Source code vulnerability detection method and device, equipment and medium

Abstract

The invention discloses a source code vulnerability detection method and device, equipment and a medium, and belongs to the technical field of information security. In the method, a code attribute graph is generated based on a to-be-detected source code; vertex information of the code attribute graph represents sub-codes of the source code to be detected, and side information of the code attribute graph represents the relationship between the sub-codes corresponding to two vertexes located at the two ends of a side; based on the vertex information and the side information, performing feature extraction on the to-be-detected source code to obtain a plurality of feature vectors of the to-be-detected source code; clustering the plurality of feature vectors of the to-be-detected source code through a trained contrast learning model to obtain a prediction probability of the to-be-detected source code; the prediction probability is used for representing the probability that the to-be-detected source code has vulnerabilities; and determining the vulnerability detection result of the to-be-detected source code based on the prediction probability of the to-be-detected source code and the preset probability threshold, so that vulnerability detection can be automatically performed on the source code, the recall rate of the source code vulnerability is improved, and the information security is protected.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a source code vulnerability detection method, device, equipment and medium. Background Art

[0002] Software vulnerabilities are usually introduced into the system due to flawed security control design or developer errors during the implementation of software specifications. Such defects and errors are inevitable during the design and implementation phases of the software life cycle.

[0003] In the related technologies, static software analysis, vulnerability pattern library, matching rule detection and other technologies, by scanning source code, identify potential errors or vulnerabilities, and often have false positives. This is due to the limitations or incompleteness of matching rules, pattern matching algorithms, etc., and the existence of vulnerabilities in inaccessible source code. At the same time, static application security testing tools have difficulty detecting complex vulnerabilities, resulting in a high false negative rate.

[0004] Therefore, there is an urgent need for a source code vulnerability detection method that can automatically detect vulnerabilities in source code, improve the recall rate of source code vulnerabilities, and protect information security. Summary of the invention

[0005] The embodiments of the present application provide a source code vulnerability detection method, apparatus, device and medium for automatically performing source code vulnerability detection, improving the recall rate of source code vulnerabilities, and protecting information security.

[0006] In a first aspect, an embodiment of the present application provides a source code vulnerability detection method, the method comprising:

[0007] Generate a code attribute graph based on the source code to be detected; the vertex information of the code attribute graph represents the sub-code of the source code to be detected, and the edge information of the code attribute graph represents the relationship between the sub-codes corresponding to the two vertices at both ends of the edge;

[0008] Based on the vertex information and the edge information, feature extraction is performed on the source code to be detected to obtain a plurality of feature vectors of the source code to be detected;

[0009] Clustering multiple feature vectors of the source code to be detected by using a trained contrast learning model to obtain a predicted probability of the source code to be detected; the predicted probability is used to characterize the probability that the source code to be detected has a vulnerability;

[0010] Based on the predicted probability of the source code to be detected and a preset probability threshold, a vulnerability detection result of the source code to be detected is determined.

[0011] In some embodiments, the extracting features of the source code to be detected based on the vertex information and the edge information to obtain multiple feature vectors of the source code to be detected includes:

[0012] Based on the vertex information and the edge information, feature extraction is performed on the source code to be detected to obtain an original feature vector of the source code to be detected;

[0013] Regularization is performed on the original feature vector to obtain multiple feature vectors of the source code to be detected.

[0014] In some embodiments, the extracting features of the source code to be detected based on the vertex information and the edge information to obtain the original feature vector of the source code to be detected includes:

[0015] For each vertex of the code attribute graph, an encoder is used to perform feature encoding on vertex information of the vertex to obtain a feature vector of the vertex; the vertex information of the vertex indicates a subcode corresponding to the vertex and a type of the subcode;

[0016] Based on the edge information and the feature vectors of each vertex of the code attribute graph, information aggregation is performed to obtain the original feature vector of the source code to be detected.

[0017] In some embodiments, the information aggregation is performed based on the edge information and the feature vectors of each vertex of the code property graph to obtain the original feature vector of the source code to be detected, including:

[0018] For each vertex of the code attribute graph, perform the following operations respectively:

[0019] Determine at least one adjacent vertex corresponding to the vertex and a feature vector of the at least one adjacent vertex according to edge information of an edge connected to the vertex;

[0020] Using a gated loop function, information screening is performed on the feature vector of the vertex and the feature vector of the at least one adjacent vertex to determine the component of the vertex;

[0021] The components of each vertex are added together to obtain the original feature vector of the source code to be detected.

[0022] In some embodiments, the regularization processing of the original feature vector to obtain multiple feature vectors of the source code to be detected includes:

[0023] Regularization processing is performed N times on the original feature vector of the source code to be detected to obtain N feature vectors; the classes of the N feature vectors are the same and the similarity between the N feature vectors and the original feature vector is greater than a similarity threshold; wherein, each time the regularization processing is performed, the output of any hidden layer in the trained contrastive learning model is randomly cleared.

[0024] In some embodiments, determining the vulnerability detection result of the source code to be detected based on the predicted probability of the source code to be detected and a preset probability threshold includes:

[0025] If the predicted probability of the source code to be detected is greater than a preset probability threshold, determining that the vulnerability detection result of the source code to be detected is that the source code to be detected has a vulnerability;

[0026] If the predicted probability of the source code to be detected is not greater than the preset probability threshold, it is determined that the vulnerability detection result of the source code to be detected is that the source code to be detected does not have a vulnerability.

