Code data access relationship extraction method and system for data security check

Abstract

The application provides a code data access relationship extraction method and system for data security verification, comprising the following steps: step S1, processing a.jar format code file to be analyzed, and outputting a coarse-grained data access relationship graph; step S2, based on the code file and the coarse-grained data access relationship graph, constructing and outputting a corresponding list of method nodes and code directories; step S3, based on the code file and the coarse-grained data access relationship graph, constructing an access relationship list between role nodes and database fields. The application uses the characteristics of the Java language and the natural language understanding ability of the large language model to solve the problem of automatic extraction of the access relationship between the role nodes and the database fields in the website source code, can analyze the input java website source code, extract the complete call link from the user to the database field, and can judge the specific return condition and the verification condition of the data field, so that the accurate data access extraction effect is achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computer testing, in particular to a method and system for extracting access relationship of roles to database fields in website project source code for data security verification. BACKGROUND

[0002] In today's digital age, data security has become a crucial issue. China has enacted laws and regulations to emphasize the need for a complete data security governance system, enhance data security protection capabilities, coordinate data security and development processes, and make detailed and explicit specifications for data security systems and data handler obligations.

[0003] For website service providers, strictly following China's data classification and data security protection standards is key to ensuring data security. Specifically, the primary task is to clearly define the scope of authority and access level of different roles in the system, effectively implement the principle of least privilege, and ensure that each role can only access the database fields required for their work, thereby effectively reducing the risk of data leakage. Secondly, data needs to be classified and labeled according to its sensitivity and importance, and hierarchical management of database fields needs to be implemented to ensure that highly sensitive data can only be accessed by authorized personnel.

[0004] In the context of data security verification, the extraction of code data access relationship is particularly critical. Accurate extraction of this relationship can help organizations better understand who has access to which data in the database, thereby providing strong support for efficient monitoring and management of data access permissions, and timely detecting potential security risks such as unauthorized access or data leakage.

[0005] Currently, the method of extracting code data access relationship is significantly different from widely used code vulnerability detection. Code data access relationship focuses on analyzing the access relationship between roles and database fields in the code, aiming to effectively protect data security; while source code vulnerability detection is committed to uncovering potential security vulnerabilities and errors in the code, thereby addressing possible weaknesses in the system.

[0006] For the extraction method of software code data access relationship, the traditional static code analysis method accurately identifies variables, data structures, functions, classes, logical statements, and constant values in the source code, and deeply explores the complex relationships and constraints between these elements. The source code is analyzed and extracted, or the source code is converted into a relational code data model library (such as the method for extracting a code data model library based on a source code file provided in patent CN118626134A), or the calling relationship of the code is extracted file by file, and finally the calling relationship graph of the project is formed (such as the JAVA code correlation analysis method based on IDEA provided in patent CN118192986A). However, this kind of static code analysis method has limitations, which can only be limited to the analysis of code structure or calling relationship, and cannot accurately extract the details of the code access operation to the database.

[0007] Another existing method is to perform a full scan of the sql operation statement by application unit, and extract all the database fields and tables involved in the application access (such as the method for determining data access relationship provided in patent CN103902565A). However, the data access relationship extraction granularity of this method is too rough, and it is difficult to meet the fine needs of data access extraction based on application roles. With the rapid development of deep learning technology, especially large language models, the excellent natural language understanding ability of machine learning models has been widely applied in code understanding, code analysis, and code generation. Large language models are often used for code optimization analysis, and potential abnormalities in software code are analyzed (a code static analysis warning automatic repair method based on a large model, CN118838824A). Deep learning is also commonly used for code vulnerability detection and identification, and the input is a code sample fragment to be detected to determine whether there is a vulnerability in the code (a network security-oriented code vulnerability detection method and system, CN116226864A). With the rapid development of deep learning technology, especially large language models, the excellent natural language understanding ability of machine learning models has been widely applied in code understanding, analysis, and generation. Currently, large language models are mainly used for code optimization analysis, focusing on analyzing potential abnormalities in software code (such as the method for extracting a code data model library based on a source code file provided in patent CN118626134A); deep learning technology is also commonly used for code vulnerability detection and identification, and the input is a code sample fragment to be detected to determine whether there is a vulnerability in the code (such as the method for extracting a code data model library based on a source code file provided in patent CN118626134A).

