Code vulnerability detection method and system based on machine learning

Abstract

The invention discloses a code vulnerability detection method and system based on machine learning, and relates to the technical field of data processing. The method comprises the steps of firstly extracting statement source codes and context source codes of all code statements from source codes, then collecting sample data from all corresponding historical test sample data by adopting a data collection algorithm aiming at all the statements, adding a collection result into a corresponding sample data set, and then collecting all the collected sample data from all the corresponding historical test sample data by adopting a data collection algorithm aiming at all the statements. And performing calibration verification modeling on the artificial intelligence model based on the machine learning algorithm by applying the corresponding data set to obtain a corresponding code vulnerability detection model, and performing prediction based on the corresponding statement source code and the context source code by applying the model to obtain a corresponding code vulnerability classification label prediction value after test. And finally, summarizing vulnerability detection results and giving an alarm, so that the accuracy of the code vulnerability detection results can be effectively improved by considering the influence of the code context content on the vulnerability existence in the code vulnerability detection process.

Description

Technical Field

[0001] The present invention belongs to the technical field of data processing, and in particular relates to a code vulnerability detection method and system based on machine learning. Background Art

[0002] As an indispensable part of the information society, software plays an increasingly important role. It is not only inseparable from the daily life of individuals, but also closely related to the development of society. However, software is a double-edged sword. While it provides convenient services for individuals and society, its potential vulnerabilities may also cause great losses to individuals and society. Vulnerabilities in software are often inevitable. On the one hand, it is difficult to have no problems in the design, development and deployment of software. On the other hand, due to commercial benefits, the software development cycle cannot be too long, which further increases the risk of software vulnerabilities. In order to reduce vulnerabilities in software and improve software quality, software vulnerability detection technology came into being. Vulnerability detection technology is to check the source code of the software or the execution process of the software, and judge whether the software has vulnerabilities based on experience, known vulnerability patterns and software execution results.

[0003] Source code vulnerability detection technology is an important means to improve software quality and security, reduce the number of vulnerabilities and reduce the cost of vulnerability repair. It is divided into the following two methods according to whether the software needs to be executed: (1) static analysis, that is, analyzing the source code without running the software in order to detect code defects, but this relies on experts to formulate rules, and there are problems such as strong subjectivity and imperfect rules; (2) dynamic testing analysis, that is, executing the target program and monitoring its running status in order to discover vulnerabilities, but it has problems such as high false negative rate, high resource consumption and difficulty in discovering complex vulnerabilities due to low analysis efficiency and low code coverage.

[0004] At present, although there are existing source code vulnerability detection technologies that implement static analysis such as "CN116541843A-A code vulnerability detection method based on machine learning", "CN111259394A-A fine-grained source code vulnerability detection method based on graph neural network" and "CN117272309A-A source code vulnerability detection method and device based on graph neural network and interpretable model", these technologies generally ignore the impact of the contextual content of the code on the existence of vulnerabilities, resulting in the accuracy of code vulnerability detection results still needs to be improved. Summary of the invention

[0005] The purpose of the present invention is to provide a code vulnerability detection method and system based on machine learning, so as to solve the problem that the accuracy of code vulnerability detection results is limited due to the general neglect of the influence of code context content on the existence of vulnerabilities in existing source code vulnerability detection technologies.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions: In the first aspect, a code vulnerability detection method based on machine learning is provided, comprising: Obtaining source code, and extracting statement source code of at least one code statement from the source code; For each code statement in the at least one code statement, extracting a corresponding context source code from the source code; For each code statement, a data collection algorithm is used to collect the historical test sample data from all historical test sample data of the same type of code statements matching the corresponding statement, and the collection result is added to the corresponding sample data set, wherein the historical test sample data contains code features of the same type of code statements used as model input items and historical post-test code vulnerability classification label values ​​of the same type of code statements used as model output items, and the code features refer to numerical features obtained by converting the statement source code and context source code of the corresponding statement; For each of the code statements, the corresponding sample data set is applied to perform calibration and verification modeling on the artificial intelligence model based on the machine learning algorithm to obtain a corresponding code vulnerability detection model, wherein the code vulnerability detection model is used to output a predicted value of the post-test code vulnerability classification label of the corresponding statement after inputting the statement source code and context source code of the corresponding statement; For each of the code statements, the corresponding statement source code and context source code are converted into the corresponding code features, and then the code features are input into the corresponding code vulnerability detection model, and the corresponding post-test code vulnerability classification label prediction value is output; The post-test code vulnerability classification label prediction value used to indicate the existence of code vulnerabilities in corresponding code statements and the code statements corresponding to the post-test code vulnerability classification label prediction value are summarized to obtain the vulnerability detection result of the source code and give an alarm reminder.

[0007] Based on the above invention content, a new scheme for predicting post-test code vulnerability classification labels based on statement source code and context source code is provided, that is, the statement source code and context source code of each code statement are first extracted from the source code, and then for each statement, a data collection algorithm is used to collect sample data from all corresponding historical test sample data, and the collection results are added to the corresponding sample data set, and then for each statement, the corresponding data set is applied to calibrate and verify the modeling of an artificial intelligence model based on a machine learning algorithm to obtain a corresponding code vulnerability detection model, and the model is applied to predict the corresponding post-test code vulnerability classification label prediction value based on the corresponding statement source code and context source code, and finally the vulnerability detection results are summarized and an alarm is given. In this way, by taking into account the influence of the code context content on the existence of vulnerabilities in the process of code vulnerability detection, the accuracy of the code vulnerability detection results can be effectively improved, which is convenient for practical application and promotion.

[0008] In one possible design, the at least one code statement includes a first code statement for outputting text, a second code statement for obtaining user input, a third code statement for executing different code blocks according to different conditions, a fourth code statement for looping through the elements in an iterable object, a fifth code statement for continuously looping through the code blocks when the condition is true, a sixth code statement for importing an available program module so as to use functions / classes in the available program module, and / or a seventh code statement for temporarily not performing any operation.

[0009] In a possible design, for each code statement, a data collection algorithm is used to collect the historical test sample data from all historical test sample data of the same type of code statements that match the corresponding statement, and the collection result is added to the corresponding sample data set, including: For a certain code statement in the at least one code statement, a number of the historical test sample data are randomly collected from all the historical test sample data of the same type of code statements matching the corresponding statement, and the number of the historical test sample data randomly collected are added to a corresponding sample data set which is initially an empty set, wherein the historical test sample data contains code features of the same type of code statements used as model input items and historical post-test code vulnerability classification label values ​​of the same type of code statements used as model output items, and the code features refer to numerical features obtained by converting the statement source code and context source code of the corresponding statement; Processing and analyzing the sample data set corresponding to the certain code statement to determine a gap direction of the sample data corresponding to the certain code statement; configuring a data collection algorithm according to the sample data gap direction, and using the data collection algorithm to collect the historical test sample data from all historical test sample data of the same type of code statements that match the certain code statement; Determine whether the newly collected historical test sample data matches the sample data gap direction. If so, add the newly collected historical test sample data to the sample data set corresponding to the certain code statement; otherwise, abandon adding the newly collected historical test sample data to the sample data set corresponding to the certain code statement.

