Code data access relation extraction method and system for data security check

Abstract

The invention provides a data security check-oriented code data access relation extraction method and system, and the method comprises the following steps: S1, processing a to-be-analyzed code file in a. Jar format, and outputting a coarse-grained data access relation graph; s2, constructing and outputting a corresponding list of method nodes and code directories based on the code file and the coarse-grained data access relation graph; and S3, based on the code file and the coarse-grained data access relation graph, constructing an access relation list between role nodes and database fields. By utilizing the characteristics of Java language and the natural language understanding ability of a large language model, the problem of automatic extraction of the database field access relation by role nodes in website source codes is solved, the input java website source codes can be analyzed, a complete calling link from a user to the database field is extracted, and the user experience is improved. And the specific return condition and verification condition of the data field can be judged, so that an accurate data access extraction effect is achieved.

Description

Technical Field

[0001] The present invention relates to the field of computer testing, and in particular to a method and system for extracting access relations between roles and database fields in website project source code for data security verification. Background Art

[0002] In today's digital age, data security has become a crucial issue. my country has successively promulgated laws and regulations emphasizing the need for the country to build a complete data security governance system, improve data security protection capabilities, coordinate data security and development processes, and make detailed and clear regulations on data security systems and the obligations of data processors.

[0003] For website service providers, strictly following my country's data classification and data security protection standards is the key to ensuring data security. Specifically, the first task is to clearly define the scope of permissions and access levels of different roles in the system, and effectively implement the principle of least privilege to ensure that each role can only access the database fields required for their work, thereby effectively reducing the risk of data leakage. Secondly, it is necessary to classify and label the data according to its sensitivity and importance, and implement hierarchical management of database fields to ensure that highly sensitive data can only be accessed by specific authorized personnel.

[0004] In the context of data security verification, the extraction of code data access relationships is particularly critical. Accurately extracting this relationship can help organizations better understand who has access to which data in the database, thereby providing strong support for efficient monitoring and management of data access rights, and timely detecting potential security risks such as unauthorized access or data leakage.

[0005] Currently, there are significant differences between the code data access relationship extraction method and the widely used code vulnerability detection. Code data access relationship focuses on analyzing the access relationship between roles and database fields in the code, aiming to effectively ensure data security; while source code vulnerability detection is committed to discovering potential security vulnerabilities and errors in the code, thereby making up for possible weaknesses in the system.

[0006] As for the method of extracting the data access relationship of software code, the traditional static code analysis method accurately identifies various elements such as variables, data structures, functions, classes, logical statements and constant values ​​in the source code, and deeply explores the complex relationships and constraints between these elements, and analyzes and extracts the source code, or converts the source code into a relational code data model library (such as the method of extracting the code data model library based on the source code file provided by patent CN118626134A), or extracts the calling relationship of the code file by file, and finally integrates it to form a call relationship diagram of the project (such as patent CN118192986A provides a JAVA code association analysis method based on IDEA). However, this type of static code analysis method has limitations. It can only be limited to the analysis of the structure or calling relationship of the code, and cannot accurately extract the details of the code's access operation to the database.

[0007] Another existing method is to perform a full scan of SQL operation statements based on applications, so as to extract all database fields and tables involved in an application access (such as patent CN103902565A provides a method and device for determining data access relations), but the data access relationship extraction granularity of this method is too coarse, and it is difficult to meet the fine requirements of data access extraction based on application roles. With the rapid development of deep learning technology, especially large language models, the excellent natural language understanding ability of machine learning models has also been widely used in code understanding, code analysis, and code generation. Large language models are often used for code optimization analysis, and potential anomalies in software codes are analyzed (a method for automatic repair of code static analysis warnings based on large models, CN118838824A). Deep learning is also commonly used for code vulnerability detection and identification, inputting code sample fragments to be detected, and detecting whether there are vulnerabilities in the code (a method and system for code vulnerability detection for network security, CN116226864A). With the rapid development of deep learning technology, especially large language models, the excellent natural language understanding ability of machine learning models has been widely infiltrated into fields such as code understanding, analysis and generation. Currently, large language models are mainly used in code optimization analysis, focusing on analyzing potential anomalies in software code (for example, patent CN118838824A provides a method for automatically repairing code static analysis warnings based on a large model); deep learning technology is also commonly used in code vulnerability detection and identification, by inputting sample fragments of the code to be detected to determine whether there are vulnerabilities in the code (for example, patent CN116226864A provides a code vulnerability detection method and system for network security).

