Row-level software vulnerability detection method and detection system integrating contextual semantics

Abstract

The present invention relates to a line-level software vulnerability detection method and detection system that integrates contextual semantics. The line-level software vulnerability detection method that integrates contextual semantics includes the following steps: S1, preprocessing the target software code to remove noise, and obtaining the preprocessed software code; S2, vector embedding the nth line of code, and obtaining the nth code line vector L n ; For the nth code line vector L n Associated code line location information. This method converts each line of code into a vector representation, then fuses the code line with contextual information during the context information extraction and feature fusion stages, thereby capturing global information related to the code line. All contextual information and code line information are then fused together to determine whether a code line has a vulnerability by determining the weight or probability of each line of code. This ultimately completes the line-level vulnerability detection task, greatly improving the accuracy of locating code vulnerabilities.

Description

Technical Field

[0001] The present invention relates to the technical field of software vulnerability detection, and in particular to a row-level software vulnerability detection method and detection system integrating contextual semantics. Background Art

[0002] Nowadays, many industries rely on software as a platform for their businesses, and the amount of software used has increased dramatically. However, due to the inevitable human factors in the software development process and insufficient security testing, a large number of vulnerabilities exist in the software. These vulnerabilities can be exploited by malicious actors, allowing them to remotely execute code, enabling data theft, surveillance, and malware distribution. Therefore, code vulnerability detection during the software development process is crucial.

[0003] Traditional vulnerability detection often consumes significant effort and resources and relies heavily on the subjective experience and knowledge of domain experts. Modern software systems, however, have a wide variety of vulnerabilities that are complex and difficult to detect using specific methods. Existing software vulnerability detection methods that apply deep learning mostly focus on coarse-grained levels, such as slice-level vulnerability detection, function-level vulnerability detection, and file-level vulnerability detection. However, not all lines of a vulnerable function are flawed (approximately 0.03%-2.9%). Therefore, even after applying the method, developers still need to devote considerable effort to locating the specific vulnerable lines of code. Summary of the Invention

[0004] Based on this, it is necessary to provide a row-level software vulnerability detection method and detection system that integrates contextual semantics to address the problem of insufficient vulnerability positioning accuracy in existing detection methods. It uses Transformer to fuse contextual information and uses compressed bilinear pooling technology to fuse contextual information and code line information to finally complete the vulnerability detection task.

[0005] In a first aspect, the present invention proposes a line-level software vulnerability detection method that integrates contextual semantics, which is used to perform line-level vulnerability detection on target software code. The line-level software vulnerability detection method includes the following steps:

[0006] S1. Preprocessing the target software code to remove noise to obtain preprocessed software code;

[0007] The preprocessed software code includes N lines of code;

[0008] S2. Embed the nth line of code into a vector to obtain the nth line of code vector L n , n∈[1,N];

[0009] For the nth code line vector L nThe location information of the associated code line;

[0010] S3, transform the nth code line vector L n The nth context vector LC is calculated by the encoding module n ;

[0011] S4, through the weight matrix U for the nth code line vector L n Study and get the nth code line vector L′ n ;

[0012] The nth context vector LC is calculated by the weight matrix V n Learn and get the nth context vector LC′ n ;

[0013] S5. Transform N code line vectors {L′1, L′2, …, L′ n} and N context vectors {LC′1, LC′2, …, LC′ n} Perform feature fusion and calculate the attention mapping matrix Attention_map through the projection model;

[0014] S6. Extract vulnerability scores from the attention map matrix Attention_map through matrix operations to obtain N vulnerability scores.

[0015] Arrange N vulnerability scores from large to small;

[0016] The n-th vulnerability score corresponds to the n-th code line vector L n ;

[0017] The nth code line vector L n According to the position information, the nth line of code in the software code is corresponded;

[0018] Among them, the code lines corresponding to the vulnerability scores in the top M positions are judged as having vulnerabilities;

[0019] M is a predefined parameter.