[0010] In a possible design, a data collection algorithm is configured according to the sample data gap direction, and the data collection algorithm is used to collect the historical test sample data from all historical test sample data of the same type of code statements matching the certain code statement, including the following steps S331 to S339: S331. According to the direction of the gap in the sample data, the initial position corresponding to the initial feature value of the code feature is initialized at the position around the data gap, and then step S332 is executed, wherein the initial position and the position around the data gap are respectively located in the multidimensional feature space constructed based on the code feature, and the position around the data gap is determined according to the direction of the gap in the sample data; S332. According to the initial feature value of the code feature, a direct binary search algorithm is used to search for the first historical test sample data whose model input item matches the initial feature value from all historical test sample data of the same type of code statements that match the certain code statement, and then execute step S333; S333. Set the feature number variable Initialize to 1, and then execute step S334; S334. Based on the current feature value of the code feature, change the first The feature value of the feature is obtained, and a new feature value of the code feature is obtained, and then step S335 is executed; S335. According to the new feature value of the code feature, the direct binary search algorithm is used to search for the second historical test sample data whose model input item matches the new feature value from all historical test sample data of the same type of code statements that match the certain code statement, and then execute step S336; S336. Compare the historical post-test code vulnerability classification label values ​​in the second historical test sample data and the first historical test sample data and used as model output items. If the historical post-test code vulnerability classification label value in the second historical test sample data is different from the historical post-test code vulnerability classification label value in the first historical test sample data, execute step S337; otherwise, execute step S338; S337. Update the first historical test sample data to the second historical test sample data, and if the feature number variable is less than the total number of dimensions of the code feature, then the feature number variable Increment by 1, then return to step S334, otherwise, go to step S339; S338. The feature value of the feature is restored to the value before the change, and if the feature number variable is less than the total number of dimensions of the code feature, then the feature number variable Increment by 1, then return to step S334, otherwise, go to step S339; S339. Take the first historical test sample data as the collection result and end this collection.

[0011] In a possible design, processing and analyzing the sample data set corresponding to the certain code statement to determine the direction of the sample data gap corresponding to the certain code statement includes: According to the definition domain of the post-test code vulnerability classification label values ​​of the same type of code statements matching the certain code statement, statistical analysis is performed on the sample data set corresponding to the certain code statement to determine the distribution interval of the post-test code vulnerability classification label values ​​in the sample data set in the definition domain; Eliminating the distribution interval in the definition domain to obtain a distribution missing interval in the definition domain; According to the distribution missing interval, a direction of a sample data gap corresponding to the certain code statement is determined.

[0012] In a possible design, for each code statement, the corresponding sample data set is applied to perform calibration and verification modeling on an artificial intelligence model based on a machine learning algorithm to obtain a corresponding code vulnerability detection model, including: Get multiple AI models based on different machine learning algorithms; For a pair of statements and models in the at least one code statement and the multiple artificial intelligence models, the sample data set of the corresponding statement is applied, and the hyperparameters of the corresponding model are optimized based on the optimization algorithm to obtain the corresponding model hyperparameters and use them to make the objective function Minimize the optimization search results, where the objective function The calculation formula is as follows:

[0013] In the formula, Indicates the output error indicator value of the artificial intelligence model, Indicates the time required for the calculation of the artificial intelligence model; Select the one with the smallest objective function from the multiple artificial intelligence models. An artificial intelligence model; The optimization search results of the hyperparameters of the artificial intelligence model and the model parameters obtained during the optimization process and corresponding to the optimization search results are imported into the artificial intelligence model to obtain a code vulnerability detection model corresponding to the code statement in the pair of statements and the model, wherein the code vulnerability detection model is used to output the post-test code vulnerability classification label prediction value of the corresponding statement after inputting the statement source code and context source code of the corresponding statement.

[0014] In one possible design, for a pair of statements and models in the at least one code statement and the multiple artificial intelligence models, the sample data set of the corresponding statement is applied, and the hyperparameters of the corresponding model are optimized based on the optimization algorithm to obtain the corresponding model hyperparameters and use them to make the objective function The minimized optimized search results include the following steps S421 to S429: S421. For a pair of statements and models in the at least one code statement and the plurality of artificial intelligence models, initialize the corresponding and maximum number of iterations The optimization algorithm parameters are randomly generated, and an initial search value array of the parameter set to be optimized is then executed, wherein the parameter set to be optimized includes all hyperparameters of the artificial intelligence model in the pair of statements and models, and the initial search value array of the parameter set to be optimized is It is expressed as follows:

[0015] In the formula, Indicates less than or equal to A positive integer, represents the total number of parameters in the parameter set to be optimized, Indicates the first The initial search value corresponding to the parameter, Indicates that The upper limit of the parameter search space corresponding to the parameters, Indicates that The lower limit of the parameter search space corresponding to the parameters, Represents a purely decimal random generator function; S422. Import the initial search value array of the parameter set to be optimized as a model hyperparameter into the artificial intelligence model in the pair of statements and the model to obtain a first artificial intelligence model, and then apply the sample data set corresponding to the code statement in the pair of statements and the model to perform model training and testing on the first artificial intelligence model to obtain a first output error situation index value and a first calculation time required index value, and finally import the first output error situation index value and the first calculation time required index value into the objective function , and the output result is used as the fitness corresponding to the initial search value array, and then step S423 is executed, wherein the objective function The calculation formula is as follows:

[0016] In the formula, Indicates the output error indicator value of the artificial intelligence model, Indicates the time required for the calculation of the artificial intelligence model; S423. Use the initial search value array of the parameter set to be optimized as the current optimal search value array, and initialize the current number of iterations , and also initialize the prohibited change countdown value of each parameter in the parameter set to be optimized to zero, and then execute step S424; S424. Based on the current optimal search value array, each parameter in the parameter set to be optimized and whose current forbidden change countdown value is zero is independently increased and decreased to obtain the parameter set to be optimized. A new search value array is generated, and then step S425 is executed, wherein: represents the total number of parameters in the set of parameters to be optimized whose current forbidden change countdown value is zero, and ; S425. For the For each array in the new search value array, the corresponding array is imported as a model hyperparameter into the artificial intelligence model in the pair of statements and the model to obtain a second artificial intelligence model of the corresponding array, and then the sample data set corresponding to the code statement in the pair of statements and the model is applied to perform model training and testing on the second artificial intelligence model to obtain a second output error situation index value and a second calculation time required index value of the corresponding array, and finally the second output error situation index value and the second calculation time required index value are imported into the objective function , and use the output result as the fitness of the corresponding array, and then execute step S426; S426. For each array, the fitness corresponding to the current optimal search value array is subtracted from the fitness of the corresponding array to obtain the fitness difference value of the corresponding array, and when the fitness difference value is greater than zero and is the maximum fitness difference value this time, the forbidden change countdown value of the corresponding unique variable parameter is updated to a positive integer value positively correlated with the fitness difference value, and then step S427 is executed, wherein the unique variable parameter refers to the parameter in the parameter set to be optimized and is used to obtain the parameter of the corresponding array by increasing or decreasing the processing; S427. Determine whether there is any parameter in the set of parameters to be optimized whose current prohibited change countdown value is zero. If not, decrement the current prohibited change countdown value of each parameter in the set of parameters to be optimized by 1, and then return to step S427, otherwise, execute step S428; S428. Determine whether there is any fitness difference value greater than zero in the fitness difference values ​​of each array. If so, update the current optimal search value array to the value in the array. The array in the new search value array and corresponding to the minimum fitness, then execute step S429, otherwise directly execute step S429; S429. Make the current number of iterations Add 1 to the current number of iterations. Whether the maximum number of iterations has been reached If so, the current optimal search value array is used as the model hyperparameter corresponding to the certain pair of statements and the model and used to make the objective function Minimize the optimized search results, otherwise return to execute step S424.

[0017] In one possible design, the multiple artificial intelligence models include artificial intelligence models based on graph neural networks, support vector machines, K nearest neighbor method, stochastic gradient descent method, multivariate linear regression, multilayer perceptron, decision tree, back propagation neural network and / or radial basis function network.

