Zero-day vulnerability mining method and system based on artificial intelligence

Abstract

The invention discloses a zero-day vulnerability mining method and system based on artificial intelligence, and relates to the field of vulnerability mining, the method comprises the following steps: collecting target software data and preprocessing to obtain an initial database; constructing feature vectors based on the initial database; constructing a vulnerability detection model, and performing feature extraction and vulnerability detection on the feature vectors; the detected vulnerability is verified; further optimizing the vulnerability detection model by using the verification result; according to the invention, the accuracy and efficiency of vulnerability detection are improved, and false alarms and missing alarms are reduced; the adaptability and expandability of the model are enhanced, and software codes of different types and complexities can be dealt with; the process of vulnerability verification and model updating is optimized, and the practicability and reliability of the whole vulnerability detection system are improved.

Description

Technical Field

[0001] The present invention relates to the field of vulnerability mining, and in particular to an artificial intelligence-based zero-day vulnerability mining method and system. Background Art

[0002] As software systems become increasingly complex, the discovery of zero-day vulnerabilities has become an important task in the field of network security. Zero-day vulnerabilities refer to those vulnerabilities that have not been fixed by developers after being discovered, and attackers can exploit these vulnerabilities to launch attacks.

[0003] Traditional vulnerability mining methods have some problems: low efficiency. Due to reliance on manual analysis, the speed of vulnerability mining is limited by the number and capabilities of analysts; high false positive rate. When identifying vulnerabilities, automated tools often generate a large number of false positives, which require further manual verification; insufficient automation. Existing automated tools often require manual intervention when dealing with complex or unknown vulnerabilities; limited ability to identify new vulnerabilities. Existing tools lack sufficient intelligence to identify new or complex zero-day vulnerabilities. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is: the problems existing in the existing zero-day vulnerability mining technology, such as low efficiency, high false alarm rate, insufficient automation and limited ability to identify new vulnerabilities.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides a zero-day vulnerability mining method based on artificial intelligence, comprising:

[0008] Collect target software data and preprocess it to obtain an initial database;

[0009] Construct feature vectors based on the initial database;

[0010] Build a vulnerability detection model to extract features and detect vulnerabilities on feature vectors;

[0011] Verify the detected vulnerabilities;

[0012] The validation results are used to further optimize the vulnerability detection model.

[0013] As a preferred solution for zero-day vulnerability mining based on artificial intelligence, it includes:

[0014] The constructing of a feature vector based on the initial database comprises:

[0015] After code standardization, the code is broken down into more fine-grained code units;

[0016] The refined code units are mapped to the vector space to generate feature vectors.

[0017] As a preferred solution for zero-day vulnerability mining based on artificial intelligence, it includes:

[0018] The construction of the vulnerability detection model, feature extraction and vulnerability detection on the feature vector includes:

[0019] The convolution operation is used to extract local features of the feature vector, and the filtering operation is used to capture the key information in the feature vector; the maximum pooling operation is performed on the feature vector after convolution processing; different weights are assigned to different positions of the sample feature vector.

[0020] As a preferred solution for zero-day vulnerability mining based on artificial intelligence, it includes:

[0021] The construction of the vulnerability detection model, feature extraction and vulnerability detection on the feature vector also includes:

[0022] The extracted features are classified and the classification results are passed to the output layer to generate a two-dimensional result vector, which is used to represent the probability of the sample being a vulnerable sample or a non-vulnerable sample.

[0023] As a preferred solution for zero-day vulnerability mining based on artificial intelligence, it includes:

[0024] The construction of the vulnerability detection model, feature extraction and vulnerability detection on the feature vector also includes:

[0025] The probability distribution of the sample is calculated based on the output vector, and a threshold is set. When the probability exceeds the threshold, the code sample is judged to contain a vulnerability, otherwise the code is judged to have no vulnerability.

