according to the number of each of the above vulnerability categories and the total number of vulnerability categories, the test richness parameter of each of the above test data is determined;

[0019] Alternatively, the minimum test path length and the minimum test path depth are respectively selected from the test path lengths and test path depths of the above-mentioned multiple test data; and the test depth parameter of each of the above-mentioned test data is determined according to each of the above-mentioned test path lengths and each of the above-mentioned test path depths, as well as the above-mentioned minimum test path length and the above-mentioned minimum test path depth.

[0020] The method provided in this embodiment determines the test speed parameters of the test data by selecting the minimum vulnerability triggering time from multiple test data, and according to the difference between the vulnerability triggering time of each test data and the minimum vulnerability triggering time. Accurate evaluation of the test speed is ensured, so that test data with a shorter vulnerability triggering time can be preferentially selected for subsequent vulnerability detection. By comparing the number of vulnerability categories of each test data with the total number of vulnerability categories of all test data, the test richness parameters of the test data can be effectively determined. Ensure that a wider range of vulnerability types are covered to avoid missing potential vulnerabilities. By selecting the minimum test path length and test path depth, and comparing them with the path length and depth of each test data, the test depth parameters of the test data can be accurately evaluated. It helps to identify test data that can deeply explore vulnerabilities and ensure the depth and comprehensiveness of vulnerability detection.

[0021] In an optional implementation, after the code to be tested is tested using the at least one test case to obtain a test result, the method further includes:

[0022] Get the test cases corresponding to the above vulnerability data;

[0023] Construct a simulation test environment for the above code to be tested;

[0024] In the above simulation test environment, the above test case is used to test the above code to obtain at least one verified vulnerability;

[0025] Based on a preset classification rule, the at least one verified vulnerability is classified to obtain a type of the at least one verified vulnerability.

[0026] The method provided in this embodiment can accurately simulate the vulnerability triggering situation in the actual operating environment by using test cases to test the code to be tested in a simulation test environment. The accuracy of the vulnerability verification is guaranteed. Compared with the traditional vulnerability testing directly in the actual environment, it can ensure that the vulnerability is reproduced more comprehensively and realistically, and reduce the test errors caused by environmental differences or external factors. After building a simulation test environment, a more controllable test can be performed on the code to be tested. Thereby ensuring that the verification of the vulnerability is not affected by unforeseen factors in the actual operating environment. This control capability makes vulnerability detection more reliable and can avoid omissions caused by uncontrollable factors.

[0027] In an optional implementation, in the simulation test environment, after testing the code to be tested using the test case and obtaining at least one verified vulnerability, the following steps are performed:

[0028] Prioritize each of the above validated vulnerabilities using the Common Vulnerability Scoring System;

[0029] Determine at least one target vulnerability according to the priority of each of the above verified vulnerabilities, wherein the priority of no target vulnerability is greater than a preset priority threshold;

[0030] Using a network vulnerability scanning tool, generating at least one repair solution corresponding to each of the at least one target vulnerability;

[0031] The at least one target vulnerability and the at least one corresponding repair solution are sent to a management terminal.

[0032] The method provided in this embodiment can objectively determine the priority of each verification vulnerability by utilizing a general vulnerability scoring system. According to the priority of the vulnerability, the target vulnerability that is most in need of repair is selected from multiple verification vulnerabilities. By setting a priority threshold, it is possible to flexibly screen out target vulnerabilities that meet the repair conditions, avoid interference from low-priority vulnerabilities, and make vulnerability repair work more efficient and targeted. By using a network vulnerability scanning tool to automatically generate a repair plan, the efficiency and accuracy of vulnerability repair can be significantly improved. The network vulnerability scanning tool can recommend specific repair measures based on the type and characteristics of the vulnerability. This automated method reduces the risk of manual judgment errors, ensures that the repair plan is more accurate, and can generate a processing plan in a short time to avoid human omissions and delays.

[0033] In an optional implementation, the generating of at least one test case based on the target test data and the historical vulnerability data includes:

[0034] Obtaining the behavior log corresponding to the above historical code, wherein the above behavior log includes multiple user historical operation information;

[0035] Determine the target user's historical operation information from the plurality of user's historical operation information;

[0036] Determine the target path information corresponding to the target user's historical operation information according to the correspondence between the target user's historical operation information and the path information;

[0037] Based on preset security rules, determine the target code area from the above historical codes;

[0038] The at least one test case is generated according to the target path information, the target code region, and the at least one target test data.