[0027] In some embodiments, the contrastive learning model is trained by:

[0028] Acquire a sample data set; the sample data set includes a plurality of source code samples, feature vectors corresponding to the plurality of source code samples, and tag data corresponding to the plurality of source code samples, wherein the tag data is a label and a vulnerability detection label corresponding to the plurality of source code samples;

[0029] Performing cosine similarity calculation based on the sample data set to determine similarities between feature vectors corresponding to the plurality of source code samples;

[0030] Based on the similarities between the feature vectors corresponding to the multiple source code samples, the feature vectors corresponding to the multiple source code samples are clustered to obtain vulnerability detection results of the multiple source code samples;

[0031] Based on the vulnerability detection results of the multiple source code samples and the vulnerability detection labels corresponding to the multiple source code samples, a loss function is determined, and the parameters of the contrastive learning model are adjusted based on the loss function until the training conditions are met, thereby obtaining the trained contrastive learning model.

[0032] In a second aspect, an embodiment of the present application provides a source code vulnerability detection device, the device comprising:

[0033] A conversion module, configured to generate a code attribute graph based on the source code to be detected; the vertex information of the code attribute graph represents the sub-code of the source code to be detected, and the edge information of the code attribute graph represents the relationship between the sub-codes corresponding to the two vertices at both ends of the edge;

[0034] A feature extraction module, configured to extract features of the source code to be detected based on the vertex information and the edge information, and obtain a plurality of feature vectors of the source code to be detected;

[0035] A prediction module, used to cluster multiple feature vectors of the source code to be detected through a trained contrast learning model to obtain a prediction probability of the source code to be detected; the prediction probability is used to characterize the probability that the source code to be detected has a vulnerability;

[0036] The classification module is used to determine the vulnerability detection result of the source code to be detected based on the predicted probability of the source code to be detected and a preset probability threshold.

[0037] In some embodiments, the feature extraction module is specifically used to:

[0038] Based on the vertex information and the edge information, feature extraction is performed on the source code to be detected to obtain an original feature vector of the source code to be detected;

[0039] Regularization is performed on the original feature vector to obtain multiple feature vectors of the source code to be detected.

[0040] In some embodiments, the feature extraction module is specifically used to:

[0041] For each vertex of the code attribute graph, an encoder is used to perform feature encoding on vertex information of the vertex to obtain a feature vector of the vertex; the vertex information of the vertex indicates a subcode corresponding to the vertex and a type of the subcode;

[0042] Based on the edge information and the feature vectors of each vertex of the code attribute graph, information aggregation is performed to obtain the original feature vector of the source code to be detected.

[0043] In some embodiments, the feature extraction module is specifically used to:

[0044] For each vertex of the code attribute graph, perform the following operations respectively:

[0045] Determine at least one adjacent vertex corresponding to the vertex and a feature vector of the at least one adjacent vertex according to edge information of an edge connected to the vertex;

[0046] Using a gated loop function, information screening is performed on the feature vector of the vertex and the feature vector of the at least one adjacent vertex to determine the component of the vertex;

[0047] The components of each vertex are added together to obtain the original feature vector of the source code to be detected.

[0048] In some embodiments, the feature extraction module is specifically used to:

[0049] Regularization processing is performed N times on the original feature vector of the source code to be detected to obtain N feature vectors; the classes of the N feature vectors are the same and the similarity between the N feature vectors and the original feature vector is greater than a similarity threshold; wherein, each time the regularization processing is performed, the output of any hidden layer in the trained contrastive learning model is randomly cleared.

[0050] In some embodiments, the classification module is specifically used to:

[0051] If the predicted probability of the source code to be detected is greater than a preset probability threshold, determining that the vulnerability detection result of the source code to be detected is that the source code to be detected has a vulnerability;

[0052] If the predicted probability of the source code to be detected is not greater than the preset probability threshold, it is determined that the vulnerability detection result of the source code to be detected is that the source code to be detected does not have a vulnerability.

[0053] In some embodiments, the apparatus includes a training module, the training module being configured to train the contrastive learning model in the following manner:

[0054] Acquire a sample data set; the sample data set includes a plurality of source code samples, feature vectors corresponding to the plurality of source code samples, and tag data corresponding to the plurality of source code samples, wherein the tag data is a label and a vulnerability detection label corresponding to the plurality of source code samples;

[0055] Performing cosine similarity calculation based on the sample data set to determine similarities between feature vectors corresponding to the plurality of source code samples;

[0056] Based on the similarities between the feature vectors corresponding to the multiple source code samples, the feature vectors corresponding to the multiple source code samples are clustered to obtain vulnerability detection results of the multiple source code samples;

[0057] Based on the vulnerability detection results of the multiple source code samples and the vulnerability detection labels corresponding to the multiple source code samples, a loss function is determined, and the parameters of the contrastive learning model are adjusted based on the loss function until the training conditions are met, thereby obtaining the trained contrastive learning model.

[0058] In a third aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein:

[0059] The memory stores a computer program that can be executed by at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the source code vulnerability detection method described in the first aspect or the second aspect above.

[0060] In a fourth aspect, an embodiment of the present application provides a computer storage medium. When a computer program in the computer storage medium is executed by a processor of an electronic device, the electronic device can execute the source code vulnerability detection method described in the first aspect or the second aspect above.

