Code vulnerability intelligent processing method and system combined with static analysis

Abstract

The invention provides an intelligent code vulnerability processing method and system combined with static analysis, and relates to the technical field of data processing.The method comprises the steps that version information of a project code library is collected, and a code scanning data set is obtained; obtaining structure information of the project code library, wherein the structure information comprises module distribution information and file dependence information; safety analysis data is generated to control a safety monitoring device to operate, and safety monitoring data is obtained; performing vulnerability continuous detection through the static analysis channel, and outputting a vulnerability continuous detection result; inputting a vulnerability management feedback model, outputting repair control data, and performing vulnerability repair execution; and through matching of the code scanning data set and the repair control data, obtaining vulnerability repair parameters, and performing vulnerability repair of the project code library. According to the method and the device, the technical problem that in the prior art, the code vulnerability processing accuracy is insufficient due to the fact that the dynamic adjustment capability of the code context is lacked and misinformation or missing report is easily generated in the detection process is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a method and system for intelligently processing code vulnerabilities in combination with static analysis. Background Art

[0002] In modern software development, as the size and complexity of code increases, the management of code vulnerabilities has become a core issue in software quality assurance and security. Code vulnerabilities may lead to sensitive data leakage, system downtime, or even malicious attacks, posing a serious threat to the interests of enterprises and users. Therefore, code vulnerability detection and repair technology has become an important research direction in the field of information security. However, underreporting usually occurs in complex code logic, such as when the code is modular and the dependencies are intricate. Traditional code vulnerability detection relies on rules and pattern matching, which makes the detection results lack code context information and difficult to determine the actual impact scope of the vulnerability. For example, some vulnerabilities may spread across modules, but the detection tool can only focus on a single module or file, which makes it easy to generate false positives or underreporting during the detection process, which in turn leads to a decrease in the accuracy of code vulnerability processing. Summary of the invention

[0003] This application provides a method and system for intelligently processing code vulnerabilities in combination with static analysis, aiming to solve the technical problem that the prior art lacks the ability to dynamically adjust the code context, which makes it easy to generate false positives or missed positives during the detection process, thereby resulting in insufficient accuracy in code vulnerability processing.

[0004] The first aspect disclosed in the present application provides an intelligent code vulnerability processing method combined with static analysis, the method comprising: collecting version information of a project code library through a data interaction interface to obtain a code scanning data set; obtaining structural information of the project code library, wherein the structural information includes module distribution information and file dependency information; generating security analysis data based on the code scanning data set and the structural information, controlling the operation of a security monitoring device through the security analysis data, and obtaining security monitoring data; performing continuous vulnerability detection on the security monitoring data through a static analysis channel, and outputting continuous vulnerability detection results; inputting the continuous vulnerability detection results and the structural information into a vulnerability management feedback model, outputting repair control data, and performing vulnerability repair execution through the repair control data; obtaining vulnerability repair parameters by matching the code scanning data set with the repair control data, and repairing the vulnerabilities of the project code library through the vulnerability repair parameters.

[0005] The second aspect disclosed in the present application provides a code vulnerability intelligent processing system combined with static analysis, the system is used for the above-mentioned code vulnerability intelligent processing method combined with static analysis, and the system includes: a version information collection unit, which is used to collect version information of a project code library through a data interaction interface to obtain a code scanning data set; a structure information acquisition unit, which is used to obtain structure information of the project code library, wherein the structure information includes module distribution information and file dependency information; a monitoring data acquisition unit, which is used to generate security analysis data based on the code scanning data set and the structure information, and control the operation of a security monitoring device through the security analysis data to obtain security monitoring data; a vulnerability continuous detection unit, which is used to perform continuous vulnerability detection on the security monitoring data through a static analysis channel and output a continuous vulnerability detection result; a vulnerability repair execution unit, which is used to input the continuous vulnerability detection result and the structure information into a vulnerability management feedback model, output repair control data, and perform vulnerability repair through the repair control data; a code library vulnerability repair unit, which is used to obtain vulnerability repair parameters by matching the code scanning data set with the repair control data, and repair vulnerabilities in the project code library through the vulnerability repair parameters.

