Source code vulnerability detection method based on improved AKC convolution and related device

Abstract

The invention discloses a source code vulnerability detection method and related device based on improved AKC convolution, and the method comprises the steps: obtaining a to-be-detected source code, carrying out the code preprocessing of the to-be-detected source code, and forming a preprocessed to-be-detected source code; analyzing and processing the preprocessed to-be-detected source code based on a static tool, and generating a program dependency graph according to an analysis result; performing image conversion processing on the program dependency graph based on a preset algorithm to generate a conversion image which is formed by combining vectors in an RGB image format; the converted image is input into a code vulnerability detection model for detection processing, a vulnerability detection result of the source code to be detected is obtained, and an improved changeable convolution kernel AKC structure is embedded in the code vulnerability detection model. In the embodiment of the invention, compared with the existing method for detecting the vulnerability of various source codes, the method for detecting the vulnerability of the source codes has the advantage that the detection precision, the false alarm rate and other data are improved to a certain extent.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a source code vulnerability detection method based on improved AKC convolution and a related device. Background Art

[0002] In recent years, with the development of computer science, relevant software in various fields of society have emerged in an endless stream; however, this is followed by a rapid increase in software vulnerabilities, which show the characteristics of complexity and diversity. These complex software vulnerabilities have brought many challenges to social production; code vulnerability refers to some defects or vulnerabilities in the software code, which can easily cause the software to exhibit unsafe behavior when it is attacked by malicious attacks. Vulnerabilities may arise from design flaws, coding errors, system configuration problems, or insufficient security policies; in the software development process, identifying and repairing these vulnerabilities is a key step to ensure software security; according to the latest data from the National Vulnerability Database (NVD) of the United States, as of 2024, approximately 150,000 vulnerabilities have been recorded in the database, which is a very large number; therefore, an efficient, stable, and automated source code vulnerability detection system is very necessary to ensure the robustness and reliability of the system.

[0003] Most of the early source code vulnerability detection methods were based on source code similarity for comparison and detection, or based on rules formulated by some experts for comparative analysis, so as to find out the vulnerable parts in the code and identify potential vulnerability threats; however, this traditional method has certain limitations. The vulnerability detection method based on code similarity is prone to high false positive and false negative rates. If the similarity algorithm is not designed carefully enough, it is easy to mistakenly report normal code as a vulnerability; if the code expression of the vulnerability is not exactly the same as the known vulnerability pattern, the system cannot correctly identify it; and the rule-based vulnerability detection method also has some problems. For example, the coverage of the rules is not wide enough to cover all known and unknown vulnerabilities. At the same time, the writing of rules is also relatively complex. It may be very difficult to write accurate rules. It requires a deep understanding of the vulnerability mechanism and the context of the code, and frequent updates of the rules to maintain the accuracy of vulnerability detection.

[0004] In recent years, the field of deep learning has developed rapidly, bringing great innovations to the field of vulnerability detection. Deep learning methods can automatically learn the characteristics and patterns of vulnerable source code from massive source code data without human intervention, and can be combined with many methods with high scalability. In addition, deep learning methods can detect some more complex vulnerabilities and better improve the accuracy of vulnerability detection. These advantages of deep learning have led to many current source code vulnerability detection methods being studied on the basis of deep learning.

[0005] With the development of deep learning technology in recent years, many methods have emerged that combine deep learning technology with source code vulnerability detection, including using large models to assist in the analysis and detection of vulnerable source code, and using the detection results of large models as new data sets to fine-tune pre-trained detection models, thereby improving the training accuracy of source code vulnerability detection pre-trained models, processing code into a plain text representation, using natural language processing methods to embed code, and using static tools to process code into a graph structure, input into a graph neural network for analysis, or analyze code by analyzing code structure graphs to generate image structure data, and then input into a convolutional network for detection; Although the above methods have their own unique advantages, there are still many areas for improvement; In early vulnerability detection research, many methods used public or custom vulnerability sets, used similarity matching algorithms to match similar vulnerabilities in the vulnerability set, and located the fragments where the vulnerabilities were generated, so as to achieve the purpose of detecting vulnerabilities. However, vulnerabilities in the real world are dynamically changing. This method may result in the inability to fully match vulnerabilities in the real world, and can only detect some vulnerabilities that exist in the established vulnerability set, and the generalization is not high; This leads to missed detection in real applications. Summary of the invention

[0006] The purpose of the present invention is to overcome the shortcomings of the prior art. The present invention provides a source code vulnerability detection method based on improved AKC convolution and related devices. Compared with various existing source code vulnerability detection methods, the detection accuracy, false alarm rate and other data have been improved to a certain extent.

[0007] In order to solve the above technical problems, an embodiment of the present invention provides a source code vulnerability detection method based on improved AKC convolution, the method comprising:

[0008] Obtaining a source code to be detected, and performing code preprocessing on the source code to be detected to form a preprocessed source code to be detected;

[0009] Analyze and process the preprocessed source code to be tested based on static tools, and generate a program dependency graph based on the analysis results;

[0010] Performing image conversion processing on the program dependency graph based on a preset algorithm to generate a conversion image, wherein the conversion image is composed of vectors in RGB image format;

[0011] The converted image is input into a code vulnerability detection model for detection processing to obtain a vulnerability detection result of the source code to be detected, wherein the code vulnerability detection model is embedded with an improved changeable convolution kernel AKC structure; the improved AKC structure consists of defining an initial sampling position, an attention structure and a deformable convolution operation.

[0012] Optionally, the performing code preprocessing on the source code to be detected to form the preprocessed source code to be detected includes:

[0013] Identifying comment information in the source code to be detected, and deleting the identified comment information to obtain the source code to be detected after deletion;

[0014] Obtaining the manually defined non-standard variable names and manually defined non-standard function names in the source code to be detected after deletion;

[0015] The manually defined non-standard variable names are mapped one by one to standard symbol names, and the manually defined non-standard function names are mapped one by one to standard function names, so as to form the preprocessed source code to be detected.