[0026] As a preferred solution for zero-day vulnerability mining based on artificial intelligence, it includes:

[0027] The method of extracting local features from feature vectors by convolution operation and capturing key information in feature vectors by filtering operation includes:

[0028] The size of the convolution kernel is set to m*k, where the value of k is consistent with the word embedding dimension of the input code sample data, and the value of m is 8.

[0029] As a preferred solution for zero-day vulnerability mining based on artificial intelligence, it includes:

[0030] The assigning different weights to different positions of the sample feature vector includes:

[0031] The formulas for space E, key space K, and value space are as follows:

[0032]

[0033] Among them, W′ E , W′ K and W′ U are the parameters of the Self-Attention model, and H is the code word semantic feature matrix calculated by BiGRU selected for abbreviation.

[0034] In a second aspect, an embodiment of the present invention provides a zero-day vulnerability mining system based on artificial intelligence, including:

[0035] The data collection and preprocessing module is used to collect and preprocess the target software data to obtain the initial database;

[0036] A feature vector construction module, used to construct a feature vector based on an initial database;

[0037] Vulnerability detection model building module, used to build vulnerability detection model, extract features and detect vulnerabilities on feature vectors;

[0038] Vulnerability verification module, used to verify the detected vulnerabilities;

[0039] The model optimization module is used to further optimize the vulnerability detection model using the verification results.

[0040] In a third aspect, an embodiment of the present invention provides a computing device, including:

[0041] Memory and processor;

[0042] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the one or more programs are executed by the one or more processors, the one or more processors implement the artificial intelligence-based zero-day vulnerability mining method as described in any embodiment of the present invention.

[0043] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the artificial intelligence-based zero-day vulnerability mining method.

[0044] Beneficial effects of the present invention: The present invention combines TextCNN with the bidirectional gating unit BiGRU and introduces the Self-Attention mechanism to construct an efficient vulnerability detection model; TextCNN extracts local features of the code feature vector, which can capture key information in the code and improve the accuracy of feature extraction; the bidirectional gating unit BiGRU extracts the temporal features of the code feature vector, effectively captures the contextual relationship and dynamic characteristics of the code, and enhances the expression ability of the model; the Self-Attention mechanism gives different weights to different positions of the sample feature vector, strengthens the key features, and enables the model to be more effective Focusing on important information improves the accuracy of detection; the convolution kernel size is optimized so that the convolution operation can more completely cover each word vector, improving the effect of feature extraction; the maximum pooling operation selects 1-max maximum pooling, effectively extracts the most important features in the vector, simplifies the model structure, and improves processing efficiency; through the vulnerability verification results, the model can be further optimized, enhancing the adaptability and stability of the model; the Softmax function output layer can convert the output of the deep learning model into a probability distribution, making the model judgment more intuitive and reliable; setting a threshold to determine whether a code sample contains a vulnerability provides a clear judgment standard and enhances the practicality of the model. The present invention can be widely used in the field of software vulnerability detection, can effectively identify and prevent potential software vulnerabilities, ensure the security and reliability of the software, and significantly improve the accuracy and efficiency of vulnerability detection through multi-level and multi-angle feature extraction and processing, and has important application value and broad application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0046] Figure 1 This is an overall flow chart of the zero-day vulnerability mining method based on artificial intelligence described in the first embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0048] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0049] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0050] Example 1

[0051] Reference Figure 1 , which is the first embodiment of the present invention, and provides a zero-day vulnerability mining method based on artificial intelligence, comprising:

[0052] S1: Collect target software data and preprocess it to obtain the initial database;

[0053] S2: construct feature vectors based on the initial database;

[0054] S3: Build a vulnerability detection model to extract features and detect vulnerabilities on feature vectors;

[0055] S4: Verify the detected vulnerabilities;

[0056] S5: Use the verification results to further optimize the vulnerability detection model.