[0018] In a second aspect, a code vulnerability detection device based on machine learning is provided, including a statement code extraction unit, a context code extraction unit, a sample data collection unit, a vulnerability detection modeling unit, a detection model application unit and a detection result summary unit; The statement code extraction unit is used to obtain source code and extract statement source code of at least one code statement from the source code; The context code extraction unit is communicatively connected to the statement code extraction unit, and is used to extract corresponding context source code from the source code for each code statement in the at least one code statement; The sample data collection unit is communicatively connected to the statement code extraction unit, and is used for collecting the historical test sample data from all historical test sample data of the same type of code statements matching the corresponding statement using a data collection algorithm for each code statement, and adding the collection result to the corresponding sample data set, wherein the historical test sample data contains code features of the same type of code statements used as model input items and historical post-test code vulnerability classification label values ​​of the same type of code statements used as model output items, and the code features refer to numerical features obtained by converting the statement source code and context source code of the corresponding statement; The vulnerability detection modeling unit is communicatively connected to the sample data collection unit, and is used to apply the corresponding sample data set to each code statement, perform calibration verification modeling on the artificial intelligence model based on the machine learning algorithm, and obtain a corresponding code vulnerability detection model, wherein the code vulnerability detection model is used to output a predicted value of the post-test code vulnerability classification label of the corresponding statement after inputting the statement source code and context source code of the corresponding statement; The detection model application unit is respectively connected to the statement code extraction unit, the context code extraction unit and the vulnerability detection modeling unit, and is used to convert the corresponding statement source code and the context source code into the corresponding code features for each code statement, and then input the code features into the corresponding code vulnerability detection model, and output the corresponding post-test code vulnerability classification label prediction value; The detection result summary unit is communicatively connected to the detection model application unit, and is used to summarize the post-test code vulnerability classification label prediction value indicating that a corresponding code statement has a code vulnerability and the code statement corresponding to the post-test code vulnerability classification label prediction value, obtain the vulnerability detection result of the source code and give an alarm reminder.

[0019] In a third aspect, the present invention provides a computer system comprising a memory, a processor and a transceiver which are communicatively connected in sequence, wherein the memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the machine learning-based code vulnerability detection method as described in the first aspect or any possible design of the first aspect.

[0020] In a fourth aspect, the present invention provides a computer-readable storage medium having instructions stored thereon. When the instructions are executed on a computer, the machine learning-based code vulnerability detection method as described in the first aspect or any possible design of the first aspect is executed.

[0021] In a fifth aspect, the present invention provides a computer program product, comprising a computer program or instructions, which, when executed by a computer, implements the machine learning-based code vulnerability detection method as described in the first aspect or any possible design of the first aspect.

[0022] Beneficial effects of the above scheme: (1) The present invention creatively provides a new solution for predicting post-test code vulnerability classification labels based on statement source code and context source code, that is, first extracting the statement source code and context source code of each code statement from the source code, then using a data collection algorithm to collect sample data from all corresponding historical test sample data for each statement, and adding the collected results to the corresponding sample data set, and then using the corresponding data set to calibrate and verify the modeling of an artificial intelligence model based on a machine learning algorithm for each statement, to obtain a corresponding code vulnerability detection model, and applying the model to predict the corresponding post-test code vulnerability classification label prediction value based on the corresponding statement source code and context source code, and finally summarizing the vulnerability detection results and giving an alarm reminder, so that by taking into account the influence of the code context content on the existence of vulnerabilities in the code vulnerability detection process, the accuracy of the code vulnerability detection results can be effectively improved; (2) The model hyperparameters can be optimized through the aforementioned new heuristic algorithm steps. During the optimization process, the search results in each optimal neighborhood search direction can be temporarily locked for different numbers of iterations based on different fitness difference values, which is conducive to quickly searching for the optimal model hyperparameters. In addition, by first quantitatively increasing / decreasing the parameters to be adjusted in steps and then randomly increasing / decreasing the parameters in an unquantified manner, it is also possible to avoid falling into the local optimal solution, which is further conducive to quickly and accurately obtaining the optimal search results, facilitating practical application and promotion. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1A flowchart of a code vulnerability detection method based on machine learning provided in an embodiment of the present application.

[0025] Figure 2 A schematic diagram of the structure of a code vulnerability detection system based on machine learning provided in an embodiment of the present application.

[0026] Figure 3 A schematic diagram of the structure of a computer system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the present invention will be briefly introduced below in combination with the drawings and the description of the embodiments or the prior art. Obviously, the following description of the structures of the drawings is only some embodiments of the present invention. For ordinary technicians in this field, other embodiments can be obtained based on these embodiments without creative work. It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention.

[0028] It should be understood that although the terms first and second, etc. may be used herein to describe various objects, these objects should not be limited by these terms. These terms are only used to distinguish one object from another object. For example, a first object can be referred to as a second object, and similarly, a second object can be referred to as a first object without departing from the scope of the exemplary embodiments of the present invention.

[0029] It should be understood that the term "and / or" that may appear in this document is merely a description of the association relationship between associated objects, indicating that there may be three relationships. For example, A and / or B can indicate three situations: A exists alone, B exists alone, or A and B exist at the same time. For another example, A, B and / or C can indicate the existence of any one of A, B and C or any combination of them. The term " / and" that may appear in this document describes another type of association object relationship, indicating that there may be two relationships. For example, A / and B can indicate two situations: A exists alone or A and B exist at the same time. In addition, the character " / " that may appear in this document generally indicates that the previous and next associated objects are in an "or" relationship.

[0030] Example like Figure 1As shown, the code vulnerability detection method based on machine learning provided in the first aspect of this embodiment can be executed by, but is not limited to, a computer device with certain computing resources, such as a cloud server, a personal computer (PC, which refers to a multi-purpose computer with a size, price and performance suitable for personal use; desktops, laptops, small laptops, tablets and ultrabooks are all personal computers), smart phones, personal digital assistants (PDA) or wearable devices. Figure 1 As shown, the code vulnerability detection method may include but is not limited to the following steps S1 to S6.

[0031] S1. Obtain source code, and extract statement source code of at least one code statement from the source code.

[0032] In step S1, the source code is the code vulnerability detection object, which is generally but not limited to being composed of multiple code statements, etc., so the statement source code of the at least one code statement can be conventionally extracted from the source code. The code statement is the smallest unit for code vulnerability detection in this embodiment, which can be composed of one code or multiple codes; specifically, the at least one code statement includes but is not limited to a first code statement for outputting text (such as a print statement), a second code statement for obtaining user input (such as an input statement), a third code statement for executing different code blocks according to different conditions (such as an if statement), a fourth code statement for looping through elements in an iterable object (such as a for statement), a fifth code statement for continuously looping and executing a code block when a condition is true (such as a while statement), a sixth code statement for importing an available program module so as to use a function / class in the available program module (such as an import statement, the aforementioned available program module is exemplified as a Python module), and / or a seventh code statement for temporarily not performing any operation (such as a pass statement), etc. In addition, in order to avoid a large amount of noise information in the feature data passed into the subsequent model due to recognition errors, which may cause interference to the final judgment result, after obtaining the source code, the identifiers in the source code can be identified by referring to the code standardization technical means in "CN116541843A-A Code Vulnerability Detection Method Based on Machine Learning", and the identifiers can be standardized to obtain standardized source code, and finally the statement source code of the at least one code statement can be extracted from the standardized source code.

[0033] S2. For each code statement in the at least one code statement, a corresponding context source code is extracted from the source code.

[0034] In step S2, the context source code refers to the source code located before the corresponding code statement and / or the source code located after the corresponding code statement. These source codes can be limited according to a preset number of distances (for example, extracting the first 10 source codes and / or the last 10 source codes), or can be determined according to the logical relationship between the corresponding code statement and the previous and next source codes (for example, extracting all the previous source codes containing the same identifier as the corresponding code statement and / or all the subsequent source codes containing the same identifier as the corresponding code statement). They can also be conventionally extracted.

[0035] S3. For each of the code statements, a data collection algorithm is used to collect the historical test sample data from all historical test sample data of the same type of code statements that match the corresponding statement, and the collection results are added to the corresponding sample data set, wherein the historical test sample data includes but is not limited to code features of the same type of code statements used as model input items and historical post-test code vulnerability classification label values ​​of the same type of code statements used as model output items, and the code features refer to numerical features obtained by converting the statement source code and context source code based on the corresponding statement.