[0061] The method provided in the embodiment of the present application has the following beneficial effects:

[0062] In the embodiment of the present application, a code property graph is generated based on the source code to be detected; the vertex information of the code property graph represents the sub-code of the source code to be detected, and the edge information of the code property graph represents the relationship between the sub-codes corresponding to the two vertices at the two ends of the edge; based on the vertex information and the edge information, feature extraction is performed on the source code to be detected to obtain multiple feature vectors of the source code to be detected; through the trained contrast learning model, the multiple feature vectors of the source code to be detected are clustered to obtain the predicted probability of the source code to be detected; the predicted probability is used to characterize the probability that the source code to be detected has a vulnerability; based on the predicted probability of the source code to be detected and a preset probability threshold, the vulnerability detection result of the source code to be detected is determined.

[0063] Therefore, the CPG tool is first used to convert the source code to be detected into the code property graph CPG structure and extract vertex information and edge information, and then the source code to be detected is converted into a feature vector containing semantic and grammatical information. Then, the contrastive learning model is used to learn the important features of the feature vector of the source code to be detected. Through the classification layer, the probability that the source code to be detected has vulnerabilities is output. This method can analyze software vulnerabilities that have not appeared, automatically detect vulnerabilities in the source code, improve the recall rate of source code vulnerabilities, and protect information security.

[0064] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent from the description, or may be understood by practicing the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0066] Figure 1 A schematic diagram of an application scenario of a source code vulnerability detection method provided in an embodiment of the present application;

[0067] Figure 2A schematic diagram of a flow chart of a source code vulnerability detection method provided in an embodiment of the present application;

[0068] Figure 3 A schematic diagram of a flow chart of a method for determining an original feature vector provided in an embodiment of the present application;

[0069] Figure 4 A flowchart of a training method for a comparative learning model provided in an embodiment of the present application;

[0070] Figure 5 A schematic diagram of the structure of a source code vulnerability detection device provided in an embodiment of the present application;

[0071] Figure 6 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0072] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Among them, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0073] Furthermore, in the description of the embodiments of the present application, unless otherwise specified, “ / ” means or. For example, A / B can mean A or B. The “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0074] In the following, the terms "first" and "second" are used for descriptive purposes only and should not be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more.

[0075] In order to facilitate understanding of a source code vulnerability detection method provided in an embodiment of the present application, some terms appearing in the present application are explained below.

[0076] CPG (CodePropertyGraph): Code property graph is a graphical representation method used to capture various properties of a program, including but not limited to control flow, data flow, type information, function calls, etc., and can extract useful structural information from the source code. CPG outputs a graph G = (Node, Edge), where Node is a node and Edge is an edge of the graph G. In CPG, each vertex n∈Node is a small piece of code and is classified into different types of vertices, including arithmetic expressions, call statements, etc. The edge e∈Edge represents the relationship between vertices n.

[0077] Contrastive learning model: used to find source code feature vectors with similar or contrasting features in the data. For similar data pairs, they can be clustered closer to learn each other's high-level features; on the contrary, for contrasting data pairs, they can be pushed further apart.

[0078] Gated Graph Neural Networks (GGNN): The basic principle of GGNN is to learn and update the representation of nodes through the message passing mechanism between nodes. Unlike traditional neural networks, the state of each node in GGNN not only reflects its own feature information, but also integrates the features of its neighboring nodes. This node state update process from a global perspective is achieved through iterative message passing, allowing nodes to dynamically adjust their own representations according to the surrounding environment.

[0079] The important innovation of GGNN is the introduction of a gating mechanism, which draws on the design ideas of recurrent neural networks (such as LSTM or GRU) to allow the model to selectively learn when updating node states. Specifically, by setting different gating units, the model can filter out the most critical neighbor information for updating the current node state in each round of iteration, while ignoring irrelevant or noisy information, thereby effectively capturing and retaining complex patterns and dependencies in graph data.

[0080] Software vulnerabilities are usually introduced into the system due to flawed security control design or developer errors during the implementation of software specifications. Such defects and errors are inevitable during the design and implementation phases of the software life cycle.

[0081] In the related technologies, static software analysis, vulnerability pattern library, matching rule detection and other technologies, by scanning source code, identify potential errors or vulnerabilities, and often have false positives. This is due to the limitations or incompleteness of matching rules, pattern matching algorithms, etc., and the existence of vulnerabilities in inaccessible source code. At the same time, static application security testing tools have difficulty detecting complex vulnerabilities, resulting in a high false negative rate.

[0082] Therefore, there is an urgent need for a source code vulnerability detection method that can automatically detect source code vulnerabilities, improve the recall rate of source code vulnerabilities, and protect information security.

[0083] In view of this, the embodiments of the present application provide a source code vulnerability detection method, apparatus, device and medium for automatically performing vulnerability detection on source code, improving the recall rate of source code vulnerabilities, and protecting information security.

[0084] The inventive concept of the embodiment of the present application: In the embodiment of the present application, a CPG tool is first used to convert the source code to be detected into a code property graph CPG structure and extract vertex information and edge information, and the source code to be detected is converted into a feature vector containing semantic and grammatical information. Then, a comparative learning model is used to learn the important features of the feature vector of the source code to be detected. Through the classification layer, the probability that a vulnerability exists in the source code to be detected is output. This method can analyze software vulnerabilities that have not appeared, automatically detect vulnerabilities in the source code, improve the recall rate of source code vulnerabilities, and protect information security.