[0057] It should be noted that, through the iterative process of S1-S5, the present invention improves the accuracy and efficiency of vulnerability detection, reduces false positives and missed negatives; enhances the adaptability and scalability of the model, and is able to cope with software codes of different types and complexities; optimizes the process of vulnerability verification and model updating, and improves the practicality and reliability of the entire vulnerability detection system.

[0058] Example 2

[0059] Reference Figure 1 , which is an embodiment of the present invention, provides a zero-day vulnerability mining method based on artificial intelligence based on the previous embodiment, including:

[0060] In the embodiment of the present application, the target software data is collected and preprocessed in the above step S1 to obtain an initial database including:

[0061] Collect the source code and related execution data of the target software. The collected data will be cleaned to remove invalid or redundant data and retain information useful for subsequent analysis.

[0062] In the embodiment of the present application, constructing a feature vector based on the initial database in the above step S2 includes:

[0063] After code standardization, the code is broken down into more fine-grained code units;

[0064] The refined code units are mapped to the vector space to generate feature vectors.

[0065] Code standardization includes:

[0066] The remaining code tokens are standardized by reassigning a new symbolic name to each variable and function in the code in the form of VAR_i and FUN_i, respectively, where i is the label of the variable or function that first appears in the code snippet, and the remaining tokens including reserved words, library function names, and punctuation marks remain unchanged.

[0067] Specifically, in the embodiments of the present application, the following steps may be adopted:

[0068] AST generation: After removing the comments of the original code, a new symbolic name is reassigned to each variable and function in the code in the form of VAR_i and FUN_i to standardize its remaining code tokens, where i is the label of the variable or function that first appears in the code snippet, and the remaining tokens (including reserved words, library function names, and punctuation marks) remain unchanged.

[0069] AST degradation: If the AST is encoded as a whole for subsequent vulnerability detection, it will bring the problem of vulnerability semantic loss. The AST degradation module decomposes the AST into more fine-grained code units that are easier to encode. Formally, given an AST, the task of the AST degradation module is to divide it into an ordered set D, where D consists of code units of limited size.

[0070] The Word 2vec model is used to map AST to vector space to obtain feature vectors.

[0071] It should be noted that the Abstract Syntax Tree (AST) is a basic code representation that organizes code elements into a tree structure. Leaf nodes correspond to the main elements of the code, such as variable types, symbols, and operators, while non-leaf nodes represent a set of restricted code structures, such as expressions and loops. Compared with the code tokens generated by lexical analysis, AST not only contains lexical information, but also naturally presents the syntactic structure of the source code. By introducing the AST tree, more comprehensive, rich, and accurate code semantic information can be provided to ensure that no potential security vulnerabilities are missed, thereby improving the accuracy of subsequent vulnerability detection.

[0072] In another possible implementation, in addition to constructing feature vectors based on AST, the following methods can also be used to construct feature vectors to further improve the accuracy and efficiency of vulnerability detection:

[0073] Based on Control Flow Graph (CFG):

[0074] A control flow graph is a graph structure that represents the execution path of a program, where nodes represent basic blocks of code (such as statements, conditional judgments, etc.) and edges represent control flows. By constructing a CFG and mapping it to a vector space, the execution path and logical structure of the program can be captured, thereby extracting more comprehensive features.

[0075] step:

[0076] CFG generation: Control flow graphs are generated at compile time or by static analysis tools.

[0077] CFG degradation: Decompose the CFG into basic blocks and map them to vector space.

[0078] Feature vector construction: Use graph embedding technology (such as Graph2Vec) to map CFG into vector space and generate feature vectors.

[0079] Based on Data Flow Graph (DFG):

[0080] A data flow graph shows how data flows between different operations in a program, where nodes represent data operations and edges represent data flow paths. By constructing a DFG, we can capture the relationship between data operations and extract data-related features.

[0081] step:

[0082] DFG generation: Static analysis tools generate data flow graphs.

[0083] DFG degradation: Decompose DFG into basic data operation units and map them into vector space.

[0084] Feature vector construction: DFG is mapped to vector space using graph embedding technology to generate feature vectors.