[0016] Optionally, the method of analyzing the preprocessed source code to be detected based on a static tool and generating a program dependency graph according to the analysis result includes:

[0017] Analyze the preprocessed source code to be detected based on the static tool to generate a code control flow graph, wherein a node in the code control flow graph represents a function statement, and the edges of the code control flow graph are all directed edges, and the directed edge between two nodes represents the execution order and branch relationship between the two statements;

[0018] The program dependency graph is generated based on dependencies between nodes of the code control flow graph.

[0019] Optionally, performing image conversion processing on the program dependency graph based on a preset algorithm to generate a converted image includes:

[0020] The degree centrality of each node in the program dependency graph is calculated based on the degree centrality algorithm to obtain the degree centrality vector of each node in the program dependency graph, wherein the degree centrality vector is used to represent the vector of the measure of the node centrality, and the larger the measure value of the degree centrality corresponding to the node is, the more important the node is;

[0021] Based on the closeness centrality algorithm, the closeness centrality between each node in the program dependency graph is calculated to obtain the closeness centrality vector of each node in the program dependency graph, wherein the closeness centrality vector is used to represent the vector of the average length of the shortest path from a node to other nodes, and the closer the node is to other nodes, the higher its closeness centrality;

[0022] Calculate the second-order centrality of nodes in the program dependency graph based on a second-order centrality algorithm to obtain a second-order centrality vector of each node in the program dependency graph, wherein the second-order centrality vector is used to represent a vector of standard deviation of a random walk return time of a node;

[0023] The transformation image is generated based on the degree centrality vector, the closeness centrality vector and the second-order centrality vector of each node in the program dependency graph.

[0024] Optionally, generating the conversion image based on the degree centrality vector, the closeness centrality vector, and the second-order centrality vector of each node in the program dependency graph includes:

[0025] Multiply all vectors in the degree centrality vector by the numerical value calculated by the degree centrality algorithm, and sort the first multiplication results one by one to form a first update vector;

[0026] Multiply all vectors in the proximity centrality vector by the value calculated by the proximity centrality algorithm, and sort the second multiplication results one by one to form a second update vector;

[0027] Multiply all vectors in the second-order centrality vector by the numerical value calculated by the second-order centrality algorithm, and sort the third multiplication results one by one to form a third update vector;

[0028] The first update vector, the second update vector and the third update vector are combined and processed according to the format of an RGB image to generate the conversion image.

[0029] Optionally, the initial sampling position is defined by generating a regular sampling grid from the sampling grid, and defining the initial sampling position with the regular sampling grid as the center;

[0030] The attention structure is used to map the feature set X of the input node to query(Q), key(K), and value(V), where query(Q) represents a given request query Q, key(K) represents a given key value K, and value(V) represents a given attribute value V, and Q = XW Q , K = XW K 、V=XW V .

[0031] Optionally, the attention structure is calculated as follows:

[0032]

[0033] Among them, d out represents the dimension of Q; W Q , W K , W V Represents three different weight parameters that need to be trained;

[0034] For node x v and x u , the self-attention calculation process is as follows:

[0035]

[0036] f(x u )=W v x v ;

[0037] Among them, <.,.> represents the dot product between two nodes.

[0038] In addition, an embodiment of the present invention further provides a source code vulnerability detection device based on improved AKC convolution, the device comprising:

[0039] Preprocessing module: used for obtaining source code to be detected, performing code preprocessing on the source code to be detected, and forming preprocessed source code to be detected;

[0040] Graph generation module: used to analyze and process the preprocessed source code to be detected based on static tools, and generate a program dependency graph based on the analysis results;

[0041] A graph conversion module: used for performing image conversion processing on the program dependency graph based on a preset algorithm to generate a conversion image, wherein the conversion image is composed of vectors in RGB image format;

[0042] Detection module: used for inputting the conversion image into the code vulnerability detection model for detection processing to obtain the vulnerability detection result of the source code to be detected, wherein the code vulnerability detection model is embedded with an improved changeable convolution kernel AKC structure; the improved AKC structure consists of defining an initial sampling position, an attention structure and a deformable convolution operation.

[0043] In addition, an embodiment of the present invention further provides an electronic device, which includes a processor and a memory, wherein the memory is used to store instructions, and the processor is used to call the instructions in the memory, so that the electronic device executes the source code vulnerability detection method as described in any one of the above.

[0044] In addition, an embodiment of the present invention further provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes the source code vulnerability detection method as described in any one of the above.

[0045] In an embodiment of the present invention, code preprocessing is performed on the source code to be detected to form the preprocessed source code to be detected; the preprocessed source code to be detected is analyzed and processed based on a static tool, and a program dependency graph is generated according to the analysis result; image conversion processing is performed on the program dependency graph based on a preset algorithm to generate a conversion image, and the conversion image is composed of vectors in RGB image format; the conversion image is input into a code vulnerability detection model for detection processing to obtain the vulnerability detection result of the source code to be detected, and the code vulnerability detection model is embedded with an improved changeable convolution kernel AKC structure; compared with various existing source code vulnerability detection methods, the detection accuracy, false alarm rate and other data have been improved to a certain extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 It is a flowchart of a source code vulnerability detection method of an improved AKC convolution in an embodiment of the present invention;

[0048] Figure 2 is a flow chart of a source code vulnerability detection method of an improved AKC convolution in another embodiment of the present invention;

[0049] Figure 3 It is a schematic diagram of the structure of a source code vulnerability detection device of an improved AKC convolution in an embodiment of the present invention;

[0050] Figure 4 is a schematic diagram of the structure of an electronic device in an embodiment of the present invention;

[0051] Figure 5 It is a flow chart of the preprocessing of the source code to be detected in the embodiment of the present invention. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] For example, see Figure 1 , Figure 1It is a flowchart of the source code vulnerability detection method of the improved AKC convolution in the embodiment of the present invention.