[0085] After introducing the main inventive concept of the embodiment of the present application, the following describes the application scenario of a source code vulnerability detection method provided by the embodiment of the present application in conjunction with the accompanying drawings. Figure 1 , which is a schematic diagram of an application scenario of a source code vulnerability detection method provided in an embodiment of the present application. Figure 1 The system includes a server 100 and an electronic device 200; wherein:

[0086] After obtaining the source code to be detected, the electronic device 200 converts the source code to be detected into a code property graph, and then extracts features of the source code to be detected based on the vertex information and edge information in the code property graph to obtain multiple feature vectors of the source code to be detected; then obtains the trained comparative learning model from the server 100, clusters the multiple feature vectors of the source code to be detected through the trained comparative learning model, and obtains the predicted probability of the source code to be detected; the predicted probability is used to characterize the probability that a vulnerability exists in the source code to be detected; based on the predicted probability of the source code to be detected and a preset probability threshold, determines the vulnerability detection result of the source code to be detected, and stores the vulnerability detection result of the source code to be detected in the server 100.

[0087] Among them, the server 100 and the electronic device 200 can communicate with each other, and the communication method can be to use wired communication technology, such as communicating by connecting a network cable or a serial port cable; or to use wireless communication technology, for example, communicating through Bluetooth or WIFI and other technologies, without specific limitation.

[0088] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided in the embodiment of the present application.

[0089] See also Figure 2 , is a flow chart of a source code vulnerability detection method provided by an embodiment of the present application. The method includes: Figure 2 Steps shown:

[0090] In step 201, a code attribute graph is generated based on the source code to be detected; the vertex information of the code attribute graph represents the sub-code of the source code to be detected, and the edge information of the code attribute graph represents the relationship between the sub-codes corresponding to the two vertices at both ends of the edge.

[0091] The specific implementation is that after obtaining the source code to be tested, the source code to be tested is parsed by the language front end and converted into nodes in the code property graph (CPG); then the information retained in the graph is refined and improved through the Passes stage to obtain the code property graph of the source code to be tested.

[0092] CPG is a useful tool for extracting graph information. CPG can be used to construct a feature file of the source code to be detected. CPG outputs a graph G = (Node, Edge), where Node is a node and Edge is an edge of the graph G. Through the combination of nodes and edges, CPG can fully capture the structure and semantic information of the code, providing a solid foundation for subsequent feature extraction and vulnerability detection.

[0093] In CPG, each vertex n∈Node is a small piece of code, that is, a sub-code of the source code to be detected, such as a basic unit or fragment in the code, usually a statement, expression or declaration. The sub-code represented by each vertex is different, but the types of vertices may be the same or different, including arithmetic expressions, assignment statements, function calls, conditional statements, loop statements, variable declarations, class declarations, comments, etc.

[0094] In CPG, each edge e∈Edge represents the relationship between vertices n, that is, the relationship between the sub-codes corresponding to the two vertices at both ends of the edge, reflecting the logical dependency and control flow in the code. Edge types include control flow, data flow, type, call, inheritance, implementation, etc.

[0095] In step 202, feature extraction is performed on the source code to be detected based on the vertex information and the edge information to obtain a plurality of feature vectors of the source code to be detected.

[0096] In some embodiments, based on vertex information and edge information, feature extraction is performed on the source code to be detected to obtain multiple feature vectors of the source code to be detected, which is performed as follows:

[0097] Based on vertex information and edge information, feature extraction is performed on the source code to be detected to obtain the original feature vector of the source code to be detected; regularization processing is performed on the original feature vector to obtain multiple feature vectors of the source code to be detected.

[0098] Furthermore, based on vertex information and edge information, feature extraction is performed on the source code to be detected to obtain the original feature vector of the source code to be detected, which can be performed as follows: Figure 3 Steps shown:

[0099] In step 301, for each vertex of the code attribute graph, an encoder is used to perform feature encoding on vertex information of the vertex to obtain a feature vector of the vertex; the vertex information of the vertex represents the sub-code corresponding to the vertex and the type of the sub-code.

[0100] Specifically, we first perform lexical analysis on the subcode corresponding to each vertex and decompose it into a series of lexical units (tokens). Then, we use a pre-trained word embedding model to convert each lexical unit into a vector of fixed dimension, which captures the semantic information of the lexical words. For longer subcodes, we can use models such as recursive neural networks, long short-term memory networks, and transformers to encode the lexical sequence and generate a vector representing the subcode.

[0101] Each vertex has a specific type, and in order to incorporate the type information into the encoding, the vertex type can be converted into a binary vector using one-hot encoding. The vector of subcodes is then concatenated with the one-hot encoded vector of the vertex type to form a higher-dimensional representative vector.

[0102] In implementation, in order to represent the semantic information and grammatical information of vertex n, an encoder is used to encode the vertex information of vertex n. The subcode corresponding to vertex n is first encoded and converted into a vector V n , and then combine the type information of vertex n to convert vector V n A one-hot encoded vector C with the type of vertex n e Connect into a representative vector X n , that is, we get the eigenvector X of vertex n n .

[0103] The type information of vertex n can be determined when generating the code attribute graph, and then the type information of vertex n is one-hot encoded to obtain the one-hot encoding vector C of the type information of vertex n. e .

[0104] The eigenvector X of vertex n n It not only contains the semantic information of the subcode, but also the type information (syntactic structure), so that the model can better understand the characteristics of the vertex.

[0105] In step 302, information aggregation is performed based on the edge information and the feature vectors of each vertex of the code attribute graph to obtain the original feature vector of the source code to be detected.