[0036] In the step S3, the aforementioned example of all historical test sample data of the same type of code statements that match the corresponding statement refers to: for a certain code statement, if the corresponding statement is a for statement, the historical test sample data must be sample data obtained by historical testing for the for statement, and cannot be sample data obtained by historical testing for if statements or other statements. Generally speaking, the data collection algorithm can adopt a direct binary search method (DBSMethod, also known as a binary search algorithm, which is a method for efficiently finding specific elements in an ordered array; its core idea is to locate the position of the target element by continuously narrowing the search range), but it is also considered that the data distribution used for single model neural network training at this stage must meet certain distribution conditions, that is, the distribution of each result in all sample data must be relatively uniform, otherwise the trained model cannot achieve basic prediction functions, so preferably, for each code statement, a data collection algorithm is used to collect the historical test sample data from all historical test sample data of the same type of code statements that match the corresponding statement, and the collected results are added to the corresponding sample data set, including but not limited to the following steps S31 to S34.

[0037] S31. For a certain code statement in the at least one code statement, randomly collect a number of the historical test sample data from all the historical test sample data of the same type of code statements matching the corresponding statement, and add the randomly collected number of the historical test sample data to the corresponding sample data set which is initially an empty set, wherein the historical test sample data include but are not limited to code features of the same type of code statements used as model input items and historical post-test code vulnerability classification label values ​​of the same type of code statements used as model output items, etc., and the code features refer to numerical features obtained by converting the statement source code and context source code of the corresponding statement.

[0038] In the step S31, the code features can be obtained by converting the statement source code and context source code of the corresponding statement using the text vector conversion algorithm in "CN116541843A-A code vulnerability detection method based on machine learning", or by processing the statement source code and context source code of the corresponding statement using the code graph feature extraction method in "CN111259394A-A fine-grained source code vulnerability detection method based on graph neural network", and can also be obtained by processing the statement source code and context source code of the corresponding statement using other existing feature extraction methods. In addition, the code vulnerability classification label value after historical testing can be obtained by marking the statement source code and context source code of the corresponding statement through historical dynamic testing analysis, and the specific code vulnerability classification label value can include, but is not limited to, a first label value (for example, represented by "1") for indicating that the corresponding code statement has a code vulnerability and a second label value (for example, represented by "0") for indicating that the corresponding code statement does not have a code vulnerability, which will not be repeated here.

[0039] S32. Process and analyze the sample data set corresponding to the certain code statement to determine the direction of the sample data gap corresponding to the certain code statement.

[0040] In the step S32, specifically, the sample data set corresponding to the certain code statement is processed and analyzed to determine the direction of the sample data gap corresponding to the certain code statement, including but not limited to the following steps S321 to S323.

[0041] S321. According to the definition domain of the post-test code vulnerability classification label values ​​of the same type of code statements that match the certain code statement, statistical analysis is performed on the sample data set corresponding to the certain code statement to determine the distribution range of the post-test code vulnerability classification label values ​​in the sample data set in the definition domain.

[0042] In the step S321, for example, assuming that the post-test code vulnerability classification label values ​​of the same type of code statements matching the certain code statement are as follows: 4, 3, 2, 1 and 0 (that is, the zero value is used to indicate that the corresponding code statement does not have a code vulnerability, and other non-zero values ​​are used to indicate that the corresponding code statement has different code vulnerability situations), then the definition domain can be exemplified as {4, 3, 2, 1, 0}, and then through conventional statistical analysis means, it can be determined that the distribution interval of the post-test code vulnerability classification label value in the definition domain is {4, 3} and {0}.

[0043] S322. Eliminate the distribution interval in the definition domain to obtain a distribution missing interval in the definition domain.

[0044] In the step S322, based on the specific example of the above step S321, it can be obtained that the distribution missing interval is {1,0}.

[0045] S323. Determine the direction of the sample data gap corresponding to the certain code statement according to the distribution missing interval.

[0046] S33. Configure a data collection algorithm according to the sample data gap direction, and use the data collection algorithm to collect the historical test sample data from all historical test sample data of the same type of code statements that match the certain code statement.

[0047] In the step S33, specifically, a data collection algorithm is configured according to the sample data gap direction, and the data collection algorithm is used to collect the historical test sample data from all historical test sample data of the same type of code statements matching the certain code statement, including but not limited to the following steps S331 to S339.

[0048] S331. According to the direction of the sample data gap, the initial position corresponding to the initial feature value of the code feature is initialized at the position surrounding the data gap, and then step S332 is executed, wherein the initial position and the position surrounding the data gap are respectively located in the multidimensional feature space constructed based on the code feature, and the position surrounding the data gap is determined according to the direction of the sample data gap.

[0049] In step S331, assuming that the multidimensional feature space is a three-dimensional space, and the direction of the sample data gap is pointing to a certain coordinate position in the three-dimensional space, the code feature value closest to the certain coordinate position in the sample data set corresponding to the certain code statement can be used as the peripheral position of the data gap and the initial position.

[0050] S332. According to the initial feature value of the code feature, a direct binary search algorithm is used to search for the first historical test sample data whose model input item matches the initial feature value from all historical test sample data of the same type of code statements that match the certain code statement, and then execute step S333.

[0051] S333. Set the feature number variable Initialized to 1, and then execute step S334.

[0052] S334. Based on the current feature value of the code feature, change the first The feature value of the feature is obtained to obtain a new feature value of the code feature, and then step S335 is executed.

[0053] S335. According to the new feature value of the code feature, the direct binary search algorithm is used to search for the second historical test sample data whose model input item matches the new feature value from all historical test sample data of the same type of code statements that match the certain code statement, and then execute step S336.

[0054] S336. Compare the historical post-test code vulnerability classification label value in the second historical test sample data with the historical post-test code vulnerability classification label value in the first historical test sample data and used as the model output item. If the historical post-test code vulnerability classification label value in the second historical test sample data is different from the historical post-test code vulnerability classification label value in the first historical test sample data, execute step S337; otherwise, execute step S338.

[0055] S337. Update the first historical test sample data to the second historical test sample data, and if the feature number variable is less than the total number of dimensions of the code feature, then the feature number variable Increment by 1, then return to execute step S334, otherwise execute step S339.

[0056] S338. The feature value of the feature is restored to the value before the change, and if the feature number variable is less than the total number of dimensions of the code feature, then the feature number variable Increment by 1, then return to execute step S334, otherwise execute step S339.

[0057] S339. Take the first historical test sample data as the collection result and end this collection.

[0058] S34. Determine whether the newly collected historical test sample data matches the sample data gap direction. If so, add the newly collected historical test sample data to the sample data set corresponding to the certain code statement. Otherwise, abandon adding the newly collected historical test sample data to the sample data set corresponding to the certain code statement.

[0059] In step S34, judging whether the newly collected historical test sample data matches the sample data gap direction may include but is not limited to: according to the definition domain of the post-test code vulnerability classification label value of the same type of code statement that matches the certain code statement, statistical analysis is performed again on the sample data set corresponding to the certain code statement and the newly collected historical test sample data to determine the new distribution range of the post-test code vulnerability classification label value in the definition domain, and then if the new distribution range is expanded (which means that the distribution missing range is shrinking), it can be determined that the newly collected historical test sample data matches the sample data gap direction, otherwise it is determined that the newly collected historical test sample data does not match the sample data gap direction.

[0060] S4. For each of the code statements, apply the corresponding sample data set to calibrate and verify the artificial intelligence model based on the machine learning algorithm to obtain the corresponding code vulnerability detection model, wherein the code vulnerability detection model is used to output the post-test code vulnerability classification label prediction value of the corresponding statement after inputting the statement source code and context source code of the corresponding statement.

[0061] In step S4, the machine learning algorithm is a core artificial intelligence algorithm that specifically studies how computers simulate or implement human learning behavior to acquire new knowledge or skills, reorganize existing knowledge structures to continuously improve their own performance, and is the fundamental way to make computers intelligent; specifically, the machine learning algorithm preferably, but not limited to, uses machine learning algorithms based on graph neural networks, support vector machines, K nearest neighbor methods, stochastic gradient descent methods, multivariate linear regression, multilayer perceptrons, decision trees, back propagation neural networks or radial basis function networks, etc., so as to quickly and accurately find the rules in the data. Based on a certain amount of the sample data set, the code vulnerability detection model that has been verified can be trained through conventional calibration verification modeling methods (the specific process includes the calibration process and verification process of the model, that is, first by comparing the model simulation results with the measured data, and then adjusting the model parameters according to the comparison results, so that the simulation results are consistent with the actual process). Considering that different machine learning algorithms have different prediction accuracies and different calculation times required for prediction, in order to obtain the corresponding optimal code vulnerability detection model that can take into account both detection accuracy and detection speed based on different machine learning algorithm training for different code statements, preferably, for each code statement, the corresponding sample data set is applied to calibrate and verify the artificial intelligence model based on the machine learning algorithm to obtain the corresponding code vulnerability detection model, including but not limited to the following steps S41 to S44.