[0020] As a preferred example, in S2, the nth code line vector L is calculated using sine and cosine functions. n The position information of the associated code line is as follows:

[0021]

[0022]

[0023] Where P is the position information of the code line, i is the position of the code line, k is the dimension index in the position encoding, and d is the dimension of the code line vector L.

[0024] As a preferred example, in S3, the encoding module includes an encoder in a Transformer model.

[0025] As a preferred example, in S3, the context vector LC is calculated. n Previously, the number of code lines in all target software codes in the same batch was padded to K; K is the maximum number of code lines in all target software codes in the batch.

[0026] As a preferred example, in S4, the code line vector L n The formula for learning is:

[0027] L′ n =ReLU(L n *U)

[0028] Context vector LC n The formula for learning is:

[0029] LC′ n =ReLU(LC n *V)

[0030] Where ReLU is a nonlinear activation function.

[0031] As a preferred example, in S5, the method for performing feature fusion includes:

[0032] Generate a projection of a low-rank space using projection matrix P and projection matrix Q;

[0033] Use projection to perform attention mapping to obtain the attention mapping matrix Attention_map;

[0034] The calculation formula of the attention mapping matrix Attention_map is:

[0035] Attention_map=(P·{L′1,L′2,…,L′ n})·(Q·{LC′1,LC′2,…,LC′ n}).

[0036] As a preferred example, in S5, the diagonal elements in the attention mapping matrix Attention_map are extracted to obtain a new mapping matrix;

[0037] Normalize the elements of each row in the new mapping matrix;

[0038] Each element in the normalized mapping matrix corresponds to a vulnerability score.

[0039] As a preferred embodiment, the row-level software vulnerability detection method integrating contextual semantics further includes S0;

[0040] S0. Performing coarse-grained detection on the target software code to detect whether there are vulnerabilities in the entire target software code;

[0041] If a vulnerability is detected in the target software code as a whole, proceed to S1-S6;

[0042] If it is detected that there are no vulnerabilities in the entire target software code, the process ends.

[0043] As a preferred embodiment, the method for coarse-grained detection of target software code includes the following steps:

[0044] S21, preprocessing the target software code to remove noise, thereby obtaining a preprocessed software code;

[0045] The preprocessed software code includes N lines of code;

[0046] S22. Perform vector embedding on the nth line of code to obtain the nth line of code vector L n , n∈[1,N];

[0047] For the nth code line vector L n Associated location information;

[0048] S23, the nth code line vector L n The nth context vector LC is calculated by the encoding module n ;

[0049] S24, the nth code line vector L is calculated by the weight matrix U n Study and get the nth code line vector L′ n ;

[0050] The nth context vector LC is calculated by the weight matrix V n Learn and get the nth context vector LC′ n ;

[0051] S25, transform N code line vectors {L′1, L′2, …, L′ n} and N context vectors {LC′1, LC′2, …, LC′ n} Perform feature fusion to obtain the attention mapping matrix Attention_map;

[0052] S26. Pool the attention map matrix Attention_map and input it into the linear layer to calculate the variable value B. The calculation formula is:

[0053] B=Sigmoid(Linear(mean(Attention_map))

[0054] In the formula, Sigmoid is the Sigmoid activation function, and Linear represents linear processing;

[0055] Map the variable value B to between 0 and 1. A value greater than or equal to 0.5 after mapping is considered to have a vulnerability, and a value less than 0.5 is considered to have no vulnerability.