[0106] Specifically, based on the edge information and the feature vectors of each vertex of the code attribute graph, information aggregation is performed to obtain the original feature vector of the source code to be detected, which is executed as follows:

[0107] For each vertex of the code attribute graph, the following operations are performed respectively: according to the edge information of the edge connected to the vertex, at least one adjacent vertex corresponding to the vertex and the feature vector of at least one adjacent vertex are determined; using the gated loop function, the feature vector of the vertex and the feature vector of at least one adjacent vertex are screened to determine the components of the vertex;

[0108] The components of each vertex are added together to obtain the original feature vector of the source code to be detected.

[0109] The implementation is that after obtaining the feature vector of each vertex in the code attribute graph, the gated graph sequence neural network is used to extract the information of each vertex to obtain the original feature vector of the source code to be detected. GGNN is an improved model of graph neural network, which is specifically expressed as:

[0110]

[0111] Through the above formula, the GGNN model can extract the vertex information and edge information of the code attribute graph, where f GRU is the gated loop function, X n is the feature vector of vertex n, and h is a transformation function used to synthesize the feature vector X of at least one adjacent vertex u corresponding to vertex n. u Edge is at least one adjacent vertex corresponding to vertex n.

[0112] After determining at least one adjacent vertex u corresponding to vertex n according to the edge information, the feature vector X of vertex n is processed by the gated loop function. n The feature vector X of at least one adjacent vertex u corresponding to vertex n u After that, the components of vertex n are obtained, and then the components of all vertices n are summed to obtain an original feature vector X representing the source code to be detected graph , all the information of the graph is synthesized in this process.

[0113] Furthermore, performing regularization processing on the original feature vector to obtain multiple feature vectors of the source code to be detected can be performed as follows: performing regularization processing N times on the original feature vector of the source code to be detected to obtain N feature vectors.

[0114] Among them, the classes of the N feature vectors are the same and the similarity between the N feature vectors and the original feature vector is greater than the similarity threshold; wherein, each time the regularization process is performed, the output of any hidden layer in the trained contrastive learning model is randomly cleared.

[0115] When contrastive learning uses traditional supervised learning methods to detect source code vulnerabilities, the model relies heavily on the amount of pre-labeled data, while the amount of unlabeled data is very large. In order to deal with data imbalance during training, a dropout (regularization) function is used in the embodiment of the present application to generate minority class data. For each hidden layer in the network, each neuron has a certain probability of being temporarily removed. Therefore, overfitting during training can be avoided by randomly disabling the connection of a neuron, that is, each time regularization is performed, the output of any hidden layer in the trained contrastive learning model is randomly cleared, and the output of any hidden layer is set to zero.

[0116] The original eigenvector is x=(x n ,x2,...,x m ), after regularizing the original feature vector x using the dropout function, each component x of the original feature vector i (i=1,2...,m) is expressed as:

[0117]

[0118] Among them, b i is a random variable that follows a Bernoulli distribution:

[0119]

[0120] Through the above operation, the generated feature vector is still adjacent to the original feature vector in space. The original feature vector is passed through the dropout function N times to generate N feature vectors with the same class and close to the original feature vector.

[0121] Thus, multiple feature vectors of the source code to be detected can be obtained, and the data set is balanced using the multiple feature vectors of the source code to be detected.

[0122] In step 203, multiple feature vectors of the source code to be detected are clustered using the trained contrastive learning model to obtain a predicted probability of the source code to be detected.

[0123] The predicted probability is used to characterize the probability that a vulnerability exists in the source code to be detected.

[0124] In specific implementation, after balancing the data, the trained contrastive learning model is used to cluster multiple feature vectors of the source code to be detected, and then the predicted probability of the source code to be detected is output through the final classification layer.

[0125] In the embodiment of the present application, the classification layer needs to be trained until the parameters of the classification layer are adjusted until the parameters of the classification layer tend to be stable. The specific implementation is: the parameters of the classification layer are adjusted by the cross entropy loss function. The cross entropy loss function is expressed as:

[0126]

[0127] Among them, X i Is the source code to be tested i The feature vector of , σ is the activation function, N is the total number of source code samples, label i is the source code label (annotated by the user), 0 is the vulnerability source code label, and 1 is the security source code label.

[0128] During training, the parameters of the classification layer are adjusted according to the value of the cross entropy loss function. After the trained classification layer is obtained, the predicted probability of the source code to be detected is output through the trained classification layer.

[0129] In step 204, based on the predicted probability of the source code to be detected and a preset probability threshold, a vulnerability detection result of the source code to be detected is determined.

[0130] The specific implementation is:

[0131] If the predicted probability of the source code to be detected is greater than the preset probability threshold, determining that the vulnerability detection result of the source code to be detected is that the source code to be detected has a vulnerability;

[0132] If the predicted probability of the source code to be detected is not greater than the preset probability threshold, it is determined that the vulnerability detection result of the source code to be detected is that the source code to be detected does not have a vulnerability.

[0133] Among them, the preset probability threshold can be set according to experience or according to actual needs, and the embodiments of the present application do not limit this.