[0039] The method provided in this embodiment can more accurately determine the focus of the test by combining the historical operation information, path information and behavior log of historical code of the target user. Potential vulnerability points can be identified by analyzing the historical behavior of the target user. Through in-depth mining of historical vulnerability data, user operation logs and other information, potential vulnerability areas can be intelligently identified, rather than relying solely on static code review. Combining the association between path information and historical operations, the generated test cases can more accurately simulate the vulnerability situations that may be encountered in the actual environment. Through the behavior log of historical code and user operation information, the test strategy can be dynamically adjusted and the path can be selected for verification. This makes the test process not just a static coverage test, but an adaptive adjustment based on actual conditions, thereby improving the efficiency and accuracy of vulnerability detection.

[0040] In an optional implementation, before generating at least one test case based on the target test data and the historical vulnerability data, the method further includes:

[0041] Obtain multiple code samples with known vulnerabilities from a vulnerability database to form a code sample set;

[0042] Based on a preset classification rule, classify the code samples in the above code sample set to obtain a classified code sample set;

[0043] Based on the generative adversarial network, the above classified code sample set is expanded to obtain an expanded code sample set;

[0044] According to the type of the code to be tested, the historical code is searched from the expanded code sample set, and the historical vulnerability data is determined.

[0045] The method provided in this embodiment obtains code samples of multiple known vulnerabilities from a vulnerability database to form a code sample set, thereby ensuring that the test cases generated are based on more comprehensive and rich historical vulnerability data. It provides a more sufficient source of vulnerability information for subsequent test case generation, ensuring the breadth and depth of the test. By classifying the code sample set to obtain a classified code sample set, different types of vulnerabilities can be distinguished more accurately, and more targeted test cases can be designed for different categories of vulnerabilities. It can be based on dimensions such as vulnerability type, code structure, and usage environment, so that the test cases can focus on the specific characteristics of potential vulnerabilities and improve detection efficiency. According to the type of code to be tested, historical code is searched from the expanded code sample set, and historical vulnerability data is determined, which can effectively match the historical vulnerability data with the actual characteristics of the code to be tested, further improving the relevance of the test cases.

[0046] In a second aspect, the present invention provides a device for detecting code vulnerabilities, the device being applied to perform vulnerability testing on a code to be tested, the device comprising:

[0047] An acquisition module, used to acquire vulnerability information and / or path information in the process of testing the above-mentioned code to be tested using multiple test data, where one test data corresponds to one vulnerability information and / or one path information;

[0048] A selection module, configured to select at least one target test data from a plurality of test data according to each of the vulnerability information and / or each of the path information and a preset rule, wherein the vulnerability information and the path information corresponding to the at least one target test data conform to the preset rule;

[0049] A generation module, configured to generate at least one test case based on target test data and historical vulnerability data, wherein the historical code corresponding to the historical vulnerability data is of the same type as the code to be tested;

[0050] The test module is used to test the code to be tested using the at least one test case to obtain a test result, wherein the test result includes vulnerability data of the code to be tested.

[0051] The present invention provides a code vulnerability detection device, which selects the minimum vulnerability triggering time from multiple test data, and determines the test speed parameters of the test data according to the difference between the vulnerability triggering time of each test data and the minimum vulnerability triggering time. Accurate evaluation of the test speed is ensured, so that test data with a shorter vulnerability triggering time can be preferentially selected for subsequent vulnerability detection. By comparing the number of vulnerability categories of each test data with the total number of vulnerability categories of all test data, the test richness parameters of the test data can be effectively determined. Ensure that a wider range of vulnerability types are covered to avoid missing potential vulnerabilities. By selecting the minimum test path length and test path depth, and comparing them with the path length and depth of each test data, the test depth parameters of the test data can be accurately evaluated. It helps to identify test data that can deeply explore vulnerabilities and ensure the depth and comprehensiveness of vulnerability detection.

[0052] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the code vulnerability detection method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0053] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the method for detecting code vulnerabilities according to the first aspect or any corresponding embodiment thereof.