[0054] like Figure 1 As shown, a source code vulnerability detection method based on improved AKC convolution, the method comprising:

[0055] S101: obtaining a source code to be detected, and performing code preprocessing on the source code to be detected to form a preprocessed source code to be detected;

[0056] In the specific implementation process of the present invention, the code preprocessing of the source code to be detected to form the preprocessed source code to be detected includes: identifying the comment information in the source code to be detected, and deleting the identified comment information to obtain the deleted source code to be detected; obtaining the manually defined non-standard variable names and manually defined non-standard function names in the deleted source code to be detected; mapping the manually defined non-standard variable names to standard symbol names one by one, and mapping the manually defined non-standard function names to standard function names one by one to form the preprocessed source code to be detected.

[0057] Specifically, since this technical solution focuses on detecting code vulnerabilities at the function code line level; for vulnerability detection methods of other granularities, it is more appropriate to focus on source code vulnerability detection for function code lines; because compared with the vulnerability detection method at the slice level, detection at the function code line granularity can obtain more vulnerability signatures, and compared with the vulnerability detection method at the file level, it will have higher detection accuracy. In the process of writing code, code writers often use different names to name variables and function blocks according to project requirements or personal writing habits, and also add a lot of comment information; comment information is not helpful for our source code vulnerability detection process, but will affect the embedding process of code nodes, generate a lot of noise, and thus greatly affect the results of source code vulnerability detection.

[0058] Therefore, the following three steps are used to abstract and normalize the source code: delete all comments in the code, because they are irrelevant to the semantics of the program and will affect the performance of code vulnerability detection; map manually defined non-standard variable names to standard symbol names (for example, map number1 to VAR1); map manually defined non-standard function names to standard function names (for example, map apple to FUN1); Figure 5 shown.

[0059] S102: Analyze and process the preprocessed source code to be detected based on a static tool, and generate a program dependency graph according to the analysis result;

[0060] In the specific implementation process of the present invention, the preprocessed source code to be detected is analyzed and processed based on the static tool, and a program dependency graph is generated according to the analysis results, including: based on the static tool, the preprocessed source code to be detected is analyzed to generate a code control flow graph, wherein a node in the code control flow graph represents a function statement, and the edges of the code control flow graph are all directed edges, and the directed edge between two nodes represents the execution order and branch relationship between the two statements; the program dependency graph is generated based on the dependencies between the nodes of the code control flow graph.

[0061] Specifically, we need to use the static tool Joern, a tool mainly used for code analysis for C / C++ language, to generate the PDG (Program Dependency Graph) of the source code. Before generating the PDG graph, Joern will first generate a CFG graph for the source code; CFG represents the control flow graph of the code, in which a node represents a function statement. The edges of the CFG graph are all directed edges. The directed edge between two nodes represents the execution order and branch relationship between the two statements; if there are two nodes in the control flow graph with a directed edge, A->B, and the value calculated in the A statement will be used by the B statement, then A is called the data dependency of B; if whether B is executed depends on the execution result of A, then A is called the control dependency of B; PDG is a graph representation method that contains all the control flow and data flow relationships of the source code. A node in the PDG also corresponds to a line of code in the function. We use the Sent2Vec model to embed all nodes in the PDG graph and convert them into fixed-length vectors; specifically, two embedding methods are used to embed the source code to generate three fixed-length vectors with a fixed dimension of 128.

[0062] S103: performing image conversion processing on the program dependency graph based on a preset algorithm to generate a conversion image, wherein the conversion image is composed of vectors in RGB image format;

[0063] In the specific implementation process of the present invention, the program dependency graph is image converted based on a preset algorithm to generate a conversion image, including: calculating the degree centrality of each node in the program dependency graph based on a degree centrality algorithm to obtain a degree centrality vector of each node in the program dependency graph, the degree centrality vector is used to represent a vector of measures of node centrality, and the larger the measure value of the degree centrality of the node, the more important the node is; calculating the proximity centrality between each node in the program dependency graph based on a closeness centrality algorithm to obtain a closeness centrality vector of each node in the program dependency graph, the closeness centrality vector is used to represent a vector of the average length of the shortest path from a node to other nodes, and the closer the node is to other nodes, the higher its closeness centrality; calculating the second-order centrality of the nodes in the program dependency graph based on a second-order centrality algorithm to obtain a second-order centrality vector of each node in the program dependency graph, the second-order centrality vector is used to represent a vector of the standard deviation of the random walk return time of the node; generating the conversion image based on the degree centrality vector, closeness centrality vector and second-order centrality vector of each node in the program dependency graph.

[0064] Furthermore, the method of generating the conversion image based on the degree centrality vector, the proximity centrality vector and the second-order centrality vector of each node in the program dependency graph includes: multiplying all the vectors in the degree centrality vector with the numerical values ​​calculated by the degree centrality algorithm, and sorting the first multiplication results one by one to form a first update vector; multiplying all the vectors in the proximity centrality vector with the numerical values ​​calculated by the proximity centrality algorithm, and sorting the second multiplication results one by one to form a second update vector; multiplying all the vectors in the second-order centrality vector with the numerical values ​​calculated by the second-order centrality algorithm, and sorting the third multiplication results one by one to form a third update vector; and combining the first update vector, the second update vector and the third update vector in the format of an RGB image to generate the conversion image.

[0065] Specifically, after obtaining the program dependency graph, each node in the program dependency graph is no longer represented by the initial method, but is represented by a vector instead; the goal is to fully obtain and retain the program semantics of different code lines, and convert them into the form of images, and finally detect the vulnerability of the code through image detection methods; in order to achieve this goal, we consider the PDG graph as a social network, and use the centrality analysis method commonly used in social networks to process the PDG graph, so as to obtain the importance of all code lines in the PDG graph; because a normal image usually contains three different channels (R, G, B), the three channels are combined into a complete image, based on this feature, three different centrality algorithms are selected: closeness centrality, degree centrality and second-order centrality to calculate the importance of different nodes.