[0056] In a second aspect, the present invention proposes a row-level software vulnerability detection system integrating contextual semantics, which uses the row-level software vulnerability detection method integrating contextual semantics in the first aspect; the row-level software vulnerability detection system includes:

[0057] A preprocessing module, which is used to preprocess the target software code to remove noise;

[0058] Vector embedding module, which is used to embed the nth line of code into a vector to obtain the nth line of code vector L n ; It is also used to integrate the code line location information into the code line vector L n middle;

[0059] The information extraction module is used to fuse context information and extract the n-th code line vector L n Calculate the nth context vector LC n ; Also used for the nth code line vector L n and the nth context vector LC n Perform learning and obtain the learned code row vector L′ n and context vector LC′ n ;

[0060] Vulnerability prediction module, which is used to transform N code line vectors {L′1, L′2, …, L′ n} and N context vectors {LC′1, LC′2, …, LC′ n}Use the projection matrix P and the projection matrix Q to generate a projection of a low-rank space, and calculate the attention mapping matrix Attention_map; it is also used to extract the vulnerability scores of the attention mapping matrix Attention_map through matrix operations to obtain N vulnerability scores; arrange the N vulnerability scores from large to small, and the code lines corresponding to the vulnerability scores in the first M positions are judged to have vulnerabilities.

[0061] The beneficial effects of the present invention are as follows: the present invention converts each line of code into a vector representation, and then fuses the context information of the code line in the context information extraction and feature fusion stage, thereby capturing the global information related to the code line, and then fuses all the context information and code line information. By judging the weight or probability size (i.e., vulnerability score) of each line of code, it is determined whether the code line has a vulnerability, and finally the line-level vulnerability detection task of the code is completed, which greatly improves the accuracy of locating code vulnerabilities and reduces the effort spent by developers to locate specific vulnerable code lines. In addition, the present invention automates the entire process from code preprocessing to vulnerability prediction, providing developers with an efficient vulnerability location tool. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0063] Figure 1 This is a flow chart of the row-level software vulnerability detection method proposed by the present invention;

[0064] Figure 2 This is an example diagram showing the before and after comparison of the code in one embodiment after preprocessing;

[0065] Figure 3 is a flow chart of a method for coarse-grained software vulnerability detection in another embodiment;

[0066] Figure 4 The figure shows the results of vulnerability detection using the row-level software vulnerability detection method. DETAILED DESCRIPTION

[0067] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0068] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this invention pertains. The terms used herein in the specification of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The term "or / and" as used herein includes any and all combinations of one or more of the associated listed items.

[0069] This embodiment provides a line-level software vulnerability detection method that integrates contextual semantics, which mainly includes the steps of code preprocessing, code line vector embedding, context information extraction, feature fusion and vulnerability prediction. Code preprocessing first removes the noise caused by personalized naming and comments, blank lines in the code, special characters, etc. In the code line vector embedding stage, each line of code is converted into a vector representation through tools such as Code Tokenizer and CodeBERT model. In the context information extraction and feature fusion stages, Transformer is used to fuse context information to capture global information related to the code line, and then compressed bilinear pooling technology is used to fuse the context information and code line information to finally complete the vulnerability detection task.

[0070] For details, please refer to Figure 1 ,The row-level software vulnerability detection method integrating contextual semantics includes the following steps:

[0071] S1. Preprocess the target software code to remove noise, thereby obtaining preprocessed software code. The preprocessed software code includes N lines of code.

[0072] In this step, the line-level software vulnerability detection method can perform vulnerability detection on the code in batches. Each batch includes multiple files. Each file includes multiple lines of code. Vulnerability detection tasks often ignore the differences in naming styles of functions, variables, methods, etc., as well as comments in the code, which may introduce unnecessary noise. In this embodiment, in order to reduce the impact of such noise, the code preprocessing stage first replaces the personalized names in all input source domain and target domain function codes with symbolic names, for example, Figure 2 As shown in the following example, change the variable names to "VAR0" and "VAR1", the function names to "FUN0" and "FUN1", and delete the comments, blank lines, special characters, etc. contained in the code.

[0073] S2. Embed the nth line of code into a vector to obtain the nth line of code vector L n , n∈[1,N]. For the nth code line vector L n Associated location information.