[0054] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions, wherein the computer instructions are used to enable a computer to execute the method for detecting code vulnerabilities in the above-mentioned first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0056] Figure 1 is one of the flow charts of the method for detecting code vulnerabilities according to an embodiment of the present invention;

[0057] Figure 2 This is a second flowchart of the method for detecting code vulnerabilities according to an embodiment of the present invention;

[0058] Figure 3is a schematic diagram of a device for detecting code vulnerabilities according to an embodiment of the present invention;

[0059] Figure 4 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0061] According to an embodiment of the present invention, an embodiment of a method for detecting a code vulnerability is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0062] In this embodiment, a method for detecting a code vulnerability is provided, which can be used for a computer. Figure 1 FIG. 1 is a flow chart of a method for detecting a code vulnerability according to an embodiment of the present invention. Figure 1 The method is used to test the vulnerability of the code under test, and the method includes:

[0063] Step S101 , obtaining vulnerability information and / or path information in the process of testing the code to be tested using multiple test data.

[0064] One test data corresponds to one vulnerability information and / or one path information. Test data can be randomly generated by fuzz testing tools. The code to be tested can be a software project, module, or code library. Vulnerability information can include all vulnerabilities found during the test, such as buffer overflow, null pointer reference, resource leakage, etc., or vulnerability pattern information. Path information can be the execution path of the program during the test, such as the execution flow under different conditional branches, or a node sequence.

[0065] One way to obtain vulnerability information and / or path information is to test the code to be tested multiple times and collect vulnerability information and path information for each test. Each test data corresponds to specific vulnerability information and path information. Vulnerability information refers to code problems found during execution, and path information refers to the execution path of the program during the test.

[0066] Step S102: selecting at least one target test data from a plurality of test data according to each vulnerability information and / or each path information and a preset rule.

[0067] The vulnerability information and path information corresponding to at least one target test data meet the preset rules. The preset rules may include criteria such as the severity of the vulnerability, the complexity of the path, or the type of the vulnerability.

[0068] One way to select at least one target test data is to select test data that meets preset rules as target test data according to the vulnerability pattern in the vulnerability information and the node sequence in the path information.

[0069] Step S103: Generate at least one test case based on the target test data and the historical vulnerability data.

[0070] The historical code corresponding to the historical vulnerability data is of the same type as the code to be tested. Test cases can be input data, operation sequences, and expected results that trigger vulnerabilities. Historical vulnerability data can include vulnerabilities found in similar codes in the past, and can have similar structure, logic, or functions to the code to be tested.

[0071] One way to generate test cases is: based on target test data and historical vulnerability data, the system generates test cases with corresponding input data, operation sequences and expected results.

[0072] Step S104: Use at least one test case to test the code to be tested and obtain a test result.

[0073] The test results include vulnerability data of the tested code.

[0074] One way to test the code to be tested is to input the input data in the test case into the code to be tested according to the operation sequence, and compare the output result with the expected result to determine the vulnerability data of the code to be tested as the test result.

[0075] A method for detecting code vulnerabilities provided by the present invention obtains vulnerability information and / or path information during the testing process of a code to be tested using multiple test data, selects at least one target test data that meets the preset rules from multiple test data according to each vulnerability information and / or path information, generates at least one test case based on the target test data and historical vulnerability data of the same type as the code to be tested, tests the code to be tested using the at least one test case, and obtains a test result including the vulnerability data of the target code to be tested. By combining multiple test data and historical vulnerability information, the code to be tested is tested using preset rule screening and test case generation to obtain vulnerability data, thereby significantly improving the accuracy, efficiency and comprehensiveness of code vulnerability detection, thereby achieving the technical effect of improving the efficiency and quality of code vulnerability detection.

[0076] In an optional implementation, in order to further select target test data, Figure 2 This is a second flowchart of the method for detecting code vulnerabilities according to an embodiment of the present invention, wherein the above step S102 includes:

[0077] Step S201: determining the fitness parameter of each of the test data based on each of the vulnerability information and / or each of the path information.

[0078] The above fitness parameters include at least one of the following parameters: test speed parameter, test richness parameter, test depth parameter. The test speed parameter can be a measure of the time or computing resources required for the test data during execution. Test data with faster test speed can usually be executed efficiently and is suitable for quickly verifying the stability of the program. The test richness parameter can be the number or type of code paths that the test data can touch during execution. The ability of test data to cover more code paths means that it can detect potential vulnerabilities more comprehensively. The test depth parameter can be a measure of the test data's ability to test the deep logic inside the code. It is related to whether the test data can go deep into more complex logic, branches or boundary conditions. Test data with greater depth can help identify deep potential vulnerabilities.

