Security diagnosis evaluation method and system for open source software

Abstract

The invention discloses a safety diagnosis evaluation method and system for open source software, and relates to the technical field of safety diagnosis. Performing dependency extraction on the code attribute graph and then constructing a code relation tree; extracting a context code related to the vulnerability in the source code through the context slice to obtain a target code snippet, and performing feature extraction on the target code snippet to obtain a first feature; performing anonymization processing on a variable name and a function name in the source code, performing word embedding on an anonymized code sequence through Word2Vec, and extracting syntactic information of a target code snippet by using a bidirectional gating loop unit model to obtain a second feature; the first feature and the second feature are substituted into a multi-layer perceptron model to obtain the vulnerability existence probability of the source code, the dependency relationship between codes is comprehensively captured, and then target code snippets are extracted through context slicing, so that the potential vulnerability position and type are more accurately identified, and the security is improved; and the risk of being attacked by the supply chain is reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of security diagnosis, and in particular relates to a security diagnosis and evaluation method and system for open source software. Background Art

[0002] With the rapid development of modern software development, open source software has become an important part of building applications for enterprises and developers. Open source software has the advantages of being free, open, and customizable, and is widely used in various projects. However, since the source code of open source software is public, security risks also increase. Attackers can find vulnerabilities and exploit them by analyzing the public source code. In addition, the development and maintenance status of open source software projects varies. Some projects may lack continuous maintenance or fail to fix known vulnerabilities in a timely manner, resulting in security risks during their use.

[0003] In the software supply chain, the complexity of open source software and its dependencies further amplifies security risks. Modern software is often composed of multiple open source components, and vulnerabilities in any one component may affect the security of the entire system. For example, if there is a serious vulnerability in an open source library and the library is widely used, its potential threats will spread rapidly and may cause large-scale security incidents. In addition, many industries require that the software systems used must meet strict security and privacy standards. This means that when enterprises adopt open source software, they must conduct detailed security assessments on it to ensure that compliance requirements are met and to avoid security incidents such as data leaks.

[0004] Existing methods often have difficulty in comprehensive coverage when faced with deep dependencies and cross-dependencies, which may lead to the security vulnerabilities of certain dependencies being overlooked, increasing the risk of supply chain attacks. Summary of the invention

[0005] The purpose of the present invention is to solve the problem that the security vulnerabilities of certain dependencies are ignored, increasing the risk of supply chain attacks, and to propose a security diagnosis and evaluation method and system for open source software.

[0006] In a first aspect of the present invention, a security diagnosis and evaluation method for open source software is first proposed, the method comprising: Obtain source code of open source software, and perform code parsing on the source code using the Joern tool to obtain a code property graph, perform dependency extraction on the code property graph to obtain a program dependency graph, and construct a code relationship tree according to the program dependency graph; According to the code relationship tree, extracting context code related to the vulnerability in the source code through context slicing to obtain a target code fragment, and performing feature extraction on the target code fragment to obtain a first feature; After anonymizing the variable names and function names in the source code, embedding the anonymized code sequence through Word2Vec, and extracting the syntactic information of the target code fragment using a bidirectional gated recurrent unit model to obtain a second feature; The first feature and the second feature are subjected to feature fusion to obtain a target feature, the target feature is substituted into a multi-layer perceptron model to obtain a probability of vulnerability existence in the source code, and a security assessment is performed on the open source software according to the probability of vulnerability existence.

[0007] Optionally, performing dependency extraction on the code property graph to obtain a program dependency graph, and constructing a code relationship tree according to the program dependency graph includes: The data dependency is obtained by tracing the data flow graph in the code attribute graph to find the usage relationship between each variable, the control dependency is obtained by tracing the control flow graph in the code attribute graph, and the structural dependency is obtained by analyzing the scope and hierarchy in the source code; Integrate the data dependency, the control dependency and the structure dependency to obtain a program dependency graph; The main function in the source code is obtained as a root node, and each code block in the source code is identified as a child node and added to the root node according to the program dependency graph, and corresponding child nodes are recursively added to each child node according to the program dependency graph until all code blocks are identified to obtain a code relationship tree.

[0008] Optionally, according to the code relationship tree, extracting the context code related to the vulnerability in the source code by context slicing to obtain the target code fragment includes: Determine the vulnerability in the source code by using vulnerability detection rules, and mark the vulnerability in the code relationship tree to obtain a starting point; According to the code relationship tree, nodes related to the vulnerability are extracted forward and backward along the code relationship tree starting from the starting point, and all code fragments corresponding to the vulnerability-related nodes are obtained, and forward and backward slicing is performed along the control flow and data flow to obtain the target code fragment.