[0085] Based on semantic analysis:

[0086] Semantic analysis can capture the deep semantic information of the code, such as variable type, scope, function call relationship, etc. Through semantic analysis, feature vectors related to code semantics can be extracted.

[0087] step:

[0088] Semantic analysis: Use static analysis tools to perform semantic analysis and capture deep semantic information of the code.

[0089] Feature extraction: Extract semantically relevant features (such as variable types, function call chains, etc.).

[0090] Feature vector construction: Map the extracted semantic features into the vector space to generate a feature vector.

[0091] Based on word embedding:

[0092] Similar to word embedding technology in natural language processing, identifiers in the code (such as variable names, function names) can be mapped to a continuous vector space to capture the semantic relationship between identifiers.

[0093] step:

[0094] Code segmentation: segment the identifiers in the code.

[0095] Word embedding model training: Use word embedding models such as Word2Vec or GloVe to train vector representations of identifiers.

[0096] Feature vector construction: Aggregate the word embedding vectors of the identifier to generate a feature vector.

[0097] Based on static taint analysis:

[0098] Static taint analysis is a static analysis technology that can track data flows, identify taint information in data flows, and extract relevant features.

[0099] step:

[0100] Taint analysis: Use static taint analysis tools to identify taint information in data streams.

[0101] Feature extraction: Extract features related to stains (such as stain propagation path, stain type, etc.).

[0102] Feature vector construction: Map the extracted stain features to the vector space to generate a feature vector.

[0103] Based on behavioral analysis:

[0104] Behavioral analysis can capture the dynamic behavior of the code during execution, such as function call sequence, exception handling, etc. Through behavioral analysis, features related to code execution behavior can be extracted.

[0105] step:

[0106] Behavior capture: Captures behavior such as function call sequences and exception handling during code execution.

[0107] Feature extraction: Extract behavior-related features (such as call sequence, exception type, etc.).

[0108] Feature vector construction: Map the extracted behavioral features to the vector space to generate feature vectors.

[0109] By combining these different feature extraction methods, code features can be extracted in multiple dimensions, thereby improving the comprehensiveness and accuracy of vulnerability detection models. These methods can be used alone or in combination to build a richer and more comprehensive feature vector.

[0110] In the embodiment of the present application, the vulnerability detection model is constructed in the above step S3, and feature extraction and vulnerability detection of the feature vector include:

[0111] TextCNN is combined with the bidirectional gating unit BiGRU to build a vulnerability detection model to extract features from feature vectors and perform vulnerability detection.

[0112] Specifically, TextCNN is combined with the bidirectional gating unit BiGRU to extract features from feature vectors. TextCNN is used to extract local features of code feature vectors, BiGRU is used to extract temporal features of code feature vectors, and the Self-Attention mechanism is used to enhance sample features. The steps are as follows:

[0113] Use TextCNN to perform convolution filtering on the feature vector;

[0114] The size of the convolution kernel is set to m*k, where the value of k should be consistent with the word vector dimension of the input code sample data to ensure that the width of the convolution kernel can completely cover each word vector. After multiple experimental tests, it was found that when the value of m is 8, the feature extraction effect of the convolution kernel is the best.

[0115] The data passes through the maximum pooling layer, and 1-max maximum pooling is selected to extract the most important features in the vector.

[0116] The BiGRU is combined with the Self-Attention mechanism to assign different weights to different positions of the sample feature vector to strengthen the key features of the text.

[0117] By combining BiGRU with the Self-Attention mechanism, BiGRU can find the focus and improve the training effect. The calculation formula of BiGRU is as follows:

[0118]

[0119] in, and are the hidden transition sequences in the forward and backward directions respectively, and are the hidden states of the i-th forward and backward outputs of GRU, and L is the total number of GRU units contained in BiGRU. The output of the bidirectional gated recurrent unit BiGRU is The dimension is 1×2N.

