Vulnerability information knowledge graph construction method and vulnerability patch acquisition method

Abstract

The invention discloses a vulnerability information knowledge graph construction method and a vulnerability patch acquisition method, and belongs to the technical field of computer program detection. According to the method, the vulnerability information related to the current vulnerability is collected as much as possible through a vulnerability information collection method based on search and used for constructing the vulnerability information knowledge graph, and then one or more patch codes related to the current vulnerability are mined and submitted through a screening method based on a white list and a filtering method based on a black list. Finally, more patch code submission related to the current vulnerability is obtained through vulnerability repair code submission similarity analysis, the purpose of finding all vulnerability patches is achieved as much as possible, and finally a security patch code submission set of the vulnerability number is output. According to the method, the patch mining accuracy can be improved, meanwhile, the patch with the complete vulnerability can be efficiently mined under the conditions that single-code submission and multi-code submission exist in the vulnerability patch, and the limitation and defects of an existing vulnerability patch mining method are overcome.

Description

Technical Field

[0001] The present invention relates to the field of computer program detection technology, and in particular to a method for constructing a vulnerability information knowledge graph and a method for obtaining vulnerability patches. Background Art

[0002] A software vulnerability is a defect or error in the design, implementation, or configuration of a software system that may be maliciously exploited under certain conditions, thereby affecting the normal function, security, or data integrity of the system. Identifying and fixing these vulnerabilities is critical to maintaining the security and reliability of software. Completing vulnerability repairs usually requires accurate and complete security patches. A vulnerability usually has a security patch, and a security patch usually consists of one or more code submissions. Completing vulnerability repairs requires a complete security patch, that is, a full code submission.

[0003] Patch mining for open source vulnerability detection is mainly divided into two categories: collecting and matching key vulnerability information and using large models to assist patch mining. The first type of method (such as TRACER [FSE, 2022]), by accurately matching the provided vulnerability information with the security patch information, involves searching for vulnerability numbers directly in the code submission list or in the link domains of similar submissions, which are usually in the reference information of the National Vulnerability Database (NVD) and other extended resources. This type of method only uses accurate but limited information, which severely limits their capabilities because vulnerability information is generally full of errors or even missing phenomena. The second type of method (such as PatchFinder [ASE, 2024]), extracts various features from security patches and vulnerability information, and then trains machine learning models to select or sort the repair code submissions that are most relevant to the provided vulnerabilities. Such methods rely only on code submission content, while code submission descriptions are usually severely lacking in patch-related information, have non-standardized structures, are difficult to process, and contain very limited information about the desired associations. At the same time, due to the large number of code submission candidates (some projects have more than 100,000 code submissions), insufficient information in the submission information, and high computational overhead, the sorting stage of selecting target patch code submissions will result in a large number of false positives and false negatives. Therefore, the above methods are not capable of accurately identifying a single patch code submission, not to mention that their design cannot achieve the goal of finding all related code submissions of the patch of the target vulnerability to completely fix the vulnerability. Summary of the invention

[0004] The purpose of the present invention is to provide a method for constructing a vulnerability information knowledge graph, so as to reduce the impact of missing and inaccurate information on patch mining caused by a single information source.

[0005] The method for constructing a vulnerability information knowledge graph includes the following steps:

[0006] Get links to different types of information sources related to the vulnerability based on the vulnerability number;

[0007] The vulnerability number is used as the first-level node, the information source category is used as the second-level node, and the information source link is used as the third-level node to construct the information node graph of the vulnerability;

[0008] Crawling the links existing in the content of each information source link to form lower-level nodes; continuing crawling to form a set number of lower-level nodes;

[0009] Extract key vulnerability information from each link content and add it as supplementary content of the corresponding node;

[0010] The vulnerability patch knowledge graph is constructed with nodes as entities and the relationships between nodes as entity relationships.

[0011] Preferably, a small sample prompting strategy is used to judge the relevance between the link content and the vulnerability through a big data model to extract key vulnerability information.

