Source code security verification method and device, equipment and medium

Abstract

The invention discloses a security verification method and device for a source code, equipment and a medium. The method comprises the steps of obtaining a file call dependency graph and a function call graph of the source code; segmenting the file calling dependency graph to obtain file dependency sub-graphs; segmenting the function call graph based on the file dependency sub-graph to obtain a function call sub-graph; traversing the function calling sub-graph to obtain a first function set and a second function set; obtaining a third function set based on the file call dependency graph, the function call graph, the function call sub-graph and the second function set; and based on the first function set and the third function set, obtaining a target fragment corresponding to the source code, and verifying the target fragment to obtain a verification result of the source code. The source code is identified and disassembled through the combined dependency relationship of the file call dependency graph and the function call graph, so that the disassembly efficiency and verification effect of the source code are improved.

Description

Technical Field

[0001] The present application relates to the field of software security technology, and in particular to a source code security verification method, device, equipment and medium. Background Art

[0002] Computer software is closely related to people's lives. It is almost everywhere, from daily communication devices such as the Internet and mobile phones to key infrastructure such as energy and national defense. Due to the lack of effective means to control software quality, software vulnerabilities or errors are almost inevitable. Every year, the losses caused by software vulnerabilities or errors amount to tens of billions of dollars. The operating system is the basic platform for all software, and it is of great value to strictly ensure its reliability and security. Among the currently known technologies, only formal methods can ensure that software will not make mistakes. However, due to the large code size and complexity, high concurrency and other problems of large-scale software systems, such as operating systems, their formal verification has always been a very difficult task.

[0003] For source code verification of complex software, model checking technology is generally used. Model checking first converts the program source code into a formula, and then uses a formula parser to prove the correctness of the formula. Compared with formal verification technologies such as theorem proving, model checking has a higher degree of automation. However, due to the large code size and complexity of complex software, model checking may lead to problems such as long verification time or timeout, false positives or false negatives. Summary of the invention

[0004] The present application provides a source code security verification method, apparatus, device and medium, which identifies and disassembles source code through the combined dependency relationship of a file call dependency graph and a function call graph, thereby improving the source code disassembly efficiency and verification effect.

[0005] The technical solution of this application is as follows:

[0006] On the one hand, the present application provides a method for security verification of source code, the method comprising: obtaining a file call dependency graph and a function call graph of the source code; splitting the file call dependency graph to obtain a file dependency subgraph; splitting the function call graph based on the file dependency subgraph to obtain a function call subgraph; traversing the function call subgraph to obtain a first function set and a second function set, the first function set including a plurality of first target functions within a preset verification range, the second function set including a second target function called by the plurality of first target functions; obtaining a third function set based on the file call dependency graph, the function call graph, the function call subgraph and the second function set; obtaining a target fragment corresponding to the source code based on the first function set and the third function set and verifying the target fragment to obtain a verification result of the source code.

[0007] On the other hand, the present application provides a source code security verification device, the device comprising:

[0008] A first acquisition module is used to acquire a file call dependency graph and a function call graph of a source code;

[0009] A first segmentation module, used to segment the file call dependency graph to obtain a file dependency subgraph;

[0010] A second segmentation module is used to segment the function call graph based on the file dependency subgraph to obtain a function call subgraph;

[0011] A traversal module is used for the function call subgraph to obtain a first function set and a second function set, wherein the first function set includes a plurality of first target functions within a preset verification range, and the second function set includes second target functions called by the plurality of first target functions;

[0012] A third function set acquisition module, configured to obtain a third function set based on the file call dependency graph, the function call graph, the function call subgraph and the second function set;

[0013] The verification module obtains a target segment corresponding to the source code based on the first function set and the third function set, and verifies the target segment to obtain a verification result of the source code.

[0014] On the other hand, a source code security verification device is provided, the device comprising a processor and a memory, the memory storing at least one instruction or at least one program, the at least one instruction or the at least one program being loaded and executed by the processor to implement the source code security verification method as described above.

[0015] On the other hand, a computer-readable storage medium is provided, in which at least one instruction or at least one program is stored, and the at least one instruction or the at least one program is loaded and executed by a processor to implement the security verification of the source code as described above.