[0006] One or more technical solutions provided in this application have at least the following beneficial effects:

[0007] By collecting version information of the project code base through the data interaction interface and combining it with the structural information of module distribution and file dependencies, it provides a global perspective and fine-grained contextual support for vulnerability detection, thereby improving the accuracy of detection and avoiding false positives or omissions due to lack of contextual information; by fusing the code scanning data set and structural information to generate targeted security analysis data, it can focus on high-risk areas and reduce redundant work in security analysis. It can also control the operation of security monitoring devices through security analysis data to achieve dynamic monitoring of the runtime status of the code, further capture potential problems that are difficult to detect with static analysis, and provide efficient and secure real-time monitoring capabilities; it continuously detects security monitoring data through the static analysis channel and outputs continuous vulnerability detection results, thus achieving continuity and automation of vulnerability detection and enabling real-time scanning of new code or changed parts to reduce It reduces omissions and improves the timeliness of vulnerability detection, ensuring that the security status of the project code base is always within a controllable range; the continuous vulnerability detection results and structural information are combined into the vulnerability management feedback model, and new problems are avoided during the repair process according to the module distribution and file dependency information. The feedback model is used to classify and prioritize vulnerabilities, clarify the urgency and scope of repairs, and automatically generate repair control data to reduce the workload of manual vulnerability analysis and improve the efficiency of vulnerability repair; by matching the code scanning data set and the repair control data, vulnerability repair parameters are generated, and finally vulnerability repair is executed. This data-driven matching method can generate the most appropriate repair parameters according to the actual situation of the code base, ensure the accuracy of the repair measures, and through the guidance of the repair parameters, it can quickly locate the problem code and repair location, reducing duplication of work in the repair process.

[0008] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 A flowchart of a method for intelligently processing code vulnerabilities in combination with static analysis provided in an embodiment of the present application.

[0010] Figure 2 A schematic diagram of the structure of a code vulnerability intelligent processing system combined with static analysis provided in an embodiment of the present application.

[0011] Explanation of the accompanying drawings: version information collection unit 10, structure information acquisition unit 20, monitoring data acquisition unit 30, vulnerability continuous detection unit 40, vulnerability repair execution unit 50, code base vulnerability repair unit 60. DETAILED DESCRIPTION

[0012] The embodiments of the present application provide a method and system for intelligently processing code vulnerabilities in combination with static analysis, thereby solving the technical problem that the prior art lacks the ability to dynamically adjust the code context, which makes it easy to generate false positives or missed positives during the detection process, thereby leading to insufficient accuracy in code vulnerability processing.

[0013] After introducing the basic principles of the present application, various non-limiting implementation methods of the present application will be specifically introduced below in conjunction with the accompanying drawings of the specification. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0014] Embodiment 1, as Figure 1 As shown, the embodiment of the present application provides a method for intelligently processing code vulnerabilities combined with static analysis, the method comprising:

[0015] The version information of the project code base is collected through the data interaction interface to obtain the code scanning data set.

[0016] The data interaction interface is an API or an automated tool that interacts with the version control system of the project code base and extracts version information of the project code base, including historical versions, current versions, branch information, etc. The data interaction interface extracts the project's version number, submission records, code update history and other information. These data help to understand the changing trend of the code base. Based on the collected version information, a set of all relevant code change data is generated, namely the code scanning data set. These data include the original code, the changed code, the code modification type (such as addition, deletion, modification), etc. This part of the data provides the original code scanning information for subsequent static analysis.

[0017] The structural information of the project code base is obtained, wherein the structural information includes module distribution information and file dependency information.

[0018] The structure of a project usually consists of multiple modules. Module distribution information refers to the division of each module in the project and its location. This information is obtained by parsing the directory structure of the project. For example, each folder or subdirectory in the directory can be regarded as a module, and the code file under the folder is the specific implementation of the module. If the project uses a framework, the division of project modules can also be determined through the framework's configuration file.

[0019] File dependency information is used to determine the relationship between code files. Usually, code files depend on each other through calls, references, or shared variables. File dependencies can be generated by static analysis tools. For example, the code of a module may depend on functions or classes in another module. Dependency information includes direct dependencies and indirect dependencies, as well as calling relationships between files. For example, a code dependency graph can be generated by a static analysis tool, which helps to identify the degree of coupling between modules.

[0020] The overall architecture diagram of the project code base is generated by combining module distribution information and file dependency information. For example, a large project consists of multiple microservice modules, each of which has a specific set of file dependencies. Through this structural information, the complexity, modularity and maintainability of the project can be analyzed and evaluated.

[0021] Security analysis data is generated based on the code scanning data set and the structural information, and the operation of the security monitoring device is controlled by the security analysis data to obtain security monitoring data.

[0022] Security analysis data is generated by combining the code scanning data set and the structural information of the project. The security analysis data includes risk assessment, location of potential vulnerability points, identification of sensitive code fragments, etc. The security analysis data can be assisted by the security vulnerability database. Security monitoring devices are configured and controlled based on security analysis data. The security monitoring devices can be software or hardware, such as intrusion detection systems, application behavior monitoring tools, etc. For example, monitoring rules and thresholds are set according to the security analysis data, such as setting which types of behaviors or code patterns should trigger alarms.