[0008] The code data access relationship extraction method above can extract method call relationship and part of data access relationship to some extent, but generally lacks the ability to extract data field access relationship for roles, and cannot effectively meet the strict requirements of data access security check. Moreover, the existing methods of analyzing code using deep learning or large language models are mostly focused on code quality detection, and only analyze continuous code fragments, making it difficult to achieve joint analysis of access relationship across multiple files.

[0009] In summary, in view of the problems of the prior art, it is a key task to be solved urgently to study a role-to-database field access relationship extraction method and system for website project source code for data security check. SUMMARY

[0010] In view of the defects in the prior art, the purpose of the present application is to provide a code data access relationship extraction method and system for data security check.

[0011] According to the code data access relationship extraction method for data security check provided by the present application, the following steps are included:

[0012] Step S1, input the.jar format code file to be analyzed, and output the coarse-grained data access relationship graph in the form of a graph database after processing;

[0013] Step S2, based on the.jar format code file to be analyzed and the coarse-grained data access relationship graph, construct and output the corresponding list of method nodes and code directories;

[0014] Step S3, based on the.jar format code file to be analyzed and the coarse-grained data access relationship graph, construct the access relationship list between the role nodes and the database fields, for data security check.

[0015] Preferably, step S1 includes the following sub-steps:

[0016] Step S1.1, extract the relationship between classes and method nodes:

[0017] Step S1.2, extract the binding relationship between front-end pages and method nodes:

[0018] Step S1.3, extract the persistent layer data access operation.

[0019] Preferably, step S1.1 includes the following sub-steps:

[0020] Step S1.1.1, read the.jar format code file to be analyzed, and extract all files ending with '.class' after parsing;

[0021] Step S1.1.2, parsing each file ending with '.class', collecting class information, obtaining the name of the class, the package hierarchy to which it belongs, the list of method nodes contained, and traversing the method node code in the file to collect the call information in the method node;

[0022] Step S1.1.3, creating corresponding packages, classes, and method nodes in the graph database and adding the extracted call relationship between method nodes;

[0023] Step S1.1.4, creating implementation relationships between classes in the database and supplementing the relationship between interfaces and interface implementation classes.

[0024] Preferably, step S1.2 includes the following sub-steps:

[0025] Step S1.2.1, reading the source code package and building the code structure in the form of an abstract syntax tree;

[0026] Step S1.2.2, for each method node, first access the parent node of the method node, i.e., the class node, to obtain the annotation information of the class. If the annotation involves URL parameters, extract the parameters, then read the annotation information of the method node and extract the URL parameters, and concatenate the class annotation parameters to obtain the URL parameters corresponding to the method node;

[0027] Step S1.2.3, creating corresponding URL nodes in the graph database and establishing access relationships with the corresponding method nodes.

[0028] Preferably, step S1.3 includes the following sub-steps:

[0029] Step S1.3.1, reading the source code package and extracting all files ending with '.xml' after parsing;

[0030] Step S1.3.2, parsing each file ending with '.xml', reading each sql statement in turn, first judging the statement type, then extracting the data field name, data table name, and method node name according to the statement type;

[0031] Step S1.3.3, creating corresponding field and table nodes in the graph database and establishing access relationships with the corresponding method nodes.

[0032] Preferably, step S2 includes the following sub-steps:

[0033] Step S2.1, traversing all method nodes in the coarse-grained data access relationship graph obtained in step S1;

[0034] Step S2.2, for each method node, obtaining the class and package information that defines the method node, concatenating the class and package information into a relative path as an attribute of the method node;

[0035] Step S2.3, for the method node with the access database field relationship, obtaining the name of the class node defining the method node, searching for a file named "the name of the class node.xml" in the code directory, if the corresponding file is successfully found, adding the path of the file to the attribute of the method node.

