A source code security verification method, device, equipment and medium

Abstract

The application discloses a security verification method, device and equipment of source code and a medium. The method comprises the following steps: acquiring a file call dependency graph and a function call graph of the source code; segmenting the file call dependency graph to obtain a file dependency subgraph; segmenting the function call graph based on the file dependency subgraph to obtain a function call subgraph; traversing the function call subgraph to obtain a first function set and a second function set; obtaining a third function set based on the file call dependency graph, the function call graph, the function call subgraph and the second function set; and obtaining a target slice corresponding to the source code based on the first function set and the third function set, verifying the target slice, and obtaining a verification result of the source code. The source code is identified and disassembled through the combined dependency relationship of the file call dependency graph and the function call graph, and the disassembly efficiency and verification effect of the source code are improved.

Description

Technical Field

[0001] The present application relates to the field of software security technology, and in particular to a source code security verification method, apparatus, device and medium. Background Art

[0002] Computer software is closely intertwined with our daily lives, from everyday communications devices like the internet and mobile phones to critical infrastructure like energy and national defense. Due to a lack of effective quality control measures, software vulnerabilities and errors are almost inevitable. Annually, these vulnerabilities and errors result in losses exceeding tens of billions of dollars. Operating systems are the foundational platform for all software, and ensuring their reliability and security is of paramount importance. Currently, only formal methods can guarantee that software is error-free. However, due to the large code size, complexity, and high degree of concurrency of large-scale software systems, such as operating systems, formal verification has always been a challenging task.

[0003] Model checking is a common method for verifying the source code of complex software. Model checking converts the program source code into formulas, then uses a formula parser to prove the correctness of the formulas. Compared to formal verification techniques such as theorem proving, model checking offers a higher degree of automation. However, due to the large code size and complexity of complex software, model checking can lead to problems such as long verification times, timeouts, false positives, and missed detections. Summary of the Invention

[0004] The present application provides a source code security verification method, apparatus, device and medium, which identifies and disassembles source code through the combined dependency relationship of file call dependency graph and function call graph, thereby improving the source code disassembly efficiency and verification effect.

[0005] The technical solution of this application is as follows:

[0006] On the one hand, the present application provides a method for security verification of source code, the method comprising: obtaining a file call dependency graph and a function call graph of the source code; splitting the file call dependency graph to obtain a file dependency subgraph; splitting the function call graph based on the file dependency subgraph to obtain a function call subgraph; traversing the function call subgraph to obtain a first function set and a second function set, the first function set including multiple first target functions within a preset verification range, and the second function set including second target functions called by the multiple first target functions; obtaining a third function set based on the file call dependency graph, the function call graph, the function call subgraph and the second function set; obtaining a target fragment corresponding to the source code based on the first function set and the third function set and verifying the target fragment to obtain a verification result of the source code.

[0007] On the other hand, the present application provides a source code security verification device, the device comprising:

[0008] A first acquisition module is used to obtain a file call dependency graph and a function call graph of the source code;

[0009] A first segmentation module is used to segment the file call dependency graph to obtain a file dependency subgraph;

[0010] A second segmentation module is configured to segment the function call graph based on the file dependency subgraph to obtain a function call subgraph;

[0011] A traversal module is used to traverse the function call subgraph to obtain a first function set and a second function set, wherein the first function set includes a plurality of first target functions within a preset verification range, and the second function set includes second target functions called by the plurality of first target functions;

[0012] A third function set acquisition module, configured to obtain a third function set based on the file call dependency graph, the function call graph, the function call subgraph, and the second function set;

[0013] The verification module obtains a target segment corresponding to the source code based on the first function set and the third function set, and verifies the target segment to obtain a verification result of the source code.

[0014] On the other hand, a source code security verification device is provided, which includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the source code security verification method as described above.

[0015] On the other hand, a computer-readable storage medium is provided, in which at least one instruction or at least one program is stored. The at least one instruction or the at least one program is loaded and executed by a processor to implement the security verification of the source code as described above.