[0012] Another object of the present invention is to provide a vulnerability patch acquisition method, which is used to efficiently mine complete vulnerability patches in the case where the vulnerability patches exist in single code submission and multiple code submissions.

[0013] The method for obtaining a vulnerability patch includes the following steps:

[0014] Perform knowledge association analysis on the knowledge graph constructed according to the above method to confirm whether there are link patterns directly or indirectly related to code submission;

[0015] Get code submissions that match the link mode to automatically obtain vulnerability patches.

[0016] Preferably, the code submissions are matched and filtered according to predetermined rules to screen the code submissions.

[0017] Preferably, the specified software that is not affected by the vulnerability is removed, as well as code submissions that only contain comment lines, blank lines, test part code modifications, and document annotated part modifications.

[0018] Preferably, a patch code filtering operation is performed to filter out code submissions that are not related to vulnerability repairs.

[0019] Preferably, similarities between the code submissions are identified to obtain a complete patch code submission.

[0020] Preferably, the similarity between the code submissions includes similarity based on code modification of the code submissions and similarity based on descriptions of the code submissions.

[0021] The beneficial effects of the present invention are as follows:

[0022] The present invention solves the problems existing in the existing vulnerability patch mining methods, such as heavy reliance on a single information source and focusing only on the situation where a single code is submitted to repair the patch. The present invention constructs a knowledge graph related to the target vulnerability information by widely collecting vulnerability information sources, thereby reducing the impact of missing and inaccurate information on patch mining caused by a single information source. At the same time, it makes up for the deficiency of the existing patch mining technology that is limited to focusing on the idea that there is only one repair code submission for the vulnerability patch, and supports the search for complete patches for the vulnerability patch with one or more repair code submissions. The present invention can improve the accuracy of patch mining in the case of widespread missing vulnerability information, and can efficiently mine complete vulnerability patches in the case of single code submission and multiple code submissions for the vulnerability patch, thereby solving the above-mentioned limitations and deficiencies of the existing vulnerability patch mining methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a flow chart of the present invention.

[0024] Figure 2 It is the PHunter algorithm of the present invention.

[0025] Figure 3 The code submission for the example (bee9c5913) is a negative sample code submission with an expanded description of the target vulnerability.

[0026] Figure 4 The code commit for the example (ede782b414) is a negative sample code commit that adds test code. DETAILED DESCRIPTION

[0027] The following will be combined with the accompanying drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0028] The overall method flow of the present invention is as follows Figure 1 As shown, the present invention collects as much vulnerability information related to the current vulnerability as possible through a search-based vulnerability information collection method for building a vulnerability information knowledge graph, and then mines one or more patch code submissions related to the current vulnerability through a whitelist-based screening method and a blacklist-based filtering method, and finally obtains more patch code submissions related to the current vulnerability through vulnerability repair code submission similarity analysis, so as to achieve the purpose of finding all vulnerability patches as much as possible, and finally outputs a security patch code submission set for the vulnerability number.

[0029] Use the search engine to search for the project's official vulnerability announcements using the vulnerability number and the keywords "security" or "announcement", obtain the first three returned results as official vulnerability announcement information sources, use the vulnerability number to search the vulnerability database, and use the returned page as the vulnerability information association page information source, use the search engine to search for the vulnerability number, retrieve other vulnerability-related analysis reports and news as other information sources, and use the above three types of information sources as the initial vulnerability information source. Use the vulnerability number as the initial node Node-CVEid of the graph; use the three collected categories as the first-level node Node-Origin of the graph; use the links collected from the three categories as the second-level node Node-InfoSource and add them after their category node Node-Origin.