[0036] Preferably, step S3 comprises the following sub-steps:

[0037] Step S3.1, based on the corresponding list of the method node and the code directory and the coarse-grained data access relationship graph, analyzing the database access operation by parsing the XML file, obtaining the analysis result of the method node of the XML file;

[0038] Step S3.2, based on the analysis result of the method node of the XML file, analyzing the function description, parameter form, return value and database field access status of the remaining method nodes in the coarse-grained data access relationship graph, obtaining the analysis result of the remaining method nodes in the coarse-grained data access relationship graph; thereby obtaining the analysis result of all method nodes in the coarse-grained data access relationship graph;

[0039] Step S3.3, role node data access summary: for each URL node in the coarse-grained data access relationship graph, finding all method nodes related to the URL node, summarizing the analysis results of the method nodes, obtaining the access relationship list between the URL node and the database field; for each role node in the coarse-grained data access relationship graph, finding all URL nodes related to the role node, summarizing the access relationship list between the URL node and the database field, obtaining the access relationship list between the role node and the database field.

[0040] Preferably, step S3.1 comprises the following sub-sub-steps:

[0041] Step S3.1.1, based on the corresponding list of the method node and the code directory, reading the XML file in the corresponding directory in turn, parsing each database operation statement in the XML file by using the prompt word, extracting the "id" of each statement, the parameter passed into the statement, the behavior of the statement, the return value of the statement, whether the statement has a verification process, and forming the XML analysis result;

[0042] Step S3.1.2, finding the corresponding persistence layer class node in the coarse-grained data access relationship graph through the path attribute, positioning the corresponding method node in the corresponding list of the method node and the code directory obtained in step S2 through the "id" in the XML analysis result, and adding the XML analysis result as the attribute of the method node.

[0043] Preferably, step S3.2 comprises the following sub-sub-steps:

[0044] Step S3.2.1, for any method node in the coarse-grained data access relationship graph, read the path attribute of the corresponding class node, locate the position of the code file, read the code file as the input of the large language model;

[0045] Step S3.2.2, for any method node determined in step S3.2.1, first find all associated method nodes called by the method node, read the function description, parameter requirement, limitation condition, and involved database field attribute of each associated method node as supplementary description information of the large language model;

[0046] Step S3.2.3, using the prompt word to combine the code file read in step S3.2.1 and the supplementary description information obtained in step S3.2.2, analyze the function description, incoming parameter, incoming parameter form, method node return value, and database field access involved in the method node determined in step S3.2.1, and add the analysis results as attributes to the method node;

[0047] Step S3.2.4, starting from the underlying database access operation, successively access the upper method nodes, and add the analysis results as attributes according to the processes of steps S3.2.1 to S3.2.3, until reaching the front-end URL node.

[0048] The application also provides a code data access relationship extraction system for data security verification, comprising:

[0049] A coarse-grained data access relationship extraction subsystem, which inputs the.jar format code file to be analyzed, and outputs the coarse-grained data access relationship graph in the form of a graph database after processing;

[0050] A code directory mapping subsystem, which constructs and outputs the corresponding list of method nodes and code directories based on the.jar format code file to be analyzed and the coarse-grained data access relationship graph;

[0051] A large language model enhanced analysis subsystem, which constructs the access relationship list between the role nodes and the database fields based on the.jar format code file to be analyzed and the coarse-grained data access relationship graph, and is used for data security verification.

[0052] Compared with the prior art, the application has the following beneficial effects:

[0053] 1. The application utilizes the characteristics of Java language and the natural language understanding ability of large language models to solve the problem of automatic extraction of role-to-database field access relationship in website source code, can analyze the input java website source code, extract the complete call link from the user to the database field, and can judge the specific return condition and verification condition of the data field, so as to achieve accurate data access extraction effect.

[0054] 2. In the scene of data security verification, the application realizes the extraction of data access relationship of website source code, obtains the access relationship of "role-page-database field", and facilitates the compliance judgment of the verification personnel by directly comparing with the data security specification, which can greatly reduce the workload of the verification personnel in reading and understanding the code and manually combing the data access relationship, and significantly improve the verification efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0055] Other features, objects and advantages of the application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0056] Figure 1 A code data access relationship extraction flowchart in the embodiment of the application;

[0057] Figure 2 A coarse-grained code data access relationship extraction result example in the embodiment of the application;

[0058] Figure 3 A complete code data access relationship extraction result example in the embodiment of the application. DETAILED DESCRIPTION

[0059] The application will be described in detail below with reference to specific embodiments. The following embodiments will help those skilled in the art to further understand the application, but do not limit the application in any form. It should be pointed out that for those skilled in the art, without departing from the concept of the application, a number of changes and improvements can be made. These all belong to the protection scope of the application.

