Intelligent detection method for QEMU component digital model

Abstract

The invention provides an intelligent detection method for a QEMU component digital model, and belongs to the technical field of software testing and source code defect detection.The method comprises the specific steps that 1, source codes of the QEMU component digital model are obtained; step 2, matching source code defects in the QEMU component digital model according to definition of a source code defect rule on the basis of an abstract syntax tree of the source code; step 3, generating an expansion graph of the program according to the source code, performing path dependence analysis on the source code by combining a symbolic execution technology, and detecting potential source code defects depending on an execution path; and 4, detecting the source code through the deep learning model to obtain a detection result, and determining whether the source code defects in the step 2 and the step 3 are correct or not according to the detection result. By means of the processing scheme, the problems that in an existing detection method, the false alarm rate is high, and defect type detection is incomplete are solved.

Description

Technical Field

[0001] The present application relates to the field of software testing and source code defect detection, and in particular to an intelligent detection method for QEMU component digital models. Background Art

[0002] In the process of software development, it is inevitable to introduce many software defects. These software defects may be caused by irregular coding, and serious ones may cause system crashes. For example, declarations and definitions, control statements, function usage, pointers and resources, expressions, etc. in the software source code often cause array out-of-bounds, arithmetic overflow, division by zero, pointer errors, and data competition.

[0003] In order to ensure the quality of software and the safe and stable operation of the system, it is extremely necessary to strictly detect and correct the defects hidden in the software. Traditional static analysis tools based on source code require a lot of manpower and time costs, and have low detection efficiency and accuracy. Summary of the invention

[0004] In view of this, the present application provides an intelligent detection method for the digital model of QEMU components to solve the problems of high false alarm rate and incomplete detection of defect types in existing detection methods.

[0005] The intelligent detection method for the digital model of QEMU components provided by the present application adopts the following technical solution:

[0006] An intelligent detection method for a QEMU component digital model, comprising:

[0007] Step 1, obtain the source code of the QEMU component digital model;

[0008] Step 2: Based on the abstract syntax tree of the source code and according to the definition of the source code defect rule, match the source code defects in the QEMU component digital model;

[0009] Step 3: Generate an extension graph of the program based on the source code, and perform path dependency analysis on the source code in combination with symbolic execution technology to detect potential source code defects that depend on the execution path;

[0010] Step 4 detects the source code through the deep learning model to obtain the detection results, and confirms whether the source code defects in steps 2 and 3 are correct based on the detection results.

[0011] Optionally, the step 1 specifically includes:

[0012] During the compilation process, based on the fact that the QEMU component digital model uses the Makefile compilation tool chain, the build information is collected by directly running the Makefile or simulating the build to obtain the list of source files that need to be analyzed, the compilation options of the source files, the header file search path, and the key information of the predefined macros;

[0013] Acquire the source code to be tested by combining the source file list, source file compilation options, header file search path and predefined macro key information;

[0014] The source code to be tested replaces the predefined macros and header file inclusions with the original code according to the header file search path and predefined macro key information, and then forms a complete source code to be tested. The complete source code to be tested is scanned and the source code file is converted into an abstract syntax tree AST.

[0015] Optionally, step 1 further includes:

[0016] The characteristics of the digital models of QEMU components are analyzed, and a set of detection rules suitable for QEMU components is organized and constructed in combination with some existing rule sets.

[0017] Optionally, the step 2 specifically includes:

[0018] Use the abstract syntax tree to build the matching object corresponding to the source code, combine the class implemented by the matching object with the source code defect rule to match, and obtain the source code defect detected based on the abstract syntax tree:

[0019] In the process of scanning the complete source code to be detected, when scanning the #if and #endif preprocessing statements, the registered PPCallbacks class in the preprocessor in the analysis engine is called, and the overloaded function for the preprocessing instructions added by the registerPPCallbacks function in the preprocessing stage is used to obtain the source code defects detected based on the preprocessing instructions; when analyzing the file unit in the source code, the onStartOfTranslationUnit function is used to initialize and allocate storage space when entering the file unit, and statistics are performed and written to the storage space when performing abstract syntax tree matching. When the file unit analysis is ended, the onEndOfTranslationUnit function is called, and analysis is performed based on the content in the storage space to obtain the source code defects detected based on the file unit statistics;

[0020] During the scanning of the complete source code to be tested, an interface for obtaining the original text of the source code is left in the lexical analysis stage. The original text lexical structure is tested through the interface to obtain source code defects based on lexical analysis.