[0023] The security monitoring device continuously monitors code execution and application behavior according to the configured rules, and captures data that conforms to the preset patterns. The collected security monitoring data includes but is not limited to abnormal access patterns, unauthorized data access, suspicious network requests, etc.

[0024] The security monitoring data is continuously tested for vulnerabilities through a static analysis channel, and the continuous vulnerability detection results are output.

[0025] The static analysis channel is an analysis process that conducts in-depth analysis of the collected monitoring data to identify potential vulnerabilities or unsafe programming patterns in the code. This channel uses static analysis tools such as Sonar Qube, combined with custom security rules and vulnerability pattern databases for analysis.

[0026] Through a continuous detection process, newly collected data is constantly analyzed and compared with existing vulnerability indicators to discover new or recurring security vulnerabilities. During the detection process, special attention is paid to new vulnerabilities introduced by code changes and old vulnerabilities that have not been fixed in historical versions of the code base. The obtained continuous vulnerability detection results clearly indicate which code files, lines or modules contain potential security vulnerabilities, as well as vulnerability types, severity and other information for subsequent code corrections.

[0027] The vulnerability continuous detection result and the structural information are input into a vulnerability management feedback model, and repair control data is output, and vulnerability repair is performed through the repair control data.

[0028] The vulnerability management feedback model is a data-based decision support system. It can be a rule-based system or use machine learning technology. The model analyzes the input data, evaluates the pros and cons of different repair strategies, and generates the best or most suitable repair control data, including specific repair instructions, priority sorting, resource allocation suggestions, etc., to guide developers or automated tools to repair vulnerabilities. Based on the generated repair control data, specific code modifications, configuration adjustments, or other repair activities are performed to reduce the impact of vulnerabilities on the project and improve the overall security of the software.

[0029] The code scanning data set is matched with the repair control data to obtain vulnerability repair parameters, and the vulnerability repair of the project code base is performed using the vulnerability repair parameters.

[0030] Matching refers to the comparative analysis of the code scanning data set and the repair control data to find the appropriate repair plan and the code part that needs to be repaired, ensure that the repair control data is consistent with the actual situation of the code base, and obtain the vulnerability repair parameters after matching. The vulnerability repair parameters are specific data, including the location of the repair code, the specific content of the modification, the required test steps, etc., which are used to guide how to modify the code, update the configuration, or change the dependency to repair the identified vulnerability.

[0031] Using the obtained vulnerability repair parameters, modify the code base, which can be done through automated tools, such as the automatic submission function of the version control system. After the repair, it is usually necessary to rerun the test to verify whether the repair is effective and to ensure that no new errors are introduced. Through the above steps, not only the repair process is optimized, but also the repair quality is improved. The accuracy and effectiveness of the repair strategy are ensured through the data-driven feedback mechanism.

[0032] Furthermore, the method of inputting the vulnerability continuous detection result and the structure information into a vulnerability management feedback model further includes:

[0033] A data preprocessing module is constructed, wherein the data preprocessing module is set with a risk rating threshold; when the vulnerability continuous detection result and the structural information are input into a vulnerability management feedback model, the fluctuation trend of the vulnerability continuous detection result is evaluated by the risk rating threshold, and a risk node identifier is generated; code security continuous detection feature points are generated according to the risk node identifier, and the data preprocessing module completes preprocessing of the vulnerability continuous detection result, and the code security continuous detection feature points are input into the vulnerability management feedback model as feature data.

[0034] The main function of the data preprocessing module is to standardize and clean the input data, ensure the quality and consistency of the data, and provide accurate input for subsequent analysis. Preprocessing includes removing duplicate data, filling missing values, formatting date and time tags, converting data types, etc. The data preprocessing module is set with risk rating thresholds to distinguish the severity and urgency of vulnerabilities. These thresholds can be set based on factors such as the potential impact of the vulnerability, the possibility of exploitation, and the complexity of the attack. The risk threshold can be a fixed value set in advance or adjusted according to the actual security status of the project.

[0035] Fluctuation trend assessment refers to analyzing the frequency, change patterns, and severity trends of vulnerabilities, which helps identify which vulnerabilities persist or change, and which vulnerabilities may cause new risks due to new code submissions. Risk node identification is generated through fluctuation trend assessment. Risk node identification refers to the location or type of vulnerability that exceeds the threshold and has potential high risk. These identifications are unique identifiers of the vulnerability, the name of the relevant module, or the line number of code, which are used to quickly locate and prioritize in subsequent repairs and management.