[0060] The application aims to solve the problem of automatic extraction of role-to-database field access relationship in website source code, and proposes a code data access relationship extraction method and system for data security verification. The application utilizes the characteristics of code language to construct coarse-grained data access relationship, assists large language model to perform directional file reading and code analysis, and then accurately extracts the access relationship between role and database field. After access relationship extraction, the front-end page that each role can access is obtained, as well as the database field name that the front-end page can access and the corresponding restriction condition, so as to verify the compliance of data security access control.

[0061] Embodiment 1:

[0062] The embodiment provides a code data access relationship extraction method for data security checking, and particularly relates to analyzing a java website source code project, and comprises the following steps:

[0063] In step S1, input the.jar format code file to be analyzed, and output a coarse-grained data access relationship graph in the form of a graph database after processing.

[0064] Specifically, the coarse-grained data access relationship extraction process is as follows: firstly, the access and containing relationship between data classes and method nodes, the binding relationship between front-end pages and back-end method nodes, and the access relationship between method nodes and database fields are obtained. By integrating these information, an access path extending from the front-end page to the database field can be constructed. In the specific implementation mode, the Java reflection mechanism, the abstract syntax tree, and the method node of the persistent layer configuration file parsing are used to obtain the information.

[0065] Specifically, step S1 comprises the following sub-steps:

[0066] In step S1.1, the relationship between classes and method nodes is extracted.

[0067] Specifically, the Java reflection mechanism is used to analyze and operate the class, method node, attribute and other information at runtime without determining these information at compile time. The class information in the.jar package is obtained by using the reflection mechanism, including the method node, attribute and other contents of the class. Then, the caller and the callee of the method node are determined by using the reflection mechanism, so as to construct the calling relationship between the method nodes. When the method nodes in the class node are traversed, the information of the method nodes can be obtained one by one, including the method node name, parameter type and the like, and then the calling relationship graph between the method nodes is constructed.

[0068] Further specifically, step S1.1 comprises the following sub-steps:

[0069] In step S1.1.1, the.jar format code file to be analyzed is read, and all files ending with '.class' are extracted after parsing.

[0070] In step S1.1.2, each file ending with '.class' is parsed, class information is collected, the name of the class, the package level to which the class belongs, and the method node list contained by the class are obtained, and the calling information in the method node is collected by traversing the method node code in the file.

[0071] In step S1.1.3, the corresponding package, class and method node are created in the graph database, and the calling relationship between the extracted method nodes is added.

[0072] Step S1.1.4, creating the implementation relationship between classes in the database, supplementing the interface and interface implementation class relationship.

[0073] Step S1.2, extracting the binding relationship between the front-end page and the method node.

[0074] Specifically, when extracting annotations through the abstract syntax tree, the source code can be parsed and the annotation information therein can be identified, and some annotations contain metadata such as URL binding with the method node. By analyzing the annotations, the URL address and other information bound with the method node can be read to obtain the relationship between the method node and the specific front-end URL node. Through the analysis of the annotation information in the abstract syntax tree, the mapping relationship between the method node and the URL node is extracted, and the binding relationship between the front-end URL node and the back-end method node is determined.

[0075] Further specifically, step S1.2 includes the following sub-steps:

[0076] Step S1.2.1, reading the source code package and constructing the code structure in the form of an abstract syntax tree.

[0077] Step S1.2.2, for each method node, first access the parent node of the method node, i.e., the class node, to obtain the annotation information of the class. If the annotation involves URL parameters, the parameters are extracted, and the annotation information of the method node is read and the URL parameters are extracted, and the URL parameters corresponding to the method node are obtained by splicing the class annotation parameters.

[0078] Step S1.2.3, creating the corresponding URL node in the graph database and establishing an access relationship with the corresponding method node.

[0079] Step S1.3, extracting the persistent layer data access operation.