[0021] Optionally, the step 3 specifically includes:

[0022] Simulate execution according to the source code execution mode, generate the program extension graph based on AST and control flow graph, record and update the value range and constraints of symbolic values ​​and conditional expressions, and detect potential complex defects through constraint solving of path conditions.

[0023] Optionally, a ternary modeling approach is used to track the record and update status of symbol values.

[0024] In summary, this application includes the following beneficial technical effects:

[0025] This application is applicable to source code defect detection of QEMU component models, especially in large and complex projects, and has better results than traditional source code detection. This method is based on projects developed on the QEMU virtualization platform, supports static analysis of programming languages ​​such as C, and can detect common problems such as memory management, improper use of pointers, and resource leaks. By combining the detection of deep learning models, this application greatly improves the accuracy and efficiency of source code defect detection, reduces the false alarm rate, and helps improve the quality of QEMU component models. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0027] Figure 1 This is a flow chart of the intelligent detection method of QEMU component digital model for this application;

[0028] Figure 2 This is the basic architecture of the Transformer-based CBCD-LLM model in the embodiments of this application. DETAILED DESCRIPTION

[0029] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0030] The following describes the implementation methods of the present application through specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The present application can also be implemented or applied through other different specific implementation methods, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that, in the absence of conflict, the following embodiments and the features in the embodiments can be combined with each other. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work belong to the scope of protection of the present application.

[0031] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present application, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this device and / or practice this method.

[0032] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present application. The illustrations only show the components related to the present application rather than being drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed at will, and the component layout may also be more complicated.

[0033] Additionally, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects described may be practiced without these specific details.

[0034] The embodiment of the present application provides an intelligent detection method for a QEMU component digital model.

[0035] like Figure 1 As shown, an intelligent detection method for digital models of QEMU components;

[0036] Starting from the input of the source code, after a series of analysis and detection, the source code defect information is finally output. After the source code is input into the system, it is first parsed by the compiler front end in the compilation tool chain adaptation module to generate an abstract syntax tree AST and a control flow graph CFG. AST reflects the structure and hierarchical relationship of the code, while CFG describes the control flow of the program in different states, which is helpful for subsequent defect detection; based on the generation of AST and CFG, defect detection and confirmation are performed in turn. The embodiment of the present application comprises a compilation tool chain adaptation module, a detection rule set configuration module, a source code defect detection module based on rule matching, a source code defect detection module based on symbolic execution, and a source code defect detection and confirmation module based on deep learning.

[0037] Specifically include:

[0038] Step 1: Obtain the source code of the QEMU component digital model; Step 1 specifically includes:

[0039] During the compilation process, the toolchain adapter module collects build information by directly running or simulating the build of Makefile, based on the fact that the QEMU component digital model uses the Makefile compilation toolchain, and obtains the list of source files to be analyzed, the compilation options of the source files, the header file search path, and the key information of predefined macros. This information is crucial for the analysis phase. In this way, the entire project of the QEMU component digital model can be completely and automatically analyzed.

[0040] The source code to be tested is obtained by combining the source file list, the compilation options of the source files, the header file search path and the predefined macro key information.

[0041] The source code to be detected replaces the predefined macros and header file inclusions with the original code according to the header file search path and predefined macro key information, and then forms a complete source code to be detected. The complete source code to be detected is scanned and the source code file is converted into AST.

[0042] The characteristics of the digital model of QEMU components are analyzed through the detection rule set configuration module. Combined with some existing rule sets, a set of detection rules suitable for QEMU components is organized and constructed. The detection rules include source code defect rule definition, symbolic execution technology, GJB-8114, MisraC2012, CWE and self-defined rules. These rules cover common defect types, such as memory management, type safety, pointer use, coding standards, array overflow and underflow, integer overflow, improper memory buffer operation restrictions, double pointer release, null pointer dereference, use of released resources, resources not released at the end of the life cycle, dynamically allocated space not released, division by zero error, dead code, unsafe API calls and floating-point loop variables.

