A vulnerability detection method, device, equipment and medium of source code

Abstract

This application discloses a method, apparatus, device, and medium for vulnerability detection of source code, belonging to the field of information security technology. In this method, a code attribute graph is generated based on the source code to be detected; the vertex information of the code attribute graph represents the sub-code of the source code to be detected, and the edge information of the code attribute graph represents the relationship between the sub-codes corresponding to the two vertices at the ends of the edge; based on the vertex and edge information, features are extracted from the source code to be detected to obtain multiple feature vectors; through a trained contrastive learning model, the multiple feature vectors of the source code to be detected are clustered to obtain the predicted probability of the source code to be detected; the predicted probability is used to characterize the probability that the source code to be detected has a vulnerability; based on the predicted probability of the source code to be detected and a preset probability threshold, the vulnerability detection result of the source code to be detected is determined, which can automatically detect vulnerabilities in source code, improve the recall rate of source code vulnerabilities, and protect information security.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a method, apparatus, device and medium for detecting vulnerabilities in source code. Background Technology

[0002] Software vulnerabilities are typically introduced into a system due to flawed security control design or developer errors during the implementation of software specifications. Such defects and errors are unavoidable in the design and implementation phases of the software lifecycle.

[0003] Among related technologies, static software analysis, vulnerability pattern libraries, and rule-based detection, which scan source code to identify potential errors or vulnerabilities, often produce false positives. This is due to limitations or incompleteness in matching rules and pattern matching algorithms, as well as vulnerabilities existing in inaccessible source code. Furthermore, static application security testing tools struggle to detect complex vulnerabilities, leading to a high false negative rate.

[0004] Therefore, there is an urgent need for a source code vulnerability detection method that can automatically detect vulnerabilities in source code, improve the recall rate of source code vulnerabilities, and protect information security. Summary of the Invention

[0005] This application provides a method, apparatus, device, and medium for detecting vulnerabilities in source code, which can automatically detect vulnerabilities in source code, improve the recall rate of source code vulnerabilities, and protect information security.

[0006] In a first aspect, embodiments of this application provide a method for detecting vulnerabilities in source code, the method comprising:

[0007] A code attribute graph is generated based on the source code to be detected; the vertex information of the code attribute graph represents the sub-code of the source code to be detected, and the edge information of the code attribute graph represents the relationship between the sub-codes corresponding to the two vertices at both ends of the edge;

[0008] Based on the vertex information and the edge information, feature extraction is performed on the source code to be detected to obtain multiple feature vectors of the source code to be detected;

[0009] By using a trained contrastive learning model, multiple feature vectors of the source code to be detected are clustered to obtain the predicted probability of the source code to be detected; the predicted probability is used to characterize the probability that the source code to be detected has a vulnerability.

[0010] Based on the predicted probability and preset probability threshold of the source code to be detected, the vulnerability detection result of the source code to be detected is determined.

[0011] In some embodiments, the step of extracting features from the source code to be detected based on the vertex information and the edge information to obtain multiple feature vectors of the source code to be detected includes:

[0012] Based on the vertex information and the edge information, feature extraction is performed on the source code to be detected to obtain the original feature vector of the source code to be detected;

[0013] The original feature vectors are regularized to obtain multiple feature vectors of the source code to be detected.

[0014] In some embodiments, the step of extracting features from the source code to be detected based on the vertex information and the edge information to obtain the original feature vector of the source code to be detected includes:

[0015] For each vertex of the code attribute graph, an encoder is used to perform feature encoding on the vertex information of the vertex to obtain the feature vector of the vertex; the vertex information of the vertex represents the sub-code corresponding to the vertex and the type of the sub-code;

[0016] Based on the edge information and the feature vectors of each vertex of the code attribute graph, information aggregation is performed to obtain the original feature vector of the source code to be detected.

[0017] In some embodiments, the step of aggregating information based on the edge information and the feature vectors of each vertex of the code attribute graph to obtain the original feature vector of the source code to be detected includes:

[0018] For each vertex of the code attribute graph, perform the following operations:

[0019] Based on the edge information of the edge connected to the vertex, determine at least one adjacent vertex corresponding to the vertex, and the feature vector of the at least one adjacent vertex;

[0020] Using a gated loop function, information filtering is performed on the feature vector of the vertex and the feature vector of at least one adjacent vertex to determine the components of the vertex;

[0021] The components of each vertex are summed to obtain the original feature vector of the source code to be detected.

[0022] In some embodiments, the regularization process performed on the original feature vector to obtain multiple feature vectors of the source code to be detected includes:

[0023] The original feature vector of the source code to be detected is regularized N times to obtain N feature vectors; the N feature vectors have the same class and the similarity between the N feature vectors and the original feature vector is greater than the similarity threshold; wherein, during each regularization process, the output of any hidden layer in the trained contrastive learning model is randomly cleared.

[0024] In some embodiments, determining the vulnerability detection result of the source code to be detected based on the predicted probability and a preset probability threshold includes:

[0025] If the predicted probability of the source code to be detected is greater than a preset probability threshold, the vulnerability detection result of the source code to be detected is determined to be that the source code to be detected has a vulnerability.

[0026] If the predicted probability of the source code to be detected is not greater than a preset probability threshold, the vulnerability detection result of the source code to be detected is determined to be that the source code to be detected does not have a vulnerability.

[0027] In some embodiments, the contrastive learning model is trained in the following manner:

[0028] Obtain a sample dataset; the sample dataset includes multiple source code samples, feature vectors corresponding to each of the multiple source code samples, and label data corresponding to each of the multiple source code samples, wherein the label data consists of labels and vulnerability detection labels corresponding to each of the multiple source code samples.