[0134] Among them, when executing the vulnerability detection of the source code provided by the embodiment of the present application, it can be done by Figure 4 The contrastive learning model is trained in the manner shown to obtain a trained contrastive learning model:

[0135] In step 401, a sample data set is obtained; the sample data set includes a plurality of source code samples, feature vectors corresponding to the plurality of source code samples, and tag data corresponding to the plurality of source code samples, wherein the tag data is a label corresponding to the plurality of source code samples and a vulnerability detection label;

[0136] In step 402, cosine similarity calculation is performed based on the sample data set to determine the similarity between the feature vectors corresponding to the plurality of source code samples;

[0137] In step 403, based on the similarity between the feature vectors corresponding to the multiple source code samples, the feature vectors corresponding to the multiple source code samples are clustered to obtain vulnerability detection results of the multiple source code samples;

[0138] In step 404, based on the vulnerability detection results of the multiple source code samples and the vulnerability detection labels corresponding to the multiple source code samples, a loss function is determined, and the parameters of the contrastive learning model are adjusted based on the loss function until the training conditions are met to obtain a trained contrastive learning model.

[0139] Specifically, the contrastive learning model is used to find source code feature vectors with similar or contrasting features in the data. For similar data pairs, they can be clustered closer to learn each other's high-level features, while contrasting data pairs are pushed farther apart. Using contrastive learning can optimize the source code classification process, thereby helping the model learn features.

[0140] Suppose there is a set of source code samples where d i and are two similar or identically labeled source code samples, d i and are two source code samples that are dissimilar or have different labels. Let X i , They are d i , The corresponding feature vector. The sample data set includes N source code samples, so the training objective of the sample data set is:

[0141]

[0142] Where, L cl Represents the sum of the losses of N source code samples, Loss i represents the loss of the i-th source code sample.

[0143] Among them, Loss i Defined by the following formula:

[0144]

[0145] In the formula, label i ,label j ,label k is the source code label (annotated by the user), 0 is the vulnerability source code label, and 1 is the security source code label. When B is true, 1 B is 1, otherwise 1 B is 0, where For N source code samples with X i The total number of samples with the same label, i is the index of the N source code sample example, k is the index of other examples with the same label as index i in the N source code samples, and j is the index of other examples with different labels from index i in the N source code samples. θ is a positive hyperparameter, cos(X i ,X k ) is the cosine similarity, expressed as:

[0146]

[0147] Where, X i Yes i The corresponding eigenvector, X k yes The corresponding feature vector,feature vector is extracted using graph embedding.

[0148] In contrastive learning, if label i and label k The same, that is, source code samples x_i and x_k are positive sample pairs, for example, they are both secure source code or both vulnerable source code, then they are considered to have the same label. On the contrary, if label i and label k different, that is, one of x_i and x_k is a secure source code and the other is a vulnerable source code, then they are considered to have different labels and are a negative sample pair.

[0149] Finally, based on Loss i The parameters of the contrastive learning model are adjusted until the training conditions are met to obtain a trained contrastive learning model.

[0150] Among them, the training condition is the training target L cl becomes stable, or the number of training sessions exceeds the preset number.

[0151] Therefore, the trained contrastive learning model can be used to learn the important features in the original feature vector of the source code to be detected, and then the vulnerability detection results of the source code to be detected can be obtained.

[0152] Based on the description in the previous article, a code attribute graph is generated based on the source code to be detected; the vertex information of the code attribute graph represents the sub-code of the source code to be detected, and the edge information of the code attribute graph represents the relationship between the sub-codes corresponding to the two vertices located at the two ends of the edge; based on the vertex information and the edge information, feature extraction is performed on the source code to be detected to obtain multiple feature vectors of the source code to be detected; through the trained contrast learning model, the multiple feature vectors of the source code to be detected are clustered to obtain the predicted probability of the source code to be detected; the predicted probability is used to characterize the probability that a vulnerability exists in the source code to be detected; based on the predicted probability of the source code to be detected and a preset probability threshold, the vulnerability detection result of the source code to be detected is determined.

[0153] Therefore, the CPG tool is first used to convert the source code to be detected into the code property graph CPG structure and extract vertex information and edge information, and then the source code to be detected is converted into a feature vector containing semantic and grammatical information. Then, the contrastive learning model is used to learn the important features of the feature vector of the source code to be detected. Through the classification layer, the probability that the source code to be detected has vulnerabilities is output. This method can analyze software vulnerabilities that have not appeared, automatically detect vulnerabilities in the source code, improve the recall rate of source code vulnerabilities, and protect information security.

[0154] Based on the same technical concept, an embodiment of the present application also provides a source code vulnerability detection device. The principle of solving the problem by the source code vulnerability detection device is similar to the above-mentioned source code vulnerability detection method. Therefore, the implementation of the source code vulnerability detection device can refer to the implementation of the source code vulnerability detection method, and the repeated parts will not be repeated.

[0155] Figure 5 A schematic diagram of the structure of a source code vulnerability detection device provided in an embodiment of the present application, the device includes a conversion module 501, a feature extraction module 502, a prediction module 503 and a classification module 504, wherein:

[0156] The conversion module 501 is used to generate a code attribute graph based on the source code to be detected; the vertex information of the code attribute graph represents the sub-code of the source code to be detected, and the edge information of the code attribute graph represents the relationship between the sub-codes corresponding to the two vertices at both ends of the edge;

[0157] A feature extraction module 502 is used to extract features of the source code to be detected based on the vertex information and the edge information to obtain multiple feature vectors of the source code to be detected;

[0158] The prediction module 503 is used to cluster multiple feature vectors of the source code to be detected through the trained contrast learning model to obtain the prediction probability of the source code to be detected; the prediction probability is used to characterize the probability that the source code to be detected has a vulnerability;

[0159] The classification module 504 is used to determine the vulnerability detection result of the source code to be detected based on the predicted probability of the source code to be detected and a preset probability threshold.