[0030] Detailed and multi-dimensional vulnerability information (such as vulnerability-related Issue IDs and locations) is essential for comprehensive and accurate collection of vulnerability patches. After extensive analysis of vulnerabilities and related information, the present invention designs a collection algorithm InfoCollector to obtain comprehensive and accurate information. Specifically, it is achieved by retrieving relevant details from a wider range of web pages discussing vulnerabilities and extracting additional vulnerability-related data (such as vulnerability impact location and vulnerability type). InfoCollector includes two analysis phases: initial analysis phase and in-depth analysis phase.

[0031] In the initial analysis phase, links related to specific target vulnerability numbers are collected from the National Vulnerability Database (NVD). The present invention also uses Google search commands, using vulnerability numbers combined with special representations "security OR advisory" to collect relevant links leading to vulnerability security announcements or advisories related to CVE-ID (vulnerability number). This process helps determine the main sources of target vulnerability information. Sublinks are explored from these sources to obtain additional data, and security pages of project management are considered, which often provide important vulnerability details. In order to construct a node graph of information related to vulnerabilities, the embodiment of the present invention limits the analysis to four layers to balance the complexity and scalability of the analysis. Each node may be connected to hundreds of sublinks, and expansion beyond four layers will cause the scale of the graph to grow exponentially. In addition, the present invention finds that adding a fifth layer of available data on the basis of the existing four layers of nodes contributes less than 1% of the incremental contribution, while significantly increasing the redundancy in analysis and overhead. The cost of applying a large model to each web page for analysis and information extraction is also too high.

[0032] In the deep analysis stage, each information node in the information node graph is further analyzed, and the vulnerability node graph is expanded in two layers. The web page content in each node Node-InfoSource is crawled. The links in the web page content are analyzed, and a list ListOne is generated, and each link in the list ListOne is used as the next layer node Node-InfoSourceNext of the node graph. The web page content of the current layer node Node-InfoSourceNext is crawled, the links in the current layer web page content are analyzed, and a list ListTwo is generated, and each link in the list LisTwo is used as the next layer node Node-InfoSourceNextNext of the node graph, and the web page content in the crawled node Node-InfoSourceNextNext is stored, and information related to the target vulnerability is extracted from the web page content corresponding to the target vulnerability link. Since these contents are unstructured, directly extracting the specified details requires a lot of training processes and manual data annotation, so the present invention uses a large language model for assistance. Although the large language model performs well in language understanding, it lacks domain-specific knowledge of vulnerabilities. In order to overcome this problem, the present invention adopts a few-shot prompting strategy (i.e., a few-shot strategy) to prompt the large language model to perform operations. The present invention provides several analysis samples and results to the large language model for the large language model to be familiar with and learn, and then provides it with the content that needs to be analyzed for it to make inferences. The large language model will assist in filtering content that is not related to the target vulnerability to extract descriptions related to the target vulnerability identifier. A small number of vulnerability pages may list multiple vulnerability numbers and their corresponding vulnerability related information, but the InfoCollector of the present invention will separately extract the vulnerability description content related to a specific target vulnerability number. First, the target vulnerability number and the vulnerability description part in the content of the Node-InfoSource node are submitted as input to the large language model ChatGPT, and it is informed that this vulnerability is the object that the present invention needs to pay attention to, and a role is defined for the current dialogue of the large language model, so that it plays the role of a senior and experienced vulnerability analyst, and then the large language model is informed of the work he needs to do, that is, to determine whether the given content is related to this vulnerability. The web page content is provided to the large language model for judgment. The embodiment of the present invention uses a small sample prompt strategy to extract key information, including the problem submission number, submission link, vulnerability number, vulnerability impact version, vulnerability location, vulnerability type, vulnerability security impact, and vulnerability trigger file location.

[0033] The nodes in the existing four-layer node graph are used as the first part of the entities in the knowledge graph, and the relationship between the entities in the vulnerability information node graph is added. Each node in the vulnerability information node graph is traversed, and the extracted vulnerability key information is added as a new entity in the graph, and the relationship between the new entity and the existing entity is supplemented simultaneously to generate the target vulnerability information knowledge graph.