[0074] The pre-processed software code includes N lines of code. Code Tokenizer is used to perform word segmentation and ID conversion on each line of code. Then, the ID corresponding to each line of code is converted into a vector representation through the CodeBERT model to obtain multiple code line vectors L n, n∈[1,N], n is an integer between 1 and N. The CodeBERT model is based on the Transformer architecture and can effectively handle tasks related to understanding and generating code. The CodeBERT model can effectively capture meaningful semantic information of code lines, which helps to construct a vector representation of code lines. The specific operation is to convert each line of code obtained in the code preprocessing phase into a corresponding vector representation through the pre-trained CodeBERT model. In this embodiment, the code line vector L n The dimension of is set to d = 768, that is, each line of code in a function is converted into a vector of 768 dimensions. The code line vector L input in the subsequent model is n It is expressed in code form as (number of lines of code, embedding vector dimension). In this embodiment, vulnerability detection can be performed on software code in batches. Each batch includes multiple files, and the target software code in each file includes several lines of code.

[0075] To ensure uniform dimensionality, in the code line vector L n Before subsequent processing, fill the number of lines of code in each file in each batch to the maximum number of lines of code in this batch. For example, the input shape is (number of batches, number of lines of code in each file, 768) n , by filling the vector with 0, it is transformed into a code line vector L with a shape of (number of batches, maximum number of code lines in this batch file, 768) n In addition, the sine-cosine function is used to associate the position information of the code line with the code line vector L. n The associated formula is:

[0076]

[0077] Where P is the position information of the code line. i is the position of the code line, ranging from 0 to the maximum number of code lines - 1. k is the dimension index in the position encoding, ranging from 0 to d / 2-1. d is the code line vector L n dimension.

[0078] S3, transform the nth code line vector L n The nth context vector LC is calculated by the encoding module n .

[0079] In this step, the encoding module can use the encoder in the Transformer model, whose main function is to convert the input sequence into a feature representation (combining its context information). According to the task requirements, the encoder part of the Transformer model is used here to process the input sequence and generate a context representation. The encoding module in this embodiment can be composed of two of the above encoders connected in series. The nth code line vector L after the above processingn The nth context vector LC that integrates its context information is calculated in the input encoder n .

[0080] S4, through the weight matrix U for the nth code line vector L n Study and get the nth code line vector L′ n . The nth context vector LC is transformed by the weight matrix V n Learn and get the nth context vector LC′ n .

[0081] Specifically, we first define two learning weight matrices U and V, and then perform the same training on N code line vectors {L1, L2, ...L n} and N context vectors {LC1, LC2, ...LC n}For further study, the learning formula is:

[0082] L′ n =ReLU(L n *U)

[0083] LC′ n =ReLU(LC n *V)

[0084] In the formula, ReLU is a nonlinear activation function, the purpose of which is to add certain nonlinear factors. n , LC′ n Represented as the learned code row vector L n and context vector LC n .

[0085] S5. Transform N code line vectors {L′1, L′2, …, L′ n} and N context vectors {LC′1, LC′2, …, LC′ n}Perform feature fusion to obtain the attention mapping matrix Attention_map.

[0086] In order to obtain a more accurate representation, this method uses compressed bilinear pooling technology to perform the code line vector L′ n and the corresponding context vector LC′ n to be processed.

[0087] The N code line vectors {L′1, L′2, …, L′ n} and N context vectors {LC′1, LC′2, …, LC′ n}Use the projection matrix P and projection matrix Q to generate a projection of a low-rank space, and use MCB (multimodal compressed bilinear pooling model) to calculate the attention mapping matrix Attention_map, which is calculated as follows:

[0088] Attention_map=(P·{L′1,L′2,…,L′ n})·(Q·{LC′1,LC′2,…,LC′ n});

[0089] In this embodiment, the shapes of the projection matrix P and the projection matrix Q can both be expressed as [1, h_out, rank, hidden_dim*k]. h_out represents the number of output heads, rank is the rank of the low-rank matrix, hidden_dim is the hidden layer dimension, and k is the parameter of low-rank pooling. In this embodiment, the parameters can be specifically set to h_out = 2, rank = 10, hidden_dim = 256, k = 3. The purpose of the above-mentioned low-rank projection is to map a high-rank matrix to a lower-rank space through projection, which can effectively reduce the complexity of the data while retaining the main features of the data and performing feature fusion.