[0080] Specifically, in the persistent layer architecture, the database access operation and the mapping relationship between the method node and the database field are generally defined by means of a configuration file (such as an XML file). With the help of the XML file of the persistent layer configuration, the definition and configuration details of the database access operation are extracted, including SQL statements, parameter mapping, etc. These configuration information can help the program to clearly understand the specific logic and implementation approach of the database operation, so as to achieve the purpose of accessing the database. When parsing the database access operation statement, the access relationship of the persistent layer method node to the database field is extracted, including field reading, updating, deleting, etc. operations, and the mapping relationship between the method node and the database field is determined.

[0081] Further specifically, step S1.3 includes the following sub-steps:

[0082] Step S1.3.1, read the source code package, parse and extract all files ending with '.xml'.

[0083] Step S1.3.2, parse each file ending with '.xml', read each sql statement in turn. First, judge the statement type (select, insert or update), and then extract the data field name, data table name and method node name according to the statement type.

[0084] Step S1.3.3, create corresponding fields and table nodes in the graph database, and establish access relationship with the corresponding method nodes.

[0085] After extracting the above three kinds of relationships, the access path from the URL node to the database field is established in the graph database, and the coarse-grained data access relationship graph is obtained by combining the pre-provided access control relationship between the role node and the URL node.

[0086] Figure 2 An example of coarse-grained code data access relationship extraction result in the embodiment of the application is shown in the following table.

[0087] As shown in Figure 2 , for a URL type node, a path from the node to a field type node can be extracted.

[0088] Step S2, based on the code file in.jar format to be analyzed and the coarse-grained data access relationship graph, a corresponding list of method nodes and code directories is constructed and output.

[0089] Specifically, after extracting the coarse-grained data access relationship, in order to facilitate subsequent large language model directed code reading operation, it is necessary to construct the mapping relationship between the class and method nodes in the coarse-grained data access relationship graph and the file location in the code directory.

[0090] Further specifically, step S2 includes the following sub-steps:

[0091] Step S2.1, extract the method node code path.

[0092] Specifically, in the coarse-grained data access relationship graph, for each method node, the class and package information defining it can be obtained, and these information is spliced into a relative path as an attribute of the method node. By obtaining this attribute, the definition code of the corresponding method node can be read in the code directory.

[0093] In the coarse-grained data access relationship graph, for the classes in the persistence layer, find the xml file with the same name in the software source code, and add this file path as the path attribute of the class. In this way, for the classes in the persistence layer and the method nodes contained therein, the corresponding XML file can be read.

[0094] Specifically, the step S2 comprises the following sub-steps:

[0095] Step S2.1, traversing all the Method nodes in the coarse-grained data access relationship graph obtained in step S1;

[0096] Step S2.2, for each Method node, obtaining the Class and Package information defining the Method node, splicing the Class and Package information into a relative path as an attribute of the Method node;

[0097] Step S2.3, for the Method node having a database field access relationship, obtaining the name of the Class node defining the Method node, searching for a file named “the name of the Class node.xml” in the code directory, and if the corresponding file is successfully found, adding the path of the file to the attribute of the Method node.

[0098] Step S3, based on the code file in.jar format to be analyzed and the coarse-grained data access relationship graph, constructing an access relationship list between the role node and the database field, for data security checking.

[0099] Specifically, after obtaining the coarse-grained data access relationship graph, a “role node-URL node-Method node-database field” access path can be derived. However, this path can only determine the database fields that the user can access, but cannot necessarily determine whether these database fields will be actually displayed on the front-end page. In addition, for restrictions such as “a specific user can only view his own order information”, they have not been fully analyzed and extracted. Therefore, the natural language understanding ability of a large language model is needed, and the method of using intelligent agent prompts is used to start from the database access statement based on the coarse-grained data access relationship graph, to analyze the file code in a targeted manner, and analyze the main functions, return values, and verification conditions and other details.

[0100] Further specifically, the step S3 comprises the following sub-steps:

[0101] Step S3.1, based on the corresponding list of Method nodes and code directories and the coarse-grained data access relationship graph, analyzing the database access operation by parsing the XML file to obtain the analysis result of the Method node of the XML file.