[0120] The Self-Attention mechanism adopts a decoder-encoder framework, and the formula is as follows:

[0121] C=[c1,c2,...,c i ,c i+1 ,...,c d ]

[0122] Among them, C is the feature vector obtained by Self-Attention calculation, d is the sentence length, c i is the feature vector corresponding to the i-th code word, and its calculation formula is as follows:

[0123]

[0124] Among them, s(e i ,k j ) is the attention value calculated by the scaled dot product model, e, k and u are the elements in the query space E, key space K and value space U respectively. The formulas of E, K and U are as follows:

[0125]

[0126] Among them, W′ E , W′ K and W′ U are all model parameters, H is the code word semantic feature matrix calculated by BiGRU. The values ​​of E, K and U can be obtained by [e1,e2,...,e d ],[k1,k2,...,k d ] and [u1,u2,...,u d ]calculate.

[0127] Classification is performed through the two hidden layers of the fully connected layer, and the data information obtained by the classification of the fully connected layer is passed to the output layer for output.

[0128] Output a two-dimensional result vector and input it into the Sofmax function to get the probability of the sample being a hole sample or a hole-free sample.

[0129] Specifically, the output layer used at the end of the model takes the vector output by the hidden layer as input, outputs a two-dimensional result vector, and inputs it into the Sofmax function. The function of the Sofmax function is to convert the output of the deep learning model into a mathematical probability distribution, and the original deep learning model output is used as a confidence coefficient to generate a new output. The practical significance of the new output is that the deep learning model used determines the probability that a certain sample belongs to a certain category. In this application, two probability values ​​can be obtained after the output of the Sofmax function output layer, corresponding to the probability that the code sample is a vulnerable sample and a non-vulnerable sample, and the probability values ​​corresponding to the two categories add up to 1.

[0130] A threshold is set to determine whether a code sample contains a vulnerability. If the threshold is exceeded, the code is considered to have a vulnerability, otherwise the code has no vulnerability.

[0131] Specifically, if the probability that the code contains a vulnerability is greater than the set threshold, then the code sample will be considered to contain a vulnerability, otherwise it will be judged that the code does not contain a vulnerability. The size of this value should be determined according to specific needs.

[0132] In another possible implementation, the following different neural network architectures and technologies can be used to build a vulnerability detection model to further improve the effect of feature extraction and vulnerability detection:

[0133] Transformer-based models:

[0134] The Transformer model has achieved great success in the field of natural language processing. Its core is to introduce the self-attention mechanism to capture long-distance dependencies in the sequence. By inputting the code feature vector into the Transformer model, the complex dependencies and semantic information in the code can be better captured.

[0135] step:

[0136] Input encoding: Encode the feature vector as input sequence into an embedding representation.

[0137] Multi-head self-attention mechanism: Use a multi-head self-attention mechanism to capture long-range dependencies between feature vectors.

[0138] Feed-Forward Neural Network: A feed-forward neural network is added after each attention layer for nonlinear transformation.

[0139] Feature extraction: Feature extraction is performed through multiple layers of Transformer layers.

[0140] Vulnerability detection: The extracted features are input into the classifier for vulnerability detection.

[0141] Based on Convolutional Neural Network (CNN) and Long Short-Term Memory Network (LSTM):

[0142] Combining the convolutional neural network (CNN) and the long short-term memory network (LSTM) can simultaneously capture the local features and temporal features of the code, thereby improving the comprehensiveness of feature extraction.

[0143] step:

[0144] Local feature extraction: Use CNN to extract local features of code feature vectors.

[0145] Time series feature extraction: Use LSTM to extract the time series features of the code feature vector.

[0146] Feature fusion: The features extracted by CNN and LSTM are fused to generate a comprehensive feature vector.

[0147] Vulnerability detection: The fused feature vector is input into the fully connected layer or classifier for vulnerability detection.