[0036] Code security continuous detection feature points are key attributes extracted from vulnerability detection data, such as the frequency of vulnerability occurrence, the code modules involved, the functions affected, etc. These feature points can represent the key characteristics of the vulnerability. Through the identified risk nodes, we can determine which features are particularly important in the analysis and generate code security continuous detection feature points. Preprocess the vulnerability continuous detection results, including data cleaning and formatting, as well as normalizing the data to make the scale of the feature points consistent, which is convenient for comparison and calculation in the model.

[0037] The pre-processed code security continuous detection feature points are passed as input data to the vulnerability management feedback model. These feature points help the model understand the nature and context of the vulnerability, so as to more accurately evaluate the repair plan. In this way, the vulnerability management feedback model can operate based on more precise and detailed data, thereby improving the efficiency and effectiveness of vulnerability repair.

[0038] Furthermore, the method of inputting the code security continuous detection feature points as feature data into the vulnerability management feedback model further includes:

[0039] The vulnerability continuous detection results are segmented according to the risk node identifier to obtain segmented results; the vulnerability risk average value of each segmented result in the segmented results is calculated; a segmented feature value is generated according to the segmented results and the vulnerability risk average value; the segmented feature value and the code security continuous detection feature point are input into the vulnerability management feedback model as feature data.

[0040] Risk node identification is used as the segmentation standard, that is, vulnerabilities are classified according to their severity, type or module where they occur, so as to divide the vulnerabilities into different sections. For example, they can be segmented according to the vulnerability type (such as SQL injection, cross-site scripting, etc.) or the affected system part (such as user interface, database access, etc.). The purpose of segmentation is to classify vulnerabilities into groups with similar characteristics for more targeted analysis and processing.

[0041] The average value of vulnerability risk is calculated for each segmentation result to quantify the average risk level of each group of vulnerabilities. Specifically, risk assessment is performed based on factors such as vulnerability severity, scope of impact, and possibility of exploitation. Each vulnerability usually has one or more risk ratings associated with it. Based on the risk assessment results, the average value of all vulnerability risk ratings in the segment is calculated to obtain the average risk level of the segment. This average value indicates the severity of the vulnerabilities in each segment and determines which segments need to be prioritized.

[0042] The segment characteristic value is a comprehensive description of each segment, including the statistical information of the segment vulnerabilities and quantitative indicators of risk attributes. The characteristic value can be a single numerical value, such as a risk-weighted value. For example, the segment characteristic value is generated by weighted calculation, such as calculating the product of the risk average value and the number of vulnerabilities in the segment, and then adding the product to the volatility of the segment risk. The calculation result is used as the segment characteristic value. This calculation process reflects the overall importance and risk concentration of the vulnerabilities in the segment.

[0043] The segmentation feature value is used as a macro indicator of the segmentation result to describe the overall risk characteristics of the vulnerability, and the code security continuous detection feature point is used as a more fine-grained feature data to capture the characteristics of the vulnerability at the specific code line or module level. Integrating these two types of data as the input data of the model can focus on the vulnerability characteristics at both the macro and micro levels, allowing the model to make a more comprehensive judgment.

[0044] Furthermore, the method comprises:

[0045] Code segment vulnerability data detection is performed through the static analysis channel to obtain code segment vulnerability data; matching analysis is performed on the code segment vulnerability data and the code scanning data set to obtain a matching result; it is determined whether the matching result is within a preset deviation range; when the matching result is not within the preset deviation range, warning data is generated to perform an abnormal warning.

[0046] The static analysis channel is a set of preset tools used to analyze the structure and logic of the code before it is run to discover potential vulnerabilities. Specifically, before analysis, the code base is divided into multiple code segments according to logical or physical units (such as classes, modules, files, functions, etc.) to facilitate segment-by-segment detection. The code syntax, function calls, variable definitions, input and output, etc. of each code segment are scanned. Through the static analysis channel, potential problems that match known vulnerability patterns are identified, such as SQL injection, cross-site scripting attacks, unvalidated user input, etc. The vulnerability data of the code segment is output through analysis, including vulnerability type, risk level, location (code line number or file path), scope of impact, etc.

[0047] Use file path, code line number, function name and other information to match code segment vulnerability data and code scan data set, check whether the vulnerability belongs to the file or module identified in the scan data set, if the vulnerability data matches a certain code segment in the scan set, then confirm the location and scope of the vulnerability; if the vulnerability data does not match the scan set, it may be an analysis error or inconsistent code version, which requires further verification. Furthermore, through the matching results, determine the module, file, function and its dependencies to which the vulnerability belongs, and determine whether the vulnerability was introduced by a certain submission or change of the code, so as to further verify the accuracy of the vulnerability and exclude false positive data that does not conform to reality. Through matching analysis, ensure the accuracy and contextual integrity of vulnerability detection results, and exclude possible false positives through matching analysis, and provide reliable data support for subsequent repair steps.