[0066] Degree centrality is the most direct measure of node centrality. The larger the value of degree centrality, the more important the node is. Degree centrality is normalized by dividing by the maximum possible degree in the graph, N-1, where N is the number of nodes in the graph. The degree centrality of a node is calculated as follows:

[0067]

[0068] Closeness centrality takes into account the average length of the shortest path from each node to other nodes; that is, for a node, the closer it is to other nodes, the higher its closeness centrality; the closeness centrality of a node is calculated as follows:

[0069]

[0070] Second-order centrality describes the standard deviation of the return time of a node's random walk; each node records the time elapsed between visits by this random walk, and calculates the standard deviation (or second-order moment) of such return times; the key point is that central nodes see random walks regularly compared to other topological nodes; standard deviation can be used to accurately identify key nodes as well as globally characterize graph topology; lower values ​​of second-order centrality indicate higher centrality; second-order centrality is normalized, and the larger the normalized value, the higher the centrality; it is calculated as follows:

[0071]

[0072] First, perform centrality analysis on all nodes of the processed PDG graph (taking second-order centrality as an example) to collect the second-order centrality vectors of all nodes; then, multiply all vectors with the values ​​obtained by the centrality algorithm, and then arrange them one by one to form a new vector; which becomes a centrality channel; similarly, use the remaining two centrality algorithms to perform the same operation to obtain other two different degree channels; finally, combine these three channels in the format of RGB images to form an image; the specific method is shown in Table 1.

[0073] Table 1

[0074]

[0075] Simply put, the input of the image generation part is a PDG graph in which all nodes are vectors, and the output is a vector combination in RGB image format.

[0076] S104: Inputting the converted image into a code vulnerability detection model for detection processing to obtain a vulnerability detection result of the source code to be detected, wherein the code vulnerability detection model is embedded with an improved changeable convolution kernel AKC structure; the improved AKC structure consists of defining an initial sampling position, an attention structure, and a deformable convolution operation.

[0077] In the specific implementation process of the present invention, the definition of the initial sampling position is to generate a regular sampling grid from the sampling grid, and define the initial sampling position with the regular sampling grid as the center; the attention structure is used to map the feature set X of the input node to query(Q), key(K), value(V), query(Q) represents a given request query Q, key(K) represents a given key value K, value(V) represents a given attribute value V, and Q=XW Q , K = XW K 、V=XW V .

[0078] Furthermore, the attention structure is calculated as follows:

[0079]

[0080] Among them, d out represents the dimension of Q; W Q , W K , W V Represents three different weight parameters that need to be trained; for node x v and x u , the self-attention calculation process is as follows:

[0081]

[0082] f(x u )=W v x v ;

[0083] Among them, <.,.> represents the dot product between two nodes.

[0084] Specifically, the deformable convolution AKConv increases the performance of the network through an offset to flexibly adjust the sampling shape convolution kernel to adapt to changes in the target; based on AKConv, a new attention mechanism is added to its structure. This new attention extracts the subgraph representation rooted in each node before calculating the attention, and merges the structural information into the original attention; the performance achieved in some graphics tasks is often better; the improved AKC structure mainly consists of three parts: defining the initial sampling position, the attention structure, and the deformable convolution operation.

[0085] Define the initial sampling position: The process of defining the initial sampling position will first generate the convolution kernel P nThe initial sampling coordinates of the convolution operation are: first, the sampling grid is generated as a regular sampling grid, then an irregular network is created for the remaining sampling points, and finally they are connected to generate an overall sampling network. The regular sampling grid is centered at point (0,0). Although the irregular convolution has no center in many sizes and shapes, in order to adapt to the convolution size used, the upper left corner (0,0) point is set as the sampling origin in the algorithm. After defining the initial coordinates P of the irregular convolution, b After that, the convolution operation corresponding to position P0 is defined as follows:

[0086] Conv(P0)=∑w×(P0+P n );

[0087] Attention structure: In the attention module, the feature set X of the input node is mapped to query(Q), key(K), and value(V), where query(Q) represents the given request query Q, key(K) represents the given key value K, and value(V) represents the given attribute value V, and Q = XW Q , K = XW K 、V=XW V ; The calculation of the attention structure is as follows:

[0088]

[0089] Among them, d out represents the dimension of Q; W Q , W K , W V Represents three different weight parameters that need to be trained;

[0090] For node x v and x u , the self-attention calculation process is as follows:

[0091]

[0092] f(x u )=W v x v ;

[0093] Among them, <.,.> represents the dot product between two nodes.

[0094] In this model, the node vector representation obtained by structure extraction is used as the input of Q and W of the transformer structure, and the sentence embedding vector of each node is used as the input of V; the self-attention mechanism calculation formula of each node is as follows:

[0095]

[0096] in, Represents the node vector representation extracted from node v in the structure extraction stage after position encoding.

[0097] In this way, the converted image can be input into the code vulnerability detection model for detection processing to obtain the vulnerability detection result of the source code to be detected.

[0098] In an embodiment of the present invention, code preprocessing is performed on the source code to be detected to form the preprocessed source code to be detected; the preprocessed source code to be detected is analyzed and processed based on a static tool, and a program dependency graph is generated according to the analysis result; image conversion processing is performed on the program dependency graph based on a preset algorithm to generate a conversion image, and the conversion image is composed of vectors in RGB image format; the conversion image is input into a code vulnerability detection model for detection processing to obtain the vulnerability detection result of the source code to be detected, and the code vulnerability detection model is embedded with an improved changeable convolution kernel AKC structure; compared with various existing source code vulnerability detection methods, the detection accuracy, false alarm rate and other data have been improved to a certain extent.