[0008] Although the above code data access relationship extraction methods can extract method call relationships and some data access relationships to a certain extent, they generally lack the ability to extract data field access relationships for roles, and cannot effectively meet the strict requirements of data access security verification. In addition, existing methods of analyzing code using deep learning or large language models mostly focus on code quality detection and only analyze continuous code fragments, making it difficult to achieve the goal of joint analysis of access relationships across multiple files.

[0009] In summary, in view of the above-mentioned problems of the prior art, studying a method and system for extracting the access relationship between roles and database fields in the source code of a website project for data security verification has become a key task that needs to be solved urgently. Summary of the invention

[0010] In view of the defects in the prior art, the purpose of the present invention is to provide a method and system for extracting code data access relations for data security verification.

[0011] According to the present invention, a method for extracting code data access relations for data security verification includes the following steps:

[0012] Step S1, input the code file in .jar format to be analyzed, and output the coarse-grained data access relationship graph in the form of a graph database after processing;

[0013] Step S2, based on the code file in .jar format to be analyzed and the coarse-grained data access relationship graph, construct and output a corresponding list of method nodes and code directories;

[0014] Step S3, based on the code file in .jar format to be analyzed and the coarse-grained data access relationship diagram, build an access relationship list between role nodes and database fields for data security verification.

[0015] Preferably, step S1 includes the following sub-steps:

[0016] Step S1.1, extract the relationship between class and method nodes:

[0017] Step S1.2, extract the binding relationship between the front-end page and the method node:

[0018] Step S1.3, extracting the persistence layer data access operation.

[0019] Preferably, step S1.1 includes the following sub-steps:

[0020] Step S1.1.1, read the code file in .jar format to be analyzed, and extract all files ending with '.class' after parsing;

[0021] Step S1.1.2, parse each file ending with '.class', collect class information, obtain the class name, the package level to which it belongs, the list of method nodes it contains, and traverse the method node code in the file to collect the call information in the method node;

[0022] Step S1.1.3, create corresponding packages, classes, and method nodes in the graph database, and add the call relationships between the extracted method nodes;

[0023] Step S1.1.4, create the implementation relationship between classes in the database, and supplement the relationship between the interface and the interface implementation class.

[0024] Preferably, step S1.2 includes the following sub-steps:

[0025] Step S1.2.1, read the source code package and construct a code structure in the form of an abstract syntax tree;

[0026] Step S1.2.2: for each method node, first access the parent node of the method node, i.e., the class node, to obtain the annotation information of the class. If the annotation involves URL parameters, extract the parameters, then read the annotation information of the method node, extract the URL parameters, and concatenate them with the class annotation parameters to obtain the URL parameters corresponding to the method node.

[0027] Step S1.2.3, create a corresponding URL node in the graph database and establish an access relationship with the corresponding method node.

[0028] Preferably, step S1.3 includes the following sub-steps:

[0029] Step S1.3.1, read the source code package, parse it and extract all files ending with '.xml';

[0030] Step S1.3.2, parse each file ending with '.xml', read each SQL statement in it in turn, first determine the statement type, and then extract the data field name, data table name, and method node name according to the statement type;

[0031] Step S1.3.3, create corresponding fields and table nodes in the graph database, and establish access relationships with corresponding method nodes.

[0032] Preferably, step S2 includes the following sub-steps:

[0033] Step S2.1, traversing all method nodes in the coarse-grained data access relationship graph obtained in step S1;

[0034] Step S2.2, for each method node, obtain the class and package information that defines the method node, and splice the class and package information into a relative path as the attribute of the method node;

[0035] Step S2.3, for method nodes that have access to database field relationships, obtain the name of the class node that defines the method node, and search for a file named "class node name.xml" in the code directory. If the corresponding file is successfully found, add the file path to the properties of the method node.