[0029] Based on the sample dataset, cosine similarity is calculated to determine the similarity between the feature vectors corresponding to the multiple source code samples.

[0030] Based on the similarity between the feature vectors corresponding to the multiple source code samples, the feature vectors corresponding to the multiple source code samples are clustered to obtain the vulnerability detection results of the multiple source code samples.

[0031] Based on the vulnerability detection results of the multiple source code samples and the vulnerability detection labels corresponding to each of the multiple source code samples, a loss function is determined, and the parameters of the contrastive learning model are adjusted based on the loss function until the training conditions are met, thus obtaining the trained contrastive learning model.

[0032] Secondly, embodiments of this application provide a source code vulnerability detection device, the device comprising:

[0033] A conversion module is used to generate a code attribute graph based on the source code to be detected; the vertex information of the code attribute graph represents the sub-code of the source code to be detected, and the edge information of the code attribute graph represents the relationship between the sub-codes corresponding to the two vertices at both ends of the edge;

[0034] The feature extraction module is used to extract features from the source code to be detected based on the vertex information and the edge information, so as to obtain multiple feature vectors of the source code to be detected.

[0035] The prediction module is used to cluster multiple feature vectors of the source code to be detected using a trained contrastive learning model to obtain the predicted probability of the source code to be detected; the predicted probability is used to characterize the probability that the source code to be detected has a vulnerability.

[0036] The classification module is used to determine the vulnerability detection result of the source code to be detected based on the predicted probability and the preset probability threshold.

[0037] In some embodiments, the feature extraction module is specifically used for:

[0038] Based on the vertex information and the edge information, feature extraction is performed on the source code to be detected to obtain the original feature vector of the source code to be detected;

[0039] The original feature vectors are regularized to obtain multiple feature vectors of the source code to be detected.

[0040] In some embodiments, the feature extraction module is specifically used for:

[0041] For each vertex of the code attribute graph, an encoder is used to perform feature encoding on the vertex information of the vertex to obtain the feature vector of the vertex; the vertex information of the vertex represents the sub-code corresponding to the vertex and the type of the sub-code;

[0042] Based on the edge information and the feature vectors of each vertex of the code attribute graph, information aggregation is performed to obtain the original feature vector of the source code to be detected.

[0043] In some embodiments, the feature extraction module is specifically used for:

[0044] For each vertex of the code attribute graph, perform the following operations:

[0045] Based on the edge information of the edge connected to the vertex, determine at least one adjacent vertex corresponding to the vertex, and the feature vector of the at least one adjacent vertex;

[0046] Using a gated loop function, information filtering is performed on the feature vector of the vertex and the feature vector of at least one adjacent vertex to determine the components of the vertex;

[0047] The components of each vertex are summed to obtain the original feature vector of the source code to be detected.

[0048] In some embodiments, the feature extraction module is specifically used for:

[0049] The original feature vector of the source code to be detected is regularized N times to obtain N feature vectors; the N feature vectors have the same class and the similarity between the N feature vectors and the original feature vector is greater than the similarity threshold; wherein, during each regularization process, the output of any hidden layer in the trained contrastive learning model is randomly cleared.

[0050] In some embodiments, the classification module is specifically used for:

[0051] If the predicted probability of the source code to be detected is greater than a preset probability threshold, the vulnerability detection result of the source code to be detected is determined to be that the source code to be detected has a vulnerability.

[0052] If the predicted probability of the source code to be detected is not greater than a preset probability threshold, the vulnerability detection result of the source code to be detected is determined to be that the source code to be detected does not have a vulnerability.

[0053] In some embodiments, the apparatus includes a training module for training a contrastive learning model in the following manner:

[0054] Obtain a sample dataset; the sample dataset includes multiple source code samples, feature vectors corresponding to each of the multiple source code samples, and label data corresponding to each of the multiple source code samples, wherein the label data consists of labels and vulnerability detection labels corresponding to each of the multiple source code samples.

[0055] Based on the sample dataset, cosine similarity is calculated to determine the similarity between the feature vectors corresponding to the multiple source code samples.

[0056] Based on the similarity between the feature vectors corresponding to the multiple source code samples, the feature vectors corresponding to the multiple source code samples are clustered to obtain the vulnerability detection results of the multiple source code samples.

[0057] Based on the vulnerability detection results of the multiple source code samples and the vulnerability detection labels corresponding to each of the multiple source code samples, a loss function is determined, and the parameters of the contrastive learning model are adjusted based on the loss function until the training conditions are met, thus obtaining the trained contrastive learning model.

[0058] Thirdly, embodiments of this application provide an electronic device, including: at least one processor, and a memory communicatively connected to the at least one processor, wherein:

[0059] The memory stores a computer program that can be executed by at least one processor, such that the at least one processor is able to perform the vulnerability detection method of the source code described in the first or second aspect above.

[0060] Fourthly, embodiments of this application provide a computer storage medium in which, when a computer program in the computer storage medium is executed by a processor of an electronic device, the electronic device is able to execute the vulnerability detection method of the source code described in the first or second aspect above.