[0043] There are four main ways to detect source code defects: a matching method based on an abstract syntax tree, a matching method based on preprocessing, a matching method based on file unit statistics, and a custom matching method based on lexical analysis. The embodiment of the present application specifically discloses a defect detection method based on abstract syntax tree matching.

[0044] Step 2: Based on the abstract syntax tree of the source code and according to the definition of the source code defect rule, match the source code defect in the QEMU component digital model; Step 2 is performed by the source code defect detection module based on rule matching, which specifically includes:

[0045] Use the abstract syntax tree to build the matching object corresponding to the source code, combine the class implemented by the matching object with the source code defect rule to match, and obtain the source code defect detected based on the abstract syntax tree:

[0046] Defect detection based on abstract syntax tree matching is mainly divided into two parts: one is the implementation of the matching mechanism, and the other is the implementation of the matching object. The implementation of the matching mechanism is implemented by the abstract syntax tree matcher through the registration mechanism, and the implementation of the matching object mainly includes the declaration class Decl, the statement class Stmt, the type class QualType and the TypeLoc class. Detection based on the abstract syntax tree is currently more inclined to rule matching. One disadvantage of this detection method is that they only match one point on the abstract syntax tree, and some rules need to refer to other related features of the entire file unit to make a judgment.

[0047] Preprocessing instructions are an important part of C language. Preprocessing statements are processed by the preprocessor before the lexical analysis stage, so they cannot be analyzed based on the abstract syntax tree. In the process of scanning the complete source code to be detected, when scanning the #if and #endif preprocessing statements, the register PPCallbacks class in the preprocessor in the analysis engine is called, and the overloaded function for preprocessing instructions added by the registerPPCallbacks function in the preprocessing stage is used to detect source code defects based on preprocessing instructions.

[0048] Based on the matching method of file unit statistics, two functions onStartOfTranslationUnit and onEndOfTranslation-Unit are defined, which are run when entering and ending a file unit respectively;

[0049] When analyzing the file unit in the source code, the onStartOfTranslationUnit function is used to initialize and allocate storage space when entering the file unit, and statistics are performed and written to the storage space when performing abstract syntax tree matching; when the file unit analysis ends, the onEndOfTranslationUnit function is called, and analysis is performed based on the content in the storage space to obtain source code defects based on file unit statistical detection.

[0050] Although the above has achieved relatively complete rule-based detection, many source code features that are not convenient to abstract or have not yet been abstracted also need to be detected. Therefore, in the process of scanning the complete source code to be detected, an interface for obtaining the original text of the source code is reserved in the lexical analysis stage. The original text lexical detection is performed through the interface to obtain source code defects based on lexical analysis. Defects of source code features that are not convenient to abstract or have not yet been abstracted can be detected.

[0051] Step 3: Generate an extension graph of the program based on the source code, and perform path dependency analysis on the source code in combination with symbolic execution technology to detect potential source code defects that depend on the execution path;

[0052] Step 3 is performed by a source code defect detection module based on symbolic execution, specifically including:

[0053] The execution is simulated according to the execution mode of the source code, the extended diagram of the program is generated based on the AST and control flow graph, the value range and constraints of the symbolic value and conditional expression are recorded and updated, and potential complex defects are detected through constraint solving of path conditions. Symbolic execution technology can analyze the execution path of the program more deeply, especially in multi-branch paths to find potential logical vulnerabilities and security issues. For example, defects such as array overflow and underflow, double release of pointers, and resources not released at the end of the life cycle.

[0054] In the embodiment of the present application, a ternary modeling method is used to track the record and update status of symbolic values, better represent the relationship between expression, memory object and value, and adopt a unified and complete representation form, so that the symbolic execution engine can simulate the execution status of the program more realistically. For example, for an expression, a triple is used to explain it: Expression, Memory Object and Value.

[0055] In programming languages, an expression is a textual representation of a variable name, operation, or operation in a program. An expression can represent an object in memory when the program is running. This type of expression is called an l-value expression, which can be assigned or modified.