[0079] One way to determine fitness parameters is to determine test speed parameters and test richness based on the relative value of vulnerability information in the overall test data, and to determine test speed parameters and test depth parameters based on the relative value of path information in the overall test data.

[0080] Step S202: determining the fitness value of each of the test data according to each of the fitness parameters and the preset weight.

[0081] One test data corresponds to one fitness value. The preset weight can be a normalized value manually set in advance according to the detection requirements or detection scenarios.

[0082] One way to determine the fitness value is to sum the products of the test speed parameter, the test richness parameter, the test depth parameter and their corresponding preset weights, and use the sum result as the fitness value.

[0083] Step S203, comparing each of the above fitness values ​​with the fitness threshold, and counting all target fitness values ​​greater than the above fitness threshold, and determining the above at least one target test data according to the relationship between each target fitness value and the test data.

[0084] The fitness threshold is a pre-set value used to determine which test data has sufficient testing value.

[0085] One method of determining target test data is to compare each fitness value with a fitness threshold, screen out fitness values ​​greater than the fitness threshold, determine the corresponding test data, and use the corresponding test data as target test data.

[0086] The method provided in this embodiment can more accurately select test data that meets the requirements by analyzing the fitness of test data based on vulnerability information, path information and preset rules. The most representative target test data can be efficiently screened out by quantitatively evaluating the test data through fitness parameters. According to the fitness parameters of the test data, optimization is performed in combination with preset weights to ensure that the specific requirements of different test targets are met. Avoid the interference of redundant test data, thereby improving the efficiency and quality of the test.

[0087] In an optional implementation, in order to further determine the fitness parameters of the test data, the vulnerability information includes: vulnerability triggering time, number of vulnerability categories, and the path information includes: test path length, test path depth;

[0088] Vulnerability triggering time may refer to the time required for a vulnerability to be triggered during the test process. The shorter the time, the easier it is to trigger the vulnerability. The number of vulnerability categories may refer to the number of different vulnerability types involved in the execution of test data. If a test data can trigger more types of vulnerabilities, it means that its coverage is wider. Test path length may refer to the "length" of the path that the test data travels during the test process, that is, the number of lines of code involved in the code execution process. The longer the path length, the larger the code coverage of the test data. Test path depth may refer to the degree to which the test data can go deep into the code path, especially whether the test data can touch more complex logic, branches or nested structures. The greater the path depth, the more likely the test data can help discover deeper potential problems.

[0089] Step S201 includes:

[0090] A minimum vulnerability triggering time is selected from the vulnerability triggering times of multiple test data; and a test speed parameter of each test data is determined according to each vulnerability triggering time and the minimum vulnerability triggering time.

[0091] Alternatively, the total number of vulnerability categories of multiple test data is determined based on the number of vulnerability categories of each test data; and the test richness parameter of each test data is determined based on the number of each vulnerability category and the total number of vulnerability categories.

[0092] Alternatively, the minimum test path length and the minimum test path depth are respectively selected from the test path lengths and test path depths of multiple test data; and the test depth parameter of each test data is determined based on each test path length and each test path depth, as well as the minimum test path length and the minimum test path depth.

[0093] In this embodiment, the test speed parameter can be to select the minimum vulnerability triggering time from the vulnerability triggering times of multiple test data, that is, to find out which test data triggers the vulnerability earliest. For each test data, the ratio between its vulnerability triggering time and the minimum triggering time is calculated as the test speed parameter.

[0094] The test richness parameter can be to first calculate the total number of vulnerability categories of multiple test data, that is, the number of all different vulnerability types triggered in all test data. For each test data, calculate the ratio of its vulnerability category number to the total vulnerability category number as the test richness parameter.

[0095] The test depth parameter can be selected from the path lengths of all test data, and the shortest path length is selected to represent the simplest path in the execution process. From the path depths of all test data, the shallowest depth is selected to represent the shallowest path in the execution process. For each test data, the sum of its path length and path depth, and the sum of the minimum path length and the minimum path depth are calculated. The ratio of these two sums is used as the test depth parameter.