[0009] Optionally, extracting a feature from the target code fragment to obtain a first feature includes: Obtaining a local abstract syntax tree and a local control flow graph corresponding to the target code fragment, and extracting node information in the local abstract syntax tree to obtain first information; Extracting the control flow path related to the fault in the local control flow graph to obtain second information; extracting the usage frequency, assignment chain and usage chain of key variables in the code to obtain third information; Substitute the first information, the second information and the third information into a machine learning model to perform feature extraction to obtain a first feature.

[0010] Optionally, performing feature fusion on the first feature and the second feature to obtain a target feature includes: Performing linear transformation on the first feature and the second feature respectively to obtain a first linear feature and a second linear feature; Divide the first linear feature into multiple subspaces, perform parallel attention operations to obtain multiple attention heads, and concatenate all the attention heads to obtain a first target feature; The first target feature and the second linear feature are weightedly fused to obtain a target feature.

[0011] In a second aspect of the present invention, a security diagnosis and evaluation system for open source software is provided, comprising: A code relationship tree determination module is used to obtain the source code of the open source software, and perform code analysis on the source code using the Joern tool to obtain a code attribute graph, perform dependency extraction on the code attribute graph to obtain a program dependency graph, and construct a code relationship tree according to the program dependency graph; A first feature extraction module is used to extract context code related to the vulnerability in the source code through context slicing according to the code relationship tree to obtain a target code fragment, and perform feature extraction on the target code fragment to obtain a first feature; A second feature extraction module is used to anonymize the variable names and function names in the source code, embed the anonymized code sequence through Word2Vec, and use a bidirectional gated recurrent unit model to extract the syntactic information of the target code fragment to obtain a second feature; A feature fusion module is used to fuse the first feature and the second feature to obtain a target feature, substitute the target feature into a multi-layer perceptron model to obtain a probability of vulnerability existence in the source code, and perform a security assessment on the open source software based on the probability of vulnerability existence.

[0012] Optionally, the code relationship tree determination module includes: A dependency extraction module, used to obtain data dependency by tracing the data flow graph in the code attribute graph to find the usage relationship between each variable, obtain control dependency by tracing the control flow graph in the code attribute graph, and obtain structural dependency by analyzing the scope and hierarchy in the source code; A dependency integration module, used for integrating the data dependency, the control dependency and the structure dependency to obtain a program dependency graph; A code relationship tree establishment module is used to obtain the main function in the source code as a root node, identify each code block in the source code as a child node and add it to the root node according to the program dependency graph, and recursively add corresponding child nodes to each child node according to the program dependency graph until all code blocks are identified to obtain a code relationship tree.

[0013] Optionally, the first feature extraction module includes: A vulnerability marking module, used to determine the vulnerability in the source code through vulnerability detection rules, and mark the vulnerability in the code relationship tree to obtain a starting point; The target code fragment determination module is used to extract nodes related to the vulnerability forward and backward along the code relationship tree based on the code relationship tree and starting from the starting point, obtain all code fragments corresponding to the vulnerability-related nodes, and perform forward and backward slicing along the control flow and data flow to obtain the target code fragment.

[0014] Optionally, the first feature extraction module further includes: A node information extraction module, used to obtain a local abstract syntax tree and a local control flow graph corresponding to the target code fragment, and extract node information in the local abstract syntax tree to obtain first information; An information extraction module is used to extract the control flow path related to the fault in the local control flow graph to obtain second information; extract the usage frequency, assignment chain and usage chain of key variables in the code to obtain third information; The first feature fusion module is used to substitute the first information, the second information and the third information into a machine learning model to perform feature extraction to obtain a first feature.

[0015] Optionally, the feature fusion module includes: A linear transformation module, used to perform linear transformation on the first feature and the second feature to obtain a first linear feature and a second linear feature; A first target feature construction module, used to divide the first linear feature into multiple subspaces, perform parallel attention operations to obtain multiple attention heads, and concatenate all the attention heads to obtain a first target feature; The feature weighted fusion module is used to perform weighted fusion on the first target feature and the second linear feature to obtain a target feature.

[0016] Beneficial effects of the present invention: The present invention proposes a security diagnosis and evaluation method for open source software. The method comprises the following steps: obtaining source code of the open source software, parsing the source code by a Joern tool to obtain a code attribute graph, extracting dependencies on the code attribute graph to obtain a program dependency graph, and constructing a code relationship tree according to the program dependency graph; extracting context codes related to vulnerabilities in the source code by context slicing according to the code relationship tree to obtain target code fragments, and extracting features of the target code fragments to obtain a first feature; anonymizing variable names and function names in the source code, embedding the anonymized code sequences by Word2Vec, and extracting syntactic information of the target code fragments by using a bidirectional gated recurrent unit model to obtain a second feature; fusion of the first feature and the second feature to obtain a target feature, substituting the target feature into a multi-layer perceptron model to obtain the probability of vulnerability existence in the source code, and performing security evaluation on the open source software according to the probability of vulnerability existence. By using the Joern tool to generate a code attribute graph (CAG) and extract a program dependency graph, the solution can deeply parse the structure of the source code and fully capture the dependencies between the codes. It can then extract the target code snippets through context slicing, reducing the amount of code to be analyzed and improving the speed of the overall solution. By fusing the first and second features, the solution can more comprehensively and accurately identify potential vulnerability locations and types, thereby improving security and reducing the risk of supply chain attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The present invention will be further described below in conjunction with the accompanying drawings.