[0056] A memory object can be a variable, an array, an array element, a structure, a field of a structure, a dynamically allocated memory block, etc. In static analysis, the concept of "region" is used to represent memory objects. A region is an abstract representation of a memory object, because a memory object always occupies a continuous region in the address space. In addition, when performing static analysis, it is necessary not only to know the correspondence between expressions and regions, but also to know the structural relationship between regions, or the hierarchical relationship. For example, the region of an array is originally composed of the regions of all its elements. However, for the array itself, all its elements are represented by different regions. At the same time, since the region of an array element is subordinate to the region of the array, a parent-child relationship is established between regions, and the parent region of the array element is the array region. For the stack, heap, and static storage needed in the program, three regions (stack region, heap region, and static region) are also used to represent it. In this way, if the array is a local array, its parent region is the stack region. This not only represents the relationship between expressions and regions, but also the hierarchical relationship between regions, providing deeper support for the symbolic execution engine.

[0057] Value refers to the value stored in the memory. These values ​​are divided into two categories: one is to describe the memory address, called location value, and the rest are to describe ordinary values, called non-location values. For location value, the location value is the starting address of the pointer. According to the corresponding type, the value of its storage object can be read. For non-location value, according to the corresponding type, it is the value of the expression.

[0058] Step 4 detects the source code through the deep learning model to obtain the detection result, and confirms whether the source code defects in steps 2 and 3 are correct according to the detection result. Step 4 is performed through the source code defect detection and confirmation module based on deep learning.

[0059] After using static analysis technology for defect detection, a large number of potential defect reports are often generated, but some of them may be "false alarms". This application uses a deep learning model to confirm the defects detected by the rule matching and symbolic execution detection modules to further reduce the false alarm rate.

[0060] In this application, a large domain model for source code defect detection (Code-Bugs-Confirmation / Detection–Large Language Model, CBCD-LLM) is designed. This model adopts the basic architecture of encoder-decoder, with the input being the source code content and the output being the source code defect confirmation or detection information.

[0061] Before the model training phase, we first build a high-quality data set. The data sources are public code repositories (such as GitHub), internal corporate code repositories, open source projects, Juliet test sets, and QEMU-related test codes. Then we perform data screening, data labeling, data enhancement, and training data set construction. The labeled data is divided into training sets, validation sets, and test sets according to a certain ratio. For a complete code segment, there are often only a few lines with defects, and the rest of the code is correct. Therefore, for defective code samples, their corresponding weights need to be adjusted to avoid model bias. In addition, the recursive feature elimination method (RFE) and the improved lion group optimization algorithm (ILSO-BP) are combined to effectively improve the detection accuracy. Then, training and enhancement are performed based on the data set. Through training with a large amount of code data, the CBCD-LLM model can detect and confirm more complex code patterns and potential security issues.

[0062] This model uses the Transformer architecture model as the basic architecture. The specific implementation is as follows Figure 2 shown.

[0063] For the input embedding layer, the input of the encoder and decoder first passes through the embedding layer to convert the code into a vector representation, which can capture the semantic relationship between contexts, as well as the complex patterns and potential grammatical rules in the code.

[0064] The multi-head attention layer mechanism enables each token to pay attention to other tokens in the input sequence, thereby better understanding the context. Multi-head attention allows the model to focus on different parts on multiple different "heads", thereby improving the model's ability to capture multiple aspects of information.

[0065] The masked multi-head attention layer is used to ensure that the model can only see the previous token when predicting the next token. This mechanism ensures that the decoder does not "peek" at future tokens, making the generation process autoregressive.

[0066] Residual connections and layer normalization make the model more stable and accelerate training. Residual connections allow information to bypass certain layers to avoid the gradient vanishing problem; layer normalization allows the model to converge faster.

[0067] The feedforward neural network layer provides nonlinear transformation for the output of each position, making the model more expressive. The feedforward layer consists of two fully connected layers with an activation function in between.

[0068] For the linear layer and SoftMax activation function of the decoder, at the end of the decoder, after being processed by the previous layers, the generated output undergoes linear transformation and SoftMax activation function to generate the probability distribution of each Token on the Token table. Based on this probability distribution, the next Token is selected to gradually generate the output sequence.