[0102] Specifically, the extraction and analysis of the database operation statements are realized by XML file parsing. The extraction includes the unique identification "id", the detailed description of the parameters (type, example, specific description), the behavior of the statement (such as "select", "insert", etc.), the definition of the return value (whether there is a return value and the field name of the return value), and whether there is a verification process. In the result synchronization stage, the analysis result is associated with the persistence layer class node, and the path attribute is added to the coarse-grained data access relationship graph, so as to locate the corresponding persistence layer method node, thereby further optimizing the expression of the data access relationship.

[0103] Further specifically, step S3.1 includes the following sub-sub-steps:

[0104] Step S3.1.1, based on the corresponding list of method nodes and code directories, in the corresponding directory, the XML file is read in sequence, each database operation statement in the XML file is parsed by using the prompt, the "id" of each statement, the parameters (type, example, specific description) of the statement, the behavior ("select", "insert" or other) of the statement, the return value (whether there is a return value, the field name of the return value or the modified value, such as returning the field defined in the BaseResultMap, then write the specific field name) of the statement, and whether the statement has a verification process (such as limiting some ids) are extracted, and the XML analysis result is formed;

[0105] The prompt of the present embodiment refers to a designed prompt or instruction based on natural language to guide the large language model to perform a specific task.

[0106] Step S3.1.2, find the corresponding persistence layer class node in the coarse-grained data access relationship graph through the path attribute, locate the corresponding method node through the "id" in the XML analysis result, and add the XML analysis result as the attribute of the method node.

[0107] Step S3.2, based on the analysis result of the method node of the XML file, analyze the function description, parameter form, return value and database field access status of the remaining method nodes in the coarse-grained data access relationship graph, obtain the analysis result of the remaining method nodes in the coarse-grained data access relationship graph, and obtain the analysis result of all the method nodes in the coarse-grained data access relationship graph.

[0108] Specifically, first, the code file location to the class node is determined by the path attribute as the input of the large language model. Then, for each method node, the associated method node called by it is found to collect the function description, parameter requirement, limitation condition, database field attribute and other contents to supplement the description. Through the method node call analysis process, the function description, parameter form, return value and database field access status of the method node are analyzed comprehensively by combining the code content and the associated method node attribute information. Finally, the analysis results are added to the method node as attributes, and the analysis is performed layer by layer until the front-end URL node is reached, so that the comprehensive analysis and addition of the method node attributes are achieved.

[0109] The "large language model" in the embodiment refers to a large language model (LLM), which is a language model with a large number of parameters and aims to understand and generate human language. It is trained by a large amount of text data and can perform a wide range of tasks including text summarization, translation, sentiment analysis, etc.

[0110] Further specifically, step S3.2 includes the following sub-sub-steps:

[0111] Step S3.2.1, for any method node in the coarse-grained data access relationship graph, read the path attribute of the class node to locate the position of the code file, and read the code file as the input of the large language model;

[0112] Step S3.2.2, for any method node determined in step S3.2.1, first find all associated method nodes called by the method node, read the function description, parameter requirement, limitation condition and database field attribute involved in the access of each associated method node as the supplementary description information of the large language model;

[0113] Step S3.2.3, using the prompt word to combine the code file read in step S3.2.1 and the supplementary description information obtained in step S3.2.2, analyze the function description, input parameter, input parameter form, return value and database field access involved in the method node determined in step S3.2.1, and add the analysis results to the method node as attributes;

[0114] Step S3.2.4, starting from the method node of the XML file, sequentially access the upper method nodes, and add the analysis results as attributes according to the processes of steps S3.2.1 to S3.2.3 until the front-end URL node is reached.

[0115] Figure 3 An example of the complete code data access relationship extraction result in the embodiment of the application is shown.

[0116] Step S3.3, Role Node Data Access Summary: For each URL node in the coarse-grained data access relationship graph, find all method nodes that are related to the URL node, summarize the analysis results of the method nodes, and obtain a list of access relationships between the URL node and the database field; for each role node in the coarse-grained data access relationship graph, find all URL nodes that are related to the role node, summarize the list of access relationships between the URL node and the database field, and obtain a list of access relationships between the role node and the database field.