[0090] S6. Extract the vulnerability scores from the attention map matrix through matrix operations to obtain N vulnerability scores. Arrange the N vulnerability scores from large to small. The nth vulnerability score corresponds to the nth code line vector L n The nth code line vector L n The nth line of code in the software code is mapped based on the location information. The code lines corresponding to the vulnerability scores in the top M positions are judged to have vulnerabilities. M is a predefined parameter.

[0091] In this step, the attention mapping matrix Attention_map is subjected to matrix operations to obtain the vulnerability score corresponding to each line of code. The vulnerability scores are arranged from large to small, and the code lines corresponding to the vulnerability scores within the set sequence number (i.e., the first few in the set order) are judged to have vulnerabilities. Specifically, after learning the above model, the attention mapping matrix Attention_map with the shape of (number of batches, number of output heads, maximum number of code lines in this batch function, maximum number of code lines in this batch function) is obtained. In this embodiment, the number of output heads is 2, so the attention scores obtained in the two subspaces corresponding to the number of output heads are summed to obtain a further (number of batches, maximum number of code lines in this batch function, maximum number of code lines in this batch function) attention mapping matrix 2. Subsequently, the diagonal elements in the attention mapping matrix 2 are taken to obtain a new attention mapping matrix 3 (used to extract the attention of each element to itself from the original attention mapping matrix) of (number of batches, maximum number of code lines in this batch function). The values ​​of each row in the attention mapping matrix 3 are summed up, and the elements of each row in the attention mapping matrix 3 are divided by the sum of the corresponding number of rows. This is equivalent to making the sum of the weights of each row in the attention mapping matrix 3 equal to 1, and normalizing the elements therein. The elements in the matrix are then extracted to obtain N vulnerability scores containing the location information of the code line. The N vulnerability scores are arranged from large to small, and the code lines corresponding to the vulnerability scores in the first M positions are judged to have vulnerabilities. M is a predefined parameter, which can locate the code lines most likely to have vulnerabilities.

[0092] To verify the detection effect of the line-level software vulnerability detection method integrating contextual semantics, the line-level software vulnerability detection method integrating contextual semantics in the above embodiment is used to perform vulnerability detection on a set of target software codes. The target software codes are known to have vulnerabilities through running in advance, but it is unknown which specific line of code has the vulnerability. Figure 3 As shown in the figure, through the vulnerability detection of this line-level software vulnerability detection method, a probability (i.e., the vulnerability score calculated above) can be calculated for each line of code, and the code lines with vulnerabilities can be determined by sorting the probabilities, such as Figure 3 The 4th / 5th lines of code in the , which are ranked at the top in terms of probability, can be identified as having vulnerabilities. For the detected lines of code, after manual inspection:

[0093] Line 4: Array out-of-bounds exception. The loop condition is written as i <= input.length(). When i = input.length(), input.charAt(i) throws a StringIndexOutOfBoundsException.

[0094] Line 5: NullPointerException. If input is null, calling input.charAt(i) will throw a NullPointerException.

[0095] From this we can see that Figure 3 Lines 4 and 5 in the example above contain vulnerabilities, and the line-level software vulnerability detection method that incorporates contextual semantics can accurately detect the code lines where the vulnerabilities are located. This line-level software vulnerability detection method can pinpoint the specific vulnerable lines of code, greatly improving the accuracy of vulnerability localization in software code.