[0016] The source code security verification method, device, equipment and storage medium provided by this application have the following technical effects:

[0017] By using the technical solution provided by the present application, in the scenario of formal verification of source code, the file call dependency graph and function call graph of the source code are first obtained; the file call dependency graph is divided to obtain the file dependency subgraph; the function call graph is divided based on the file dependency subgraph to obtain the function call subgraph; the function call subgraph is traversed to obtain the first function set and the second function set, the first function set includes multiple first target functions within the preset verification range, and the second function set includes multiple second target functions called by the first target function; the third function set is obtained based on the file call dependency graph, the function call graph, the function call subgraph, and the second function set; based on the first function set and the third function set, the target fragmentation corresponding to the source code is obtained and the target fragmentation is verified to obtain the verification result of the source code. By first dividing the file call dependency graph and then dividing the function call graph, the efficiency and accuracy of the function call graph division are improved, thereby improving the verification efficiency of the source code. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0019] Figure 1 It is a flowchart of a source code security verification method provided by an embodiment of the present application;

[0020] Figure 2 is a schematic diagram of a process for determining a third function set provided in an embodiment of the present application;

[0021] Figure 3 is a schematic diagram of a process for determining a third objective function provided in an embodiment of the present application;

[0022] Figure 4 It is a schematic diagram of a source code security verification device provided in an embodiment of the present application;

[0023] Figure 5 It is a structural diagram of a source code security verification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] The following describes a source code security verification method provided by an embodiment of the present application. Figure 1 A flowchart of a source code security verification method provided in an embodiment of the present application. It should be noted that this specification provides method operation steps such as the embodiments or flowcharts, but may include more or fewer operation steps based on conventional or non-creative work. The order of steps listed in the embodiments is only one way of executing the steps among many orders, and does not represent the only order of execution. When the actual system or product is executed, it can be executed in the order shown in the embodiments or the drawings or in parallel (for example, in a parallel processor or multi-threaded processing environment). Specifically, Figure 1 As shown, the method may include:

[0027] S101, obtaining a file call dependency graph and a function call graph of a source code.

[0028] In the embodiments of the present specification, the above-mentioned computer system may be a computer system installed in a computer device, which may include but is not limited to: a mobile terminal, a computer terminal, a server or a similar computing device, and the computer system may include: Microsoft Windows system, iOS system, Android system and embedded system, etc., wherein the embedded system may include: Linux system, VxWorks system, uCOS system, FreeRTOS system, RTOS system, etc.

[0029] It is understandable that computer software is closely related to people's lives. Due to the lack of effective means to control software quality, software vulnerabilities or errors are almost inevitable. The operating system is the basic platform for all software, and it is of great value to strictly ensure its reliability and security. In the currently known technologies, formal verification methods can be used to verify whether the software will make mistakes. However, due to the large scale of some software, such as operating systems, the large code scale and complexity, high concurrency and other problems, its formal verification has always been difficult and complicated. Formal verification methods for complex software source code include theorem proof, model checking, constraint solving, abstract interpretation and other methods. In the prior art, model checking is generally used to formally verify complex software. Among them, model checking first converts the program source code into a formula, and then uses a formula parser to prove the correctness of the formula. Compared with formal verification technologies such as theorem proof, model checking has a higher degree of automation. However, due to the large code scale and complexity of complex software, model checking will have problems such as long verification time or running timeout, false positives or false negatives.

[0030] Specifically, existing program disassembly method relies on manual operation or configuration setting, mainly relies on the experience of verification personnel, lacks automated processing means.For improving verification efficiency and accuracy, some actual functions would be replaced with pile functions usually to simplify the detection process. However, there is no clear standard to guide which functions are piled, usually based on experience, or progressively increase the use of pile functions according to verification feedback.

[0031] Specifically, the technical solution of the present application is implemented through a security verification component, which includes a combined call graph generator, an automatic program disassembler and a stub function filter. The combined call graph generator is used to generate a file call dependency graph and a function call graph, the automatic program disassembler is used to split the file call dependency graph and the function call graph to extract a first function set and a second function set, and the stub function filter is used to filter out functions that need to be plugged in.

[0032] Specifically, the above source code security verification method can be applied to a variety of programming languages, including C, C++, Java, etc.

[0033] In the embodiment of this specification, S101 includes:

[0034] S1011, extracting the file calling relationship and function calling relationship of the source code.