[0069] Both the encoder and the decoder are composed of multiple identical stacked layers (the part represented by Nx), usually containing 6 to 12 layers. As the number of layers increases, the expressive power of the model increases.

[0070] The role of output embedding is to convert the internal representation of the model into natural language output. It is a bridge between the semantic space of the model and the actual vocabulary space, allowing the model to output grammatically and semantically coherent text through the decoder.

[0071] This application has experimentally proved that for the source code defects of QEMU component models, source code defect detection based on rule matching engine and symbolic execution engine is used, and confirmed by deep learning model CBCD-LLM, compared with the detection results of TestBed, the accuracy rate is improved by 13.5%. At the same time, by using the deep learning model CBCD-LLM to directly detect defects in the source code, the detected defects are merged with the above-mentioned confirmed defects. Through analysis, the recall rate of this application for QEMU component model detection is improved by 7.3% compared with TestBed.

[0072] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. An intelligent detection method for QEMU component digital models, characterized in that: include: Step 1, obtain the source code of the QEMU component digital model; Step 2: Based on the abstract syntax tree of the source code and according to the definition of the source code defect rule, match the source code defects in the QEMU component digital model; Step 3: Generate an extension graph of the program based on the source code, and perform path dependency analysis on the source code in combination with symbolic execution technology to detect potential source code defects that depend on the execution path; Step 4 detects the source code through the deep learning model to obtain the detection results, and confirms whether the source code defects in steps 2 and 3 are correct based on the detection results.

2. The intelligent detection method for the QEMU component digital model according to claim 1 is characterized in that: The step 1 specifically includes: During the compilation process, based on the fact that the QEMU component digital model uses the Makefile compilation tool chain, the build information is collected by directly running the Makefile or simulating the build to obtain the list of source files that need to be analyzed, the compilation options of the source files, the header file search path, and the key information of the predefined macros; Acquire the source code to be tested by combining the source file list, source file compilation options, header file search path and predefined macro key information; The source code to be tested replaces the predefined macros and header file inclusions with the original code according to the header file search path and predefined macro key information, and then forms a complete source code to be tested. The complete source code to be tested is scanned and the source code file is converted into an abstract syntax tree AST.

3. The intelligent detection method for the QEMU component digital model according to claim 2 is characterized in that: The step 1 also includes: The characteristics of the digital models of QEMU components are analyzed, and a set of detection rules suitable for QEMU components is organized and constructed in combination with some existing rule sets.

4. The intelligent detection method for the QEMU component digital model according to claim 1 is characterized in that: The step 2 specifically includes: Use the abstract syntax tree to build the matching object corresponding to the source code, combine the class implemented by the matching object with the source code defect rule to match, and obtain the source code defect detected based on the abstract syntax tree: In the process of scanning the complete source code to be detected, when scanning the #if and #endif preprocessing statements, the registered PPCallbacks class in the preprocessor in the analysis engine is called, and the overloaded function for the preprocessing instructions added by the registerPPCallbacks function in the preprocessing stage is used to obtain the source code defects detected based on the preprocessing instructions; when analyzing the file unit in the source code, the onStartOfTranslationUnit function is used to initialize and allocate storage space when entering the file unit, and statistics are performed and written to the storage space when performing abstract syntax tree matching. When the file unit analysis is ended, the onEndOfTranslationUnit function is called, and analysis is performed based on the content in the storage space to obtain the source code defects detected based on the file unit statistics; During the scanning of the complete source code to be tested, an interface for obtaining the original text of the source code is left in the lexical analysis stage. The original text lexical structure is tested through the interface to obtain source code defects based on lexical analysis.

5. The intelligent detection method for QEMU component digital model according to claim 1, characterized in that: The step 3 specifically includes: Simulate execution according to the source code execution mode, generate the program extension graph based on AST and control flow graph, record and update the value range and constraints of symbolic values ​​and conditional expressions, and detect potential complex defects through constraint solving of path conditions.

6. The intelligent detection method for the QEMU component digital model according to claim 5 is characterized in that: The record and update status of symbol values ​​are tracked by ternary modeling.

Images