[0061] The method provided in this application has the following beneficial effects:

[0062] In this embodiment, a code attribute graph is generated based on the source code to be detected. The vertex information of the code attribute graph represents the sub-code of the source code to be detected, and the edge information of the code attribute graph represents the relationship between the sub-codes corresponding to the two vertices at the two ends of the edge. Based on the vertex information and edge information, features are extracted from the source code to be detected to obtain multiple feature vectors of the source code to be detected. Through a trained contrastive learning model, the multiple feature vectors of the source code to be detected are clustered to obtain the predicted probability of the source code to be detected. The predicted probability is used to characterize the probability that the source code to be detected has a vulnerability. Based on the predicted probability of the source code to be detected and a preset probability threshold, the vulnerability detection result of the source code to be detected is determined.

[0063] Therefore, the CPG tool is first used to convert the source code to be detected into a CPG structure and extract vertex and edge information. The source code to be detected is then converted into a feature vector containing semantic and syntactic information. Then, a contrastive learning model is used to learn the important features of the feature vector of the source code to be detected. Through a classification layer, the probability of the source code to be detected having vulnerabilities is output. This method can analyze software vulnerabilities that have not appeared before, automatically detect vulnerabilities in the source code, improve the recall rate of source code vulnerabilities, and protect information security.

[0064] Other features and advantages of this application will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing this application. Attached Figure Description

[0065] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0066] Figure 1 A schematic diagram illustrating an application scenario of a source code vulnerability detection method provided in this application embodiment;

[0067] Figure 2A flowchart illustrating a source code vulnerability detection method provided in an embodiment of this application;

[0068] Figure 3 A flowchart illustrating a method for determining an original feature vector provided in an embodiment of this application;

[0069] Figure 4 A flowchart illustrating a training method for a contrastive learning model provided in an embodiment of this application;

[0070] Figure 5 A schematic diagram of the structure of a source code vulnerability detection device provided in an embodiment of this application;

[0071] Figure 6 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0072] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. The described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0073] Furthermore, in the description of the embodiments of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The "and / or" in the text is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in the description of the embodiments of this application, "multiple" means two or more.

[0074] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined with "first" and "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0075] To facilitate understanding of the source code vulnerability detection method provided in this application, some terms appearing in this application will be explained below.

[0076] CPG (CodePropertyGraph): A code property graph is a graphical representation method used to capture various properties of a program, including but not limited to control flow, data flow, type information, function calls, etc., and can extract useful structured information from the source code. The output of a CPG is a graph G = (Node, Edge), where Node is a node and Edge is an edge of graph G. In a CPG, each vertex n ∈ Node represents a small piece of code and is categorized into different types of vertices, including arithmetic expressions, call statements, etc. Edges e ∈ Edge represent the relationships between vertices n.

[0077] Contrastive learning models are used to find source code feature vectors in data that are similar or contrasting. For similar data pairs, they can be clustered closer together to learn each other's high-level features; conversely, for contrasting data pairs, they can be pushed further apart.

[0078] Gated Graph Neural Networks (GGNNs): The basic principle of GGNNs is to learn and update node representations through message passing between nodes. Unlike traditional neural networks, the state of each node in a GGNN not only reflects its own feature information but also integrates the features of its neighboring nodes. This global perspective node state update process is achieved through iterative message passing, enabling nodes to dynamically adjust their representations according to their surrounding environment.

[0079] A key innovation of GGNN lies in its gating mechanism, which borrows design principles from recurrent neural networks (such as LSTM or GRU) to allow the model to selectively learn when updating node states. Specifically, by setting different gating units, the model can filter out the most critical neighbor information for updating the current node state in each iteration, while ignoring irrelevant or noisy information, thus effectively capturing and preserving complex patterns and dependencies in graph data.

[0080] Software vulnerabilities are typically introduced into a system due to flawed security control design or developer errors during the implementation of software specifications. Such defects and errors are unavoidable in the design and implementation phases of the software lifecycle.

[0081] Among related technologies, static software analysis, vulnerability pattern libraries, and rule-based detection, which scan source code to identify potential errors or vulnerabilities, often produce false positives. This is due to limitations or incompleteness in matching rules and pattern matching algorithms, as well as vulnerabilities existing in inaccessible source code. Furthermore, static application security testing tools struggle to detect complex vulnerabilities, leading to a high false negative rate.

[0082] Therefore, there is an urgent need for a source code vulnerability detection method that can automatically detect vulnerabilities in source code, improve the recall rate of source code vulnerabilities, and protect information security.

[0083] In view of this, embodiments of this application provide a method, apparatus, device, and medium for detecting vulnerabilities in source code, which can automatically detect vulnerabilities in source code, improve the recall rate of source code vulnerabilities, and protect information security.

[0084] The inventive concept of this application embodiment is as follows: In this application embodiment, the CPG tool is first used to convert the source code to be detected into a code attribute graph CPG structure and extract vertex and edge information. The source code to be detected is then converted into a feature vector containing semantic and syntactic information. Then, a contrastive learning model is used to learn the important features of the feature vector of the source code to be detected. Through a classification layer, the probability of the source code to be detected having vulnerabilities is output. This method can analyze software vulnerabilities that have not appeared before, automatically detect vulnerabilities in the source code, improve the recall rate of source code vulnerabilities, and protect information security.

[0085] After introducing the main inventive concept of the embodiments of this application, the application scenario of a source code vulnerability detection method provided by the embodiments of this application will be described below with reference to the accompanying drawings. Figure 1 The diagram shown is an application scenario illustration of a source code vulnerability detection method provided in an embodiment of this application. Figure 1 It includes a server 100 and electronic devices 200; among which:

[0086] After acquiring the source code to be detected, the electronic device 200 converts the source code into a code attribute graph. Then, based on the vertex and edge information in the code attribute graph, it extracts features from the source code to obtain multiple feature vectors. Next, it obtains a trained contrastive learning model from the server 100 and clusters the multiple feature vectors of the source code to obtain the predicted probability of the source code. The predicted probability is used to characterize the probability that the source code has a vulnerability. Based on the predicted probability of the source code and a preset probability threshold, the vulnerability detection result of the source code is determined and stored in the server 100.