[0034] In empirical studies, using key information, such as commit numbers or issue numbers, in reference links often results in mining highly accurate patch mappings. However, when this information is not available, the present invention finds that using other relevant information, such as the location and type of the vulnerability, can significantly reduce the search space. By applying heuristic methods, such as excluding patches that only modify test files, the present invention can further accurately identify potential fix code commits. Based on this approach, an embodiment of the present invention proposes a method that combines matching and filtering strategies, PHunter, which is an algorithm for discovering vulnerability patches. The detailed algorithm is as follows: Figure 2 It combines matching and filtering strategies to efficiently and accurately identify commits related to a given vulnerability. It first uses a whitelist-based approach to prioritize highly relevant fix code commits. If no match is found, it will adopt a blacklist-based filtering approach, leveraging additional vulnerability information to exclude irrelevant commits while retaining commits related to vulnerability fixes.

[0035] The present invention develops PMatcher, which is a whitelist-based matching method for giving priority to highly relevant fix code submissions. The node Node-InfoSource in the target vulnerability information knowledge graph is analyzed to see if there is a link pattern directly related to the code submission. If it meets the link pattern, it is considered that there is a directly related patch code submission; secondly, the nodes Node-InfoSourceNext and Node-InfoSourceNextNext in the target vulnerability information knowledge graph are analyzed to see if there is a link pattern directly related to the code submission. If it meets the link pattern, it is considered that there is an indirectly related patch code submission. Three regular expressions are used to normalize the features of submission links and numbers for matching:

[0036] Rule1=github\.com(?:\ / [^\ / ]+){2}\ / commit\ / ([0-9a-f]{40})

[0037] Rule2=svn\.org\ / viewvc\? view=revision&revision=(\d+)

[0038] Rule3=\.git\.commit\.

[0039] PHunter applies these expressions to the links associated with the vulnerability, storing them in list C. Γ Then, PHunter matches these with the vulnerability numbers in the commit list C. The matched code commits are considered to be related to the vulnerability fix and are stored in C'.

[0040] In some cases, the matched code submission description may contain a vulnerability number, but may only describe or test the vulnerability without providing a patch to fix the vulnerability number. To solve this problem, the present invention can analyze the code submission content more thoroughly, focusing on the modified code in the code submission, especially the non-test code, as a valid fix code submission. For example, Figure 3 As shown, commit bee9c5913 adds a description of the target vulnerability. Figure 4 The commit ede782b414 shown added a test for the vulnerability. Neither is classified as a valid fix commit.

[0041] Redundant candidate filtering, collect all code submissions from the code base of the target affected by the vulnerability, as Lall, then analyze the vulnerability affected version range in the vulnerability description for further screening, as Lversion, and then analyze the vulnerability affected location information in the vulnerability description for further screening, as Llocation. Next, the present invention extracts all nouns from the description as keywords for screening, as Lkeywords, and finally, the list is screened for the last time to filter code submissions that are not related to security, as Lfinal. Since vulnerabilities are usually tracked using issue numbers, linking them helps identify fix code submissions. The filtering strategy is designed to exclude submissions that are low in relevance to specific target vulnerabilities. The present invention first uses the issue number as a keyword to filter submissions. If the issue number cannot be found, then filter by affected version, location, and keyword in turn to exclude irrelevant submissions.

[0042] The description information of the code submission and the specific modified code snippets may vary due to different branch fixes of the same vulnerability, which may result in the first two methods not necessarily being able to identify complete code repair submissions related to the target vulnerability. The present invention proposes a secure code submission extension algorithm, which aims to completely and accurately find all possible repair code submissions for a given vulnerability. Vulnerability repair code submission similarity analysis identifies complete repair code submissions related to the target vulnerability by utilizing the similarities between code submissions. The present invention divides these extension methods into two groups: code modification similarity methods based on code submissions and similarity methods based on code submission descriptions.