[0062] S41. Obtain multiple artificial intelligence models based on different machine learning algorithms.

[0063] In step S41, specifically, the multiple artificial intelligence models include but are not limited to artificial intelligence models based on graph neural networks, support vector machines, K nearest neighbor method, stochastic gradient descent method, multivariate linear regression, multilayer perceptron, decision tree, back propagation neural network and / or radial basis function network, etc.; they can be conventionally constructed based on existing technologies.

[0064] S42. For a pair of statements and models in the at least one code statement and the multiple artificial intelligence models, apply the sample data set of the corresponding statement, optimize the hyperparameters of the corresponding model based on the optimization algorithm, obtain the corresponding model hyperparameters and use them to make the objective function Minimize the optimization search results, where the objective function The calculation formula is as follows:

[0065] In the formula, Indicates the output error indicator value of the artificial intelligence model, Indicates the time required for the calculation of the artificial intelligence model.

[0066] In step S42, model hyperparameters refer to parameters pre-set in the learning model. These parameters cannot be directly learned from data in the standard model training process, but need to be manually set to optimize the performance of the model, such as the number of hidden layer nodes, learning rate, and batch size. The output error situation index value is used to reflect the accuracy of model detection. The smaller the value, the higher the model detection accuracy. It specifically includes but is not limited to the average deviation value, variance and / or average error rate of the overall samples, and can be obtained through conventional statistics during model training and testing. The calculation time required index value is used to reflect the model detection speed. The shorter the value, the faster the model detection speed, which can be obtained through conventional timing during the model testing process. The objective function It is used as a comprehensive indicator that takes into account both detection accuracy and detection speed. The smaller the result, the better the trained model can achieve in terms of both detection accuracy and detection speed, so as to select the best code vulnerability detection model that takes into account both detection accuracy and detection speed. In addition, the optimization algorithm can be, but is not limited to, a particle swarm optimization algorithm, a Newton optimization algorithm, a genetic optimization algorithm, a Grey Wolf Algorithm, a whale optimization algorithm, or a tuna school optimization algorithm.

[0067] S43. Select the one with the smallest objective function from the multiple artificial intelligence models An artificial intelligence model.

[0068] In the step S43, specifically, according to the fitness corresponding to the current optimal search value array of each artificial intelligence model, if it is found that the fitness corresponding to the current optimal search value array of a certain model is the minimum value, then the model is taken as the one with the minimum objective function. An artificial intelligence model.

[0069] S44. Import the optimization search results of the hyperparameters of the artificial intelligence model and the model parameters obtained during the optimization process and corresponding to the optimization search results into the artificial intelligence model to obtain a code vulnerability detection model corresponding to the code statement in the pair of statements and the model, wherein the code vulnerability detection model is used to output the post-test code vulnerability classification label prediction value of the corresponding statement after inputting the statement source code and context source code of the corresponding statement.

[0070] In step S44, the optimization search result of the hyperparameters of the artificial intelligence model is the current optimal search value array of the artificial intelligence model. Also, considering that some hyperparameters need to be integers (such as the number of hidden layer nodes), before the optimization search result of the hyperparameters of the artificial intelligence model is imported into the model as the model hyperparameters, it is necessary to round the corresponding parameter values, such as rounding the hidden layer node values.

[0071] S5. For each code statement, the corresponding statement source code and context source code are converted into the corresponding code features, and then the code features are input into the corresponding code vulnerability detection model, and the corresponding post-test code vulnerability classification label prediction value is output.

[0072] S6. Summarize the post-test code vulnerability classification label prediction value used to indicate that the corresponding code statement has a code vulnerability and the code statement corresponding to the post-test code vulnerability classification label prediction value, obtain the vulnerability detection result of the source code and give an alarm reminder.

[0073] In step S6, for example, if the at least one code statement includes statement A, statement B, statement C, and statement D, and the predicted value of the post-test code vulnerability classification label of statement B is 1, and the predicted value of the post-test code vulnerability classification label of statement C is 2, then the value 1 can be bound to statement B and the value 2 can be bound to statement C, and output to the human-computer interaction interface as the vulnerability detection result of the source code for alarm reminder, so that software developers can repair the vulnerability in time. In addition, in order to achieve the purpose of automatic leak detection and repair, the vulnerability detection result of the source code can also be uploaded to the DeepSeek platform to automatically repair the code vulnerability, and the code vulnerability detection model is reapplied to the statement source code and context source code of the code statement after the vulnerability is repaired to perform code vulnerability inspection until the output result shows that there is no post-test code vulnerability classification label prediction value for indicating that the corresponding code statement has a code vulnerability.

[0074] Therefore, based on the code vulnerability detection method described in the aforementioned steps S1 to S6, a new scheme for predicting the classification label of code vulnerabilities after testing based on statement source code and context source code is provided, that is, the statement source code and context source code of each code statement are first extracted from the source code, and then for each statement, a data collection algorithm is used to collect sample data from all corresponding historical test sample data, and the collection results are added to the corresponding sample data set, and then for each statement, the corresponding data set is applied to calibrate and verify the modeling of the artificial intelligence model based on the machine learning algorithm to obtain the corresponding code vulnerability detection model, and the model is applied to predict the corresponding post-test code vulnerability classification label prediction value based on the corresponding statement source code and context source code, and finally the vulnerability detection results are summarized and an alarm is given. In this way, by taking into account the influence of the code context content on the existence of vulnerabilities in the process of code vulnerability detection, the accuracy of the code vulnerability detection results can be effectively improved, which is convenient for practical application and promotion.

[0075] Based on the technical solution of the first aspect, this embodiment further provides a possible design for optimizing model hyperparameters based on a new heuristic algorithm, that is, for a pair of statements and models in the at least one code statement and the multiple artificial intelligence models, the sample data set of the corresponding statement is applied, and the hyperparameters of the corresponding model are optimized based on the optimization algorithm to obtain the corresponding model hyperparameters and use them to make the objective function The minimized optimized search results include but are not limited to the following steps S421 to S429.

[0076] S421. For a pair of statements and models in the at least one code statement and the plurality of artificial intelligence models, initialize the corresponding and maximum number of iterations The optimization algorithm parameters are randomly generated, and an initial search value array of the parameter set to be optimized is then executed, wherein the parameter set to be optimized includes all hyperparameters of the artificial intelligence model in the pair of statements and models, and the initial search value array of the parameter set to be optimized is It is expressed as follows:

[0077] In the formula, Indicates less than or equal to A positive integer, represents the total number of parameters in the parameter set to be optimized, Indicates the first The initial search value corresponding to the parameter, Indicates that The upper limit of the parameter search space corresponding to the parameters, Indicates that The lower limit of the parameter search space corresponding to the parameters, Represents a purely decimal random generator.

[0078] S422. Import the initial search value array of the parameter set to be optimized as a model hyperparameter into the artificial intelligence model in the pair of statements and the model to obtain a first artificial intelligence model, and then apply the sample data set corresponding to the code statement in the pair of statements and the model to perform model training and testing on the first artificial intelligence model to obtain a first output error situation index value and a first calculation time required index value, and finally import the first output error situation index value and the first calculation time required index value into the objective function , and the output result is used as the fitness corresponding to the initial search value array, and then step S423 is executed, wherein the objective function The calculation formula is as follows:

[0079] In the formula, Indicates the output error indicator value of the artificial intelligence model, Indicates the time required for the calculation of the artificial intelligence model.