[0096] In another embodiment, the row-level software vulnerability detection method integrating contextual semantics further includes S0.

[0097] S0. Perform coarse-grained detection on the target software code to detect whether there are vulnerabilities in the target software code as a whole.

[0098] If it is detected that the target software code as a whole has a vulnerability, then proceed to S1-S6.

[0099] If it is detected that there are no vulnerabilities in the entire target software code, the process ends.

[0100] In this row-level software vulnerability detection method that integrates contextual semantics, S1-S6 can perform fine-grained vulnerability detection, while S0 can perform coarse-grained file-level vulnerability detection. Specifically, Figure 4 As shown, the method for performing coarse-grained detection on the target software code includes the following steps:

[0101] S21, preprocessing the target software code to remove noise, thereby obtaining a preprocessed software code;

[0102] The preprocessed software code includes N lines of code;

[0103] S22. Perform vector embedding on the nth line of code to obtain the nth line of code vector L n , n∈[1,N];

[0104] For the nth code line vector L n Associated location information;

[0105] S23, the nth code line vector L n The nth context vector LC is calculated by the encoding module n ;

[0106] S24, the nth code line vector L is calculated by the weight matrix U n Study and get the nth code line vector L′ n ;

[0107] The nth context vector LC is calculated by the weight matrix V n Learn and get the nth context vector LC′ n ;

[0108] S25, transform N code line vectors {L′1, L′2, …, L′ n} and N context vectors {LC′1, LC′2, …, LC′ n} Perform feature fusion to obtain the attention mapping matrix Attention_map;

[0109] S26. Perform an average pooling operation on the attention map matrix Attention_map, and input the pooled result into the linear layer (a fully connected layer can be used) to calculate the variable value B. The calculation formula is:

[0110] B=Sigmoid(Linear(mean(Attention_map))

[0111] Where Sigmoid is the Sigmoid activation function and Linear represents linear processing.

[0112] The obtained variable value is mapped to the range of 0 to 1 for a binary classification task: a mapped value greater than or equal to 0.5 is considered to have a vulnerability, and the system output value is 1. A mapped value less than 0.5 is considered to have no vulnerability, and the system output value is 0.

[0113] This coarse-grained vulnerability detection method performs coarse-grained detection of target software code to detect vulnerabilities across the entire software before performing line-level vulnerability detection. Fine-grained vulnerability detection is performed only after the target code is confirmed to contain vulnerabilities, thereby reducing the waste of computing resources. Furthermore, the file-level vulnerability detection results and data can be used as part of the pre-training or training data for various models in the fine-grained vulnerability detection method, increasing the data volume and improving model training efficiency.

[0114] In addition, the model used in the row-level software vulnerability detection method that integrates contextual semantics can also be trained using existing methods: supervised training of the model using training sets and test sets, and updating the model parameters through backpropagation until the training loss function reaches the expected level.

[0115] In another embodiment, a context-integrated row-level software vulnerability detection system is proposed, which uses the context-integrated row-level software vulnerability detection method described above. The row-level software vulnerability detection system includes a preprocessing module, a vector embedding module, an information extraction module, and a vulnerability prediction module.

[0116] The preprocessing module is used to preprocess the target software code to remove noise.

[0117] The vector embedding module is used to embed the nth line of code into a vector to obtain the nth line of code vector L n The vector embedding module is also used to integrate the code line location information into the code line vector L n middle.

[0118] The information extraction module is used to fuse context information and extract the nth code line vector L n Calculate the nth context vector LC n The information extraction module is also used to extract the n-th code line vector L n and the nth context vector LC n Perform learning and obtain the learned code row vector L′ n and context vector LC′ n .