[0016] The source code security verification method, apparatus, device, and storage medium provided in this application have the following technical effects:

[0017] By utilizing the technical solution provided by the present application, in the scenario of formal verification of source code, the file call dependency graph and function call graph of the source code are first obtained; the file call dependency graph is segmented to obtain a file dependency subgraph; the function call graph is segmented based on the file dependency subgraph to obtain a function call subgraph; the function call subgraph is traversed to obtain a first function set and a second function set, wherein the first function set includes multiple first target functions within a preset verification range, and the second function set includes multiple second target functions called by the first target functions; a third function set is obtained based on the file call dependency graph, the function call graph, the function call subgraph, and the second function set; based on the first function set and the third function set, the target fragment corresponding to the source code is obtained and the target fragment is verified to obtain the verification result of the source code. By first segmenting the file call dependency graph and then segmenting the function call graph, the efficiency and accuracy of the function call graph division are improved, thereby improving the verification efficiency of the source code. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present application or the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0019] Figure 1 This is a flow chart of a source code security verification method provided by an embodiment of the present application;

[0020] Figure 2 is a schematic diagram of a flow chart for determining a third function set provided in an embodiment of the present application;

[0021] Figure 3 This is a schematic diagram of a process for determining a third objective function provided by an embodiment of the present application;

[0022] Figure 4 This is a schematic diagram of a source code security verification device provided by an embodiment of the present application;

[0023] Figure 5 This is a schematic diagram of the structure of a source code security verification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0026] The following describes a method for verifying the security of source code provided by an embodiment of the present application. Figure 1 A flowchart of a source code security verification method provided in an embodiment of the present application. It should be noted that this specification provides method operation steps such as the embodiments or flowcharts, but may include more or fewer operation steps based on conventional or non-creative work. The order of steps listed in the embodiment is only one way of executing the steps among many, and does not represent the only execution order. When the actual system or product is executed, it can be executed in sequence or in parallel (for example, in a parallel processor or multi-threaded processing environment) according to the method shown in the embodiment or the accompanying drawings. Specifically, Figure 1 As shown, the method may include:

[0027] S101, obtaining a file call dependency graph and a function call graph of a source code.

[0028] In the embodiments of this specification, the above-mentioned computer system may be a computer system installed in a computer device, which may include but is not limited to: a mobile terminal, a computer terminal, a server or a similar computing device. The computer system may include: Microsoft Windows system, iOS system, Android system and embedded system, etc., among which the embedded system may include: Linux system, VxWorks system, uCOS system, FreeRTOS system, RTOS system, etc.

[0029] Understandably, computer software is closely intertwined with people's lives. Due to the lack of effective means to control software quality, software vulnerabilities and errors are almost inevitable. Operating systems are the foundational platform for all software, and strictly ensuring their reliability and security is of paramount importance. Currently available technologies can verify software for errors through formal verification methods. However, due to the large scale and complexity of certain software, such as operating systems, their code size, complexity, and high degree of concurrency, formal verification has always been difficult and complex. Formal verification methods for complex software source code include theorem proving, model checking, constraint solving, and abstract interpretation. Model checking is commonly used to formally verify complex software. Model checking converts program source code into formulas, then uses a formula parser to prove the correctness of the formulas. Compared to formal verification techniques such as theorem proving, model checking offers a higher degree of automation. However, due to the large code size and complexity of complex software, model checking can lead to problems such as long verification times, runtime timeouts, and false positives or missed negatives.

[0030] Particularly, existing program disassembly method relies on manual operation or configuration setting, mainly relies on the experience of verification personnel, lacks the processing means of automation.For improving verification efficiency and accuracy, some actual functions would be replaced with pile functions usually to simplify the detection process. Yet, there is no clear and definite standard to guide which functions are piled, normally based on experience, or progressively increase the use of pile functions according to verification feedback.

[0031] Specifically, the technical solution of the present application is implemented through a security verification component, which includes a combined call graph generator, an automatic program disassembler and a stub function filter. The combined call graph generator is used to generate a file call dependency graph and a function call graph. The automatic program disassembler is used to split the file call dependency graph and the function call graph to extract the first function set and the second function set. The stub function filter is used to filter out functions that need to be instrumented.

[0032] Specifically, the above source code security verification method can be applied to multiple programming languages, including C, C++, Java, etc.

[0033] In the embodiment of this specification, S101 includes:

[0034] S1011, extracting the file calling relationship and function calling relationship of the source code.

[0035] S1013: Generate a file call dependency graph and a function call graph based on the file call relationship and the function call relationship.