[0080] In the step S422, considering that some hyperparameters need to be integers (such as the number of hidden layer nodes), it is necessary to round the corresponding parameter values ​​before importing the initial search value array as a model hyperparameter into the model, such as rounding the hidden layer node values. The specific process of model training and testing the first artificial intelligence model using the sample data set corresponding to the code statement in the pair of statements and the model is an existing conventional calibration verification method and will not be repeated here. In addition, when obtaining the first output error condition index value and the first calculation time required index value, it is also necessary to record the model parameters corresponding to the initial search value array and obtained through model training for use in the subsequent step S44.

[0081] S423. Use the initial search value array of the parameter set to be optimized as the current optimal search value array, and initialize the current number of iterations , and also initialize the prohibited change countdown value of each parameter in the parameter set to be optimized to zero, and then execute step S424.

[0082] S424. Based on the current optimal search value array, each parameter in the parameter set to be optimized and whose current forbidden change countdown value is zero is independently increased and decreased to obtain the parameter set to be optimized. A new search value array is generated, and then step S425 is executed, wherein: represents the total number of parameters in the set of parameters to be optimized whose current forbidden change countdown value is zero, and .

[0083] In the step S424, the increase processing or the decrease processing needs to be performed in the corresponding parameter search space, and can be a quantitative step increase / decrease, or an indefinite random increase / decrease, and it is also possible to first perform a quantitative step increase / decrease on each parameter in the parameter set to be optimized and whose current prohibited change countdown value is zero, and then if it is found that the update of the current optimal search value array has not been completed (that is, step S429 is directly executed in the subsequent step S428), then perform an indefinite random increase / decrease on each parameter in the parameter set to be optimized and whose current prohibited change countdown value is zero, so as to avoid falling into a local optimal solution. For example, if there are the following five parameters in the parameter set to be optimized: parameter A, parameter B, parameter C, parameter D, parameter E and parameter F, wherein the current prohibited change countdown values ​​of parameter A, parameter B, parameter E and parameter F are zero (that is, The value is 4), then based on the current optimal search value array, parameter A is independently increased and decreased respectively, to obtain two different new search value arrays of the parameter set to be optimized (one of which is obtained based on the increase process, and the other is obtained based on the decrease process); based on the current optimal search value array, parameter B is independently increased and decreased respectively, to obtain two different new search value arrays of the parameter set to be optimized; based on the current optimal search value array, parameter E is independently increased and decreased respectively, to obtain two different new search value arrays of the parameter set to be optimized; based on the current optimal search value array, parameter F is independently increased and decreased respectively, to obtain two different new search value arrays of the parameter set to be optimized; and further 2×4=8 new search value arrays can be obtained, each of which represents a neighborhood search direction in the search space.

[0084] S425. For the For each array in the new search value array, the corresponding array is imported as a model hyperparameter into the artificial intelligence model in the pair of statements and the model to obtain a second artificial intelligence model of the corresponding array, and then the sample data set corresponding to the code statement in the pair of statements and the model is applied to perform model training and testing on the second artificial intelligence model to obtain a second output error situation index value and a second calculation time required index value of the corresponding array, and finally the second output error situation index value and the second calculation time required index value are imported into the objective function , and use the output result as the fitness of the corresponding array, and then execute step S426.

[0085] In the step S425, the specific technical details can be obtained by referring to the conventional derivation of the aforementioned step S422, which will not be repeated here. In addition, when obtaining the second output error condition index value and the second calculation required time index value, it is also necessary to record the corresponding data and the model parameters obtained through model training so as to be used in the subsequent step S44.

[0086] S426. For each array, subtract the fitness of the corresponding array from the fitness corresponding to the current optimal search value array to obtain the fitness difference value of the corresponding array, and when the fitness difference value is greater than zero and is the largest fitness difference value this time, update the prohibited change countdown value of the corresponding unique variable parameter to a positive integer value positively correlated with the fitness difference value, and then execute step S427, wherein the unique variable parameter refers to the parameter in the parameter set to be optimized and is used to obtain the parameter of the corresponding array by increasing or decreasing the processing.

[0087] In step S426, the fitness difference value is greater than zero and is the largest fitness difference value this time, which means that the best search value array is obtained in the neighborhood search direction corresponding to the corresponding parameter this time, so it is necessary to temporarily lock the search results in this neighborhood search direction by updating the forbidden change countdown value of the corresponding parameter to a positive integer positively correlated with the fitness difference value. In addition, based on the example in step S424 above, among the eight new search value arrays corresponding to parameters A, B, E and F, if the fitness difference value of a new search value array corresponding to parameter F is greater than zero and is the largest fitness difference value this time (i.e., the largest among the eight fitness difference values ​​this time), then the forbidden change countdown value of parameter F is updated from zero to a positive integer value positively correlated with the fitness difference value, while the forbidden change countdown values ​​of parameters A, B and E remain zero.

[0088] S427. Determine whether there is any parameter in the parameter set to be optimized whose current prohibited change countdown value is zero. If not, decrement the current prohibited change countdown value of each parameter in the parameter set to be optimized by 1, and then return to execute step S427, otherwise execute step S428.

[0089] In step S427, if the current prohibited change countdown values ​​of all parameters in the parameter set to be optimized are not zero, it means that it is impossible to return to execute step S424 subsequently, so they need to be decremented together until the current prohibited change countdown value of at least one parameter is zero.

[0090] S428. Determine whether there is any fitness difference value greater than zero in the fitness difference values ​​of each array. If so, update the current optimal search value array to the value in the array. If an array in the new search value array and corresponding to the minimum fitness is found, then step S429 is executed; otherwise, step S429 is directly executed.

[0091] S429. Make the current number of iterations Add 1 to the current number of iterations. Whether the maximum number of iterations has been reached If so, the current optimal search value array is used as the model hyperparameter corresponding to the certain pair of statements and the model and used to make the objective function Minimize the optimized search results, otherwise return to execute step S424.

[0092] Therefore, based on the aforementioned possible design one, the model hyperparameters are optimized through the aforementioned new heuristic algorithm steps. During the optimization process, the search results in each optimal neighborhood search direction can be temporarily locked for different numbers of iterations based on different fitness difference values, thereby facilitating rapid search for the optimal model hyperparameters. By first quantitatively increasing / decreasing the parameters to be adjusted in steps and then performing an indefinite random increase / decrease in the parameters, it is also possible to avoid falling into a local optimal solution, further facilitating rapid and accurate acquisition of the optimal search results.

[0093] like Figure 2 As shown, the second aspect of this embodiment provides a virtual system for implementing the code vulnerability detection method described in the first aspect or possible design one, including a statement code extraction unit, a context code extraction unit, a sample data collection unit, a vulnerability detection modeling unit, a detection model application unit and a detection result summary unit; The statement code extraction unit is used to obtain source code and extract statement source code of at least one code statement from the source code; The context code extraction unit is communicatively connected to the statement code extraction unit, and is used to extract corresponding context source code from the source code for each code statement in the at least one code statement; The sample data collection unit is communicatively connected to the statement code extraction unit, and is used for collecting the historical test sample data from all historical test sample data of the same type of code statements matching the corresponding statement using a data collection algorithm for each code statement, and adding the collection result to the corresponding sample data set, wherein the historical test sample data contains code features of the same type of code statements used as model input items and historical post-test code vulnerability classification label values ​​of the same type of code statements used as model output items, and the code features refer to numerical features obtained by converting the statement source code and context source code of the corresponding statement; The vulnerability detection modeling unit is communicatively connected to the sample data collection unit, and is used to apply the corresponding sample data set to each code statement, perform calibration verification modeling on the artificial intelligence model based on the machine learning algorithm, and obtain a corresponding code vulnerability detection model, wherein the code vulnerability detection model is used to output a predicted value of the post-test code vulnerability classification label of the corresponding statement after inputting the statement source code and context source code of the corresponding statement; The detection model application unit is respectively connected to the statement code extraction unit, the context code extraction unit and the vulnerability detection modeling unit, and is used to convert the corresponding statement source code and the context source code into the corresponding code features for each code statement, and then input the code features into the corresponding code vulnerability detection model, and output the corresponding post-test code vulnerability classification label prediction value; The detection result summary unit is communicatively connected to the detection model application unit, and is used to summarize the post-test code vulnerability classification label prediction value indicating that a corresponding code statement has a code vulnerability and the code statement corresponding to the post-test code vulnerability classification label prediction value, obtain the vulnerability detection result of the source code and give an alarm reminder.