[0119] The vulnerability prediction module is used to transform N code line vectors {L′1, L′2, …, L′ n} and N context vectors {LC′1, LC′2, …, LC′ n The projection matrix P and the projection matrix Q are used to generate a low-rank projection space and calculate the attention map matrix Attention_map. The vulnerability prediction module also extracts vulnerability scores from the attention map matrix Attention_map through matrix operations, obtaining N vulnerability scores. These N vulnerability scores are then sorted from largest to smallest, and the code lines corresponding to the top M vulnerability scores are determined to have vulnerabilities.

[0120] In another embodiment, a row-level software vulnerability detection system integrating contextual semantics is also proposed. Compared with the above-mentioned row-level software vulnerability detection system integrating contextual semantics, the difference is that the vulnerability prediction module is further used to input the attention mapping matrix Attention_map into the linear layer after pooling to calculate the variable value B, and map the variable value B to a value between 0 and 1. A value greater than or equal to 0.5 after mapping is considered to have a vulnerability, and a value less than 0.5 is considered to have no vulnerability.

[0121] In other embodiments, an electronic device is provided. The electronic device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the steps of the above-mentioned row-level software vulnerability detection method integrating contextual semantics are implemented.

[0122] Some other embodiments also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described row-level software vulnerability detection method integrating contextual semantics.

[0123] Some other embodiments also provide a software program product, which includes program instructions and, when executed on an electronic device, enables the electronic device to execute the above-mentioned row-level software vulnerability detection method integrating contextual semantics.

[0124] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0125] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be determined by the appended claims.

Claims

1. A row-level software vulnerability detection method integrating contextual semantics, characterized by , which is used to perform line-level vulnerability detection on the target software code; the line-level software vulnerability detection method includes the following steps: S1. Preprocessing the target software code to remove noise to obtain preprocessed software code; The preprocessed software code includes N lines of code; S2. Perform vector embedding on the nth line of code in the preprocessed software code to obtain the nth code line vector L n , n∈[1,N]; For the nth code line vector L n The location information of the associated code line; S3, transform the nth code line vector L n The nth context vector LC is calculated by the encoding module n ; S4, through the weight matrix U for the nth code line vector L n Study and get the nth code line vector L ′ n ; The nth context vector LC is calculated by the weight matrix V n Learn and get the nth context vector LC ′ n ; S5, transform N code line vectors {L ′ 1, L ′ 2,…,L ′ n } and N context vectors {LC ′ 1.LC ′ 2,…,LC ′ n } Perform feature fusion to obtain the attention mapping matrix Attention_map; S6. Extract vulnerability scores from the attention map matrix Attention_map through matrix operations to obtain N vulnerability scores. Arrange N vulnerability scores from large to small; The n-th vulnerability score corresponds to the n-th code line vector L n ; The nth code line vector L n According to the position information, the nth line of code in the software code is corresponded; Among them, the code lines corresponding to the vulnerability scores in the top M positions are judged as having vulnerabilities; M is a predefined parameter.

2. The row-level software vulnerability detection method integrating contextual semantics according to claim 1 is characterized in that: In S2, the nth code line vector L is calculated using sine and cosine functions. n The position information of the associated code line is as follows: Where P is the position information of the code line, i is the position of the code line, k is the dimension index in the position encoding, and d is the dimension of the code line vector L.

3. The row-level software vulnerability detection method integrating contextual semantics according to claim 1 is characterized in that: In S3, the encoding module includes the encoder in the Transformer model.

4. The row-level software vulnerability detection method integrating contextual semantics according to claim 1 is characterized in that: In S3, the context vector LC is calculated n Previously, the number of code lines in all target software codes in the same batch was padded to K; K is the maximum number of code lines in all target software codes in the batch.

5. The row-level software vulnerability detection method integrating contextual semantics according to claim 1 is characterized in that: In S4, the code line vector L n The formula for learning is: L ′ n =ReLU(L n *U) Context vector LC n The formula for learning is: IC ′ n =ReLU(LC n *V) Where ReLU is a nonlinear activation function.