[0096] The method provided in this embodiment determines the test speed parameters of the test data by selecting the minimum vulnerability triggering time from multiple test data, and according to the difference between the vulnerability triggering time of each test data and the minimum vulnerability triggering time. Accurate evaluation of the test speed is ensured, so that test data with a shorter vulnerability triggering time can be preferentially selected for subsequent vulnerability detection. By comparing the number of vulnerability categories of each test data with the total number of vulnerability categories of all test data, the test richness parameters of the test data can be effectively determined. Ensure that a wider range of vulnerability types are covered to avoid missing potential vulnerabilities. By selecting the minimum test path length and test path depth, and comparing them with the path length and depth of each test data, the test depth parameters of the test data can be accurately evaluated. It helps to identify test data that can deeply explore vulnerabilities and ensure the depth and comprehensiveness of vulnerability detection.

[0097] In an optional implementation, in order to further reproduce the test result, after step S104, the following is further included:

[0098] Obtain test cases corresponding to the above vulnerability data; construct a simulation test environment for the above code to be tested; in the above simulation test environment, use the above test cases to test the above code to be tested to obtain at least one verified vulnerability; based on preset classification rules, classify the above at least one verified vulnerability to obtain the type of the above at least one verified vulnerability.

[0099] In this embodiment, relevant test cases are extracted based on previous test results. The simulation environment simulates real system operating conditions, including hardware, operating system, library dependencies, network conditions, etc. After the simulation test environment is set up, the acquired test cases, i.e., the input data related to the previously identified vulnerabilities, are used to test the code to be tested. The test cases are run in the simulation environment to verify whether the code to be tested triggers the corresponding vulnerability. The test results will confirm whether the vulnerability is reproduced in the simulation environment. Even in different environments, whether the vulnerability still exists and whether it can be triggered repeatedly.

[0100] The method provided in this embodiment can accurately simulate the vulnerability triggering situation in the actual operating environment by using test cases to test the code to be tested in a simulation test environment. The accuracy of the vulnerability verification is guaranteed. Compared with the traditional vulnerability testing directly in the actual environment, it can ensure that the vulnerability is reproduced more comprehensively and realistically, and reduce the test errors caused by environmental differences or external factors. After building a simulation test environment, a more controllable test can be performed on the code to be tested. Thereby ensuring that the verification of the vulnerability is not affected by unforeseen factors in the actual operating environment. This control capability makes vulnerability detection more reliable and can avoid omissions caused by uncontrollable factors.

[0101] In an optional implementation, in order to further repair the vulnerability, in the above-mentioned simulation test environment, the above-mentioned code to be tested is tested using the above-mentioned test case, and after obtaining at least one verified vulnerability, the following steps are included:

[0102] Using a common vulnerability scoring system, determine the priority of each of the above-verified vulnerabilities; according to the priority of each of the above-verified vulnerabilities, determine at least one target vulnerability, and none of the above-mentioned target vulnerabilities has a priority greater than a preset priority threshold; using a network vulnerability scanning tool, generate at least one repair plan corresponding to each of the above-mentioned at least one target vulnerability; send the above-mentioned at least one target vulnerability and the above-mentioned at least one corresponding repair plan to the management end.

[0103] In this embodiment, after obtaining at least one verified vulnerability, the system will score each verified vulnerability according to the Common Vulnerability Scoring System (CVSS). CVSS is a standardized vulnerability assessment tool that considers multiple factors (such as the severity of the vulnerability, the ease of exploitation, the scope of the vulnerability, etc.) to give a priority score. Priorities are assigned to all verified vulnerabilities, and a preset priority threshold needs to be set. The target vulnerability is a vulnerability with a priority higher than or equal to the set threshold. The generation of a repair plan usually relies on a network vulnerability scanning tool that can automatically detect vulnerabilities and provide recommended repair measures based on the type of vulnerability. The network vulnerability scanning tool generates a repair plan based on the following factors: the type of vulnerability (such as buffer overflow, SQL injection, etc.); the affected system or software version; the solution to the vulnerability (such as code repair, configuration change, patch installation, etc.). After the repair plan is generated, each target vulnerability and the corresponding repair plan are sent to the management end.