[0117] by Figure 3 Taking data access relationships as an example, for the page " / order-items / {id}", the analysis results are as follows: the purpose of this page is to retrieve order product information; its input parameter is id; the database fields accessed by this page include goods_name; goods_img; goods_name; selling_price; and its restriction is that it can only access the orders of a specific user. Therefore, the conclusion is that when a user accesses the page " / order-items / {id}", they can access the database fields goods_name; goods_img; goods_name; selling_price, but the restriction of id applies.

[0118] Example 2:

[0119] The present invention also provides a code data access relationship extraction system for data security verification. The code data access relationship extraction system for data security verification can be implemented by executing the process steps of the code data access relationship extraction method for data security verification. That is, those skilled in the art can understand the code data access relationship extraction method for data security verification as a preferred embodiment of the code data access relationship extraction system for data security verification.

[0120] Figure 1 This is a flowchart illustrating the code data access relationship extraction process in an embodiment of the present invention.

[0121] like Figure 1 As shown, this code data access relationship extraction system includes:

[0122] The coarse-grained data access relationship extraction subsystem takes a .jar format code file to be analyzed as input, processes it, and outputs a coarse-grained data access relationship graph in the form of a graph database.

[0123] The code directory mapping subsystem, based on the code files in .jar format to be analyzed and a coarse-grained data access relationship graph, constructs and outputs a list of corresponding method nodes and code directories;

[0124] The large language model enhancement analysis subsystem constructs an access relationship list between role nodes and database fields based on a code file in a.jar format and a coarse-grained data access relationship graph, and is used for data security checking.

[0125] Those skilled in the art know that, in addition to implementing the system provided by the present application and each device, module and unit thereof in the form of pure computer readable program code, the system provided by the present application and each device, module and unit thereof can also be implemented in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers and embedded microcontrollers to achieve the same functions by logically programming the method steps. Therefore, the system provided by the present application and each device, module and unit thereof can be considered as a hardware component, and the devices, modules and units included therein for achieving various functions can also be considered as structures within the hardware component; the devices, modules and units for achieving various functions can also be considered as both software modules implementing methods and structures within hardware components.

[0126] The specific embodiments of the present application are described above. It needs to be understood that the present application is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essential content of the present application. The embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily without conflict.

Claims

1. A method for extracting code data access relationships for data security verification, characterized in that, Includes the following steps: Step S1: Input the .jar format code file to be analyzed. After processing, output a coarse-grained data access relationship graph in the form of a graph database. Step S2: Based on the code file in .jar format to be analyzed and the coarse-grained data access relationship graph, construct and output a list of corresponding method nodes and code directories; Step S3: Based on the code file in .jar format to be analyzed and the coarse-grained data access relationship diagram, construct a list of access relationships between role nodes and database fields for data security verification; Step S2 includes the following sub-steps: Step S2.1: In the coarse-grained data access relationship graph obtained in step S1, traverse all method nodes; Step S2.2: For each method node, obtain the class and package information that defines the method node, and concatenate the class and package information into a relative path as an attribute of the method node; Step S2.3: For method nodes that have access to database field relationships, obtain the name of the class node that defines the method node, search for a file named "the name of the class node.xml" in the code directory, and if the corresponding file is successfully found, add the path of the file to the attribute of the method node. Step S3 includes the following sub-steps: Step S3.1: Based on the corresponding list of method nodes and code directories and the coarse-grained data access relationship diagram, the database access operations are analyzed by parsing the XML file to obtain the analysis results of the method nodes in the XML file; Step S3.2: Based on the analysis results of the method nodes in the XML file, analyze the functional descriptions, parameter forms, return values, and database field access status of the remaining method nodes in the coarse-grained data access relationship diagram to obtain the analysis results of the remaining method nodes in the coarse-grained data access relationship diagram; thus obtaining the analysis results of all method nodes in the coarse-grained data access relationship diagram. Step S3.3, Role Node Data Access Summary: For each URL node in the coarse-grained data access relationship graph, find all method nodes that are related to the URL node, summarize the analysis results of the method nodes, and obtain a list of access relationships between the URL node and the database field; For each role node in the coarse-grained data access relationship graph, find all URL nodes that are related to the role node, summarize the list of access relationships between the URL node and the database field, and obtain a list of access relationships between the role node and the database field. Step S3.1 includes the following sub-steps: Step S3.1.1: Based on the corresponding list of method nodes and code directories, read the XML file sequentially in the corresponding directory, parse each database operation statement in it using prompt words, extract the "id" of each statement, the parameters passed to the statement, the behavior of the statement, the return value of the statement, and whether the statement has a validation process, and form the XML analysis result. Step S3.1.2: In the coarse-grained data access relationship graph, find the corresponding persistent layer class node through the path attribute, locate the corresponding method node in the corresponding list of method nodes and code directories obtained in step S2 through the "id" in the XML analysis result, and add the XML analysis result as an attribute of the method node; Step S3.2 includes the following sub-steps: Step S3.2.1: For any method node in the coarse-grained data access relationship graph, read the path attribute of the class node to which it belongs, locate the position of the code file, and read the code file as the input of the large language model; Step S3.2.2: For any method node determined in step S3.2.1, first find all associated method nodes called by the method node, and read the functional description, parameter requirements, constraints, and database field attributes involved in the access of each associated method node as supplementary explanatory information for the large language model; Step S3.2.3: Using the prompt words in conjunction with the code file read in step S3.2.1 and the supplementary information obtained in step S3.2.2, analyze the functional description, input parameters, input parameter format, method node return value, and database field access involved in the method node of the method node determined in step S3.2.1, and add the analysis results as attributes to the method node; Step S3.2.4: Starting from the underlying database access operation, access the upper-level method nodes in sequence, analyze them according to the process of steps S3.2.1 to S3.2.3 and add them as attributes until the front-end URL node is reached.