[0035] S1013, generating a file call dependency graph and a function call graph based on the file call relationship and the function call relationship.

[0036] Specifically, the Makefile build command can be used to obtain the file dependencies of the source code and generate a file call dependency graph, wherein the file call dependency graph may be in a GML format. Static analysis tools such as Clang StaticAnalyzer, Understand, SonarQube or other abstract syntax trees are used to obtain the function call graph of the source code.

[0037] S102, split the file call dependency graph to obtain a file dependency subgraph.

[0038] In one embodiment, a graph segmentation algorithm such as the METIS algorithm or the Spectral Clustering algorithm is used to call a file dependency graph to obtain a file dependency subgraph.

[0039] S103, splitting the function call graph based on the file dependency subgraph to obtain a function call subgraph.

[0040] In the embodiments of the present application specification, a mapping relationship is established between each function and the file to which it belongs, and the functions are assigned to corresponding subgraphs according to the file dependency subgraph. Functions belonging to the same file subgraph and their calling relationships are extracted to generate a function call subgraph.

[0041] S104, traverse the function call subgraph to obtain a first function set and a second function set, the first function set includes a plurality of first target functions within a preset verification range, and the second function set includes a plurality of second target functions called by the first target functions.

[0042] Specifically, the nodes and dependency edges of the function call subgraph are extracted in sequence to obtain the first function set and the second function set, the first function set is the function set to be verified, the second function set is the function set to be plugged, the first target function is the function of the function call subgraph, and the second target function is the dependency edge related function.

[0043] S105, obtaining a third function set based on the file call dependency graph, the function call graph, the function call subgraph and the second function set.

[0044] In one embodiment, S105 includes:

[0045] S202, based on the file call dependency graph, the function call graph, and the function call subgraph, a plurality of third objective functions and a plurality of combined metric values ​​are obtained, and the combined metric values ​​correspond to the third objective functions one by one.

[0046] Specifically, in one embodiment, S202 includes:

[0047] S301, based on a file call dependency graph, obtain a plurality of first key nodes of the source code, each of the first key nodes includes a first metric value, and the first metric value represents the strength of the dependency relationship between the files.

[0048] Specifically, a first key node is identified from the file call dependency graph, and a first metric value is calculated. The first key node represents a file. The first metric value = first in-degree value / first out-degree value. The first in-degree value is the number of times the node is called by other files, and the first out-degree value is the number of times other files are called. In an embodiment of the present application, a node whose first in-degree value is greater than the first out-degree value is the first key node, that is, a node whose first metric value is greater than 1 is the first key node. When the first out-degree value is zero, a first preset value is selected as the input value of the first out-degree value. The first preset value of the present application is 1 / 2.

[0049] S303, based on the function call graph, obtain multiple second key nodes of the source code, each second key node includes a second metric value, and the second metric value represents the strength of the call relationship between the functions.

[0050] Specifically, the second key node is identified from the function call graph, and the second metric value is calculated. The second key node represents the function. The second metric value = second in-degree value / second out-degree value. The second in-degree value is the number of times the node is called by other functions, and the second out-degree value is the number of times the node calls other functions. Functions with high in-degree and low out-degree are screened as second key nodes. In the embodiment of the present application, the node whose second in-degree value is greater than the second out-degree value is the second key node, that is, the second metric value is greater than 1 and is the second key node. When the second out-degree value is zero, the second preset value is selected as the input amount of the second out-degree value. The second preset value of the present application is 1 / 2.

[0051] S305, based on the multiple first key nodes and the multiple second key nodes, obtain multiple third key nodes, the third key nodes representing the function that the file where the second key node is located belongs to the first key node.

[0052] Specifically, for each second key node, the file to which the node belongs is searched, and if the file is the first key node, the function is associated with the file as the third key node.

[0053] S307, based on the plurality of third key nodes and the function call subgraph, obtain a plurality of third objective functions and a plurality of combined metric values, wherein the combined metric values ​​correspond one to one to the third objective functions.

[0054] In one embodiment, S307 includes:

[0055] S402, based on the function call subgraph, obtain multiple fourth key nodes of the source code, each fourth key node includes a third metric value, the third metric value is determined based on the third in-degree value and the third out-degree value, and the third in-degree value is greater than the third out-degree value.