[0036] Preferably, step S3 includes the following sub-steps:

[0037] Step S3.1, based on the corresponding list of method nodes and code directories and the coarse-grained data access relationship diagram, by parsing the XML file, analyzing the database access operation, and obtaining the analysis results of the method nodes of the XML file;

[0038] Step S3.2, based on the analysis results of the method nodes in the XML file, analyze the function descriptions, parameter forms, return values, and database field access status of the remaining method nodes in the coarse-grained data access relationship graph to obtain the analysis results of the remaining method nodes in the coarse-grained data access relationship graph; thereby obtaining the analysis results of all method nodes in the coarse-grained data access relationship graph;

[0039] Step S3.3, role node data access summary: For each URL node in the coarse-grained data access relationship graph, find all method nodes that have a relationship with the URL node, summarize the analysis results of the method nodes, and obtain a list of access relationships between the URL node and the database fields; for each role node in the coarse-grained data access relationship graph, find all URL nodes that have a relationship with the role node, summarize the list of access relationships between the URL node and the database fields, and obtain a list of access relationships between the role node and the database fields.

[0040] Preferably, step S3.1 includes the following sub-steps:

[0041] Step S3.1.1, based on the corresponding list of method nodes and code directories, read the XML files in the corresponding directories one by one, parse each database operation statement therein using the prompt words, extract the "id" of each statement, the parameters passed in by the statement, the behavior of the statement, the return value of the statement, whether the statement has a verification process, and form the XML analysis result;

[0042] Step S3.1.2, find the corresponding persistence layer class node through the path attribute in the coarse-grained data access relationship diagram, and locate the corresponding method node in the corresponding list of method nodes and code directories obtained in step S2 through the "id" in the XML analysis result, and add the XML analysis result as an attribute of the method node.

[0043] Preferably, step S3.2 includes the following sub-steps:

[0044] Step S3.2.1, for any method node in the coarse-grained data access relationship graph, read the path attribute of the corresponding class node, locate the location of the code file, and read the code file as the input of the large language model;

[0045] Step S3.2.2, for any method node determined in step S3.2.1, first search for all associated method nodes called by the method node, read the function description, parameter requirements, restrictions, and database field attributes involved in access of each associated method node as supplementary information for the large language model;

[0046] Step S3.2.3, using the prompt words in conjunction with the code file read in step S3.2.1 and the supplementary information obtained in step S3.2.2, analyze the function description, input parameters, input parameter form, method node return value, and database field access involved in the method node determined in step S3.2.1, and add the analysis results as attributes to the method node;

[0047] Step S3.2.4, starting from the bottom-level database access operation, access the upper-level method nodes in sequence, analyze them according to the process from step S3.2.1 to step S3.2.3, and add them as attributes until reaching the front-end URL node.

[0048] The present invention also provides a code data access relationship extraction system for data security verification, comprising:

[0049] The coarse-grained data access relationship extraction subsystem inputs the .jar format code file to be analyzed, and after processing, outputs the coarse-grained data access relationship graph in the form of a graph database;

[0050] The code directory mapping subsystem builds and outputs a corresponding list of method nodes and code directories based on the .jar format code files to be analyzed and the coarse-grained data access relationship graph;

[0051] The large language model enhanced analysis subsystem builds an access relationship list between role nodes and database fields based on the .jar format code file to be analyzed and the coarse-grained data access relationship diagram for data security verification.

[0052] Compared with the prior art, the present invention has the following beneficial effects:

[0053] 1. The present invention utilizes the characteristics of the Java language and the natural language understanding ability of the large language model to solve the problem of automatically extracting the access relationship between roles and database fields in the website source code. It can analyze the input Java website source code, extract the complete call link from the user to the database field, and determine the specific return status and verification conditions of the data field, thereby achieving accurate data access extraction effect.