[0087] The server 100 and the electronic device 200 can communicate with each other. The communication method can be wired communication technology, such as communicating through a network cable or serial cable; or wireless communication technology, such as communicating through Bluetooth or WIFI. There are no specific restrictions.

[0088] To further illustrate the technical solutions provided in the embodiments of this application, a detailed description is provided below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiments of this application provide method operation steps as shown in the following embodiments or drawings, the method may include more or fewer operation steps based on conventional or non-inventive methods. In steps where there is no logically necessary causal relationship, the execution order of these steps is not limited to the execution order provided in the embodiments of this application.

[0089] See Figure 2 This is a flowchart illustrating a source code vulnerability detection method provided in an embodiment of this application. The method includes, for example: Figure 2 The steps shown are as follows:

[0090] In step 201, a code attribute graph is generated based on the source code to be detected; the vertex information of the code attribute graph represents the sub-code of the source code to be detected, and the edge information of the code attribute graph represents the relationship between the sub-codes corresponding to the two vertices at both ends of the edge.

[0091] Specifically, after obtaining the source code to be tested, the source code is parsed by the language front-end and transformed into nodes in the code attribute graph (CPG); then, the information retained in the graph is refined and improved through the Passes stage to obtain the code attribute graph of the source code to be tested.

[0092] CPG is a useful tool for extracting graph information. It can be used to construct feature files for source code to be detected. The output of CPG is a graph G = (Node, Edge), where Node is a node and Edge is an edge of G. Through the combination of nodes and edges, CPG can comprehensively capture the structural and semantic information of the code, providing a solid foundation for subsequent feature extraction and vulnerability detection.

[0093] In CPG, each vertex n∈Node represents a small piece of code, i.e., a sub-code of the source code to be examined, such as a basic unit or fragment of code, usually a statement, expression, or declaration. The sub-code represented by each vertex is different, but the types of vertices may be the same or different. Vertex types include arithmetic expressions, assignment statements, function calls, conditional statements, loop statements, variable declarations, class declarations, comments, etc.

[0094] In CPG, each edge e∈Edge represents a relationship between vertices n, that is, the relationship between the sub-codes corresponding to the two vertices at the two ends of the edge, reflecting the logical dependencies and control flow in the code. Edge types include control flow, data flow, type, call, inheritance, implementation, etc.

[0095] In step 202, based on vertex and edge information, feature extraction is performed on the source code to be detected to obtain multiple feature vectors of the source code to be detected.

[0096] In some embodiments, feature extraction is performed on the source code to be detected based on vertex and edge information to obtain multiple feature vectors of the source code to be detected, and the process is as follows:

[0097] Based on vertex and edge information, feature extraction is performed on the source code to be detected to obtain the original feature vector of the source code to be detected; the original feature vector is then regularized to obtain multiple feature vectors of the source code to be detected.

[0098] Furthermore, based on vertex and edge information, feature extraction is performed on the source code to be detected, yielding the original feature vector of the source code, which can be executed as follows: Figure 3 The steps shown are as follows:

[0099] In step 301, for each vertex of the code attribute graph, the vertex information of the vertex is feature-encoded using an encoder to obtain the feature vector of the vertex; the vertex information of the vertex represents the sub-code and the type of the sub-code corresponding to the vertex.

[0100] Specifically, the subcode corresponding to each vertex is first subjected to lexical analysis, decomposing it into a series of lexical units (tokens). Then, a pre-trained word embedding model is used to convert each lexical unit into a fixed-dimensional vector, which captures the semantic information of the word. For longer subcodes, models such as recurrent neural networks, long short-term memory networks, or Transformers can be used to encode the word sequence and generate a vector representing the subcode.

[0101] Each vertex has a specific type. To incorporate this type information into the encoding, one-hot encoding can be used to convert the vertex type into a binary vector. Then, the vector of the sub-code is concatenated with the one-hot encoded vector of the vertex type to form a higher-dimensional representative vector.

[0102] In implementation, to represent the semantic and syntactic information of vertex n, an encoder is used to perform feature encoding on the vertex information of vertex n. First, the sub-code corresponding to vertex n is encoded and converted into a vector V. n Then, combine the type information of vertex n to form vector V. n A single-hot encoded vector C of type n e Connect them into a representative vector X n That is, to obtain the eigenvector X of vertex n. n .

[0103] The type information of vertex n can be determined when generating the code attribute graph. Then, the type information of vertex n is one-hot encoded to obtain the one-hot encoded vector C of vertex n's type information. e .

[0104] The eigenvector X of vertex n n It not only contains semantic information of subcodes, but also type information (syntactic structure), enabling the model to better understand the characteristics of vertices.

[0105] In step 302, information aggregation is performed based on the edge information and the feature vectors of each vertex of the code attribute graph to obtain the original feature vector of the source code to be detected.

[0106] Specifically, based on edge information and the feature vectors of each vertex in the code attribute graph, information aggregation is performed to obtain the original feature vector of the source code to be detected, which is then executed as follows:

[0107] For each vertex in the code attribute graph, perform the following operations: Based on the edge information of the edges connected to the vertex, determine at least one adjacent vertex and the feature vector of at least one adjacent vertex; Use a gated loop function to filter the feature vector of the vertex and the feature vector of at least one adjacent vertex to determine the components of the vertex.