[0043] Code modification similarity method based on code submission. According to research, code changes in fix submissions related to the same vulnerability can be divided into four categories: identical, highly similar, subset relationship, and significantly different. The method of the present invention is designed to handle the first three most common categories. Specifically, it uses local sensitive hashing to group probabilistically similar inputs into the same category, so as to flexibly handle code submission modifications. First, local sensitive hashing is applied to each code change, and the distance between the inputs is calculated. If the distance is less than a predetermined threshold, it is judged to be similar. The threshold selects the optimal value selected through multiple experiments. These inputs refer to code modifications from target fix code submissions and candidate code submissions.

[0044] Similarity method based on code submission description. Code submission messages usually contain specific purpose and details about the code submission. The present invention divides this information into two similarity types: the first is fine-grained similarity. Code submission descriptions that explicitly reference vulnerability numbers or issue numbers. Code submissions with the same impact number are considered part of the same security patch. The second is coarse-grained similarity. The code submission information does not specify the exact vulnerability but the description content is similar. The present invention uses the SequenceMatcher library to evaluate similarity, and descriptions are considered similar only when their similarity scores reach 90% or higher.

[0045] Finally, the detection method PatchExplorer of the present invention is compared with the current representative methods and tools direct matching method, TRACER and VFCFinder. The results are shown in Table 1. The first column is the name of the target project, and the second column is the number of security code submissions of the target, which represents the number of security code submissions that can be detected under ideal conditions. The following three columns are the results of the number of patch code submissions mined by the direct association method, TRACER, VFCFinder and the method PatchExplorer of this paper. In terms of recall rate, PatchExplorer is 64.66%, 35.35% and 65.55% higher than the other three methods respectively.

[0046]

[0047]

[0048] Table 1

[0049] The above embodiments are provided only for the purpose of describing the present invention, and are not intended to limit the scope of the present invention. The scope of the present invention is defined by the appended claims. Various equivalent substitutions and modifications made without departing from the spirit and principles of the present invention should all be included within the scope of the present invention.

Claims

1. A method for constructing a vulnerability information knowledge graph, the steps of which include: Get links to different types of information sources related to the vulnerability based on the vulnerability number; The vulnerability number is used as the initial node, the information source category is used as the first-level node, and the information source link is used as the second-level node to construct the information node graph of the vulnerability; Crawling the links existing in the content of each information source link to form lower-level nodes; continuing crawling to form a set number of lower-level nodes; Extract key vulnerability information from each link content and add it as supplementary content of the corresponding node; A vulnerability information knowledge graph is constructed with nodes as entities and the relationships between nodes as entity relationships.

2. The method according to claim 1, characterized in that A few-sample prompting strategy is used to judge the relevance of the link content and the vulnerability through a large language model to extract key vulnerability information.

3. Method for obtaining vulnerability patches, the steps include: Performing knowledge association analysis on the knowledge graph constructed according to the method of claim 1 or 2 to confirm whether there is a link pattern directly or indirectly related to code submission; Get code submissions that match the link mode to automatically obtain vulnerability patches.

4. The method according to claim 3, characterized in that The code submissions are matched and filtered according to predetermined rules to screen the code submissions.

5. The method according to claim 4, characterized in that Remove the specified software that is not affected by the vulnerability, as well as code submissions that only contain comment lines, blank lines, test code modifications, and document annotation modifications.

6. The method according to claim 3, characterized in that Perform patch code filtering operations to filter out code submissions that are not related to vulnerability fixes.

7. The method according to claim 3, characterized in that Similarities between the code submissions are identified to obtain complete patch code submissions.

8. The method according to claim 7, characterized in that The similarity between the code submissions includes similarity based on code modification of the code submissions and similarity based on descriptions of the code submissions.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing the method according to any one of claims 1 to 8.

10. A storage medium storing a computer program, wherein when the computer program is executed by a computer, the method according to any one of claims 1 to 8 is implemented.

Images