[0054] 2. In the scenario of data security verification, the present invention realizes the extraction of data access relationships of website source code and obtains the access relationship of "role-page-database field", which is convenient for the verifier to directly make compliance judgments against the data security specifications. It can greatly reduce the workload of the verifier in reading and understanding the code and manually combing the data access relationship, and significantly improve the verification efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0056] Figure 1 A flowchart of code data access relationship extraction in an embodiment of the present invention;

[0057] Figure 2 This is an example of a coarse-grained code data access relationship extraction result in an embodiment of the present invention;

[0058] Figure 3 This is an example of the complete code data access relationship extraction result in an embodiment of the present invention. DETAILED DESCRIPTION

[0059] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0060] The present invention aims to solve the problem of automatically extracting the access relationship between roles and database fields in the source code of a website, and proposes a method and system for extracting code data access relationship for data security verification. The present invention uses the characteristics of code language to construct coarse-grained data access relationship, assists the large language model in directional file reading and code analysis, and then accurately extracts the access relationship between roles and database fields. After the access relationship extraction, the front-end pages that can be accessed by each role, as well as the names of the database fields that can be accessed by the front-end pages and the corresponding restrictions are obtained, so as to verify the compliance of data security access control.

[0061] Embodiment 1:

[0062] This embodiment provides a method for extracting code data access relationships for data security verification, which specifically involves analyzing a Java website source code project, including the following steps:

[0063] Step S1, input the code file in .jar format to be analyzed, and output the coarse-grained data access relationship graph in the form of a graph database after processing.

[0064] Specifically, the coarse-grained data access relationship extraction process is as follows: First, the access and inclusion relationship between data classes and method nodes, the binding relationship between the front-end page and the back-end method nodes, and the access relationship between method nodes and database fields need to be obtained. By integrating this information, an access path extending from the front-end page to the database field can be constructed. In terms of specific implementation methods, the Java reflection mechanism, abstract syntax tree, and method nodes parsed by the persistence layer configuration file are used to obtain each part of the information.

[0065] Specifically, step S1 includes the following sub-steps:

[0066] Step S1.1, extract the relationship between class and method nodes.

[0067] Specifically, through the Java reflection mechanism, class, method nodes, attributes and other information are analyzed and operated at runtime without determining this information at compile time. The reflection mechanism is used to obtain the class information in the .jar package, including the method nodes, attributes and other contents of the class. The caller and the callee of the method node are then determined through the reflection mechanism to build the call relationship between the method nodes. When traversing the method nodes in the class node, the information of the method nodes can be obtained one by one, including the method node name, parameter type, etc., and then the call relationship diagram between the method nodes can be built.

[0068] More specifically, step S1.1 includes the following sub-steps:

[0069] Step S1.1.1, read the code file in .jar format to be analyzed, and extract all files ending with '.class' after parsing.

[0070] Step S1.1.2, parse each file ending with '.class', collect class information, obtain the class name, the package level to which it belongs, the list of method nodes it contains, and traverse the method node code in the file to collect the call information in the method node.

[0071] Step S1.1.3, create corresponding packages, classes, and method nodes in the graph database, and add the calling relationships between the extracted method nodes.

[0072] Step S1.1.4, create the implementation relationship between classes in the database, and supplement the relationship between the interface and the interface implementation class.

[0073] Step S1.2, extract the binding relationship between the front-end page and the method node.

[0074] Specifically, when extracting annotations through the abstract syntax tree, the source code can be parsed and the annotation information can be identified. Some annotations contain metadata such as URLs bound to method nodes. By analyzing the annotations, the URL address and other information bound to the method node can be read to obtain the relationship between the method node and the specific front-end URL node. By analyzing the annotation information in the abstract syntax tree, the mapping relationship between the method node and the URL node is extracted, and the binding relationship between the front-end URL node and the back-end method node is clarified.

[0075] More specifically, step S1.2 includes the following sub-steps:

[0076] Step S1.2.1, read the source code package and construct a code structure in the form of an abstract syntax tree.

[0077] Step S1.2.2: For each method node, first access the parent node of the method node, i.e., the class node, to obtain the annotation information of the class. If the annotation involves URL parameters, extract the parameters, then read the annotation information of the method node, extract the URL parameters, and concatenate them with the class annotation parameters to obtain the URL parameters corresponding to the method node.

[0078] Step S1.2.3, create a corresponding URL node in the graph database and establish an access relationship with the corresponding method node.

[0079] Step S1.3, extracting the persistence layer data access operation.