[0094] The working process, working details and technical effects of the aforementioned device provided in the second aspect of this embodiment can be referred to the code vulnerability detection method based on machine learning described in the first aspect or possible design one, and will not be repeated here.

[0095] like Figure 3As shown, the third aspect of this embodiment provides a computer system for executing the code vulnerability detection method based on machine learning as described in the first aspect or possible design one, including a memory, a processor and a transceiver that are sequentially connected in communication, wherein the memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program, and execute the code vulnerability detection method based on machine learning as described in the first aspect or possible design one. For example, the memory may include, but is not limited to, random access memory (Random-AccessMemory, RAM), read-only memory (Read-Only Memory, ROM), flash memory (Flash Memory), first-in-first-out memory (First Input First Output, FIFO) and / or first-in-last-out memory (First Input Last Output, FILO), etc.; the processor may be, but is not limited to, a microprocessor of the STM32F105 series. In addition, the computer system may also include, but is not limited to, a power module, a display screen and other necessary components.

[0096] The working process, working details and technical effects of the aforementioned computer system provided in the third aspect of this embodiment can be found in the first aspect or the possible design one of the code vulnerability detection method based on machine learning, and will not be repeated here.

[0097] The fourth aspect of this embodiment provides a computer-readable storage medium storing instructions including the code vulnerability detection method based on machine learning as described in the first aspect or possible design one, that is, the computer-readable storage medium stores instructions, and when the instructions are run on a computer, the code vulnerability detection method based on machine learning as described in the first aspect or possible design one is executed. The computer-readable storage medium refers to a carrier for storing data, which may include but is not limited to computer-readable storage media such as floppy disks, optical disks, hard disks, flash memories, USB flash drives, and / or memory sticks, and the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.

[0098] The working process, working details and technical effects of the aforementioned computer-readable storage medium provided in the fourth aspect of this embodiment can be referred to the machine learning-based code vulnerability detection method as described in the first aspect or possible design one, and will not be repeated here.

[0099] A fifth aspect of this embodiment provides a computer program product, including a computer program or instructions, wherein the computer program or instructions, when executed by a computer, implements the machine learning-based code vulnerability detection method as described in the first aspect or possible design 1. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.

[0100] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A code vulnerability detection method based on machine learning, characterized in that: include: Obtaining source code, and extracting statement source code of at least one code statement from the source code; For each code statement in the at least one code statement, extracting a corresponding context source code from the source code; For each code statement, a data collection algorithm is used to collect the historical test sample data from all historical test sample data of the same type of code statements matching the corresponding statement, and the collection result is added to the corresponding sample data set, wherein the historical test sample data contains code features of the same type of code statements used as model input items and historical post-test code vulnerability classification label values ​​of the same type of code statements used as model output items, and the code features refer to numerical features obtained by converting the statement source code and context source code of the corresponding statement; For each of the code statements, the corresponding sample data set is applied to perform calibration and verification modeling on the artificial intelligence model based on the machine learning algorithm to obtain a corresponding code vulnerability detection model, wherein the code vulnerability detection model is used to output a predicted value of the post-test code vulnerability classification label of the corresponding statement after inputting the statement source code and context source code of the corresponding statement; For each of the code statements, the corresponding statement source code and context source code are converted into the corresponding code features, and then the code features are input into the corresponding code vulnerability detection model, and the corresponding post-test code vulnerability classification label prediction value is output; The post-test code vulnerability classification label prediction value used to indicate the existence of code vulnerabilities in corresponding code statements and the code statements corresponding to the post-test code vulnerability classification label prediction value are summarized to obtain the vulnerability detection result of the source code and give an alarm reminder.

2. The code vulnerability detection method according to claim 1, characterized in that: The at least one code statement includes a first code statement for outputting text, a second code statement for obtaining user input, a third code statement for executing different code blocks according to different conditions, a fourth code statement for looping through elements in an iterable object, a fifth code statement for continuously looping through code blocks when a condition is true, a sixth code statement for importing an available program module so as to use a function / class in the available program module, and / or a seventh code statement for temporarily not performing any operation.

3. The code vulnerability detection method according to claim 1, characterized in that: For each code statement, a data collection algorithm is used to collect the historical test sample data from all historical test sample data of the same type of code statements that match the corresponding statement, and the collection results are added to the corresponding sample data set, including: For a certain code statement in the at least one code statement, a number of the historical test sample data are randomly collected from all the historical test sample data of the same type of code statements matching the corresponding statement, and the number of the historical test sample data randomly collected are added to a corresponding sample data set which is initially an empty set, wherein the historical test sample data contains code features of the same type of code statements used as model input items and historical post-test code vulnerability classification label values ​​of the same type of code statements used as model output items, and the code features refer to numerical features obtained by converting the statement source code and context source code of the corresponding statement; Processing and analyzing the sample data set corresponding to the certain code statement to determine a gap direction of the sample data corresponding to the certain code statement; configuring a data collection algorithm according to the sample data gap direction, and using the data collection algorithm to collect the historical test sample data from all historical test sample data of the same type of code statements that match the certain code statement; Determine whether the newly collected historical test sample data matches the sample data gap direction. If so, add the newly collected historical test sample data to the sample data set corresponding to the certain code statement; otherwise, abandon adding the newly collected historical test sample data to the sample data set corresponding to the certain code statement.

4. The code vulnerability detection method according to claim 3, characterized in that: Configuring a data collection algorithm according to the sample data gap direction, and using the data collection algorithm to collect the historical test sample data from all historical test sample data of the same type of code statements matching the certain code statement, including the following steps S331 to S339: S331. According to the direction of the gap in the sample data, the initial position corresponding to the initial feature value of the code feature is initialized at the position around the data gap, and then step S332 is executed, wherein the initial position and the position around the data gap are respectively located in the multidimensional feature space constructed based on the code feature, and the position around the data gap is determined according to the direction of the gap in the sample data; S332. According to the initial feature value of the code feature, a direct binary search algorithm is used to search for the first historical test sample data whose model input item matches the initial feature value from all historical test sample data of the same type of code statements that match the certain code statement, and then execute step S333; S333. Set the feature number variable Initialize to 1, and then execute step S334; S334. Based on the current feature value of the code feature, change the first The feature value of the feature is obtained, and a new feature value of the code feature is obtained, and then step S335 is executed; S335. According to the new feature value of the code feature, the direct binary search algorithm is used to search for the second historical test sample data whose model input item matches the new feature value from all historical test sample data of the same type of code statements that match the certain code statement, and then execute step S336; S336. Compare the historical post-test code vulnerability classification label values ​​in the second historical test sample data and the first historical test sample data and used as model output items. If the historical post-test code vulnerability classification label value in the second historical test sample data is different from the historical post-test code vulnerability classification label value in the first historical test sample data, execute step S337; otherwise, execute step S338; S337. Update the first historical test sample data to the second historical test sample data, and if the feature number variable is less than the total number of dimensions of the code feature, then the feature sequence variable Increment by 1, then return to step S334, otherwise, go to step S339; S338. The feature value of the feature is restored to the value before the change, and if the feature sequence variable is less than the total number of dimensions of the code feature, then the feature sequence variable Increment by 1, then return to step S334, otherwise, go to step S339; S339. Take the first historical test sample data as the collection result and end this collection.

5. The code vulnerability detection method according to claim 3, characterized in that: Processing and analyzing the sample data set corresponding to the certain code statement to determine the direction of the sample data gap corresponding to the certain code statement includes: According to the definition domain of the post-test code vulnerability classification label values ​​of the same type of code statements matching the certain code statement, statistical analysis is performed on the sample data set corresponding to the certain code statement to determine the distribution interval of the post-test code vulnerability classification label values ​​in the sample data set in the definition domain; Eliminating the distribution interval in the definition domain to obtain a distribution missing interval in the definition domain; According to the distribution missing interval, a sample data gap direction corresponding to the certain code statement is determined.