[0108] The components of each vertex are summed to obtain the original feature vector of the source code to be detected.

[0109] The implementation involves obtaining the feature vector of each vertex in the code attribute graph, then using a gated graph sequence neural network (GGNN) to extract information from each vertex, thus obtaining the original feature vector of the source code to be detected. GGNN is an improved model of graph neural networks, specifically represented as follows:

[0110]

[0111] Using the above formula, the GGNN model can extract vertex and edge information from the code attribute graph, where f GRU It is a gated loop function, X n Let X be the eigenvector of vertex n, and h be a transformation function used to synthesize the eigenvector X of at least one adjacent vertex u corresponding to vertex n. u The information is as follows: Edge is at least one adjacent vertex corresponding to vertex n.

[0112] After determining at least one adjacent vertex u corresponding to vertex n based on the edge information, the feature vector X of vertex n is processed by a gated loop function. n The eigenvector X of at least one adjacent vertex u corresponding to vertex n u Next, the components of vertex n are obtained, and then the components of all vertices n are summed to obtain an original feature vector X representing the source code to be detected. graph In this process, all the information of the graph is synthesized.

[0113] Furthermore, the original feature vectors are regularized to obtain multiple feature vectors of the source code to be detected. This can be done by performing regularization on the original feature vectors of the source code to be detected N times to obtain N feature vectors.

[0114] Among them, the N feature vectors have the same class and the similarity between the N feature vectors and the original feature vectors is greater than the similarity threshold; among them, during each regularization process, the output of any hidden layer in the trained contrastive learning model is randomly cleared.

[0115] When contrastive learning is used to detect source code vulnerabilities using traditional supervised learning methods, the model heavily relies on the amount of pre-labeled data, while the amount of unlabeled data is very large. To address the data imbalance during training, this embodiment uses the dropout (regularization) function to generate minority class data. For each hidden layer in the network, each neuron has a certain probability of being temporarily removed. Therefore, overfitting during training can be avoided by randomly disabling the connection of a neuron, i.e., randomly clearing the output of any hidden layer in the trained contrastive learning model and setting the output of any hidden layer to zero during each regularization process.

[0116] The original feature vector is x = (x n ,x2,...,x m After regularizing the original feature vector x using the dropout function, each component x of the original feature vector... i (i = 1, 2, ..., m) can be represented as:

[0117]

[0118] Among them, b i Let be a random variable that follows a Bernoulli distribution:

[0119]

[0120] Through the above operations, the generated feature vectors are still spatially adjacent to the original feature vectors. The original feature vectors are then passed through the dropout function N times to generate N feature vectors of the same class that are close to the original feature vectors.

[0121] Therefore, multiple feature vectors of the source code to be detected can be obtained, and the dataset can be balanced using these multiple feature vectors.

[0122] In step 203, the trained contrastive learning model is used to cluster multiple feature vectors of the source code to be detected, thereby obtaining the predicted probability of the source code to be detected.

[0123] The predicted probability is used to characterize the probability that the source code to be detected contains a vulnerability.

[0124] In practice, after balancing the data, a trained contrastive learning model is used to cluster multiple feature vectors of the source code to be detected, and then the predicted probability of the source code to be detected is output through the final classification layer.

[0125] In this embodiment, the classification layer needs to be trained until its parameters are adjusted and stabilized. Specifically, the classification layer parameters are adjusted using the cross-entropy loss function. The cross-entropy loss function is expressed as:

[0126]

[0127] Among them, X i The source code to be tested is d i The feature vector, σ is the activation function, N is the total number of source code samples, and label i These are source code tags (user-annotated), with 0 for vulnerable source code tags and 1 for secure source code tags.

[0128] During training, the parameters of the classification layer are adjusted based on the value of the cross-entropy loss function. After the classification layer is trained, the predicted probability of the source code to be detected is output through the trained classification layer.

[0129] In step 204, the vulnerability detection result of the source code to be detected is determined based on the predicted probability of the source code to be detected and the preset probability threshold.

[0130] The specific implementation is as follows:

[0131] If the predicted probability of the source code to be detected is greater than the preset probability threshold, the vulnerability detection result of the source code to be detected is determined to be that the source code to be detected has a vulnerability.

[0132] If the predicted probability of the source code to be tested is not greater than the preset probability threshold, the vulnerability detection result of the source code to be tested is determined to be that the source code to be tested has no vulnerability.

[0133] The preset probability threshold can be set based on experience or according to actual needs, and this application embodiment does not impose any restrictions on it.

[0134] In performing vulnerability detection on the source code provided in the embodiments of this application, it can be done through methods such as... Figure 4 The contrastive learning model is trained as shown to obtain the trained contrastive learning model:

[0135] In step 401, a sample dataset is obtained; the sample dataset includes multiple source code samples, feature vectors corresponding to each of the multiple source code samples, and label data corresponding to each of the multiple source code samples. The label data consists of labels and vulnerability detection labels corresponding to each of the multiple source code samples.

[0136] In step 402, cosine similarity is calculated based on the sample dataset to determine the similarity between the feature vectors corresponding to each of the multiple source code samples.

[0137] In step 403, based on the similarity between the feature vectors corresponding to each of the multiple source code samples, the feature vectors corresponding to each of the multiple source code samples are clustered to obtain the vulnerability detection results of the multiple source code samples.

[0138] In step 404, based on the vulnerability detection results of multiple source code samples and the vulnerability detection labels corresponding to each of the multiple source code samples, a loss function is determined, and the parameters of the contrastive learning model are adjusted based on the loss function until the training conditions are met, thus obtaining the trained contrastive learning model.