[0036] Specifically, using the Makefile build command can obtain the file dependencies of the source code and generate a file call dependency graph, where the file call dependency graph can be in GML format. Static analysis tools such as Clang StaticAnalyzer, Understand, SonarQube, or other abstract syntax trees can be used to obtain the function call graph of the source code.

[0037] S102, splitting the file call dependency graph to obtain a file dependency subgraph.

[0038] In one embodiment, a graph segmentation algorithm such as the METIS algorithm or the Spectral Clustering algorithm is used to call a file dependency graph to obtain a file dependency subgraph.

[0039] S103: Segment the function call graph based on the file dependency subgraph to obtain a function call subgraph.

[0040] In the embodiments of the present application specification, a mapping relationship is established between each function and the file to which it belongs, and functions are assigned to corresponding subgraphs according to the file dependency subgraph. Functions belonging to the same file subgraph and their calling relationships are extracted to generate a function call subgraph.

[0041] S104, traverse the function call subgraph to obtain a first function set and a second function set, the first function set includes multiple first target functions within a preset verification range, and the second function set includes multiple second target functions called by the first target functions.

[0042] Specifically, the nodes and dependency edges of the function call subgraph are extracted in sequence to obtain the first function set and the second function set. The first function set is the function set to be verified, and the second function set is the function set to be plugged. The first target function is the function of the function call subgraph, and the second target function is the dependency edge related function.

[0043] S105: Obtain a third function set based on the file call dependency graph, the function call graph, the function call subgraph, and the second function set.

[0044] In one embodiment, S105 includes:

[0045] S202 : Based on the file call dependency graph, the function call graph, and the function call subgraph, a plurality of third objective functions and a plurality of combined metric values ​​are obtained, where the combined metric values ​​correspond one-to-one to the third objective functions.

[0046] Specifically, in one embodiment, S202 includes:

[0047] S301 : Based on a file call dependency graph, a plurality of first key nodes of the source code are obtained, each of the first key nodes includes a first metric value, and the first metric value represents the strength of the dependency relationship between the files.

[0048] Specifically, the first key node is identified from the file call dependency graph, and the first metric value is calculated. The first key node represents the file, and the first metric value = the first in-degree value / the first out-degree value. The first in-degree value is the number of times the node is called by other files, and the first out-degree value is the number of times other files are called. In the embodiment of the present application, the node whose first in-degree value is greater than the first out-degree value is the first key node, that is, the first metric value is greater than 1, which is the first key node. When the first out-degree value is zero, the first preset value is selected as the input amount of the first out-degree value. The first preset value of the present application is 1 / 2.

[0049] S303: Based on the function call graph, a plurality of second key nodes of the source code are obtained, each second key node includes a second metric value, and the second metric value represents the strength of the call relationship between the functions.

[0050] Specifically, the second key node is identified from the function call graph, and the second metric value is calculated. The second key node represents the function. The second metric value = second in-degree value / second out-degree value. The second in-degree value is the number of times the node is called by other functions, and the second out-degree value is the number of times the node calls other functions. Functions with high in-degree and low out-degree are screened as second key nodes. In the embodiment of the present application, the node whose second in-degree value is greater than the second out-degree value is the second key node, that is, the second metric value is greater than 1, which is the second key node. When the second out-degree value is zero, the second preset value is selected as the input amount of the second out-degree value. The second preset value of the present application is 1 / 2.

[0051] S305 , obtaining a plurality of third key nodes based on the plurality of first key nodes and the plurality of second key nodes, wherein the third key nodes represent functions of the files where the second key nodes are located belonging to the first key nodes.

[0052] Specifically, for each second key node, the file to which the node belongs is searched, and if the file is the first key node, the function is associated with the file as the third key node.

[0053] S307 , based on the plurality of third key nodes and the function call subgraph, obtain a plurality of third objective functions and a plurality of combined metric values, where the combined metric values ​​correspond one-to-one to the third objective functions.

[0054] In one embodiment, S307 includes:

[0055] S402: Based on the function call subgraph, obtain multiple fourth key nodes of the source code, each fourth key node includes a third metric value, the third metric value is determined based on the third in-degree value and the third out-degree value, and the third in-degree value is greater than the third out-degree value.