[0056] Specifically, the fourth key node is identified from the function call subgraph, and the third metric value is calculated. The third key node represents the function. The third metric value = third in-degree value / third out-degree value. The third in-degree value is the number of times the node is called by other functions, and the second out-degree value is the number of times the node calls other functions. Functions with high in-degree and low out-degree are screened as the third key nodes. In the embodiment of the present application, the node whose third in-degree value is greater than the third out-degree value is the third key node, that is, the third metric value is greater than 1 and is the second key node. When the third out-degree value is zero, the third preset value is selected as the input amount of the second out-degree value. The third preset value of the present application is 1 / 2.

[0057] S404, based on the plurality of third key nodes and the plurality of fourth key nodes, a plurality of third objective functions are obtained, wherein the third objective function represents the function where the fourth key node is located and belongs to the function of the third key node.

[0058] Specifically, the fourth key node set is traversed to obtain the function to which each key node belongs, and the functions of the fourth key node belonging to the third key node are screened to obtain a plurality of third objective functions.

[0059] In one embodiment, after S404, the following steps are included:

[0060] S501, obtaining a first metric value, a second metric value, and a third metric value of each third objective function to obtain a combined metric value of each third function.

[0061] Specifically, the first metric value represents the association of the function in the file dependency graph, the second metric value represents the calling frequency of the function in the function call graph, and the third metric value represents the dependency characteristics of the function in the call subgraph. In an embodiment of the present specification, the combined metric value = the first metric value + the second metric value + the third metric value; in other embodiments, the combined metric value = α·first metric value + β·second metric value + γ·third metric value, where α, β, and γ are weight parameters, and the weight parameters can be adjusted according to actual needs.

[0062] S503, sorting the combined metric values ​​in descending order to obtain a fourth function set.

[0063] Specifically, the name of each third objective function and the corresponding combined metric value are input, the combined metric values ​​of each third objective function are arranged in descending order, and the first N functions are selected as the fourth function set or the function set with a combined metric value greater than a preset threshold is selected as the fourth function set. The number N of the fourth function set is associated with the scale of the source code to be verified.

[0064] S204, sorting the multiple combined metric values ​​to obtain a fourth function set, where the fourth function set includes a preset number of fourth objective functions, and the combined metric value of the fourth objective function is greater than the preset metric value.

[0065] Specifically, multiple combined metric values ​​are sorted in descending order or ascending order, and the name of each third objective function and the corresponding combined metric value are input. If sorted in ascending order, the first M functions are eliminated, and the eliminated functions are taken as the fourth function set.

[0066] S206: Add the fourth function set to the second function set to obtain an updated second function set.

[0067] Specifically, the updated second function set is the target function set to be plugged in. In one embodiment of the specification, deduplication processing is performed on the merged function set to output the updated second function set.

[0068] S208, performing instrumentation processing on the updated second function set to obtain a third function set.

[0069] In the embodiments of the specification, the instrumentation process refers to inserting code into the source code to facilitate tracking, recording or modifying program behavior. Instrumentation is performed on each function of the updated second function set, such as inserting performance test code and debugging code, etc. The code is inserted at the beginning of the function, which is often used for logging, timing or resource allocation monitoring, and the code is inserted at the end of the function to record function return values ​​or release resources. In one embodiment, the updated second function set is instrumented by manual instrumentation.

[0070] S106: Based on the first function set and the third function set, obtain a target segment corresponding to the source code and verify the target segment to obtain a verification result of the source code.

[0071] Specifically, the target slice includes a first function set and a third function set, and the source code slice is divided according to the functional modules or functions of the source code. The target slice is input into the model detection tool to start model detection and form a verification result report of the overall software source code.

[0072] In one embodiment, S106 includes:

[0073] S602: Obtain a target fragment corresponding to the source code based on the first function set and the third function set.

[0074] Specifically, the target sharding is to split the source code by function or function block, so that each shard represents an independent part of the source code and can be verified separately. The first function set includes the function set to be verified, and the second function set is the function set after the instrumentation process. The target sharding is to split the source code by function or function block, so that each shard represents an independent part of the source code and can be verified separately. By combining the first function set and the third function set, the boundaries of each shard are determined, thereby obtaining the target sharding.

[0075] S604: Verify the target slice and the feature information to be verified to obtain multiple verification results.