[0099] For example 2, please refer to Figure 2 , Figure 2 It is a flowchart of a source code vulnerability detection method of an improved AKC convolution in another embodiment of the present invention.

[0100] like Figure 2 As shown, a source code vulnerability detection method based on improved AKC convolution, the method comprising:

[0101] S201: obtaining a source code to be detected, and performing code preprocessing on the source code to be detected to form a preprocessed source code to be detected;

[0102] S202: Analyze and process the preprocessed source code to be detected based on a static tool, and generate a program dependency graph according to the analysis result;

[0103] S203: Calculate the degree centrality of each node in the program dependency graph based on a degree centrality algorithm to obtain a degree centrality vector of each node in the program dependency graph, wherein the degree centrality vector is used to represent a vector of a measure of the node centrality, and the larger the measure value of the degree centrality corresponding to the node is, the more important the node is;

[0104] S204: Calculating the closeness centrality between the nodes in the program dependency graph based on a closeness centrality algorithm to obtain a closeness centrality vector of each node in the program dependency graph, wherein the closeness centrality vector is used to represent a vector of an average length of the shortest path from a node to other nodes, and the closer the node is to other nodes, the higher its closeness centrality;

[0105] S205: Calculate the second-order centrality of the nodes in the program dependency graph based on a second-order centrality algorithm to obtain a second-order centrality vector of each node in the program dependency graph, where the second-order centrality vector is used to represent a vector of the standard deviation of the random walk return time of the node;

[0106] S206: generating the conversion image based on the degree centrality vector, the closeness centrality vector and the second-order centrality vector of each node in the program dependency graph;

[0107] S207: Input the converted image into a code vulnerability detection model for detection processing to obtain a vulnerability detection result of the source code to be detected, wherein the code vulnerability detection model is embedded with an improved changeable convolution kernel AKC structure; the improved AKC structure consists of defining an initial sampling position, an attention structure and a deformable convolution operation.

[0108] The specific implementation of the second embodiment can be found in the above embodiments, which will not be described in detail here.

[0109] For example 3, please refer to Figure 3 , Figure 3 It is a schematic diagram of the structure of a source code vulnerability detection device of an improved AKC convolution in an embodiment of the present invention.

[0110] like Figure 3 As shown, a source code vulnerability detection device based on improved AKC convolution, the device comprises:

[0111] Preprocessing module 301: used to obtain source code to be detected, perform code preprocessing on the source code to be detected, and form preprocessed source code to be detected;

[0112] In the specific implementation process of the present invention, the code preprocessing of the source code to be detected to form the preprocessed source code to be detected includes: identifying the comment information in the source code to be detected, and deleting the identified comment information to obtain the deleted source code to be detected; obtaining the manually defined non-standard variable names and manually defined non-standard function names in the deleted source code to be detected; mapping the manually defined non-standard variable names to standard symbol names one by one, and mapping the manually defined non-standard function names to standard function names one by one to form the preprocessed source code to be detected.

[0113] Specifically, since this technical solution focuses on detecting code vulnerabilities at the function code line level; for vulnerability detection methods of other granularities, it is more appropriate to focus on source code vulnerability detection for function code lines; because compared with the vulnerability detection method at the slice level, detection at the function code line granularity can obtain more vulnerability signatures, and compared with the vulnerability detection method at the file level, it will have higher detection accuracy. In the process of writing code, code writers often use different names to name variables and function blocks according to project requirements or personal writing habits, and also add a lot of comment information; comment information is not helpful for our source code vulnerability detection process, but will affect the embedding process of code nodes, generate a lot of noise, and thus greatly affect the results of source code vulnerability detection.

[0114] Therefore, the following three steps are used to abstract and normalize the source code: delete all comments in the code, because they are irrelevant to the semantics of the program and will affect the performance of code vulnerability detection; map manually defined non-standard variable names to standard symbol names (for example, map number1 to VAR1); map manually defined non-standard function names to standard function names (for example, map apple to FUN1); Figure 5 shown.

[0115] Graph generation module 302: used to analyze and process the preprocessed source code to be detected based on static tools, and generate a program dependency graph according to the analysis results;

[0116] In the specific implementation process of the present invention, the preprocessed source code to be detected is analyzed and processed based on the static tool, and a program dependency graph is generated according to the analysis results, including: based on the static tool, the preprocessed source code to be detected is analyzed to generate a code control flow graph, wherein a node in the code control flow graph represents a function statement, and the edges of the code control flow graph are all directed edges, and the directed edge between two nodes represents the execution order and branch relationship between the two statements; the program dependency graph is generated based on the dependencies between the nodes of the code control flow graph.

[0117] Specifically, we need to use the static tool Joern, a tool mainly used for code analysis for C / C++ language, to generate the PDG (Program Dependency Graph) of the source code. Before generating the PDG graph, Joern will first generate a CFG graph for the source code; CFG represents the control flow graph of the code, in which a node represents a function statement. The edges of the CFG graph are all directed edges. The directed edge between two nodes represents the execution order and branch relationship between the two statements; if there are two nodes in the control flow graph with a directed edge, A->B, and the value calculated in the A statement will be used by the B statement, then A is called the data dependency of B; if whether B is executed depends on the execution result of A, then A is called the control dependency of B; PDG is a graph representation method that contains all the control flow and data flow relationships of the source code. A node in the PDG also corresponds to a line of code in the function. We use the Sent2Vec model to embed all nodes in the PDG graph and convert them into fixed-length vectors; specifically, two embedding methods are used to embed the source code to generate three fixed-length vectors with a fixed dimension of 128.