6. The code vulnerability detection method according to claim 1, characterized in that: For each of the code statements, the corresponding sample data set is applied to calibrate and verify the artificial intelligence model based on the machine learning algorithm to obtain the corresponding code vulnerability detection model, including: Get multiple AI models based on different machine learning algorithms; For a pair of statements and models in the at least one code statement and the multiple artificial intelligence models, the sample data set of the corresponding statement is applied, and the hyperparameters of the corresponding model are optimized based on the optimization algorithm to obtain the corresponding model hyperparameters and use them to make the objective function Minimize the optimization search results, where the objective function The calculation formula is as follows: In the formula, Indicates the output error indicator value of the artificial intelligence model, Indicates the time required for the calculation of the artificial intelligence model; Select the one with the smallest objective function from the multiple artificial intelligence models. An artificial intelligence model; The optimization search results of the hyperparameters of the artificial intelligence model and the model parameters obtained during the optimization process and corresponding to the optimization search results are imported into the artificial intelligence model to obtain a code vulnerability detection model corresponding to the code statement in the pair of statements and the model, wherein the code vulnerability detection model is used to output the post-test code vulnerability classification label prediction value of the corresponding statement after inputting the statement source code and context source code of the corresponding statement.

7. The code vulnerability detection method according to claim 6, characterized in that: For a pair of statements and models in the at least one code statement and the multiple artificial intelligence models, the sample data set of the corresponding statement is applied, and the hyperparameters of the corresponding model are optimized based on the optimization algorithm to obtain the corresponding model hyperparameters and use them to make the objective function The minimized optimized search results include the following steps S421 to S429: S421. For a pair of statements and models in the at least one code statement and the plurality of artificial intelligence models, initialize the corresponding and maximum number of iterations The optimization algorithm parameters are randomly generated, and an initial search value array of the parameter set to be optimized is then executed, wherein the parameter set to be optimized includes all hyperparameters of the artificial intelligence model in the pair of statements and models, and the initial search value array of the parameter set to be optimized is It is expressed as follows: In the formula, Indicates less than or equal to A positive integer, represents the total number of parameters in the parameter set to be optimized, Indicates the first The initial search value corresponding to the parameter, Indicates that The upper limit of the parameter search space corresponding to the parameters, Indicates that The lower limit of the parameter search space corresponding to the parameters, Represents a purely decimal random generator function; S422. Import the initial search value array of the parameter set to be optimized as a model hyperparameter into the artificial intelligence model in the pair of statements and the model to obtain a first artificial intelligence model, and then apply the sample data set corresponding to the code statement in the pair of statements and the model to perform model training and testing on the first artificial intelligence model to obtain a first output error situation index value and a first calculation time required index value, and finally import the first output error situation index value and the first calculation time required index value into the objective function , and the output result is used as the fitness corresponding to the initial search value array, and then step S423 is executed, wherein the objective function The calculation formula is as follows: In the formula, Indicates the output error indicator value of the artificial intelligence model, Indicates the time required for the calculation of the artificial intelligence model; S423. Use the initial search value array of the parameter set to be optimized as the current optimal search value array, and initialize the current number of iterations , and also initialize the prohibited change countdown value of each parameter in the parameter set to be optimized to zero, and then execute step S424; S424. Based on the current optimal search value array, each parameter in the parameter set to be optimized and whose current forbidden change countdown value is zero is independently increased and decreased to obtain the parameter set to be optimized. A new search value array is generated, and then step S425 is executed, wherein: represents the total number of parameters in the set of parameters to be optimized whose current forbidden change countdown value is zero, and ; S425. For the For each array in the new search value array, the corresponding array is imported as a model hyperparameter into the artificial intelligence model in the pair of statements and the model to obtain a second artificial intelligence model of the corresponding array, and then the sample data set corresponding to the code statement in the pair of statements and the model is applied to perform model training and testing on the second artificial intelligence model to obtain a second output error situation index value and a second calculation time required index value of the corresponding array, and finally the second output error situation index value and the second calculation time required index value are imported into the objective function , and use the output result as the fitness of the corresponding array, and then execute step S426; S426. For each array, the fitness corresponding to the current optimal search value array is subtracted from the fitness of the corresponding array to obtain the fitness difference value of the corresponding array, and when the fitness difference value is greater than zero and is the maximum fitness difference value this time, the forbidden change countdown value of the corresponding unique variable parameter is updated to a positive integer value positively correlated with the fitness difference value, and then step S427 is executed, wherein the unique variable parameter refers to the parameter in the parameter set to be optimized and is used to obtain the parameter of the corresponding array by increasing or decreasing the processing; S427. Determine whether there is any parameter in the set of parameters to be optimized whose current prohibited change countdown value is zero. If not, decrement the current prohibited change countdown value of each parameter in the set of parameters to be optimized by 1, and then return to step S427, otherwise, execute step S428; S428. Determine whether there is any fitness difference value greater than zero in the fitness difference values ​​of each array. If so, update the current optimal search value array to the value in the array. The array in the new search value array and corresponding to the minimum fitness, then execute step S429, otherwise directly execute step S429; S429. Make the current number of iterations Add 1 to the current number of iterations. Whether the maximum number of iterations has been reached If so, the current optimal search value array is used as the model hyperparameter corresponding to the certain pair of statements and the model and used to make the objective function Minimize the optimized search results, otherwise return to execute step S424.

8. The code vulnerability detection method according to claim 6, characterized in that: The multiple artificial intelligence models include artificial intelligence models based on graph neural networks, support vector machines, K nearest neighbor method, stochastic gradient descent method, multivariate linear regression, multilayer perceptron, decision tree, back propagation neural network and / or radial basis function network.

9. A code vulnerability detection system based on machine learning, characterized in that: It includes a statement code extraction unit, a context code extraction unit, a sample data collection unit, a vulnerability detection modeling unit, a detection model application unit and a detection result summary unit; The statement code extraction unit is used to obtain source code and extract statement source code of at least one code statement from the source code; The context code extraction unit is communicatively connected to the statement code extraction unit, and is used to extract corresponding context source code from the source code for each code statement in the at least one code statement; The sample data collection unit is communicatively connected to the statement code extraction unit, and is used for collecting the historical test sample data from all historical test sample data of the same type of code statements matching the corresponding statement using a data collection algorithm for each code statement, and adding the collection result to the corresponding sample data set, wherein the historical test sample data contains code features of the same type of code statements used as model input items and historical post-test code vulnerability classification label values ​​of the same type of code statements used as model output items, and the code features refer to numerical features obtained by converting the statement source code and context source code of the corresponding statement; The vulnerability detection modeling unit is communicatively connected to the sample data collection unit, and is used to apply the corresponding sample data set to each code statement, perform calibration verification modeling on the artificial intelligence model based on the machine learning algorithm, and obtain a corresponding code vulnerability detection model, wherein the code vulnerability detection model is used to output a predicted value of the post-test code vulnerability classification label of the corresponding statement after inputting the statement source code and context source code of the corresponding statement; The detection model application unit is respectively connected to the statement code extraction unit, the context code extraction unit and the vulnerability detection modeling unit, and is used to convert the corresponding statement source code and the context source code into the corresponding code features for each code statement, and then input the code features into the corresponding code vulnerability detection model, and output the corresponding post-test code vulnerability classification label prediction value; The detection result summary unit is communicatively connected to the detection model application unit, and is used to summarize the post-test code vulnerability classification label prediction value indicating that a corresponding code statement has a code vulnerability and the code statement corresponding to the post-test code vulnerability classification label prediction value, obtain the vulnerability detection result of the source code and give an alarm reminder.

10. A computer system, characterized in that: It includes a memory, a processor and a transceiver which are communicatively connected in sequence, wherein the memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program to execute the code vulnerability detection method as described in any one of claims 1 to 8.

Images