[0160] In some embodiments, the feature extraction module 502 is specifically used to:

[0161] Based on the vertex information and the edge information, feature extraction is performed on the source code to be detected to obtain an original feature vector of the source code to be detected;

[0162] Regularization is performed on the original feature vector to obtain multiple feature vectors of the source code to be detected.

[0163] In some embodiments, the feature extraction module 502 is specifically used to:

[0164] For each vertex of the code attribute graph, an encoder is used to perform feature encoding on vertex information of the vertex to obtain a feature vector of the vertex; the vertex information of the vertex indicates a subcode corresponding to the vertex and a type of the subcode;

[0165] Based on the edge information and the feature vectors of each vertex of the code attribute graph, information aggregation is performed to obtain the original feature vector of the source code to be detected.

[0166] In some embodiments, the feature extraction module 502 is specifically used to:

[0167] For each vertex of the code attribute graph, perform the following operations respectively:

[0168] Determine at least one adjacent vertex corresponding to the vertex and a feature vector of the at least one adjacent vertex according to edge information of an edge connected to the vertex;

[0169] Using a gated loop function, information screening is performed on the feature vector of the vertex and the feature vector of the at least one adjacent vertex to determine the component of the vertex;

[0170] The components of each vertex are added together to obtain the original feature vector of the source code to be detected.

[0171] In some embodiments, the feature extraction module 502 is specifically used to:

[0172] Regularization processing is performed N times on the original feature vector of the source code to be detected to obtain N feature vectors; the classes of the N feature vectors are the same and the similarity between the N feature vectors and the original feature vector is greater than a similarity threshold; wherein, each time the regularization processing is performed, the output of any hidden layer in the trained contrastive learning model is randomly cleared.

[0173] In some embodiments, the classification module 504 is specifically configured to:

[0174] If the predicted probability of the source code to be detected is greater than a preset probability threshold, determining that the vulnerability detection result of the source code to be detected is that the source code to be detected has a vulnerability;

[0175] If the predicted probability of the source code to be detected is not greater than the preset probability threshold, it is determined that the vulnerability detection result of the source code to be detected is that the source code to be detected does not have a vulnerability.

[0176] In some embodiments, the apparatus includes a training module 505, wherein the training module 505 is configured to train the contrastive learning model in the following manner:

[0177] Acquire a sample data set; the sample data set includes a plurality of source code samples, feature vectors corresponding to the plurality of source code samples, and tag data corresponding to the plurality of source code samples, wherein the tag data is a label and a vulnerability detection label corresponding to the plurality of source code samples;

[0178] Performing cosine similarity calculation based on the sample data set to determine similarities between feature vectors corresponding to the plurality of source code samples;

[0179] Based on the similarities between the feature vectors corresponding to the multiple source code samples, the feature vectors corresponding to the multiple source code samples are clustered to obtain vulnerability detection results of the multiple source code samples;

[0180] Based on the vulnerability detection results of the multiple source code samples and the vulnerability detection labels corresponding to the multiple source code samples, a loss function is determined, and the parameters of the contrastive learning model are adjusted based on the loss function until the training conditions are met, thereby obtaining the trained contrastive learning model.

[0181] The division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, the functional modules in the embodiments of the present application may be integrated into a processor, or may exist physically alone, or two or more modules may be integrated into one module. The coupling between the modules may be achieved through some interfaces, which are usually electrical communication interfaces, but it is not excluded that they may be mechanical interfaces or other forms of interfaces. Therefore, the modules described as separate components may or may not be physically separated, and may be located in one place or distributed to different locations of the same or different devices. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0182] After introducing a source code vulnerability detection method and device according to an exemplary embodiment of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0183] Refer to the following Figure 6 The electronic device 130 implemented according to this embodiment of the present application is described. Figure 6 The electronic device 130 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0184] like Figure 6 As shown, the electronic device 130 is in the form of a general electronic device. The components of the electronic device 130 may include but are not limited to: at least one processor 131, at least one memory 132, and a bus 133 connecting different system components (including the memory 132 and the processor 131).

[0185] Among them, at least one memory 132 stores a computer program that can be executed by at least one processor 131. When the computer program is executed by at least one processor 131, the at least one processor 131 can execute the steps of any source code vulnerability detection method provided in the embodiments of the present application.

[0186] Bus 133 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0187] The memory 132 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1321 and / or a cache memory 1322 , and may further include a read-only memory (ROM) 1323 .

[0188] The memory 132 may also include a program / utility 1325 having a set (at least one) of program modules 1324, such program modules 1324 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0189] The electronic device 130 may also communicate with one or more external devices 134 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 130, and / or communicate with any device that enables the electronic device 130 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 135. Furthermore, the electronic device 130 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 136. As shown, the network adapter 136 communicates with other modules for the electronic device 130 via a bus 133. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 130, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0190] In an exemplary embodiment, a computer storage medium is also provided, and when a computer program in the computer storage medium is executed by a processor of an electronic device, the electronic device can perform any of the above-mentioned source code vulnerability detection methods. Optionally, the storage medium can be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0191] In an exemplary embodiment, a computer program product is also provided. When the computer program product is executed by an electronic device, the electronic device can implement the steps of any source code vulnerability detection method provided in the present application.

[0192] Furthermore, the computer program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a RAM, a ROM, an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a compact disk read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0193] The program product for device discovery in the embodiment of the present application may adopt a CD-ROM and include program code, and may be run on a computing device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0194] The readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0195] The program code contained on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, radio frequency (RF), etc., or any suitable combination of the foregoing.