[0080] Specifically, in the persistence layer architecture, database access operations and the mapping relationship between method nodes and database fields are generally defined by configuration files (such as XML files). With the help of the XML file configured in the persistence layer, the definition and configuration details of the database access operation are extracted, including SQL statements, parameter mappings, etc. These configuration information can help the program clarify the specific logic and implementation methods of the database operation, so as to achieve the purpose of accessing the database. When parsing the database access operation statement, the access relationship between the persistence layer method node and the database field is extracted, including operations such as reading, updating, and deleting the field, and then the mapping relationship between the method node and the database field is clarified.

[0081] More specifically, step S1.3 includes the following sub-steps:

[0082] Step S1.3.1, read the source code package, parse it and extract all files ending with '.xml'.

[0083] Step S1.3.2, parse each file ending with '.xml' and read each SQL statement in it in turn. First determine the statement type (select, insert or update), and then extract the data field name, data table name, and method node name according to the statement type.

[0084] Step S1.3.3, create corresponding fields and table nodes in the graph database, and establish access relationships with corresponding method nodes.

[0085] After extracting the above three relationships, an access path from the URL node to the database field is established in the graph database, and combined with the access control relationship between the role node and the URL node provided in advance, a coarse-grained data access relationship graph is obtained.

[0086] Figure 2 This is an example of a coarse-grained code data access relationship extraction result in an embodiment of the present invention;

[0087] like Figure 2 As shown, for a URL type node, a path from this node to a field type node can be extracted.

[0088] Step S2, based on the code file in .jar format to be analyzed and the coarse-grained data access relationship graph, construct and output a corresponding list of method nodes and code directories.

[0089] Specifically, after extracting the coarse-grained data access relationship, in order to facilitate the subsequent large language model to perform targeted code reading operations, it is necessary to construct a mapping relationship between the class and method nodes in the coarse-grained data access relationship graph and the file location in the code directory.

[0090] More specifically, step S2 includes the following sub-steps:

[0091] Step S2.1, extracting method node code path.

[0092] Specifically, in the coarse-grained data access relationship diagram, for each method node, you can get the class and package information that defines it, and splice this information into a relative path as the attribute of the method node. By obtaining this attribute, you can read the definition code of the corresponding method node in the code directory.

[0093] In the coarse-grained data access relationship diagram, for the classes in the persistence layer, find the XML file with the same name in the software source code, and add this file path as the path attribute of the class. In this way, the corresponding XML file can be read for the classes in the persistence layer and the method nodes they contain.

[0094] Specifically, step S2 includes the following sub-steps:

[0095] Step S2.1, traversing all method nodes in the coarse-grained data access relationship graph obtained in step S1;

[0096] Step S2.2, for each method node, obtain the class and package information that defines the method node, and concatenate the class and package information into a relative path as the attribute of the method node;

[0097] Step S2.3, for method nodes that have access to database field relationships, obtain the name of the class node that defines the method node, and search for a file named "class node name.xml" in the code directory. If the corresponding file is successfully found, add the file path to the properties of the method node.

[0098] Step S3, based on the code file in .jar format to be analyzed and the coarse-grained data access relationship diagram, build an access relationship list between role nodes and database fields for data security verification.

[0099] Specifically, after obtaining the coarse-grained data access relationship graph, an access path of "role node-URL node-method node-database field" can be derived. However, this path can only determine the database fields that users may access, but it cannot necessarily determine whether these database fields will be actually displayed on the front-end page. In addition, restrictions such as "specific users can only view their own order information" have not been fully analyzed and extracted. Therefore, it is necessary to use the natural language understanding ability of large-scale language models, use the method of intelligent agent prompts, based on the coarse-grained data access relationship graph, start from the database access statement, and parse the file code in a targeted manner to analyze the main functions, return values, verification conditions and other details.

[0100] More specifically, step S3 includes the following sub-steps:

[0101] Step S3.1, based on the corresponding list of method nodes and code directories and the coarse-grained data access relationship diagram, the analysis results of the method nodes of the XML file are obtained by parsing the XML file and analyzing the database access operation.