[0139] Specifically, contrastive learning models are used to find source code feature vectors in data that are similar or contrasting. Similar data pairs can be clustered closer together to learn each other's high-level features, while contrasting pairs are pushed further apart. Using contrastive learning can optimize the source code classification process, thereby helping the model learn features.

[0140] Suppose there is a set of source code samples Where d i and These are two similar source code samples or those with the same label, d i and These are two dissimilar source code samples or samples with different labels. Let X... i , d respectively i , The corresponding feature vector. If the sample dataset includes N source code samples, then the training objective of the sample dataset is:

[0141]

[0142] In the formula, L cl Loss represents the sum of losses for N source code samples. i Let represent the loss of the i-th source code sample.

[0143] Loss i Defined by the following formula:

[0144]

[0145] In the formula, label i ,label j ,label k These are source code labels (user-annotated), with 0 for vulnerable source code labels and 1 for secure source code labels. When B is true, 1... B =1, otherwise 1 B =0, where, For N source code samples, X i The total number of samples with the same label, where i is the index of the N source code sample examples, k is the index of other examples in the N source code samples that have the same label as index i, and j is the index of other examples in the N source code samples that have different labels than index i. θ is a positive hyperparameter, cos(X i ,X k ) is the cosine similarity, expressed as:

[0146]

[0147] In the formula, X i It is d i The corresponding feature vector, X k yes The corresponding feature vectors are extracted using graph embedding.

[0148] In contrastive learning, if the label i and label k If the source code samples x_i and x_k are identical, meaning they are positive sample pairs (e.g., both are secure source code or both are vulnerable source code), then they are considered to have the same label. Conversely, if the label... i and label k If they are different, that is, x_i is a secure source code and x_k is a vulnerable source code, then they are considered to have different labels and are negative sample pairs.

[0149] Finally, based on Loss i Adjust the parameters of the contrastive learning model until the training conditions are met to obtain the trained contrastive learning model.

[0150] The training condition is the training objective L. cl It tends to stabilize, or the number of training sessions exceeds the preset number.

[0151] Therefore, a trained contrastive learning model can be used to learn important features from the original feature vector of the source code to be detected, thereby obtaining the vulnerability detection results of the source code.

[0152] Based on the preceding description, a code attribute graph is generated from the source code to be detected. The vertex information of the code attribute graph represents the sub-code of the source code to be detected, and the edge information of the code attribute graph represents the relationship between the sub-codes corresponding to the two vertices at the ends of the edge. Based on the vertex information and edge information, features are extracted from the source code to be detected to obtain multiple feature vectors. Through a trained contrastive learning model, the multiple feature vectors of the source code to be detected are clustered to obtain the predicted probability of the source code to be detected. The predicted probability is used to characterize the probability that the source code to be detected has a vulnerability. Based on the predicted probability of the source code to be detected and a preset probability threshold, the vulnerability detection result of the source code to be detected is determined.

[0153] Therefore, the CPG tool is first used to convert the source code to be detected into a CPG structure and extract vertex and edge information. The source code to be detected is then converted into a feature vector containing semantic and syntactic information. Then, a contrastive learning model is used to learn the important features of the feature vector of the source code to be detected. Through a classification layer, the probability of the source code to be detected having vulnerabilities is output. This method can analyze software vulnerabilities that have not appeared before, automatically detect vulnerabilities in the source code, improve the recall rate of source code vulnerabilities, and protect information security.

[0154] Based on the same technical concept, this application also provides a source code vulnerability detection device. The principle of the source code vulnerability detection device in solving the problem is similar to that of the source code vulnerability detection method described above. Therefore, the implementation of the source code vulnerability detection device can refer to the implementation of the source code vulnerability detection method, and the repeated parts will not be described again.

[0155] Figure 5 This is a schematic diagram of the structure of a source code vulnerability detection device provided in an embodiment of this application. The device includes a conversion module 501, a feature extraction module 502, a prediction module 503, and a classification module 504, wherein:

[0156] The conversion module 501 is used to generate a code attribute graph based on the source code to be detected; the vertex information of the code attribute graph represents the sub-code of the source code to be detected, and the edge information of the code attribute graph represents the relationship between the sub-codes corresponding to the two vertices at both ends of the edge;

[0157] The feature extraction module 502 is used to extract features from the source code to be detected based on the vertex information and the edge information, so as to obtain multiple feature vectors of the source code to be detected.

[0158] The prediction module 503 is used to cluster multiple feature vectors of the source code to be detected using a trained contrastive learning model to obtain a predicted probability of the source code to be detected; the predicted probability is used to characterize the probability that the source code to be detected has a vulnerability.

[0159] The classification module 504 is used to determine the vulnerability detection result of the source code to be detected based on the predicted probability and the preset probability threshold.

[0160] In some embodiments, the feature extraction module 502 is specifically used for:

[0161] Based on the vertex information and the edge information, feature extraction is performed on the source code to be detected to obtain the original feature vector of the source code to be detected;

[0162] The original feature vectors are regularized to obtain multiple feature vectors of the source code to be detected.

[0163] In some embodiments, the feature extraction module 502 is specifically used for:

[0164] For each vertex of the code attribute graph, an encoder is used to perform feature encoding on the vertex information of the vertex to obtain the feature vector of the vertex; the vertex information of the vertex represents the sub-code corresponding to the vertex and the type of the sub-code;

[0165] Based on the edge information and the feature vectors of each vertex of the code attribute graph, information aggregation is performed to obtain the original feature vector of the source code to be detected.