[0118] Graph conversion module 303: used to perform image conversion processing on the program dependency graph based on a preset algorithm to generate a conversion image, wherein the conversion image is composed of vectors in RGB image format;

[0119] In the specific implementation process of the present invention, the program dependency graph is image converted based on a preset algorithm to generate a conversion image, including: calculating the degree centrality of each node in the program dependency graph based on a degree centrality algorithm to obtain a degree centrality vector of each node in the program dependency graph, the degree centrality vector is used to represent a vector of measures of node centrality, and the larger the measure value of the degree centrality of the node, the more important the node is; calculating the proximity centrality between each node in the program dependency graph based on a closeness centrality algorithm to obtain a closeness centrality vector of each node in the program dependency graph, the closeness centrality vector is used to represent a vector of the average length of the shortest path from a node to other nodes, and the closer the node is to other nodes, the higher its closeness centrality; calculating the second-order centrality of the nodes in the program dependency graph based on a second-order centrality algorithm to obtain a second-order centrality vector of each node in the program dependency graph, the second-order centrality vector is used to represent a vector of the standard deviation of the random walk return time of the node; generating the conversion image based on the degree centrality vector, closeness centrality vector and second-order centrality vector of each node in the program dependency graph.

[0120] Furthermore, the method of generating the conversion image based on the degree centrality vector, the proximity centrality vector and the second-order centrality vector of each node in the program dependency graph includes: multiplying all the vectors in the degree centrality vector with the numerical values ​​calculated by the degree centrality algorithm, and sorting the first multiplication results one by one to form a first update vector; multiplying all the vectors in the proximity centrality vector with the numerical values ​​calculated by the proximity centrality algorithm, and sorting the second multiplication results one by one to form a second update vector; multiplying all the vectors in the second-order centrality vector with the numerical values ​​calculated by the second-order centrality algorithm, and sorting the third multiplication results one by one to form a third update vector; and combining the first update vector, the second update vector and the third update vector in the format of an RGB image to generate the conversion image.

[0121] Specifically, after obtaining the program dependency graph, each node in the program dependency graph is no longer represented by the initial method, but is represented by a vector instead; the goal is to fully obtain and retain the program semantics of different code lines, and convert them into the form of images, and finally detect the vulnerability of the code through image detection methods; in order to achieve this goal, we consider the PDG graph as a social network, and use the centrality analysis method commonly used in social networks to process the PDG graph, so as to obtain the importance of all code lines in the PDG graph; because a normal image usually contains three different channels (R, G, B), the three channels are combined into a complete image, based on this feature, three different centrality algorithms are selected: closeness centrality, degree centrality and second-order centrality to calculate the importance of different nodes.

[0122] Degree centrality is the most direct measure of node centrality. The larger the value of degree centrality, the more important the node is. Degree centrality is normalized by dividing by the maximum possible degree in the graph, N-1, where N is the number of nodes in the graph. The degree centrality of a node is calculated as follows:

[0123]

[0124] Closeness centrality takes into account the average length of the shortest path from each node to other nodes; that is, for a node, the closer it is to other nodes, the higher its closeness centrality; the closeness centrality of a node is calculated as follows:

[0125]

[0126] Second-order centrality describes the standard deviation of the return time of a node's random walk; each node records the time elapsed between visits by this random walk, and calculates the standard deviation (or second-order moment) of such return times; the key point is that central nodes see random walks regularly compared to other topological nodes; standard deviation can be used to accurately identify key nodes as well as globally characterize graph topology; lower values ​​of second-order centrality indicate higher centrality; second-order centrality is normalized, and the larger the normalized value, the higher the centrality; it is calculated as follows:

[0127]

[0128] First, perform centrality analysis on all nodes of the processed PDG graph (taking second-order centrality as an example) to collect the second-order centrality vectors of all nodes; then, multiply all vectors with the values ​​obtained by the centrality algorithm, and then arrange them one by one to form a new vector; which becomes a centrality channel; similarly, use the remaining two centrality algorithms to perform the same operation to obtain other two different degree channels; finally, combine these three channels in the format of RGB images to form an image; the specific method is shown in Table 1.

[0129] Table 1

[0130]

[0131] Simply put, the input of the image generation part is a PDG graph in which all nodes are vectors, and the output is a vector combination in RGB image format.

[0132] Detection module 304: used to input the converted image into a code vulnerability detection model for detection processing to obtain the vulnerability detection result of the source code to be detected, wherein the code vulnerability detection model is embedded with an improved changeable convolution kernel AKC structure; the improved AKC structure consists of defining an initial sampling position, an attention structure and a deformable convolution operation.

[0133] In the specific implementation process of the present invention, the definition of the initial sampling position is to generate a regular sampling grid from the sampling grid, and define the initial sampling position with the regular sampling grid as the center; the attention structure is used to map the feature set X of the input node to query(Q), key(K), value(V), query(Q) represents a given request query Q, key(K) represents a given key value K, value(V) represents a given attribute value V, and Q=XW Q , K = XW K 、V=XW V .

[0134] Furthermore, the attention structure is calculated as follows:

[0135]

[0136] Among them, d out represents the dimension of Q; W Q , W K , W V Represents three different weight parameters that need to be trained; for node x v and x u , the self-attention calculation process is as follows:

[0137]

[0138] f(x u )=W v x v ;

[0139] Among them, <.,.> represents the dot product between two nodes.

[0140] Specifically, the deformable convolution AKConv increases the performance of the network through an offset to flexibly adjust the sampling shape convolution kernel to adapt to changes in the target; based on AKConv, a new attention mechanism is added to its structure. This new attention extracts the subgraph representation rooted in each node before calculating the attention, and merges the structural information into the original attention; the performance achieved in some graphics tasks is often better; the improved AKC structure mainly consists of three parts: defining the initial sampling position, the attention structure, and the deformable convolution operation.