[0102] Specifically, the database operation statements are extracted and parsed one by one through XML file parsing. This includes extracting the unique identifier "id" of the statement, a detailed description of the parameters (type, example, specific description), the behavior of the statement (such as "select" and "insert"), the definition of the return value (whether there is a return value and the name of the return value field), and whether there is a verification process. In the result synchronization stage, the analysis results are associated with the persistence layer class nodes, and path attributes are added to the coarse-grained data access relationship diagram to locate the corresponding persistence layer method node, thereby further optimizing the representation of the data access relationship.

[0103] More specifically, step S3.1 includes the following sub-steps:

[0104] Step S3.1.1, based on the corresponding list of method nodes and code directories, read the XML files in the corresponding directories one by one, parse each database operation statement therein using prompt words, extract the "id" of each statement, the parameters passed in by the statement (parameter type, parameter example, specific description of the parameter), the behavior of the statement ("select", "insert" or other), the statement return value (whether it returns a value, the field name of the return value or the modified value, if the return value is a field defined in BaseResultMap, write out the specific field name), whether the statement has a verification process (such as restricting certain ids), and form an XML analysis result;

[0105] The prompt in this embodiment refers to a prompt or instruction designed based on natural language to guide the large language model to perform a specific task.

[0106] Step S3.1.2, find the corresponding persistence layer class node through the path attribute in the coarse-grained data access relationship diagram, locate the corresponding method node through the "id" in the XML analysis result, and add the XML analysis result as an attribute of the method node.

[0107] Step S3.2, based on the analysis results of the method nodes in the XML file, analyze the function descriptions, parameter forms, return values, and database field access status of the remaining method nodes in the coarse-grained data access relationship diagram to obtain the analysis results of the remaining method nodes in the coarse-grained data access relationship diagram; thereby obtaining the analysis results of all method nodes in the coarse-grained data access relationship diagram.

[0108] Specifically, first determine the code file location of the class node through the path attribute as the input of the large language model. Then, for each method node, by finding the associated method nodes it calls, collect function descriptions, parameter requirements, restrictions, database field attributes and other content for supplementary explanation. Through the method node call analysis process, the code content and the associated method node attribute information are combined to deeply analyze the function description, parameter form, return value and database field access status of the method node. Finally, add the analysis results as attributes to the method node, analyze layer by layer until reaching the front-end URL node, and achieve a comprehensive combing and addition of method node attributes.

[0109] The "large language model" in this embodiment refers to a large language model (LLM), which is a language model with a large parameter scale. It is designed to understand and generate human language. It is trained with a large amount of text data and can perform a wide range of tasks including text summarization, translation, sentiment analysis, etc.

[0110] More specifically, step S3.2 includes the following sub-steps:

[0111] Step S3.2.1, for any method node in the coarse-grained data access relationship graph, read the path attribute of the corresponding class node, locate the location of the code file, and read the code file as the input of the large language model;

[0112] Step S3.2.2, for any method node determined in step S3.2.1, first search for all associated method nodes called by the method node, read the function description, parameter requirements, restrictions, and database field attributes involved in access of each associated method node as supplementary information for the large language model;

[0113] Step S3.2.3, using the prompt words in conjunction with the code file read in step S3.2.1 and the supplementary information obtained in step S3.2.2, analyze the function description, input parameters, input parameter form, return value, and database field access involved in the method node determined in step S3.2.1, and add the analysis results as attributes to the method node;

[0114] Step S3.2.4, starting from the method node of the XML file, access the upper-level method nodes in sequence, analyze them according to the process from step S3.2.1 to step S3.2.3, and add them as attributes until reaching the front-end URL node.

[0115] Figure 3 This is an example of the complete code data access relationship extraction result in an embodiment of the present invention.

[0116] Step S3.3, role node data access summary: For each URL node in the coarse-grained data access relationship graph, find all method nodes that have a relationship with the URL node, summarize the analysis results of the method nodes, and obtain a list of access relationships between the URL node and the database fields; for each role node in the coarse-grained data access relationship graph, find all URL nodes that have a relationship with the role node, summarize the list of access relationships between the URL node and the database fields, and obtain a list of access relationships between the role node and the database fields.