[0196] Program code for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device via any type of network such as a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0197] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0198] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0199] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0200] The present application is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0201] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0202] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0203] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0204] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application also includes these modifications and variations.

Claims

1. A source code vulnerability detection method, characterized in that: The method comprises: Generate a code attribute graph based on the source code to be detected; the vertex information of the code attribute graph represents the sub-code of the source code to be detected, and the edge information of the code attribute graph represents the relationship between the sub-codes corresponding to the two vertices at both ends of the edge; Based on the vertex information and the edge information, feature extraction is performed on the source code to be detected to obtain a plurality of feature vectors of the source code to be detected; Clustering multiple feature vectors of the source code to be detected by using a trained contrast learning model to obtain a predicted probability of the source code to be detected; the predicted probability is used to characterize the probability that the source code to be detected has a vulnerability; Based on the predicted probability of the source code to be detected and a preset probability threshold, a vulnerability detection result of the source code to be detected is determined.

2. The method according to claim 1, characterized in that The extracting features of the source code to be detected based on the vertex information and the edge information to obtain a plurality of feature vectors of the source code to be detected includes: Based on the vertex information and the edge information, feature extraction is performed on the source code to be detected to obtain an original feature vector of the source code to be detected; Regularization is performed on the original feature vector to obtain multiple feature vectors of the source code to be detected.

3. The method according to claim 2, characterized in that The step of extracting features of the source code to be detected based on the vertex information and the edge information to obtain an original feature vector of the source code to be detected includes: For each vertex of the code attribute graph, an encoder is used to perform feature encoding on vertex information of the vertex to obtain a feature vector of the vertex; the vertex information of the vertex indicates a subcode corresponding to the vertex and a type of the subcode; Based on the edge information and the feature vectors of each vertex of the code attribute graph, information aggregation is performed to obtain the original feature vector of the source code to be detected.

4. The method according to claim 3, characterized in that The step of performing information aggregation based on the edge information and the feature vectors of each vertex of the code attribute graph to obtain the original feature vector of the source code to be detected includes: For each vertex of the code attribute graph, perform the following operations respectively: Determine at least one adjacent vertex corresponding to the vertex and a feature vector of the at least one adjacent vertex according to edge information of an edge connected to the vertex; Using a gated loop function, information screening is performed on the feature vector of the vertex and the feature vector of the at least one adjacent vertex to determine the component of the vertex; The components of each vertex are added together to obtain the original feature vector of the source code to be detected.

5. The method according to claim 2, characterized in that The regularization process is performed on the original feature vector to obtain multiple feature vectors of the source code to be detected, including: Regularization processing is performed N times on the original feature vector of the source code to be detected to obtain N feature vectors; the classes of the N feature vectors are the same and the similarity between the N feature vectors and the original feature vector is greater than a similarity threshold; wherein, each time the regularization processing is performed, the output of any hidden layer in the trained contrastive learning model is randomly cleared.

6. The method according to claim 1, characterized in that The step of determining the vulnerability detection result of the source code to be detected based on the predicted probability of the source code to be detected and a preset probability threshold comprises: If the predicted probability of the source code to be detected is greater than a preset probability threshold, determining that the vulnerability detection result of the source code to be detected is that the source code to be detected has a vulnerability; If the predicted probability of the source code to be detected is not greater than the preset probability threshold, it is determined that the vulnerability detection result of the source code to be detected is that the source code to be detected does not have a vulnerability.

7. The method according to claim 1, characterized in that The contrastive learning model is trained as follows: Acquire a sample data set; the sample data set includes a plurality of source code samples, feature vectors corresponding to the plurality of source code samples, and tag data corresponding to the plurality of source code samples, wherein the tag data is a label and a vulnerability detection label corresponding to the plurality of source code samples; Performing cosine similarity calculation based on the sample data set to determine similarities between feature vectors corresponding to the plurality of source code samples; Based on the similarities between the feature vectors corresponding to the multiple source code samples, the feature vectors corresponding to the multiple source code samples are clustered to obtain vulnerability detection results of the multiple source code samples; Based on the vulnerability detection results of the multiple source code samples and the vulnerability detection labels corresponding to the multiple source code samples, a loss function is determined, and the parameters of the contrastive learning model are adjusted based on the loss function until the training conditions are met, thereby obtaining the trained contrastive learning model.

8. A source code vulnerability detection device, characterized in that: The device comprises: A conversion module, configured to generate a code attribute graph based on the source code to be detected; the vertex information of the code attribute graph represents the sub-code of the source code to be detected, and the edge information of the code attribute graph represents the relationship between the sub-codes corresponding to the two vertices at both ends of the edge; A feature extraction module, configured to extract features of the source code to be detected based on the vertex information and the edge information, and obtain a plurality of feature vectors of the source code to be detected; A prediction module, used to cluster multiple feature vectors of the source code to be detected through a trained contrast learning model to obtain a predicted probability of the source code to be detected; the predicted probability is used to characterize the probability that the source code to be detected has a vulnerability; The classification module is used to determine the vulnerability detection result of the source code to be detected based on the predicted probability of the source code to be detected and a preset probability threshold.

9. An electronic device, characterized in that: include: at least one processor, and a memory communicatively connected to the at least one processor, wherein: The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that: When the computer program in the computer storage medium is executed by a processor of an electronic device, the electronic device can execute the method according to any one of claims 1 to 7.

Images