[0076] Specifically, the feature information to be verified includes the verification standard or condition. The feature information to be verified is used to characterize input data, test cases or verification standards, etc. The target shard and the feature information to be verified are input into a model detection tool such as CPAChecker to perform model detection verification and generate multiple verification results. Each verification result characterizes the verification status of the corresponding target shard, such as pass or fail.

[0077] S606: Obtain a verification result of the source code based on the multiple verification results.

[0078] Specifically, the verification results of each target shard are combined to obtain the overall verification result of the source code. In one embodiment, when all target shards are verified, the overall source code is verified. When some shards fail to be verified, the overall source code fails to be verified. In another embodiment, if there is a priority sequence between the shards, the verification results are weighted to determine whether the source code meets the preset passing conditions.

[0079] It can be seen from the technical solutions provided by the above embodiments of this specification that in the scenario of formal verification of source code, by first obtaining the file call dependency graph and function call graph of the source code; splitting the file call dependency graph to obtain the file dependency subgraph; splitting the function call graph based on the file dependency subgraph to obtain the function call subgraph; traversing the function call subgraph to obtain the first function set and the second function set, the first function set includes multiple first target functions within the preset verification range, and the second function set includes multiple second target functions called by the first target function; based on the file call dependency graph, the function call graph, the function call subgraph and the second function set, the third function set is obtained; based on the first function set and the third function set, the target fragmentation corresponding to the source code is obtained and the target fragmentation is verified to obtain the verification result of the source code. By first splitting the file call dependency graph and then splitting the function call graph, the efficiency and accuracy of the function call graph division are improved, thereby improving the verification efficiency of the source code.

[0080] The present application embodiment provides a source code security verification device, such as Figure 4 As shown, the device comprises:

[0081] A first acquisition module 410 is used to acquire a file call dependency graph and a function call graph of a source code;

[0082] A first segmentation module 420, configured to segment the file call dependency graph to obtain a file dependency subgraph;

[0083] A second segmentation module 430 is used to segment the function call graph based on the file dependency subgraph to obtain a function call subgraph;

[0084] A traversal module 440 is used for the function call subgraph to obtain a first function set and a second function set, wherein the first function set includes a plurality of first target functions within a preset verification range, and the second function set includes second target functions called by the plurality of first target functions;

[0085] A third function set acquisition module 450, configured to obtain a third function set based on the file call dependency graph, the function call graph, the function call subgraph and the second function set;

[0086] The verification module 460 is used to obtain a target segment corresponding to the source code based on the first function set and the third function set, and verify the target segment to obtain a verification result of the source code.

[0087] In a specific embodiment, the third function set acquisition module 450 may include:

[0088] A first acquisition submodule, configured to obtain a plurality of third objective functions and a plurality of combined metric values ​​based on the file call dependency graph, the function call graph, and the function call subgraph, wherein the combined metric values ​​correspond one-to-one to the third objective functions;

[0089] A sorting submodule, configured to sort the multiple combined metric values ​​to obtain a fourth function set, wherein the fourth function set includes a preset number of fourth objective functions, and the combined metric value of the fourth objective function is greater than the preset metric value;

[0090] A first processing submodule, configured to add the fourth function set to the second function set to obtain an updated second function set;

[0091] The second processing submodule is used to perform instrumentation processing on the updated second function set to obtain the third function set.

[0092] In a specific embodiment, the first acquisition submodule may include:

[0093] A first key node acquisition unit, configured to obtain a plurality of first key nodes of the source code based on the file call dependency graph, each of the first key nodes comprising a first metric value, the first metric value representing the strength of the dependency relationship between the files;

[0094] A second key node acquisition unit, configured to obtain a plurality of second key nodes of the source code based on the function call graph, each of the second key nodes comprising a second metric value, wherein the second metric value represents the strength of the call relationship between the functions;

[0095] A third key node acquisition unit, configured to obtain a plurality of third key nodes based on the plurality of first key nodes and the plurality of second key nodes, wherein the third key nodes represent functions in which the files where the second key nodes are located belong to the first key nodes;

[0096] The first acquisition unit is used to obtain multiple third objective functions and multiple combined metric values ​​based on the multiple third key nodes and the function call subgraph, and the combined metric values ​​correspond to the third objective functions one by one.