[0018] Figure 1 A flowchart of a security diagnosis and evaluation method for open source software is provided for an embodiment of the present invention; Figure 2 A framework diagram of a security diagnosis and evaluation system for open source software is provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. The term "and / or" herein is only a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the present invention, the description of "first", "second", etc. is only used for descriptive purposes, and cannot be understood as indicating or implying its relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" can explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on the ability of ordinary technicians in the field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0020] Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative work shall fall within the scope of protection of the present invention.

[0021] The embodiment of the present invention provides a security diagnosis and evaluation method for open source software. Figure 1 , Figure 1 A flowchart of a security diagnosis and evaluation method for open source software provided by an embodiment of the present invention. The method comprises the following steps: S101, obtain the source code of the open source software, and parse the source code through the Joern tool to obtain a code attribute graph, perform dependency extraction on the code attribute graph to obtain a program dependency graph, and construct a code relationship tree according to the program dependency graph.

[0022] S102, according to the code relationship tree, extracting the context code related to the vulnerability in the source code through context slicing to obtain a target code fragment, and performing feature extraction on the target code fragment to obtain a first feature.

[0023] S103, after anonymizing the variable names and function names in the source code, the anonymized code sequence is word-embedded using Word2Vec, and the bidirectional gated recurrent unit model is used to extract the syntactic information of the target code fragment to obtain the second feature.

[0024] S104, performing feature fusion on the first feature and the second feature to obtain a target feature, substituting the target feature into a multi-layer perceptron model to obtain a probability of vulnerability existence in the source code, and performing a security assessment on the open source software based on the probability of vulnerability existence.

[0025] Based on a security diagnosis and assessment method for open source software provided by an embodiment of the present invention, a code attribute graph (CAG) is generated and a program dependency graph is extracted through the Joern tool. The solution can deeply parse the structure of the source code, comprehensively capture the dependencies between the codes, and then extract the target code fragments through context slicing, thereby reducing the amount of code to be analyzed and improving the speed of the overall solution. By fusing the first feature and the second feature, the solution can more comprehensively and accurately identify the location and type of potential vulnerabilities, thereby improving security and reducing the risk of supply chain attacks.

[0026] In one implementation, through the code property graph and program dependency graph generated by the Joern tool, the solution can deeply understand the structure of the source code and the dependencies between various components. Comprehensive analysis helps identify potential security issues and ensures comprehensive coverage of complex dependencies. Through context slicing, context code related to the vulnerability is extracted, which reduces the amount of code that needs to be analyzed, thereby improving processing efficiency, helping to accurately locate code snippets that may have vulnerabilities and avoiding comprehensive analysis of the entire code base.

[0027] In one implementation, the solution combines the contextual information and semantic information of the code by extracting structural features, i.e., the first feature, and grammatical features, i.e., the second feature, from the target code fragment. The structural features help identify the organization and dependencies of the code, while the grammatical features provide the specific implementation details of the code, thereby improving the accuracy of vulnerability detection.

[0028] In one implementation, by substituting the fused target features into a multi-layer perceptron model, the solution can automatically predict the probability of vulnerability existence. The application of deep learning models improves the accuracy of vulnerability detection and can adapt to different types of codes and vulnerability scenarios.

[0029] In one implementation, Joern is a tool for static code analysis that can extract an abstract representation of code from source code. Joern helps analyze the structure and logic in the code by constructing data structures such as abstract syntax trees, control flow graphs, and data flow graphs. The abstract syntax tree is a tree-like structure representation of the code, showing the grammatical structure of the code; the control flow graph describes the path of control flow in the code, such as conditional branches and loops; the data flow graph represents the data flow relationship between variables; and the code attribute graph combines these graphs to form a code attribute graph, which is a comprehensive representation that captures information such as functions, variables, control flow, data flow, etc. in the code.

[0030] In one implementation, in the dependency graph, nodes represent entities in the code, such as functions, variables, and data, and edges represent dependencies between these entities; according to the program dependency graph, the various parts of the code are organized into a tree structure. The code relationship tree can help understand the hierarchy of the code and its dependencies. Through the tree structure, the dependency hierarchy between different code parts can be clearly viewed, which helps to identify complex dependencies and potential security risks.