[0056] Specifically, the fourth key node is identified from the function call subgraph, and the third metric value is calculated. The third key node represents the function. The third metric value = third in-degree value / third out-degree value. The third in-degree value is the number of times the node is called by other functions, and the second out-degree value is the number of times the node calls other functions. Functions with high in-degree and low out-degree are screened as third key nodes. In the embodiment of the present application, the node whose third in-degree value is greater than the third out-degree value is the third key node, that is, the third metric value is greater than 1 and is the second key node. When the third out-degree value is zero, the third preset value is selected as the input amount of the second out-degree value. The third preset value of the present application is 1 / 2.

[0057] S404: Based on the plurality of third key nodes and the plurality of fourth key nodes, a plurality of third objective functions are obtained, where the third objective function represents the function of the fourth key node belonging to the third key node.

[0058] Specifically, the fourth key node set is traversed to obtain the function to which each key node belongs, and the functions of the fourth key node belonging to the third key node are screened to obtain a plurality of third objective functions.

[0059] In one embodiment, after S404, the following steps are included:

[0060] S501: Obtain a first metric value, a second metric value, and a third metric value of each third objective function to obtain a combined metric value of each third function.

[0061] Specifically, the first metric value represents the association of the function in the file dependency graph, the second metric value represents the calling frequency of the function in the function call graph, and the third metric value represents the dependency characteristics of the function in the call subgraph. In an embodiment of this specification, the combined metric value = the first metric value + the second metric value + the third metric value; in other embodiments, the combined metric value = α·first metric value + β·second metric value + γ·third metric value, where α, β, and γ are weight parameters, and the weight parameters can be adjusted according to actual needs.

[0062] S503 , sorting the combined metric values ​​in descending order to obtain a fourth function set.

[0063] Specifically, the name and corresponding combined metric value of each third objective function are input, the combined metric values ​​of the third objective functions are sorted in descending order, and the top N functions are selected as the fourth function set, or the set of functions with combined metric values ​​greater than a preset threshold is selected as the fourth function set. The number N of the fourth function sets is related to the size of the source code to be verified.

[0064] S204 , sorting the multiple combined metric values ​​to obtain a fourth function set, where the fourth function set includes a preset number of fourth objective functions, and the combined metric values ​​of the fourth objective functions are greater than the preset metric value.

[0065] Specifically, multiple combined metric values ​​are sorted in descending order or ascending order, and the name of each third objective function and the corresponding combined metric value are input. If the sorting is in ascending order, the first M functions are eliminated, and the functions after elimination are taken as the fourth function set.

[0066] S206: Add the fourth function set to the second function set to obtain an updated second function set.

[0067] Specifically, the updated second function set is the target function set to be instrumented. In one embodiment of the specification, deduplication processing is performed on the merged function set to output the updated second function set.

[0068] S208 , performing instrumentation processing on the updated second function set to obtain a third function set.

[0069] In the embodiments of this specification, instrumentation refers to inserting code into source code to facilitate tracking, recording, or modifying program behavior. Instrumentation is performed on each function in the updated second function set, such as by inserting performance testing code and debugging code. Code inserted at the beginning of a function is often used for logging, timing, or resource allocation monitoring, while code inserted at the end of a function is used to record function return values ​​or release resources. In one embodiment, the updated second function set is instrumented through manual instrumentation.

[0070] S106: Based on the first function set and the third function set, obtain a target shard corresponding to the source code and verify the target shard to obtain a verification result of the source code.

[0071] Specifically, the target slice includes a first function set and a third function set, and the source code slice is divided according to the functional modules or functions of the source code. The target slice is input into the model checking tool to start model checking and generate a verification result report of the entire software source code.

[0072] In one embodiment, S106 includes:

[0073] S602: Obtain target fragments corresponding to the source code based on the first function set and the third function set.

[0074] Specifically, target sharding involves splitting the source code by function or functional block, so that each shard represents an independent portion of the source code and can be independently verified. The first function set includes the set of functions to be verified, and the second function set is the set of functions after instrumentation. Target sharding involves splitting the source code by function or functional block, so that each shard represents an independent portion of the source code and can be independently verified. By combining the first and third function sets, the boundaries of each shard are determined, resulting in the target shard.

[0075] S604: Verify the target shard and the feature information to be verified to obtain multiple verification results.

[0076] Specifically, the feature information to be verified includes the verification standards or conditions. The feature information to be verified is used to represent input data, test cases or verification standards, etc. The target shard and the feature information to be verified are input into a model detection tool such as CPAChecker to perform model detection verification and generate multiple verification results. Each verification result represents the verification status of the corresponding target shard, such as pass or fail.