[0104] The method provided in this embodiment can objectively determine the priority of each verification vulnerability by utilizing a general vulnerability scoring system. According to the priority of the vulnerability, the target vulnerability that is most in need of repair is selected from multiple verification vulnerabilities. By setting a priority threshold, it is possible to flexibly screen out target vulnerabilities that meet the repair conditions, avoid interference from low-priority vulnerabilities, and make vulnerability repair work more efficient and targeted. By using a network vulnerability scanning tool to automatically generate a repair plan, the efficiency and accuracy of vulnerability repair can be significantly improved. The network vulnerability scanning tool can recommend specific repair measures based on the type and characteristics of the vulnerability. This automated method reduces the risk of manual judgment errors, ensures that the repair plan is more accurate, and can generate a processing plan in a short time to avoid human omissions and delays.

[0105] In an optional implementation, in order to further accurately generate test cases, step S103 includes:

[0106] Obtain a behavior log corresponding to the above historical code, wherein the above behavior log includes historical operation information of multiple users; determine the historical operation information of the target user from the historical operation information of the multiple users; determine the target path information corresponding to the historical operation information of the target user based on the correspondence between the historical operation information of the target user and the path information; determine the target code area from the historical code based on preset security rules; generate the at least one test case based on the target path information, the target code area, and the at least one target test data.

[0107] In this embodiment, the behavior log is log data that records user operation information. It contains the user's historical operations in the system, such as clicks, inputs, page browsing, API calls, etc. Each operation may be accompanied by a specific timestamp, operation content, user identifier and other information. The target user's historical operation information may be information related to the target path information. The preset security rules may be security standards or inspection rules set in advance based on security requirements and vulnerability protection requirements. When generating test cases, the following information may be combined: Target path information: The user's historical operation path represents the user's operation process. Target code area: The part that needs to be tested in focus determined from the code may be code related to the user's operation path. Target test data: Test data prepared for executing test cases, which may be simulated user input, operation data, or preset test conditions.

[0108] The method provided in this embodiment can more accurately determine the focus of the test by combining the historical operation information, path information and behavior log of historical code of the target user. Potential vulnerability points can be identified by analyzing the historical behavior of the target user. Through in-depth mining of historical vulnerability data, user operation logs and other information, potential vulnerability areas can be intelligently identified, rather than relying solely on static code review. Combining the association between path information and historical operations, the generated test cases can more accurately simulate the vulnerability situations that may be encountered in the actual environment. Through the behavior log of historical code and user operation information, the test strategy can be dynamically adjusted and the path can be selected for verification. This makes the test process not just a static coverage test, but an adaptive adjustment based on actual conditions, thereby improving the efficiency and accuracy of vulnerability detection.

[0109] In an optional implementation, in order to further accurately determine the historical vulnerability data, before step S103, the following is further included:

[0110] A plurality of code samples with known vulnerabilities are obtained from a vulnerability database to form a code sample set; based on a preset classification rule, the code samples in the above code sample set are classified to obtain a classified code sample set; based on a generative adversarial network, the above classified code sample set is expanded to obtain an expanded code sample set; according to the type of the above code to be tested, the above historical code is searched from the above expanded code sample set, and the above historical vulnerability data is determined.

[0111] In this embodiment, by collecting multiple code samples with known vulnerabilities into a set, preparation can be made for subsequent vulnerability analysis and expansion. After classification, the code sample set will be divided into multiple subsets, each of which contains vulnerability codes of similar types or similar characteristics. This classification helps to focus on different types of vulnerabilities and conduct in-depth analysis for different scenarios. The classified code sample set is expanded by generating an adversarial network. According to the type of the code to be tested, historical codes with similar structure, logic or function to the code to be tested can be found from the expanded code sample set. Through the search process, historical codes with similar vulnerability characteristics can be found from the expanded code samples, and the vulnerabilities existing in these historical codes can be determined.

[0112] The method provided in this embodiment obtains code samples of multiple known vulnerabilities from a vulnerability database to form a code sample set, thereby ensuring that the test cases generated are based on more comprehensive and rich historical vulnerability data. It provides a more sufficient source of vulnerability information for subsequent test case generation, ensuring the breadth and depth of the test. By classifying the code sample set to obtain a classified code sample set, different types of vulnerabilities can be distinguished more accurately, and more targeted test cases can be designed for different categories of vulnerabilities. It can be based on dimensions such as vulnerability type, code structure, and usage environment, so that the test cases can focus on the specific characteristics of potential vulnerabilities and improve detection efficiency. According to the type of code to be tested, historical code is searched from the expanded code sample set, and historical vulnerability data is determined, which can effectively match the historical vulnerability data with the actual characteristics of the code to be tested, further improving the relevance of the test cases.