[0148] Based on Graph Neural Networks (GNNs):

[0149] Graph neural networks (GNNs) can process graph structured data and are suitable for capturing complex structural relationships in code. By representing the code as a graph structure and using GNNs for feature extraction, the structural features and semantic information in the code can be better captured.

[0150] step:

[0151] Graph structure construction: The code is represented as a graph structure, where nodes represent code elements (such as statements, variables, etc.) and edges represent the relationship between elements.

[0152] Graph Embedding: Use GNNs to embed the graph structure and generate feature vectors of nodes and graphs.

[0153] Feature extraction: Feature extraction is performed through multiple GNN layers.

[0154] Vulnerability detection: The extracted features are input into the classifier for vulnerability detection.

[0155] Vulnerability detection model based on meta-learning:

[0156] Meta-learning is an algorithm that learns how to learn and can quickly adapt to new tasks on a small number of samples. By building a meta-learning model, an efficient vulnerability detection model can be quickly trained on a small amount of labeled data.

[0157] step:

[0158] Meta-learning model training: Use a large amount of non-vulnerable code and a small amount of vulnerable code to train the meta-learning model and learn how to adapt quickly on a small number of samples.

[0159] Few-sample training: Use the meta-learning model to perform few-sample training on new code snippets to quickly generate a vulnerability detection model.

[0160] Vulnerability Detection: Use the generated vulnerability detection model to perform vulnerability detection.

[0161] Vulnerability detection model based on multi-task learning:

[0162] Multi-Task Learning improves the generalization ability of the model by learning multiple related tasks at the same time. Vulnerability detection can be combined with tasks such as code classification and code generation to improve the overall performance of the model.

[0163] step:

[0164] Task definition: Define multiple related tasks, such as vulnerability detection, code classification, code generation, etc.

[0165] Joint training: Use a multi-task learning framework to train multiple tasks simultaneously.

[0166] Feature sharing: Share feature extraction layers between different tasks to improve the generalization ability of the model.

[0167] Vulnerability Detection: Use the vulnerability detection branch in the multi-task learning model to perform vulnerability detection.

[0168] Vulnerability detection model based on reinforcement learning:

[0169] Reinforcement Learning can learn the optimal strategy through interaction with the environment. In vulnerability detection, reinforcement learning models can be used to learn the optimal vulnerability detection strategy through interaction with the code environment.

[0170] step:

[0171] Environment definition: The code execution process is defined as a reinforcement learning environment, where the state represents a certain moment of code execution, the action represents the performed operation, and the reward represents the result of vulnerability detection.

[0172] Strategy learning: Use reinforcement learning algorithms (such as Q-Learning, Policy Gradient, etc.) to learn the optimal vulnerability detection strategy.

[0173] Vulnerability Detection: Use the learned policies to perform vulnerability detection.

[0174] By combining these different neural network architectures and techniques, the effects of feature extraction and vulnerability detection can be improved in multiple dimensions. These methods can be used alone or in combination to build a more efficient and accurate vulnerability detection model.

[0175] In the embodiment of the present application, the verification of the detected vulnerability in the above step S4 includes:

[0176] Generate vulnerability report: Generate a detailed vulnerability report for potential vulnerabilities detected by the model. The report should include information such as the type of vulnerability, location (code line number, file name, etc.), possible impact, and triggering conditions.

[0177] Save detection results: Save vulnerability reports to a database or related storage system for subsequent verification and analysis.

[0178] Manual vulnerability check:

[0179] Expert review: The generated vulnerability reports are manually checked by experienced security experts. Experts will carefully analyze each report to confirm whether the vulnerability really exists and assess the severity of the vulnerability.

[0180] Code review: For code snippets suspected of vulnerabilities, experts will conduct a detailed code review to confirm whether there are potential security issues.

[0181] Automated verification tools:

[0182] Automated verification: Use automated tools (such as unit testing, integration testing, fuzz testing, etc.) to verify suspected vulnerability codes. Automated tools can simulate various attack scenarios to verify whether the vulnerability can be exploited.