[0117] by Figure 3 Take the data access relationship in as an example, for the page " / order-items / {id}", the analysis result is: the purpose of this page is to obtain order product information; its input parameter is id; the database fields accessed by this page include goods_name; goods_img; goods_name; selling_price; its restriction condition is that it can only access a certain user's order. From this, we can conclude that when a user accesses the page " / order-items / {id}", he can access the database fields goods_name; goods_img; goods_name; selling_price, but there is a restriction condition of id.

[0118] Embodiment 2:

[0119] The present invention also provides a code data access relationship extraction system for data security verification. The code data access relationship extraction system for data security verification can be implemented by executing the process steps of the code data access relationship extraction method for data security verification, that is, technical personnel in this field can understand the code data access relationship extraction method for data security verification as a preferred implementation of the code data access relationship extraction system for data security verification.

[0120] Figure 1 The following is a flowchart of code data access relationship extraction in an embodiment of the present invention.

[0121] like Figure 1 As shown, the code data access relationship extraction system includes:

[0122] The coarse-grained data access relationship extraction subsystem inputs the .jar format code file to be analyzed, and after processing, outputs the coarse-grained data access relationship graph in the form of a graph database;

[0123] The code directory mapping subsystem builds and outputs a corresponding list of method nodes and code directories based on the .jar format code files to be analyzed and the coarse-grained data access relationship graph;

[0124] The large language model enhanced analysis subsystem builds an access relationship list between role nodes and database fields based on the .jar format code file to be analyzed and the coarse-grained data access relationship diagram for data security verification.

[0125] Those skilled in the art know that, in addition to realizing the system and its various devices, modules, and units provided by the present invention in a purely computer-readable program code, it is entirely possible to realize the same functions in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered as a hardware component, and the devices, modules, and units included therein for realizing various functions can also be regarded as structures within the hardware component; the devices, modules, and units for realizing various functions can also be regarded as both software modules for realizing the method and structures within the hardware component.

[0126] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A code data access relationship extraction method for data security verification, characterized in that: The steps include: Step S1, input the code file in .jar format to be analyzed, and output the coarse-grained data access relationship graph in the form of a graph database after processing; Step S2, constructing and outputting a corresponding list of method nodes and code directories based on the code file in .jar format to be analyzed and the coarse-grained data access relationship graph; Step S3, based on the code file in .jar format to be analyzed and the coarse-grained data access relationship graph, construct an access relationship list between role nodes and database fields for data security verification.

2. A method for extracting code data access relations for data security verification according to claim 1, characterized in that: The step S1 includes the following sub-steps: Step S1.1, extract the relationship between class and method nodes: Step S1.2, extract the binding relationship between the front-end page and the method node: Step S1.3, extracting the persistence layer data access operation.

3. A method for extracting code data access relations for data security verification according to claim 2, characterized in that: The step S1.1 includes the following sub-steps: Step S1.1.1, read the code file in .jar format to be analyzed, and extract all files ending with '.class' after parsing; Step S1.1.2, parse each file ending with '.class', collect class information, obtain the class name, the package level to which it belongs, the list of method nodes it contains, and traverse the method node code in the file to collect the call information in the method node; Step S1.1.3, create corresponding packages, classes, and method nodes in the graph database, and add the call relationships between the extracted method nodes; Step S1.1.4, create the implementation relationship between classes in the database, and supplement the relationship between the interface and the interface implementation class.

4. A method for extracting code data access relations for data security verification according to claim 2, characterized in that: The step S1.2 includes the following sub-steps: Step S1.2.1, read the source code package and construct a code structure in the form of an abstract syntax tree; Step S1.2.2, for each method node, first access the parent node of the method node, that is, the class node, to obtain the annotation information of the class. If the annotation involves URL parameters, extract the parameters, then read the annotation information of the method node, extract the URL parameters, and concatenate them with the class annotation parameters to obtain the URL parameters corresponding to the method node; Step S1.2.3, create a corresponding URL node in the graph database and establish an access relationship with the corresponding method node.

5. A method for extracting code data access relations for data security verification according to claim 2, characterized in that: The step S1.3 includes the following sub-steps: Step S1.3.1, read the source code package, parse it and extract all files ending with '.xml'; Step S1.3.2, parse each file ending with '.xml', read each SQL statement in turn, first determine the statement type, and then extract the data field name, data table name, and method node name according to the statement type; Step S1.3.3, create corresponding fields and table nodes in the graph database, and establish access relationships with corresponding method nodes.