[0048] The preset deviation range refers to the error or difference allowed between the code segment vulnerability data and the code scanning data set. The standard for the preset deviation range can be based on the code version change, that is, judging whether the difference between the code segment vulnerability and the corresponding code version is within a reasonable range, such as the position offset of the code segment, the line number change, etc.; or based on the vulnerability detection error, that is, allowing a certain range of vulnerability type or position offset false alarms.

[0049] The matching results are judged based on the preset deviation range, including file path consistency judgment, that is, judging whether the file where the vulnerability is located is consistent with the path recorded in the scan data set; code line number offset judgment, that is, judging whether the line number of the vulnerability detected exceeds the offset range allowed in the code version update, such as 10 lines above or below; module consistency judgment, that is, judging whether the module or component to which the vulnerability belongs still conforms to the records in the code scan data set.

[0050] If the matching result is within the preset range, it is determined that the vulnerability detection data is consistent with the scan data and the match is normal; if the matching result exceeds the preset range, there may be a detection anomaly or code version problem, which requires further processing.

[0051] When the matching result exceeds the deviation range, the abnormal warning mechanism is triggered to prompt potential problems and guide subsequent investigation and repair. Specifically, warning data is generated, which is a detailed description of the deviation range, including unmatched vulnerability information, such as vulnerability type, file path, line number, etc.; specific indicators of deviation, such as inconsistent file paths, line number offsets exceeding the range, etc.; context data, including code version information, module dependencies, detailed output of vulnerability detection tools, etc., for auxiliary analysis.

[0052] Abnormal warnings are issued based on the warning data. The warnings can be notified to the relevant persons in charge through the console, email, alarm system, etc., prompting the developers or security team to match the problems. Through abnormal warnings, the accuracy of vulnerability detection and matching processes can be improved, potential abnormalities can be discovered and corrected in time, and reliable data support can be provided for subsequent vulnerability repair and management.

[0053] Furthermore, the method for determining whether the matching result is within a preset deviation range further includes:

[0054] When the matching result is within the preset deviation range, a control influence coefficient is generated according to the deviation value; a weighted calculation is performed on the code scanning data set according to the control influence coefficient to obtain a weighted calculation result; and the vulnerability repair parameter is obtained by matching the weighted calculation result with the repair control data.

[0055] When the matching result is within the allowed deviation range, the control impact coefficient is generated by calculating the deviation value, which is used to adjust the priority or strength of vulnerability repair. Specifically, the deviation value is a quantitative indicator of the difference between the matching result and the standard expectation, such as calculating the similarity score of the file path, that is, the proportion of the consistent part in the matching path, or calculating the module matching consistency, that is, scoring according to the matching degree of dependency or module name. The smaller the calculated deviation value, the closer the match is to the ideal state; the larger the deviation value, the lower the credibility of the match.

[0056] The control impact coefficient is a weight coefficient calculated based on the deviation value, which is used to adjust the priority or importance of vulnerability data in subsequent weighted calculations. If the deviation value is close to 0, the control impact coefficient is close to 1, indicating that the credibility of the matching result is high; if the deviation value is close to the maximum allowable deviation value, the control impact coefficient is close to 0, indicating that the importance of the matching result is low.

[0057] The vulnerability data in the code scanning data set are weighted and adjusted according to the control impact coefficient. These data include the risk score of the vulnerability, the impact range of the vulnerability, the complexity of vulnerability repair, etc. The weight of the vulnerability data is adjusted according to the control impact coefficient. The weighted calculation result reflects the importance of the vulnerability in the current context. The weighted result serves as an important basis for subsequent repair decisions to ensure that more attention is paid to high-priority vulnerabilities.

[0058] The weighted calculation results are matched with the repair control data to determine the specific vulnerability repair parameters. For example, vulnerabilities with high weighted risk values ​​are assigned higher repair priorities, and vulnerabilities with lower repair complexity are repaired first to quickly reduce security threats in the system. The vulnerability repair parameters finally generated are used to guide the execution of vulnerability repair tasks. Through these steps, the vulnerability repair process achieves data-driven optimization and precise control, ensuring that limited repair resources are used first for the most important and urgent vulnerability issues, thereby improving system security and repair efficiency.

[0059] Furthermore, the method further comprises:

[0060] Perform security testing on the project code base to generate security testing results; build a feedback adjustment module based on the security testing results; and optimize the execution of vulnerability repair parameter matching through the feedback adjustment module.