[0183] Test case generation: Generate corresponding test cases based on the trigger conditions in the vulnerability report to ensure that potential vulnerabilities are covered.

[0184] Vulnerability Exploitability Assessment:

[0185] Attack simulation: Simulate attacks in a controlled environment to verify whether the vulnerability is truly exploitable. Through actual attack operations, confirm the actual harmfulness and exploitability of the vulnerability.

[0186] Security patch verification: Develop corresponding security patches and verify the patches to ensure that the vulnerabilities have been effectively fixed.

[0187] Verification result record:

[0188] Record verification results: Record the results of manual inspection and automated verification, and update the status of the vulnerability report (such as confirmed, false positive, fixed, etc.).

[0189] Generate verification report: Generate a detailed verification report, which should include the verification results, verification process, verification tool usage, and other information for each vulnerability report.

[0190] In the embodiment of the present application, further optimizing the vulnerability detection model using the verification result in the above step S5 includes:

[0191] Data collection and annotation:

[0192] Collect verification data: Collect all data generated during the verification process, including manual inspection results, automated verification results, attack simulation results, security patch verification results, etc.

[0193] Data labeling: Label the collected verification data to clarify which are real vulnerabilities, which are false positives, and the specific type and severity of the vulnerabilities.

[0194] Model evaluation and analysis:

[0195] Model performance evaluation: Use verification data to evaluate the current vulnerability detection model and calculate performance indicators such as the model's accuracy, recall rate, and F1 value.

[0196] False Alarm Analysis: Analyze the causes of false alarms, find out in which cases the model is prone to misjudgment, and record the false alarms.

[0197] False negative analysis: Analyze the reasons for false negatives, find out under what circumstances the model is likely to miss real vulnerabilities, and record the false negatives.

[0198] Model optimization:

[0199] Feature engineering: Based on the verification results, optimize the feature vector. It may be necessary to introduce new features or adjust the weights and combinations of existing features.

[0200] Hyperparameter adjustment: Based on the validation results, adjust the model's hyperparameters, such as the learning rate, batch size, and regularization parameters, to improve the model's performance.

[0201] Model structure optimization: Based on the verification results, optimize the model structure. For example, increase the number of neural network layers, introduce new neural network layers (such as Transformer layers, GNN layers, etc.), or adjust the connection method of the neural network.

[0202] Model retraining:

[0203] Data enhancement: Enhance the original data to increase the diversity and coverage of the data. For example, more training data can be generated through data expansion and data synthesis.

[0204] Model retraining: Use the optimized feature vectors and hyperparameters to retrain the vulnerability detection model to ensure that the model can achieve higher accuracy and recall on the new dataset.

[0205] Model iteration:

[0206] Continuous validation and optimization: After retraining the model, continue to validate and optimize it. Continue to collect new validation data and iterate the model to ensure that the model remains efficient and accurate.

[0207] Model deployment and monitoring: Deploy the optimized model to the production environment and monitor the model's operation. Record the model's real-time performance indicators to promptly detect and handle new false positives and false negatives.

[0208] Example 3

[0209] The above is a schematic scheme of the zero-day vulnerability mining method based on artificial intelligence of this embodiment. It should be noted that the technical scheme of the zero-day vulnerability mining system based on artificial intelligence and the technical scheme of the zero-day vulnerability mining method based on artificial intelligence belong to the same concept, and the details of the technical scheme of the zero-day vulnerability mining system based on artificial intelligence in this embodiment that are not described in detail can all be referred to the description of the technical scheme of the zero-day vulnerability mining method based on artificial intelligence.

[0210] This embodiment also provides a system for a zero-day vulnerability mining method based on artificial intelligence, including:

[0211] The data collection and preprocessing module is used to collect and preprocess the target software data to obtain the initial database;

[0212] A feature vector construction module, used to construct a feature vector based on an initial database;

[0213] Vulnerability detection model building module, used to build vulnerability detection model, extract features and detect vulnerabilities on feature vectors;

[0214] Vulnerability verification module, used to verify the detected vulnerabilities;

[0215] The model optimization module is used to further optimize the vulnerability detection model using the verification results.