[0077] S606: Obtain a verification result of the source code based on the multiple verification results.

[0078] Specifically, the verification results of each target shard are combined to obtain the overall verification result of the source code. In one embodiment, if all target shards pass the verification, the overall source code passes the verification; if some shards fail the verification, the overall source code fails the verification. In another embodiment, if there is a priority sequence between the shards, the verification results are weighted to determine whether the source code meets the preset passing conditions.

[0079] It can be seen from the technical solutions provided by the above embodiments of this specification that in the scenario of formal verification of source code, the file call dependency graph and function call graph of the source code are first obtained; the file call dependency graph is divided to obtain a file dependency subgraph; the function call graph is divided based on the file dependency subgraph to obtain a function call subgraph; the function call subgraph is traversed to obtain a first function set and a second function set, the first function set includes a plurality of first target functions within a preset verification range, and the second function set includes a plurality of second target functions called by the first target functions; a third function set is obtained based on the file call dependency graph, the function call graph, the function call subgraph, and the second function set; based on the first function set and the third function set, the target fragment corresponding to the source code is obtained and the target fragment is verified to obtain the verification result of the source code. By first dividing the file call dependency graph and then dividing the function call graph, the efficiency and accuracy of dividing the function call graph are improved, thereby improving the verification efficiency of the source code.

[0080] The present application embodiment provides a source code security verification device, such as Figure 4 As shown, the device includes:

[0081] A first acquisition module 410 is used to acquire a file call dependency graph and a function call graph of a source code;

[0082] A first segmentation module 420 is configured to segment the file call dependency graph to obtain a file dependency subgraph;

[0083] A second segmentation module 430 is configured to segment the function call graph based on the file dependency subgraph to obtain a function call subgraph;

[0084] A traversal module 440 is configured to traverse the function call subgraph to obtain a first function set and a second function set, wherein the first function set includes a plurality of first target functions within a preset verification range, and the second function set includes second target functions called by the plurality of first target functions;

[0085] A third function set acquisition module 450 is configured to obtain a third function set based on the file call dependency graph, the function call graph, the function call subgraph, and the second function set;

[0086] The verification module 460 is configured to obtain a target segment corresponding to the source code based on the first function set and the third function set, and verify the target segment to obtain a verification result of the source code.

[0087] In a specific embodiment, the third function set acquisition module 450 may include:

[0088] A first acquisition submodule is configured to obtain a plurality of third objective functions and a plurality of combined metrics based on the file call dependency graph, the function call graph, and the function call subgraph, wherein the combined metrics correspond one-to-one to the third objective functions;

[0089] a sorting submodule, configured to sort the plurality of combined metric values ​​to obtain a fourth function set, wherein the fourth function set includes a preset number of fourth objective functions, and the combined metric value of the fourth objective function is greater than the preset metric value;

[0090] a first processing submodule, configured to add the fourth function set to the second function set to obtain an updated second function set;

[0091] The second processing submodule is configured to perform instrumentation processing on the updated second function set to obtain the third function set.

[0092] In a specific embodiment, the first acquisition submodule may include:

[0093] A first key node acquisition unit is configured to obtain a plurality of first key nodes of the source code based on the file call dependency graph, each of the first key nodes including a first metric value, the first metric value representing the strength of the dependency relationship between the files;

[0094] A second key node acquisition unit is configured to obtain a plurality of second key nodes of the source code based on the function call graph, each of the second key nodes including a second metric value, the second metric value representing the strength of the call relationship between the functions;

[0095] A third key node acquisition unit, configured to obtain a plurality of third key nodes based on the plurality of first key nodes and the plurality of second key nodes, wherein the third key nodes represent functions in which the files where the second key nodes are located belong to the first key nodes;

[0096] The first acquisition unit is used to obtain multiple third objective functions and multiple combined metric values ​​based on the multiple third key nodes and the function call subgraph, where the combined metric values ​​correspond one-to-one to the third objective functions.

[0097] In a specific embodiment, the first obtaining unit may include:

[0098] a fourth key node acquisition subunit, configured to obtain, based on the function call subgraph, a plurality of fourth key nodes of the source code, each of the fourth key nodes including a third metric value, the third metric value being determined based on a third in-degree value and a third out-degree value, the third in-degree value being greater than the third out-degree value;

[0099] The first acquisition subunit is used to obtain multiple third objective functions based on the multiple third key nodes and the multiple fourth key nodes, where the third objective function represents the function of the fourth key node belonging to the third key node.