[0166] In some embodiments, the feature extraction module 502 is specifically used for:

[0167] For each vertex of the code attribute graph, perform the following operations:

[0168] Based on the edge information of the edge connected to the vertex, determine at least one adjacent vertex corresponding to the vertex, and the feature vector of the at least one adjacent vertex;

[0169] Using a gated loop function, information filtering is performed on the feature vector of the vertex and the feature vector of at least one adjacent vertex to determine the components of the vertex;

[0170] The components of each vertex are summed to obtain the original feature vector of the source code to be detected.

[0171] In some embodiments, the feature extraction module 502 is specifically used for:

[0172] The original feature vector of the source code to be detected is regularized N times to obtain N feature vectors; the N feature vectors have the same class and the similarity between the N feature vectors and the original feature vector is greater than the similarity threshold; wherein, during each regularization process, the output of any hidden layer in the trained contrastive learning model is randomly cleared.

[0173] In some embodiments, the classification module 504 is specifically used for:

[0174] If the predicted probability of the source code to be detected is greater than a preset probability threshold, the vulnerability detection result of the source code to be detected is determined to be that the source code to be detected has a vulnerability.

[0175] If the predicted probability of the source code to be detected is not greater than a preset probability threshold, the vulnerability detection result of the source code to be detected is determined to be that the source code to be detected does not have a vulnerability.

[0176] In some embodiments, the apparatus includes a training module 505, which is configured to train a contrastive learning model in the following manner:

[0177] Obtain a sample dataset; the sample dataset includes multiple source code samples, feature vectors corresponding to each of the multiple source code samples, and label data corresponding to each of the multiple source code samples, wherein the label data consists of labels and vulnerability detection labels corresponding to each of the multiple source code samples.

[0178] Based on the sample dataset, cosine similarity is calculated to determine the similarity between the feature vectors corresponding to the multiple source code samples.

[0179] Based on the similarity between the feature vectors corresponding to the multiple source code samples, the feature vectors corresponding to the multiple source code samples are clustered to obtain the vulnerability detection results of the multiple source code samples.

[0180] Based on the vulnerability detection results of the multiple source code samples and the vulnerability detection labels corresponding to each of the multiple source code samples, a loss function is determined, and the parameters of the contrastive learning model are adjusted based on the loss function until the training conditions are met, thus obtaining the trained contrastive learning model.

[0181] The module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, other division methods are possible. Furthermore, the functional modules in each embodiment of this application can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. Coupling between modules can be achieved through interfaces, typically electrical communication interfaces, but mechanical interfaces or other types of interfaces are also possible. Therefore, modules described as separate components may or may not be physically separate; they can be located in one place or distributed across different locations on the same or different devices. The integrated modules described above can be implemented in hardware or as software functional modules.

[0182] Having introduced a source code vulnerability detection method and apparatus according to an exemplary embodiment of this application, we will now introduce an electronic device according to another exemplary embodiment of this application.

[0183] The following reference Figure 6 To describe an electronic device 130 implemented according to this embodiment of the present application. Figure 6 The electronic device 130 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0184] like Figure 6 As shown, the electronic device 130 is represented in the form of a general electronic device. The components of the electronic device 130 may include, but are not limited to: at least one processor 131, at least one memory 132, and a bus 133 connecting different system components (including memory 132 and processor 131).

[0185] At least one memory 132 stores a computer program that can be executed by at least one processor 131. When the computer program is executed by at least one processor 131, it can cause at least one processor 131 to perform the steps of any source code vulnerability detection method provided in the embodiments of this application.

[0186] Bus 133 represents one or more of several bus structures, including a memory bus or memory controller, peripheral bus, processor, or local bus using any of the various bus structures.

[0187] The memory 132 may include a readable medium in the form of volatile memory, such as random access memory (RAM) 1321 and / or cache memory 1322, and may further include read-only memory (ROM) 1323.

[0188] The memory 132 may also include a program / utility 1325 having a set (at least one) of program modules 1324, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0189] Electronic device 130 can also communicate with one or more external devices 134 (e.g., keyboard, pointing device, etc.), and with one or more devices that enable a user to interact with electronic device 130, and / or with any device that enables electronic device 130 to communicate with one or more other electronic devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 135. Furthermore, electronic device 130 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 136. As shown, network adapter 136 communicates with other modules used in electronic device 130 via bus 133. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 130, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0190] In an exemplary embodiment, a computer storage medium is also provided, which, when a computer program in the computer storage medium is executed by a processor of an electronic device, enables the electronic device to execute any of the aforementioned source code vulnerability detection methods. Optionally, the storage medium may be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

[0191] In an exemplary embodiment, a computer program product is also provided, which, when executed by an electronic device, enables the electronic device to implement the steps of any of the source code vulnerability detection methods provided in this application.

[0192] Furthermore, computer program products may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, RAM, ROM, erasable programmable read-only memory (EPROM), flash memory, optical fiber, compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0193] The program product for device discovery in this application embodiment may be a CD-ROM and include program code, and may run on a computing device. However, the program product of this application is not limited thereto. In this document, the readable storage medium may be any tangible medium that contains or stores a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0194] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0195] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, radio frequency (RF), or any suitable combination thereof.

[0196] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, such as a Local Area Network (LAN) or a Wide Area Network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0197] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0198] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0199] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0200] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0201] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0202] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0203] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0204] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, then this application also includes such modifications and variations.