[0113] In an optional implementation, in order to further accurately detect code vulnerabilities, after the above step S104, it also includes: performing static and dynamic analysis on the code to be tested, obtaining the control flow graph (CFG) and data flow graph (DFG) of the code to be tested, as well as the execution path information and function call stack generated at runtime.

[0114] Based on static analysis and dynamic analysis information, high-risk areas in the code to be tested are identified, especially code snippets that may lead to security vulnerabilities, such as improper input validation, buffer overflow, database injection, etc.

[0115] Based on the vulnerability types and locations in historical vulnerability data and the potential vulnerability areas of the code to be tested, the paths and conditions that the test cases should cover are determined, thereby generating a set of test cases with efficient vulnerability detection capabilities, ensuring that the code paths most likely to have vulnerabilities can be touched during the testing process.

[0116] By simulating and verifying the generated test cases, we ensure that each test case can effectively discover potential vulnerabilities in actual testing, optimize the test case coverage and vulnerability discovery rate, and improve the overall vulnerability detection quality.

[0117] In addition, an embodiment of the present invention also provides a device for detecting code vulnerabilities. Figure 3 is a schematic diagram of a device for detecting code vulnerabilities according to an embodiment of the present invention, such as Figure 3 As shown, the detection device is used to perform vulnerability testing on the code to be tested, and the above device includes:

[0118] The acquisition module 301 is used to acquire vulnerability information and / or path information in the process of testing the above-mentioned code to be tested using multiple test data, and one test data corresponds to one vulnerability information and / or one path information.

[0119] The selection module 302 is used to select at least one target test data from multiple test data according to each of the above-mentioned vulnerability information and / or each of the above-mentioned path information and according to preset rules, and the above-mentioned vulnerability information and the above-mentioned path information corresponding to the above-mentioned at least one target test data meet the above-mentioned preset rules.

[0120] The generating module 303 is used to generate at least one test case based on the target test data and the historical vulnerability data, wherein the historical code corresponding to the historical vulnerability data is of the same type as the code to be tested.

[0121] The testing module 304 is used to test the code to be tested using the at least one test case to obtain a test result, wherein the test result includes vulnerability data of the code to be tested.

[0122] The present invention provides a code vulnerability detection device, which selects the minimum vulnerability triggering time from multiple test data, and determines the test speed parameters of the test data according to the difference between the vulnerability triggering time of each test data and the minimum vulnerability triggering time. Accurate evaluation of the test speed is ensured, so that test data with a shorter vulnerability triggering time can be preferentially selected for subsequent vulnerability detection. By comparing the number of vulnerability categories of each test data with the total number of vulnerability categories of all test data, the test richness parameters of the test data can be effectively determined. Ensure that a wider range of vulnerability types are covered to avoid missing potential vulnerabilities. By selecting the minimum test path length and test path depth, and comparing them with the path length and depth of each test data, the test depth parameters of the test data can be accurately evaluated. It helps to identify test data that can deeply explore vulnerabilities and ensure the depth and comprehensiveness of vulnerability detection.

[0123] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0124] The code vulnerability detection device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0125] The embodiment of the present invention also provides a computer device having the above Figure 3 The code vulnerability detection device is shown.

[0126] See also Figure 4 , Figure 4 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 4 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 4 A processor 10 is taken as an example.

[0127] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include an integrated circuit. The integrated circuit may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0128] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0129] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0130] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0131] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0132] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0133] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0134] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for detecting code vulnerabilities, characterized in that: The method is applied to perform vulnerability testing on a code to be tested, and the method comprises: Acquire vulnerability information and / or path information in the process of testing the code to be tested using multiple test data, where one test data corresponds to one vulnerability information and / or one path information; According to each of the vulnerability information and / or each of the path information, at least one target test data is selected from the plurality of test data according to a preset rule, and the vulnerability information and the path information corresponding to the at least one target test data conform to the preset rule; Generate at least one test case based on target test data and historical vulnerability data, where the historical code corresponding to the historical vulnerability data is of the same type as the code to be tested; The code to be tested is tested using the at least one test case to obtain a test result, wherein the test result includes vulnerability data of the code to be tested.