[0141] Define the initial sampling position: The process of defining the initial sampling position will first generate the convolution kernel P n The initial sampling coordinates of the convolution operation are: first, the sampling grid is generated as a regular sampling grid, then an irregular network is created for the remaining sampling points, and finally they are connected to generate an overall sampling network. The regular sampling grid is centered at point (0,0). Although the irregular convolution has no center in many sizes and shapes, in order to adapt to the convolution size used, the upper left corner (0,0) point is set as the sampling origin in the algorithm. After defining the initial coordinates P of the irregular convolution, b After that, the convolution operation corresponding to position P0 is defined as follows:

[0142] Conv(P0)=∑w×(P0+P n );

[0143] Attention structure: In the attention module, the feature set X of the input node is mapped to query(Q), key(K), and value(V), where query(Q) represents the given request query Q, key(K) represents the given key value K, and value(V) represents the given attribute value V, and Q = XW Q, K = XW K 、V=XW V ; The calculation of the attention structure is as follows:

[0144]

[0145] Among them, d out represents the dimension of Q; W Q , W K , W V Represents three different weight parameters that need to be trained;

[0146] For node x v and x u , the self-attention calculation process is as follows:

[0147]

[0148] f(x u )=W v x v ;

[0149] Among them, <.,.> represents the dot product between two nodes.

[0150] In this model, the node vector representation obtained by structure extraction is used as the input of Q and W of the transformer structure, and the sentence embedding vector of each node is used as the input of V; the self-attention mechanism calculation formula of each node is as follows:

[0151]

[0152] in, Represents the node vector representation extracted from node v in the structure extraction stage after position encoding.

[0153] In this way, the converted image can be input into the code vulnerability detection model for detection processing to obtain the vulnerability detection result of the source code to be detected.

[0154] In an embodiment of the present invention, code preprocessing is performed on the source code to be detected to form the preprocessed source code to be detected; the preprocessed source code to be detected is analyzed and processed based on a static tool, and a program dependency graph is generated according to the analysis result; image conversion processing is performed on the program dependency graph based on a preset algorithm to generate a conversion image, and the conversion image is composed of vectors in RGB image format; the conversion image is input into a code vulnerability detection model for detection processing to obtain the vulnerability detection result of the source code to be detected, and the code vulnerability detection model is embedded with an improved changeable convolution kernel AKC structure; compared with various existing source code vulnerability detection methods, the detection accuracy, false alarm rate and other data have been improved to a certain extent.

[0155] A computer-readable storage medium is provided in an embodiment of the present invention, wherein a computer program is stored on the computer-readable storage medium, and when the program is executed by a processor, a source code vulnerability detection method of any one of the above embodiments is implemented. The computer-readable storage medium includes, but is not limited to, any type of disk (including floppy disk, hard disk, optical disk, CD-ROM, and magneto-optical disk), ROM (Read-Only Memory), RAM (Random Access Memory), EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory, magnetic card or optical card. That is, the storage device includes any medium that can store or transmit information in a readable form by a device (for example, a computer, a mobile phone), which can be a read-only memory, a disk or an optical disk, etc.

[0156] An embodiment of the present invention further provides a computer application program, which runs on a computer and is used to execute the source code vulnerability detection method of any one of the above embodiments.

[0157] also, Figure 4 It is a schematic diagram of the structure of an electronic device in an embodiment of the present invention.

[0158] The embodiment of the present invention further provides an electronic device, such as Figure 4 The electronic device includes a processor 402, a memory 403, an input unit 404, a display unit 405 and other devices. Those skilled in the art will understand that Figure 4 The structural components of the electronic device shown do not constitute a limitation on all devices, and may include more or fewer components than shown, or combine certain components. The memory 403 can be used to store the application 401 and various functional modules, and the processor 402 runs the application 401 stored in the memory 403, thereby executing various functional applications and data processing of the device. The memory can be an internal memory or an external memory, or include both internal and external memories. The internal memory may include a read-only memory (ROM), a programmable ROM (PROM), an electrically programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a flash memory, or a random access memory. The external memory may include a hard disk, a floppy disk, a ZIP disk, a U disk, a magnetic tape, etc. The memory disclosed in the present invention includes but is not limited to these types of memories. The memory disclosed in the present invention is only used as an example and not as a limitation.

[0159] The input unit 404 is used to receive the input of the signal and the keyword input by the user. The input unit 404 may include a touch panel and other input devices. The touch panel can collect the user's touch operation on or near it (such as the user's operation on or near the touch panel using any suitable object or accessory such as a finger, stylus, etc.), and drive the corresponding connection device according to a pre-set program; other input devices may include but are not limited to one or more of a physical keyboard, a function key (such as a playback control key, a switch key, etc.), a trackball, a mouse, a joystick, etc. The display unit 405 can be used to display the information input by the user or the information provided to the user and various menus of the terminal device. The display unit 405 can be in the form of a liquid crystal display, an organic light emitting diode, etc. The processor 402 is the control center of the terminal device, which uses various interfaces and lines to connect the various parts of the entire device, and executes various functions and processes data by running or executing software programs and / or modules stored in the memory 403, and calling the data stored in the memory.

[0160] As an embodiment, the electronic device includes: one or more processors 402, a memory 403, and one or more applications 401, wherein the one or more applications 401 are stored in the memory 403 and are configured to be executed by the one or more processors 402, and the one or more applications 401 are configured to execute the source code vulnerability detection method in any one of the above-mentioned embodiments.

[0161] In an embodiment of the present invention, code preprocessing is performed on the source code to be detected to form the preprocessed source code to be detected; the preprocessed source code to be detected is analyzed and processed based on a static tool, and a program dependency graph is generated according to the analysis result; image conversion processing is performed on the program dependency graph based on a preset algorithm to generate a conversion image, and the conversion image is composed of vectors in RGB image format; the conversion image is input into a code vulnerability detection model for detection processing to obtain the vulnerability detection result of the source code to be detected, and the code vulnerability detection model is embedded with an improved changeable convolution kernel AKC structure; compared with various existing source code vulnerability detection methods, the detection accuracy, false alarm rate and other data have been improved to a certain extent.