[0061] Scan the project code base to implement security testing, including code quality testing to detect potential security vulnerabilities, inefficient or dangerous code implementations; dependency risk testing to detect whether there are known vulnerabilities in third-party libraries or dependencies introduced in the project based on the vulnerability database; configuration problem detection to detect whether there are configuration file leaks, key hardcoding or insecure default configurations; and permission problem detection to detect whether there is insecure permission control logic in the code.

[0062] Based on the security test results, a feedback adjustment module is built to dynamically adjust vulnerability repair parameters and optimize repair strategies, such as giving priority to repairing high-risk vulnerabilities and concentrating on the vulnerabilities of a certain module. Specifically, the distribution and risk level of vulnerabilities are determined based on the security test results, and the key points of repair are identified, such as which module or file has the most vulnerabilities and the highest risk. The priority rules of repair parameters are adjusted according to the test results, such as increasing the priority of high-risk vulnerabilities, and merging repair steps when repairing similar vulnerabilities to improve efficiency. The feedback adjustment logic is implemented through the rule engine to complete the construction of the feedback adjustment module.

[0063] The feedback adjustment module outputs optimized repair suggestions, including updated repair priorities, resource allocation strategies, execution order, etc., and adjusts and matches vulnerability repair parameters according to the repair suggestions to ensure more efficient and accurate repair execution. The above steps form a closed-loop vulnerability management and repair process, from comprehensive detection to dynamic adjustment, and then to efficient repair, ensuring that the security of the code base is continuously improved.

[0064] Furthermore, the method further comprises:

[0065] A code monitoring feedback window is set; it is determined whether there are abnormal vulnerability detection results in the code monitoring feedback window; when there are abnormal vulnerability detection results in the code monitoring feedback window, abnormal warning information is generated, and abnormal vulnerability warnings in the project code base are performed through the abnormal warning information.

[0066] Set a code monitoring feedback window. The feedback window can be based on a time range, such as the code detection results in the last week, month, or a certain iteration cycle, or it can be based on the code version control range, such as from the last submitted version to the current version. It can be flexibly set according to the project's development cycle, release rhythm, or risk management requirements, and is used to continuously analyze the code vulnerability detection results.

[0067] Define abnormal criteria, such as quantity abnormality, that is, the number of vulnerabilities suddenly increases significantly, such as the number of new vulnerabilities in a certain window is significantly higher than the normal range; or severity abnormality, that is, the proportion of high-risk vulnerabilities increases abnormally; or repetitive abnormality, that is, the same type of vulnerability appears repeatedly, indicating that the repair measures may be ineffective.

[0068] Compare the vulnerability data in the current window with the historical average or benchmark value to determine whether it exceeds the preset threshold. If the number, severity and distribution of vulnerabilities are all within the normal range, the detection result is judged to be normal; if the detection result exceeds the preset threshold or the trend deviates significantly, it is judged to be abnormal.

[0069] When there are abnormal vulnerability detection results in the code monitoring feedback window, abnormal warning information is generated, including the vulnerability type, quantity, risk score, impact range, and specific abnormal conditions of the vulnerability data, such as too rapid growth in the number of vulnerabilities, abnormal proportion of high-risk vulnerabilities, and concentration of vulnerabilities in specific modules.

[0070] Through abnormal warning information, abnormal vulnerability warnings are issued within the project code base. For example, real-time warning information is sent via email, instant messaging or alarm system to prompt developers to take timely repair measures. Through abnormal vulnerability warnings, continuous and intelligent vulnerability monitoring is achieved, which helps to timely discover and respond to potential security risks and provides strong support for project security management.

[0071] In summary, the code vulnerability intelligent processing method combined with static analysis provided by the embodiment of the present application has the following technical effects:

[0072] By collecting version information of the project code base through the data interaction interface and combining it with the structural information of module distribution and file dependencies, it provides a global perspective and fine-grained contextual support for vulnerability detection, thereby improving the accuracy of detection and avoiding false positives or omissions due to lack of contextual information; by fusing the code scanning data set and structural information to generate targeted security analysis data, it can focus on high-risk areas and reduce redundant work in security analysis. It can also control the operation of security monitoring devices through security analysis data to achieve dynamic monitoring of the runtime status of the code, further capture potential problems that are difficult to detect with static analysis, and provide efficient and secure real-time monitoring capabilities; it continuously detects security monitoring data through the static analysis channel and outputs continuous vulnerability detection results, thus achieving continuity and automation of vulnerability detection and enabling real-time scanning of new code or changed parts to reduce It reduces omissions and improves the timeliness of vulnerability detection, ensuring that the security status of the project code base is always within a controllable range; the continuous vulnerability detection results and structural information are combined into the vulnerability management feedback model, and new problems are avoided during the repair process according to the module distribution and file dependency information. The feedback model is used to classify and prioritize vulnerabilities, clarify the urgency and scope of repairs, and automatically generate repair control data to reduce the workload of manual vulnerability analysis and improve the efficiency of vulnerability repair; by matching the code scanning data set and the repair control data, vulnerability repair parameters are generated, and finally vulnerability repair is executed. This data-driven matching method can generate the most appropriate repair parameters according to the actual situation of the code base, ensure the accuracy of the repair measures, and through the guidance of the repair parameters, it can quickly locate the problem code and repair location, reducing duplication of work in the repair process.