2. The method according to claim 1, characterized in that The selecting at least one target test data from the plurality of test data according to each of the vulnerability information, each of the path information and the preset rule comprises: Based on each of the vulnerability information and / or each of the path information, determine a fitness parameter for each of the test data, the fitness parameter comprising at least one of the following parameters: a test speed parameter, a test richness parameter, and a test depth parameter; Determine the fitness value of each test data according to each fitness parameter and a preset weight, one test data corresponds to one fitness value; Compare each of the fitness values ​​with the fitness threshold, count all target fitness values ​​greater than the fitness threshold, and determine the at least one target test data according to the relationship between each target fitness value and the test data.

3. The method according to claim 2, characterized in that The vulnerability information includes: vulnerability triggering time, number of vulnerability categories, and the path information includes: test path length, test path depth; The determining of the fitness parameter of each test data based on each vulnerability information and / or each path information includes: Selecting a minimum vulnerability triggering time from the vulnerability triggering times of the plurality of test data; and determining a test speed parameter of each of the test data according to each of the vulnerability triggering times and the minimum vulnerability triggering time; Alternatively, according to the number of vulnerability categories of each of the test data, the total number of vulnerability categories of the multiple test data is determined; and according to the number of each of the vulnerability categories and the total number of vulnerability categories, the test richness parameter of each of the test data is determined; Alternatively, the minimum test path length and the minimum test path depth are respectively selected from the test path lengths and test path depths of the multiple test data; and the test depth parameter of each test data is determined according to each test path length and each test path depth, as well as the minimum test path length and the minimum test path depth.

4. The method according to any one of claims 1 to 3, characterized in that: After testing the code to be tested by using the at least one test case to obtain a test result, the method further includes: Obtaining test cases corresponding to the vulnerability data; Constructing a simulation test environment for the code to be tested; In the simulation test environment, the code to be tested is tested using the test case to obtain at least one verified vulnerability; Based on a preset classification rule, the at least one verified vulnerability is classified to obtain a type of the at least one verified vulnerability.

5. The method according to claim 4, characterized in that In the simulation test environment, after the code to be tested is tested using the test case and at least one verified vulnerability is obtained, the method includes: Prioritizing each of said validated vulnerabilities using a Common Vulnerability Scoring System; Determining at least one target vulnerability according to the priority of each of the verified vulnerabilities, wherein no target vulnerability has a priority greater than a preset priority threshold; Using a network vulnerability scanning tool, generating at least one repair solution corresponding to each of the at least one target vulnerability; The at least one target vulnerability and the corresponding at least one repair solution are sent to a management terminal.

6. The method according to any one of claims 1 to 3, characterized in that: The generating at least one test case based on the target test data and the historical vulnerability data includes: Obtaining a behavior log corresponding to the historical code, wherein the behavior log includes a plurality of user historical operation information; Determining target user historical operation information from the plurality of user historical operation information; Determine the target path information corresponding to the target user's historical operation information according to the correspondence between the target user's historical operation information and the path information; Based on preset security rules, determining a target code area from the historical code; The at least one test case is generated according to the target path information, the target code area, and the at least one target test data.

7. The method according to any one of claims 1 to 3, characterized in that: Before generating at least one test case based on the target test data and the historical vulnerability data, the method further includes: Obtain multiple code samples with known vulnerabilities from a vulnerability database to form a code sample set; Based on a preset classification rule, classify the code samples in the code sample set to obtain a classified code sample set; Based on a generative adversarial network, expanding the classified code sample set to obtain an expanded code sample set; According to the type of the code to be tested, the historical code is searched from the expanded code sample set, and the historical vulnerability data is determined.

8. A device for detecting code vulnerabilities, characterized in that: The device is used to perform vulnerability testing on the code to be tested, and the device comprises: An acquisition module, used for acquiring vulnerability information and / or path information in the process of testing the code to be tested using multiple test data, where one test data corresponds to one vulnerability information and / or one path information; A selection module, configured to select at least one target test data from a plurality of test data according to a preset rule based on each vulnerability information and / or each path information, wherein the vulnerability information and the path information corresponding to the at least one target test data conform to the preset rule; A generating module, configured to generate at least one test case based on target test data and historical vulnerability data, wherein the historical code corresponding to the historical vulnerability data is of the same type as the code to be tested; The testing module is used to test the code to be tested using the at least one test case to obtain a test result, wherein the test result includes vulnerability data of the code to be tested.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the code vulnerability detection method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the code vulnerability detection method according to any one of claims 1 to 7.

Images