Claims

1. A vulnerability detection method of source code, characterized by, The method comprises: generating a code attribute graph based on the to-be-detected source code; vertex information of the code attribute graph represents sub-codes of the to-be-detected source code, and edge information of the code attribute graph represents a relationship between sub-codes corresponding to two vertices at two ends of the edge; based on the vertex information and the edge information, performing feature extraction on the to-be-detected source code to obtain an original feature vector of the to-be-detected source code; performing regularization processing on the original feature vector of the to-be-detected source code N times to obtain N feature vectors; the N feature vectors are of the same class and have a similarity greater than a similarity threshold with the original feature vector; wherein, in each regularization processing, the output of any hidden layer in the trained contrast learning model is randomly emptied; by using the trained contrast learning model, clustering the plurality of feature vectors of the to-be-detected source code to obtain a prediction probability of the to-be-detected source code; the prediction probability is used to represent a probability that the to-be-detected source code has a vulnerability; the contrast learning model is trained in the following manner: obtaining a sample data set; the sample data set comprises a plurality of source code samples, feature vectors corresponding to the plurality of source code samples respectively, and label data corresponding to the plurality of source code samples respectively, the label data being labels corresponding to the plurality of source code samples respectively and a vulnerability detection label; based on the sample data set, performing cosine similarity calculation to determine the similarity between the feature vectors corresponding to the plurality of source code samples respectively; based on the similarity between the feature vectors corresponding to the plurality of source code samples respectively, clustering the feature vectors corresponding to the plurality of source code samples respectively to obtain vulnerability detection results of the plurality of source code samples; based on the vulnerability detection results of the plurality of source code samples and the vulnerability detection labels corresponding to the plurality of source code samples respectively, determining a loss function, and adjusting parameters of the contrast learning model based on the loss function until a training condition is reached to obtain the trained contrast learning model; based on the prediction probability of the to-be-detected source code and a preset probability threshold, determining a vulnerability detection result of the to-be-detected source code.

2. The method of claim 1, wherein, The method comprises: for each vertex of the code attribute graph, using an encoder to perform feature encoding on vertex information of the vertex to obtain a feature vector of the vertex; the vertex information of the vertex represents a sub-code corresponding to the vertex and a type of the sub-code; based on the edge information and the feature vectors of the vertices of the code attribute graph, performing information aggregation to obtain an original feature vector of the to-be-detected source code.

3. The method of claim 2, wherein, The method comprises: for each vertex of the code attribute graph, respectively performing the following operations: determine at least one adjacent vertex corresponding to the vertex according to edge information of edges connected to the vertex, and a feature vector of the at least one adjacent vertex; perform information screening on the feature vector of the vertex and the feature vector of the at least one adjacent vertex by using a gating recurrent function, to determine a component of the vertex; add the obtained component of each vertex to obtain an original feature vector of the source code to be detected.

4. The method of claim 1, wherein, The determining of the vulnerability detection result of the source code to be detected based on the predicted probability of the source code to be detected and a preset probability threshold value includes: if the predicted probability of the source code to be detected is greater than the preset probability threshold value, determining that the vulnerability detection result of the source code to be detected is that the source code to be detected has a vulnerability; if the predicted probability of the source code to be detected is not greater than the preset probability threshold value, determining that the vulnerability detection result of the source code to be detected is that the source code to be detected has no vulnerability.

5. A vulnerability detection apparatus for source code, characterized by comprising: The apparatus includes: a conversion module configured to generate a code attribute graph based on the source code to be detected; vertex information of the code attribute graph represents sub-codes of the source code to be detected, and edge information of the code attribute graph represents a relationship between sub-codes corresponding to two vertices at two ends of an edge; a feature extraction module configured to perform feature extraction on the source code to be detected based on the vertex information and the edge information, to obtain an original feature vector of the source code to be detected; perform N times of regularization processing on the original feature vector of the source code to be detected, to obtain N feature vectors; the N feature vectors are of the same class, and a similarity between the N feature vectors and the original feature vector is greater than a similarity threshold value; wherein, in each time of regularization processing, an output of any hidden layer in the trained contrast learning model is randomly emptied; a prediction module configured to perform clustering on a plurality of feature vectors of the source code to be detected by using a trained contrast learning model, to obtain a predicted probability of the source code to be detected; the predicted probability is used to represent a probability that the source code to be detected has a vulnerability; the contrast learning model is trained in the following manner: a sample data set is obtained; the sample data set includes a plurality of source code samples, a feature vector corresponding to each of the plurality of source code samples, and a labeled data corresponding to each of the plurality of source code samples, the labeled data being a label corresponding to each of the plurality of source code samples and a vulnerability detection label; a cosine similarity is calculated based on the sample data set, to determine a similarity between the feature vectors corresponding to the plurality of source code samples; clustering is performed on the feature vectors corresponding to the plurality of source code samples based on the similarity between the feature vectors, to obtain a vulnerability detection result of the plurality of source code samples; a loss function is determined based on the vulnerability detection result of the plurality of source code samples and the vulnerability detection label corresponding to each of the plurality of source code samples, and parameters of the contrast learning model are adjusted based on the loss function until a training condition is reached, to obtain the trained contrast learning model; The classification module is configured to determine a vulnerability detection result of the source code to be detected based on the predicted probability of the source code to be detected and a preset probability threshold.

6. An electronic device, comprising: The method comprises: At least one processor and a memory connected in communication with the at least one processor, wherein: The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-4.

7. A computer storage medium, characterized in that When the computer program in the computer storage medium is executed by the processor of the electronic device, the electronic device can perform the method of any one of claims 1-4.

Images