[0073] Embodiment 2 is based on the same inventive concept as the method for intelligently processing code vulnerabilities in combination with static analysis in the previous embodiment. Figure 2 As shown, the embodiment of the present application provides a code vulnerability intelligent processing system combined with static analysis, and the system includes:

[0074] A version information collection unit 10 is used to collect version information of a project code base through a data interaction interface to obtain a code scanning data set; a structure information acquisition unit 20 is used to obtain structure information of the project code base, wherein the structure information includes module distribution information and file dependency information; a monitoring data acquisition unit 30 is used to generate security analysis data based on the code scanning data set and the structure information, control the operation of a security monitoring device through the security analysis data, and obtain security monitoring data; a vulnerability continuous detection unit 40 is used to perform continuous vulnerability detection on the security monitoring data through a static analysis channel, and output a continuous vulnerability detection result; a vulnerability repair execution unit 50 is used to input the continuous vulnerability detection result and the structure information into a vulnerability management feedback model, output repair control data, and perform vulnerability repair execution through the repair control data; a code base vulnerability repair unit 60 is used to obtain vulnerability repair parameters by matching the code scanning data set with the repair control data, and repair vulnerabilities in the project code base through the vulnerability repair parameters.

[0075] Furthermore, the system also includes a data preprocessing module to perform the following operation steps:

[0076] A data preprocessing module is constructed, wherein the data preprocessing module is set with a risk rating threshold; when the vulnerability continuous detection result and the structural information are input into a vulnerability management feedback model, the fluctuation trend of the vulnerability continuous detection result is evaluated by the risk rating threshold, and a risk node identifier is generated; code security continuous detection feature points are generated according to the risk node identifier, and the data preprocessing module completes preprocessing of the vulnerability continuous detection result, and the code security continuous detection feature points are input into the vulnerability management feedback model as feature data.

[0077] Furthermore, the system further includes a feature data acquisition module to perform the following operation steps:

[0078] The vulnerability continuous detection results are segmented according to the risk node identifier to obtain segmented results; the vulnerability risk average value of each segmented result in the segmented results is calculated; a segmented feature value is generated according to the segmented results and the vulnerability risk average value; the segmented feature value and the code security continuous detection feature point are input into the vulnerability management feedback model as feature data.

[0079] Furthermore, the system also includes an abnormal warning module to perform the following operation steps:

[0080] Code segment vulnerability data detection is performed through the static analysis channel to obtain code segment vulnerability data; matching analysis is performed on the code segment vulnerability data and the code scanning data set to obtain a matching result; it is determined whether the matching result is within a preset deviation range; when the matching result is not within the preset deviation range, warning data is generated to perform an abnormal warning.

[0081] Furthermore, the system also includes a vulnerability repair parameter generation module to perform the following operation steps:

[0082] When the matching result is within the preset deviation range, a control influence coefficient is generated according to the deviation value; a weighted calculation is performed on the code scanning data set according to the control influence coefficient to obtain a weighted calculation result; and the vulnerability repair parameter is obtained by matching the weighted calculation result with the repair control data.

[0083] Furthermore, the system further includes an execution optimization module to perform the following operation steps:

[0084] Perform security testing on the project code base to generate security testing results; build a feedback adjustment module based on the security testing results; and optimize the execution of vulnerability repair parameter matching through the feedback adjustment module.

[0085] Furthermore, the system also includes a vulnerability anomaly warning module to perform the following operation steps:

[0086] A code monitoring feedback window is set; it is determined whether there are abnormal vulnerability detection results in the code monitoring feedback window; when there are abnormal vulnerability detection results in the code monitoring feedback window, abnormal warning information is generated, and abnormal vulnerability warnings in the project code base are performed through the abnormal warning information.