6. The row-level software vulnerability detection method integrating contextual semantics according to claim 1 is characterized in that: In S5, the feature fusion methods include: Generate a projection of a low-rank space using projection matrix P and projection matrix Q; Use projection to perform attention mapping to obtain the attention mapping matrix Attention_map; The calculation formula of the attention mapping matrix Attention_map is: Attention_map=(P·{L ′ 1,L ′ 2,…,L ′ n })·(Q·{LC ′ 1,LC ' 2,…,LC ' n })。 7. The row-level software vulnerability detection method integrating contextual semantics according to claim 1 is characterized in that: In S6, the steps of performing matrix operations include: Extract the diagonal elements in the attention mapping matrix Attention_map to obtain a new mapping matrix; Normalize the elements of each row in the new mapping matrix; Each element in the normalized mapping matrix corresponds to a vulnerability score.

8. The row-level software vulnerability detection method integrating contextual semantics according to claim 7 is characterized in that: Row-level software vulnerability detection methods that integrate contextual semantics also include S0; S0. Performing coarse-grained detection on the target software code to detect whether there are vulnerabilities in the entire target software code; If a vulnerability is detected in the target software code as a whole, proceed to S1-S6; If it is detected that there are no vulnerabilities in the entire target software code, the process ends.

9. The row-level software vulnerability detection method integrating contextual semantics according to claim 8 is characterized in that: The coarse-grained detection method for the target software code includes the following steps: S21, preprocessing the target software code to remove noise to obtain preprocessed software code, where the preprocessed software code includes N lines of code; S22. Perform vector embedding on the nth line of code to obtain the nth line of code vector L n , n∈[1,N]; For the nth code line vector L n Associated location information; S23, the nth code line vector L n The nth context vector LC is calculated by the encoding module n ; S24, the nth code line vector L is calculated by the weight matrix U n Study and get the nth code line vector L ' n ; The nth context vector LC is calculated by the weight matrix V n Learn and get the nth context vector LC ′ n ; S25, transform N code line vectors {L ′ 1, L ' 2,…,L ′ n } and N context vectors {LC ′ 1.LC ′ 2,…,LC ′ n } Perform feature fusion to obtain the attention mapping matrix Attention_map; S26. Pool the attention map matrix Attention_map and input it into the linear layer to calculate the variable value B. The calculation formula is: B=Sigmoid(Linear(mean(Attention_map)) In the formula, Sigmoid is the Sigmoid activation function, and Linear represents linear processing; Map the variable value B to between 0 and 1. A value greater than or equal to 0.5 after mapping is considered to have a vulnerability, and a value less than 0.5 is considered to have no vulnerability.

10. A row-level software vulnerability detection system integrating contextual semantics, characterized in that: It uses the row-level software vulnerability detection method integrating contextual semantics as described in any one of claims 1 to 9; The row-level software vulnerability detection system includes: A preprocessing module, which is used to preprocess the target software code to remove noise; Vector embedding module, which is used to embed the nth line of code into a vector to obtain the nth line of code vector L n ; It is also used to integrate the code line location information into the code line vector L n middle; The information extraction module is used to fuse context information and extract the n-th code line vector L n Calculate the nth context vector LC n ; Also used for the nth code line vector L n and the nth context vector LC n Perform learning and obtain the learned code row vector L ′ n and context vector LC ′ n ; Vulnerability prediction module, which is used to transform N code line vectors {L ′ 1, L ′ 2,…,L ′ n } and N context vectors {LC ′ 1.LC ′ 2,…,LC ′ n }Use the projection matrix P and the projection matrix Q to generate a projection of a low-rank space, and calculate the attention mapping matrix Attention_map; it is also used to extract the vulnerability scores of the attention mapping matrix Attention_map through matrix operations to obtain N vulnerability scores; arrange the N vulnerability scores from large to small, and the code lines corresponding to the vulnerability scores in the first M positions are judged to have vulnerabilities.

Images