6. A method for extracting code data access relations for data security verification according to claim 1, characterized in that: The step S2 includes the following sub-steps: Step S2.1, traversing all method nodes in the coarse-grained data access relationship graph obtained in step S1; Step S2.2, for each method node, obtain the class and package information that defines the method node, and concatenate the class and package information into a relative path as the attribute of the method node; Step S2.3, for the method node that has a database field access relationship, obtain the name of the class node that defines the method node, search for a file named "name of the class node.xml" in the code directory, and if the corresponding file is successfully found, add the path of the file to the properties of the method node.

7. A method for extracting code data access relations for data security verification according to claim 1, characterized in that: The step S3 includes the following sub-steps: Step S3.1, based on the corresponding list of the method nodes and the code directory and the coarse-grained data access relationship diagram, by parsing the XML file, analyzing the database access operation, and obtaining the analysis result of the method node of the XML file; Step S3.2, based on the analysis results of the method nodes of the XML file, analyze the function descriptions, parameter forms, return values ​​and database field access status of the remaining method nodes in the coarse-grained data access relationship diagram to obtain the analysis results of the remaining method nodes in the coarse-grained data access relationship diagram; thereby obtaining the analysis results of all method nodes in the coarse-grained data access relationship diagram; Step S3.3, role node data access summary: for each URL node in the coarse-grained data access relationship graph, find all method nodes that have a relationship with the URL node, summarize the analysis results of the method nodes, and obtain an access relationship list between the URL node and the database field; For each role node in the coarse-grained data access relationship graph, all URL nodes that have a relationship with the role node are searched, and the access relationship list between the URL nodes and the database fields is summarized to obtain the access relationship list between the role nodes and the database fields.

8. A method for extracting code data access relations for data security verification according to claim 7, characterized in that: The step S3.1 includes the following sub-steps: Step S3.1.1, based on the corresponding list of the method nodes and the code directory, read the XML files in the corresponding directory in turn, parse each database operation statement therein using the prompt words, extract the "id" of each statement, the parameters passed in by the statement, the behavior of the statement, the return value of the statement, whether the statement has a verification process, and form an XML analysis result; Step S3.1.2, find the corresponding persistence layer class node through the path attribute in the coarse-grained data access relationship diagram, locate the corresponding method node in the corresponding list of the method node and the code directory obtained in step S2 through the "id" in the XML analysis result, and add the XML analysis result as an attribute of the method node.

9. A method for extracting code data access relations for data security verification according to claim 7, characterized in that: The step S3.2 includes the following sub-steps: Step S3.2.1, for any method node in the coarse-grained data access relationship graph, read the path attribute of the corresponding class node, locate the location of the code file, and read the code file as the input of the large language model; Step S3.2.2, for any method node determined in step S3.2.1, first search for all associated method nodes called by the method node, read the function description, parameter requirements, restrictions, and database field attributes involved in access of each associated method node as supplementary information for the large language model; Step S3.2.3, using the prompt words in conjunction with the code file read in step S3.2.1 and the supplementary information obtained in step S3.2.2, analyze the function description, input parameters, input parameter form, method node return value, and database field access involved in the method node determined in step S3.2.1, and add the analysis results as attributes to the method node; Step S3.2.4, starting from the bottom-level database access operation, access the upper-level method nodes in sequence, analyze them according to the process from step S3.2.1 to step S3.2.3, and add them as attributes until reaching the front-end URL node.

10. A code data access relationship extraction system for data security verification, characterized in that: include: The coarse-grained data access relationship extraction subsystem inputs the .jar format code file to be analyzed, and after processing, outputs the coarse-grained data access relationship graph in the form of a graph database; A code directory mapping subsystem, based on the code file in .jar format to be analyzed and the coarse-grained data access relationship graph, constructs and outputs a corresponding list of method nodes and code directories; The large language model enhanced analysis subsystem builds an access relationship list between role nodes and database fields based on the code file in .jar format to be analyzed and the coarse-grained data access relationship graph for data security verification.

Images