[0162] In addition, the source code vulnerability detection method based on improved AKC convolution and related devices provided by the embodiment of the present invention are introduced in detail above. Specific examples are used herein to illustrate the principle and implementation mode of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation mode and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A source code vulnerability detection method based on improved AKC convolution, characterized in that: The method comprises: Obtaining a source code to be detected, and performing code preprocessing on the source code to be detected to form a preprocessed source code to be detected; Analyze and process the preprocessed source code to be tested based on static tools, and generate a program dependency graph based on the analysis results; Performing image conversion processing on the program dependency graph based on a preset algorithm to generate a conversion image, wherein the conversion image is composed of vectors in RGB image format; The converted image is input into a code vulnerability detection model for detection processing to obtain a vulnerability detection result of the source code to be detected, wherein the code vulnerability detection model is embedded with an improved changeable convolution kernel AKC structure; the improved AKC structure consists of defining an initial sampling position, an attention structure and a deformable convolution operation.

2. The source code vulnerability detection method according to claim 1, characterized in that: The performing code preprocessing on the source code to be detected to form the preprocessed source code to be detected includes: Identifying comment information in the source code to be detected, and deleting the identified comment information to obtain the source code to be detected after deletion; Obtaining the manually defined non-standard variable names and manually defined non-standard function names in the source code to be detected after deletion; The manually defined non-standard variable names are mapped one by one to standard symbol names, and the manually defined non-standard function names are mapped one by one to standard function names, so as to form the preprocessed source code to be detected.

3. The source code vulnerability detection method according to claim 1, characterized in that: The static tool is used to analyze and process the preprocessed source code to be detected, and generate a program dependency graph according to the analysis result, including: Analyze the preprocessed source code to be detected based on the static tool to generate a code control flow graph, wherein a node in the code control flow graph represents a function statement, and the edges of the code control flow graph are all directed edges, and the directed edge between two nodes represents the execution order and branch relationship between the two statements; The program dependency graph is generated based on dependencies between nodes of the code control flow graph.

4. The source code vulnerability detection method according to claim 1, characterized in that: The performing image conversion processing on the program dependency graph based on a preset algorithm to generate a conversion image includes: The degree centrality of each node in the program dependency graph is calculated based on the degree centrality algorithm to obtain the degree centrality vector of each node in the program dependency graph, wherein the degree centrality vector is used to represent the vector of the measure of the node centrality, and the larger the measure value of the degree centrality corresponding to the node is, the more important the node is; Based on the closeness centrality algorithm, the closeness centrality between each node in the program dependency graph is calculated to obtain the closeness centrality vector of each node in the program dependency graph, wherein the closeness centrality vector is used to represent the vector of the average length of the shortest path from a node to other nodes, and the closer the node is to other nodes, the higher its closeness centrality; Calculate the second-order centrality of nodes in the program dependency graph based on a second-order centrality algorithm to obtain a second-order centrality vector of each node in the program dependency graph, wherein the second-order centrality vector is used to represent a vector of standard deviation of a random walk return time of a node; The transformation image is generated based on the degree centrality vector, the closeness centrality vector and the second-order centrality vector of each node in the program dependency graph.

5. The source code vulnerability detection method according to claim 4, characterized in that: The generating the conversion image based on the degree centrality vector, the closeness centrality vector and the second-order centrality vector of each node in the program dependency graph comprises: Multiply all vectors in the degree centrality vector by the numerical value calculated by the degree centrality algorithm, and sort the first multiplication results one by one to form a first update vector; Multiply all vectors in the proximity centrality vector by the value calculated by the proximity centrality algorithm, and sort the second multiplication results one by one to form a second update vector; Multiply all vectors in the second-order centrality vector by the numerical value calculated by the second-order centrality algorithm, and sort the third multiplication results one by one to form a third update vector; The first update vector, the second update vector and the third update vector are combined and processed according to the format of an RGB image to generate the conversion image.

6. The source code vulnerability detection method according to claim 1, characterized in that: The initial sampling position is defined by generating a regular sampling grid from the sampling grid, and defining the initial sampling position with the regular sampling grid as the center; The attention structure is used to map the feature set X of the input node to query(Q), key(K), and value(V), where query(Q) represents a given request query Q, key(K) represents a given key value K, and value(V) represents a given attribute value V, and Q = XW Q , K = XW K 、V=XW V .

7. The source code vulnerability detection method according to claim 1, characterized in that: The calculation of the attention structure is as follows: Among them, d out represents the dimension of Q; W Q , W K , W V Represents three different weight parameters that need to be trained; For node x v and x u , the self-attention calculation process is as follows: f(x u )=W v x v ; Among them, <.,.> represents the dot product between two nodes.

8. A source code vulnerability detection device based on improved AKC convolution, characterized in that: The device comprises: Preprocessing module: used for obtaining source code to be detected, performing code preprocessing on the source code to be detected, and forming preprocessed source code to be detected; Graph generation module: used to analyze and process the preprocessed source code to be detected based on static tools, and generate a program dependency graph based on the analysis results; A graph conversion module: used for performing image conversion processing on the program dependency graph based on a preset algorithm to generate a conversion image, wherein the conversion image is composed of vectors in RGB image format; Detection module: used for inputting the conversion image into the code vulnerability detection model for detection processing to obtain the vulnerability detection result of the source code to be detected, wherein the code vulnerability detection model is embedded with an improved changeable convolution kernel AKC structure; the improved AKC structure consists of defining an initial sampling position, an attention structure and a deformable convolution operation.

9. An electronic device, comprising a processor and a memory, characterized in that: The memory is used to store instructions, and the processor is used to call the instructions in the memory, so that the electronic device executes the source code vulnerability detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on an electronic device, the electronic device executes the source code vulnerability detection method according to any one of claims 1 to 7.

Images