[0087] Through the above detailed description of the code vulnerability intelligent processing method combined with static analysis in this specification, those skilled in the art can clearly understand the code vulnerability intelligent processing system combined with static analysis in this embodiment. Since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0088] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An intelligent code vulnerability processing method combined with static analysis, characterized in that: The method comprises: Collect version information of the project code base through the data interaction interface to obtain the code scanning data set; Obtaining structural information of the project code base, wherein the structural information includes module distribution information and file dependency information; Generate security analysis data based on the code scanning data set and the structure information, control the operation of the security monitoring device through the security analysis data, and obtain security monitoring data; Performing continuous vulnerability detection on the security monitoring data through a static analysis channel, and outputting continuous vulnerability detection results; Input the vulnerability continuous detection result and the structure information into a vulnerability management feedback model, output repair control data, and perform vulnerability repair execution through the repair control data; The code scanning data set is matched with the repair control data to obtain vulnerability repair parameters, and the vulnerability repair of the project code base is performed using the vulnerability repair parameters.

2. The method for intelligently processing code vulnerabilities in combination with static analysis according to claim 1, characterized in that: The method further comprises: inputting the vulnerability continuous detection result and the structure information into a vulnerability management feedback model; Constructing a data preprocessing module, wherein the data preprocessing module is set with a risk rating threshold; When the vulnerability continuous detection result and the structure information are input into the vulnerability management feedback model, the fluctuation trend of the vulnerability continuous detection result is evaluated by the risk rating threshold to generate a risk node identifier; Generate code security continuous detection feature points according to the risk node identifier, complete preprocessing of the vulnerability continuous detection result by the data preprocessing module, and input the code security continuous detection feature points as feature data into the vulnerability management feedback model.

3. The method for intelligently processing code vulnerabilities in combination with static analysis as claimed in claim 2, characterized in that: The method further comprises: inputting the code security continuous detection feature points as feature data into the vulnerability management feedback model; Segmenting the continuous vulnerability detection result according to the risk node identifier to obtain a segmentation result; Calculate the average vulnerability risk of each segment result in the segment results; Generate a segmentation feature value according to the segmentation result and the vulnerability risk average value; The segmented feature values ​​and the code security continuous detection feature points are input into the vulnerability management feedback model as feature data.

4. The method for intelligently processing code vulnerabilities in combination with static analysis according to claim 1, characterized in that: The method comprises: Perform code segment vulnerability data detection through the static analysis channel to obtain code segment vulnerability data; Performing matching analysis on the code segment vulnerability data and the code scanning data set to obtain a matching result; Determining whether the matching result is within a preset deviation range; When the matching result is not within the preset deviation range, warning data is generated to issue an abnormal warning.

5. The method for intelligently processing code vulnerabilities in combination with static analysis as claimed in claim 4, characterized in that: The method for determining whether the matching result is within a preset deviation range further includes: When the matching result is within the preset deviation range, generating a control influence coefficient according to the deviation value; Performing weighted calculation on the code scanning data set according to the control influence coefficient to obtain a weighted calculation result; The vulnerability repair parameter is obtained according to the weighted calculation result and the matching of the repair control data.

6. The method for intelligently processing code vulnerabilities in combination with static analysis according to claim 1, characterized in that: The method further comprises: Performing security testing on the project code base and generating security testing results; Constructing a feedback adjustment module based on the safety detection results; The feedback adjustment module is used to optimize the execution of vulnerability repair parameter matching.

7. The method for intelligently processing code vulnerabilities in combination with static analysis according to claim 1, characterized in that: The method further comprises: Set up the code monitoring feedback window; Determine whether there is an abnormal vulnerability detection result in the code monitoring feedback window; When there is an abnormal vulnerability detection result in the code monitoring feedback window, abnormal warning information is generated, and abnormal vulnerability warning in the project code base is performed through the abnormal warning information.

8. The intelligent code vulnerability processing system combined with static analysis is characterized by: The system is used to implement the method for intelligently processing code vulnerabilities combined with static analysis according to any one of claims 1 to 7, comprising: A version information collection unit is used to collect version information of a project code base through a data interaction interface to obtain a code scanning data set; A structure information acquisition unit, used to obtain the structure information of the project code base, wherein the structure information includes module distribution information and file dependency information; A monitoring data acquisition unit, configured to generate security analysis data based on the code scanning data set and the structure information, and control the operation of the security monitoring device through the security analysis data to obtain security monitoring data; A continuous vulnerability detection unit, used to perform continuous vulnerability detection on the security monitoring data through a static analysis channel and output continuous vulnerability detection results; A vulnerability repair execution unit, used to input the vulnerability continuous detection result and the structure information into a vulnerability management feedback model, output repair control data, and perform vulnerability repair execution through the repair control data; A code base vulnerability repair unit is used to obtain vulnerability repair parameters by matching the code scanning data set with the repair control data, and repair vulnerabilities in the project code base according to the vulnerability repair parameters.

Images