[0097] In a specific embodiment, the first obtaining unit may include:

[0098] a fourth key node acquisition subunit, configured to obtain a plurality of fourth key nodes of the source code based on the function call subgraph, each of the fourth key nodes comprising a third metric value, the third metric value being determined based on a third in-degree value and a third out-degree value, the third in-degree value being greater than the third out-degree value;

[0099] The first acquisition subunit is used to obtain multiple third objective functions based on the multiple third key nodes and the multiple fourth key nodes, and the third objective function represents the function of the fourth key node belonging to the third key node.

[0100] In a specific embodiment, the first obtaining unit further includes:

[0101] A combined metric value acquisition subunit is used to acquire the first metric value, the second metric value and the third metric value of each third objective function to obtain a combined metric value of each third function;

[0102] The fourth function set acquisition subunit is used to sort the combined metric values ​​in descending order to obtain a fourth function set.

[0103] In a specific embodiment, the first acquisition module 410 further includes:

[0104] The call relationship submodule is used to extract the file call relationship and function call relationship of the source code;

[0105] The graph generation submodule is used to generate the file call dependency graph and the function call graph based on the file call relationship and the function call relationship.

[0106] In a specific embodiment, the verification module 460 further includes:

[0107] The call relationship processing submodule is used to extract the file call relationship and function call relationship of the source code;

[0108] The graph processing submodule is used to generate the file call dependency graph and the function call graph based on the file call relationship and the function call relationship.

[0109] It should be noted that the device provided in the above embodiment, when implementing its functions, is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0110] An embodiment of the present application provides a computer device, which includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement a source code security verification method provided in the above method embodiment.

[0111] Figure 5 A schematic diagram of the hardware structure of a device for implementing a source code security verification method provided in an embodiment of the present application is shown. The device may participate in or include the apparatus or system provided in an embodiment of the present application. Figure 5 As shown, the device 5 may include one or more (502a, 502b, ..., 502n are used to illustrate) processors 502 (the processor 502 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 504 for storing data, and a transmission device 506 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 5 The structure shown is for illustration only and does not limit the structure of the above electronic device. Figure 5 More or fewer components as shown, or with Figure 5 Different configurations shown.

[0112] It should be noted that the one or more processors 502 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the device 5 (or mobile device). As involved in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0113] The memory 504 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the method in the embodiment of the present application. The processor 502 executes various functional applications and data processing by running the software programs and modules stored in the memory 504, that is, realizing the above-mentioned table data processing method. The memory 504 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 504 may further include a memory remotely arranged relative to the processor 502, and these remote memories may be connected to the device 5 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0114] The transmission device 506 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the device 5. In one example, the transmission device 506 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 506 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0115] The display may be, for example, a touch screen liquid crystal display (LCD) which may enable a user to interact with a user interface of the device 5 (or mobile device).

[0116] An embodiment of the present application also provides a computer-readable storage medium, which can be set in a server to store at least one instruction or at least one program related to a table data processing method in an embodiment of the method. The at least one instruction or the at least one program is loaded and executed by the processor to implement a source code security verification method provided in the above embodiment of the method.

[0117] Optionally, in this embodiment, the storage medium may be located in at least one of the multiple network servers of the computer network. Optionally, in this embodiment, the storage medium may include, but is not limited to, various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0118] The embodiment of the present invention also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes a source code security verification method provided in the above various optional implementations.

[0119] It should be noted that the above-mentioned sequence of the embodiments of the present application is for description only and does not represent the advantages and disadvantages of the embodiments. The above-mentioned specific embodiments of the present application are described. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0120] Each embodiment in this application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, equipment and storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0121] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware, or by a program to instruct the relevant hardware, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0122] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A method for verifying the security of source code, characterized in that: The method comprises: Get the file call dependency graph and function call graph of the source code; Splitting the file call dependency graph to obtain a file dependency subgraph; Splitting the function call graph based on the file dependency subgraph to obtain a function call subgraph; Traversing the function call subgraph to obtain a first function set and a second function set, wherein the first function set includes a plurality of first target functions within a preset verification range, and the second function set includes second target functions called by the plurality of first target functions; Obtaining a third function set based on the file call dependency graph, the function call graph, the function call subgraph and the second function set; Based on the first function set and the third function set, a target slice corresponding to the source code is obtained and the target slice is verified to obtain a verification result of the source code.