[0216] This embodiment further provides a computing device, which is applicable to the case of a zero-day vulnerability mining method based on artificial intelligence, including:

[0217] Memory and processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the artificial intelligence-based zero-day vulnerability mining method proposed in the above embodiment.

[0218] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the artificial intelligence-based zero-day vulnerability mining method proposed in the above embodiment is implemented.

[0219] The storage medium proposed in this embodiment and the artificial intelligence-based zero-day vulnerability mining method proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0220] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A zero-day vulnerability mining method based on artificial intelligence, characterized in that: include: Collect target software data and preprocess it to obtain an initial database; Construct feature vectors based on the initial database; Build a vulnerability detection model to extract features and detect vulnerabilities on feature vectors; Verify the detected vulnerabilities; The validation results are used to further optimize the vulnerability detection model.

2. The method for zero-day vulnerability mining based on artificial intelligence as claimed in claim 1, characterized in that: The constructing of a feature vector based on the initial database comprises: After code standardization, the code is broken down into more fine-grained code units; The refined code units are mapped to the vector space to generate feature vectors.

3. The method for zero-day vulnerability mining based on artificial intelligence as claimed in claim 2, characterized in that: The construction of the vulnerability detection model, feature extraction and vulnerability detection on the feature vector includes: The convolution operation is used to extract local features of the feature vector, and the filtering operation is used to capture the key information in the feature vector; the maximum pooling operation is performed on the feature vector after convolution processing; different weights are assigned to different positions of the sample feature vector.

4. The method for zero-day vulnerability mining based on artificial intelligence as claimed in claim 3, characterized in that: The construction of the vulnerability detection model, feature extraction and vulnerability detection on the feature vector also includes: The extracted features are classified and the classification results are passed to the output layer to generate a two-dimensional result vector, which is used to represent the probability of the sample being a vulnerable sample or a non-vulnerable sample.

5. The method for zero-day vulnerability mining based on artificial intelligence as claimed in claim 4, characterized in that: The construction of the vulnerability detection model, feature extraction and vulnerability detection on the feature vector also includes: The probability distribution of the sample is calculated based on the output vector, and a threshold is set. When the probability exceeds the threshold, the code sample is judged to contain a vulnerability, otherwise the code is judged to have no vulnerability.

6. The method for zero-day vulnerability mining based on artificial intelligence as claimed in claim 5, characterized in that: The method of extracting local features from feature vectors by convolution operation and capturing key information in feature vectors by filtering operation includes: The size of the convolution kernel is set to m*k, where the value of k is consistent with the word embedding dimension of the input code sample data, and the value of m is 8.

7. The method for zero-day vulnerability mining based on artificial intelligence as claimed in claim 6, characterized in that: The assigning different weights to different positions of the sample feature vector includes: The formulas for space E, key space K, and value space are as follows: Among them, W′ E , W′ K and W′ U are the parameters of the Self-Attention model, and H is the code word semantic feature matrix calculated by BiGRU selected for abbreviation.

8. A system using the artificial intelligence-based zero-day vulnerability mining method as claimed in any one of claims 1 to 7, characterized in that: include: The data collection and preprocessing module is used to collect and preprocess the target software data to obtain the initial database; A feature vector construction module, used to construct a feature vector based on an initial database; Vulnerability detection model building module, used to build vulnerability detection model, extract features and detect vulnerabilities on feature vectors; Vulnerability verification module, used to verify the detected vulnerabilities; The model optimization module is used to further optimize the vulnerability detection model using the verification results.

9. A computing device comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the artificial intelligence-based zero-day vulnerability mining method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the artificial intelligence-based zero-day vulnerability mining method described in any one of claims 1 to 7.

Images