2. The method for extracting code data access relationships for data security verification as described in claim 1, characterized in that, Step S1 includes the following sub-steps: Step S1.1, extract the relationship between class and method nodes: Step S1.2, extract the binding relationship between the front-end page and method nodes: Step S1.3: Extract persistent layer data access operations.

3. The method for extracting code data access relationships for data security verification as shown in claim 2, characterized in that, Step S1.1 includes the following sub-steps: Step S1.1.1: Read the .jar format code file to be analyzed, parse it, and extract all files ending with '.class'; Step S1.1.2: Parse each file ending with '.class', collect class information, obtain the class name, package level, list of method nodes, and traverse the method node code in the file to collect the call information in the method nodes; Step S1.1.3: Create the corresponding package, class, and method nodes in the graph database, and add the call relationships between the extracted method nodes; Step S1.1.4: Create implementation relationships between classes in the database and supplement the relationships between interfaces and interface implementation classes.

4. The method for extracting code data access relationships for data security verification as shown in claim 2, characterized in that, Step S1.2 includes the following sub-steps: Step S1.2.1: Read the source code package and construct a code structure in the form of an abstract syntax tree; Step S1.2.2: For each method node, first access the parent node of the method node, i.e., the class node, to obtain the annotation information of the class. If the annotation involves URL parameters, extract the parameters, then read the annotation information of the method node, extract the URL parameters, and concatenate them with the class annotation parameters to obtain the URL parameters corresponding to the method node. Step S1.2.3: Create the corresponding URL node in the graph database and establish the access relationship with the corresponding method node.

5. A method for extracting code data access relationships for data security verification as shown in claim 2, characterized in that, Step S1.3 includes the following sub-steps: Step S1.3.1: Read the source code package, parse it, and extract all files ending with '.xml'; Step S1.3.2: Parse each file ending with '.xml', read each SQL statement in sequence, first determine the statement type, and then extract the data field name, data table name, and method node name according to the statement type; Step S1.3.3: Create the corresponding fields and table nodes in the graph database, and establish access relationships with the corresponding method nodes.

6. A code data access relationship extraction system for data security verification, employing the code data access relationship extraction method for data security verification as described in any one of claims 1-5, characterized in that, include: The coarse-grained data access relationship extraction subsystem takes a .jar format code file to be analyzed as input, processes it, and outputs a coarse-grained data access relationship graph in the form of a graph database. The code directory mapping subsystem constructs and outputs a list of corresponding method nodes and code directories based on the code file in .jar format to be analyzed and the coarse-grained data access relationship graph. The large language model enhancement analysis subsystem constructs a list of access relationships between role nodes and database fields based on the code file in .jar format to be analyzed and the coarse-grained data access relationship graph, for data security verification.

Images