2. The method according to claim 1, characterized in that The obtaining of the third function set based on the file call dependency graph, the function call graph, the function call subgraph and the second function set comprises: Based on the file call dependency graph, the function call graph, and the function call subgraph, a plurality of third objective functions and a plurality of combined metric values ​​are obtained, wherein the combined metric values ​​correspond one to one to the third objective functions; Sorting the multiple combined metric values ​​to obtain a fourth function set, the fourth function set including a preset number of fourth objective functions, the combined metric values ​​of the fourth objective functions being greater than the preset metric value; Adding the fourth function set to the second function set to obtain an updated second function set; The updated second function set is instrumented to obtain the third function set.

3. The method according to claim 2, characterized in that The obtaining of a plurality of third objective functions and a plurality of combined metric values ​​based on the file call dependency graph, the function call graph, and the function call subgraph, wherein the combined metric values ​​correspond one-to-one to the third objective function, includes: Based on the file call dependency graph, a plurality of first key nodes of the source code are obtained, each of the first key nodes includes a first metric value, and the first metric value represents the strength of the dependency relationship between the files; Based on the function call graph, a plurality of second key nodes of the source code are obtained, each of the second key nodes includes a second metric value, and the second metric value represents the strength of the call relationship between the functions; Based on the plurality of first key nodes and the plurality of second key nodes, a plurality of third key nodes are obtained, wherein the third key nodes represent functions in which the files where the second key nodes are located belong to the first key nodes; Based on the multiple third key nodes and the function call subgraph, multiple third objective functions and multiple combined metric values ​​are obtained, and the combined metric values ​​correspond to the third objective functions one by one.

4. The method according to claim 3, characterized in that The obtaining of a plurality of third objective functions and a plurality of combined metric values ​​based on the plurality of third key nodes and the function call sub-relationships, wherein the combined metric values ​​correspond to the third objective functions in a one-to-one manner, includes: Based on the function call subgraph, a plurality of fourth key nodes of the source code are obtained, each of the fourth key nodes comprises a third metric value, the third metric value is determined based on a third in-degree value and a third out-degree value, and the third in-degree value is greater than the third out-degree value; Based on the multiple third key nodes and the multiple fourth key nodes, multiple third objective functions are obtained, and the third objective function represents the function where the function of the fourth key node belongs to the function of the third key node.

5. The method according to claim 4, characterized in that The method of obtaining a plurality of third objective functions based on the plurality of third key nodes and the plurality of fourth key nodes, wherein the third objective function characterizes that the function where the fourth key node is located belongs to the function of the third key node, comprises: Obtaining a first metric value, a second metric value, and a third metric value of each third objective function to obtain a combined metric value of each third function; The combined metric values ​​are sorted in descending order to obtain a fourth function set.

6. The method according to any one of claims 1 to 3, characterized in that: The step of obtaining the file call dependency graph and function call graph of the source code includes: Extract the file calling relationship and function calling relationship of the source code; Based on the file calling relationship and the function calling relationship, the file calling dependency graph and the function calling graph are generated.

7. The method according to any one of claims 1 to 3, characterized in that: The obtaining, based on the first function set and the third function set, a target slice corresponding to the source code and verifying the target slice to obtain a verification result of the source code includes: Based on the first function set and the third function set, obtaining a target fragment corresponding to the source code; Verifying the target shard and the feature information to be verified to obtain multiple verification results; Based on the multiple verification results, a verification result of the source code is obtained.

8. A source code security verification device, characterized in that: The device comprises: A first acquisition module is used to acquire a file call dependency graph and a function call graph of a source code; A first segmentation module, used to segment the file call dependency graph to obtain a file dependency subgraph; A second segmentation module is used to segment the function call graph based on the file dependency subgraph to obtain a function call subgraph; A traversal module is used for the function call subgraph to obtain a first function set and a second function set, wherein the first function set includes a plurality of first target functions within a preset verification range, and the second function set includes second target functions called by the plurality of first target functions; A third function set acquisition module, configured to obtain a third function set based on the file call dependency graph, the function call graph, the function call subgraph and the second function set; The verification module obtains a target segment corresponding to the source code based on the first function set and the third function set, and verifies the target segment to obtain a verification result of the source code.

9. A source code security verification device, characterized in that: The device includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the source code security verification method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by a processor to implement the source code security verification method as described in any one of claims 1 to 7.

Images