[0100] In a specific embodiment, the first obtaining unit further includes:

[0101] a combined metric value acquisition subunit, configured to acquire the first metric value, the second metric value, and the third metric value of each third objective function to obtain a combined metric value of each third function;

[0102] The fourth function set obtaining subunit is configured to sort the combined metric values ​​in descending order to obtain a fourth function set.

[0103] In a specific embodiment, the first acquisition module 410 further includes:

[0104] The call relationship submodule is used to extract the file call relationship and function call relationship of the source code;

[0105] The graph generation submodule is used to generate the file call dependency graph and the function call graph based on the file call relationship and the function call relationship.

[0106] In a specific embodiment, the verification module 460 further includes:

[0107] The call relationship processing submodule is used to extract the file call relationship and function call relationship of the source code;

[0108] The graph processing submodule is used to generate the file call dependency graph and the function call graph based on the file call relationship and the function call relationship.

[0109] It should be noted that the apparatus provided in the above embodiments, when implementing its functions, is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0110] An embodiment of the present application provides a computer device, which includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded and executed by the processor to implement a source code security verification method provided in the above method embodiment.

[0111] Figure 5 A schematic diagram of the hardware structure of a device for implementing a source code security verification method provided by an embodiment of the present application is shown. The device may participate in or include the apparatus or system provided by an embodiment of the present application. Figure 5 As shown, the device 5 may include one or more (502a, 502b, ..., 502n are shown in the figure) processors 502 (the processor 502 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 504 for storing data, and a transmission device 506 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 5 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 5 More or fewer components than shown, or with Figure 5 Different configurations shown.

[0112] It should be noted that the one or more processors 502 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry". The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single independent processing module, or may be incorporated in whole or in part into any of the other components of the device 5 (or mobile device). As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0113] The memory 504 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the methods in the embodiments of the present application. The processor 502 executes various functional applications and data processing by running the software programs and modules stored in the memory 504, that is, implementing the above-mentioned table data processing method. The memory 504 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 504 may further include a memory remotely located relative to the processor 502, and these remote memories may be connected to the device 5 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0114] Transmission device 506 is used to receive or send data via a network. Specific examples of the aforementioned network may include a wireless network provided by the communications provider of device 5. In one embodiment, transmission device 506 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, transmission device 506 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0115] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the device 5 (or mobile device).

[0116] An embodiment of the present application also provides a computer-readable storage medium, which can be set in a server to store at least one instruction or at least one program related to implementing a table data processing method in a method embodiment. The at least one instruction or the at least one program is loaded and executed by the processor to implement a source code security verification method provided in the above method embodiment.

[0117] Optionally, in this embodiment, the storage medium may be located in at least one of a plurality of network servers in a computer network. Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0118] An embodiment of the present invention further provides a computer program product or computer program, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform a source code security verification method provided in any of the aforementioned optional embodiments.

[0119] It should be noted that the order of the embodiments of the present application described above is for descriptive purposes only and does not represent the superiority or inferiority of the embodiments. The above description is of specific embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0120] The various embodiments in this application are described in a progressive manner. Similar portions between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the device, equipment, and storage medium embodiments are generally similar to the method embodiments, so their descriptions are relatively simple. For relevant portions, refer to the descriptions of the method embodiments.

[0121] Those skilled in the art will understand that all or part of the steps of implementing the above embodiments may be accomplished by hardware, or by programs instructing related hardware to accomplish the steps. The programs may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk, or an optical disk, etc.

[0122] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A method for verifying the security of source code, characterized in that: The method comprises: Get the file call dependency graph and function call graph of the source code; Splitting the file call dependency graph to obtain a file dependency subgraph; Splitting the function call graph based on the file dependency subgraph to obtain a function call subgraph; Traversing the function call subgraph to obtain a first function set and a second function set, wherein the first function set includes a plurality of first target functions within a preset verification range, and the second function set includes second target functions called by the plurality of first target functions; Obtaining a third function set based on the file call dependency graph, the function call graph, the function call subgraph, and the second function set; Based on the first function set and the third function set, a target segment corresponding to the source code is obtained and the target segment is verified to obtain a verification result of the source code.

2. The method according to claim 1, characterized in that The obtaining of the third function set based on the file call dependency graph, the function call graph, the function call subgraph and the second function set includes: Based on the file call dependency graph, the function call graph, and the function call subgraph, a plurality of third objective functions and a plurality of combined metric values ​​are obtained, where the combined metric values ​​correspond one-to-one to the third objective functions; Sorting the multiple combined metric values ​​to obtain a fourth function set, where the fourth function set includes a preset number of fourth objective functions, and the combined metric values ​​of the fourth objective functions are greater than the preset metric value; Adding the fourth function set to the second function set to obtain an updated second function set; The updated second function set is instrumented to obtain the third function set.

3. The method according to claim 2, characterized in that The obtaining, based on the file call dependency graph, the function call graph, and the function call subgraph, a plurality of third objective functions and a plurality of combined metric values, wherein the combined metric values ​​correspond one-to-one to the third objective functions, includes: Based on the file call dependency graph, a plurality of first key nodes of the source code are obtained, each of the first key nodes includes a first metric value, and the first metric value represents the strength of the dependency relationship between the files; Based on the function call graph, a plurality of second key nodes of the source code are obtained, each of the second key nodes includes a second metric value, and the second metric value represents the strength of the call relationship between the functions; Based on the plurality of first key nodes and the plurality of second key nodes, a plurality of third key nodes are obtained, where the third key nodes represent functions in which the files where the second key nodes are located belong to the first key nodes; Based on the multiple third key nodes and the function call subgraph, multiple third objective functions and multiple combined metric values ​​are obtained, and the combined metric values ​​correspond to the third objective functions in a one-to-one manner.

4. The method according to claim 3, wherein The obtaining of a plurality of third objective functions and a plurality of combined metric values ​​based on the plurality of third key nodes and the function call sub-relationships, wherein the combined metric values ​​correspond one-to-one to the third objective functions, includes: Based on the function call subgraph, a plurality of fourth key nodes of the source code are obtained, each of the fourth key nodes includes a third metric value, the third metric value is determined based on a third in-degree value and a third out-degree value, and the third in-degree value is greater than the third out-degree value; Based on the multiple third key nodes and the multiple fourth key nodes, multiple third objective functions are obtained, and the third objective function represents the function of the fourth key node belonging to the third key node.

5. The method according to claim 4, characterized in that The method of obtaining a plurality of third objective functions based on the plurality of third key nodes and the plurality of fourth key nodes, wherein the third objective functions characterize that the function at which the fourth key node belongs to the function of the third key node, includes: Obtaining the first metric value, the second metric value, and the third metric value of each third objective function to obtain a combined metric value of each third function; The combined metric values ​​are sorted in descending order to obtain a fourth function set.

6. The method according to any one of claims 1 to 3, characterized in that The obtaining of the file call dependency graph and function call graph of the source code includes: Extract the file calling relationship and function calling relationship of the source code; Based on the file calling relationship and the function calling relationship, the file calling dependency graph and the function calling graph are generated.

7. The method according to any one of claims 1 to 3, characterized in that The obtaining, based on the first function set and the third function set, a target fragment corresponding to the source code and verifying the target fragment to obtain a verification result of the source code includes: Based on the first function set and the third function set, obtaining a target fragment corresponding to the source code; Verifying the target shards and the feature information to be verified to obtain multiple verification results; A verification result of the source code is obtained based on the multiple verification results.

8. A source code security verification device, characterized in that: The device comprises: A first acquisition module is used to obtain a file call dependency graph and a function call graph of the source code; A first segmentation module is used to segment the file call dependency graph to obtain a file dependency subgraph; A second segmentation module is configured to segment the function call graph based on the file dependency subgraph to obtain a function call subgraph; A traversal module is used to traverse the function call subgraph to obtain a first function set and a second function set, wherein the first function set includes a plurality of first target functions within a preset verification range, and the second function set includes second target functions called by the plurality of first target functions; A third function set acquisition module, configured to obtain a third function set based on the file call dependency graph, the function call graph, the function call subgraph, and the second function set; The verification module obtains a target segment corresponding to the source code based on the first function set and the third function set, and verifies the target segment to obtain a verification result of the source code.

9. A source code security verification device, characterized in that: The device includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the source code security verification method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The storage medium stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by a processor to implement the source code security verification method according to any one of claims 1 to 7.

Images