[0031] In one implementation, the purpose of anonymization is to remove specific identifiers such as variable names and function names in the source code, thereby eliminating the interference of naming differences on the analysis model and allowing the model to focus more on the structure and semantics of the code; replacing all variable names and function names in the source code with common identifiers. This step usually keeps the logical structure of the code unchanged, but makes the names in the code no longer specific, and the grammatical structure and logical relationships of the code remain consistent, so that subsequent analysis can correctly understand the function of the code.

[0032] In one implementation, Word2Vec is a technology that converts words into vector representations, which can capture the semantic relationship between words. In code analysis, Word2Vec maps the anonymized names of identifiers in the code into vectors to represent the semantics of the code.

[0033] In one implementation, the word vector obtained by Word2Vec is passed as input to a bidirectional gated recurrent unit. The bidirectional gated recurrent unit considers both the forward and reverse information of the input sequence, thereby capturing more contextual information. The bidirectional gated recurrent unit extracts the syntactic features of the target code snippet through its gating mechanisms such as update gates and reset gates. These features include structural information, logical flow, and grammatical relationships in the code.

[0034] In one implementation, the multilayer perceptron model includes an input layer, a hidden layer, and an output layer. The number of nodes in the input layer is equal to the dimension of the target feature, and the target feature is extracted from the source code. There are 5 hidden layers, and the number of neurons in each hidden layer decreases from input to output, and the number of neurons is 100, 80, 60, 40, and 20, respectively. The activation function uses ReLU, and the output layer uses the Sigmoid function. The output value is between 0 and 1. If the output value is greater than or equal to 0.472, it means that the code snippet has a vulnerability, otherwise it does not exist.

[0035] In one embodiment, performing dependency extraction on the code property graph to obtain a program dependency graph, and constructing a code relationship tree according to the program dependency graph includes: By tracing the data flow graph in the code attribute graph, we can find the usage relationship between each variable to obtain data dependency. By tracing the control flow graph in the code attribute graph, we can obtain control dependency. By analyzing the scope and hierarchy in the source code, we can obtain structural dependency. Integrate data dependency, control dependency and structural dependency to obtain a program dependency graph; Get the main function in the source code as the root node, identify each code block in the source code as a child node and add it to the root node according to the program dependency graph, and recursively add corresponding child nodes to each child node according to the program dependency graph until all code blocks are identified and the code relationship tree is obtained.

[0036] In one implementation, by integrating data dependency, control dependency, and structural dependency, the various dependencies of the code can be fully understood, which can reveal the complex interactions and potential problems in the code; the combination of data dependency, control dependency, and structural dependency can provide detailed contextual information to help understand the execution process and data flow of the code, so as to better locate and analyze problems.

[0037] In one implementation, the data dependency graph can help track data flow and identify potential data leakage or tampering points. The control dependency graph can reveal the impact of conditional judgments and control flows on vulnerabilities, and help analyze the triggering conditions and execution paths of vulnerabilities. The structural dependency graph provides code hierarchy and scope information to help understand the relationship between different modules and functions.

[0038] In one implementation, the data dependency graph is the read-write dependency relationship between different statements or operations in the program, reflecting how data flows in the program. The source code is parsed and an abstract syntax tree is generated. The definition and usage location of each variable is identified based on the abstract syntax tree. The definition and usage relationship of the variable is traced, and the definition location and usage location of the variable are connected. If the value of the variable flows between statements, a dependency relationship needs to be added to finally obtain the data dependency graph.

[0039] In one implementation, the control dependency graph is used to describe the conditional dependencies on the program execution path, that is, the execution of certain statements depends on the results of conditional judgments, and a control flow graph of the program is generated. The nodes represent basic blocks or statements, and the edges represent control flow transfers. The control structure is identified from the control flow graph, and the post-dominator tree is used to determine the control dependency relationship. The post-dominator tree indicates that in the program control flow, on the path from a certain node to the end of the program, a certain node is always executed before another node; if the child nodes after node B have control dependencies on node B.

[0040] In one implementation, a structural dependency graph describes function call relationships in a program, block structures such as hierarchical relationships between functions and classes, identifies function call relationships in a program, generates nodes to represent functions, edges to represent function calls, identifies nested structures in the code such as nested statement blocks in classes, methods, and functions, records dependencies between parent and child nodes, connects nested nodes such as function calls and structures between class-member functions, and forms a hierarchical dependency structure.

[0041] In one implementation, the control flow graph, data flow graph, call graph and structural dependency are integrated into a unified program dependency graph. The nodes of the program dependency graph represent operations in the program such as variable definitions, statements, functions, etc., and the edges represent three dependency relationships: data dependency, control dependency and structural dependency.

[0042] In one implementation, the code relationship tree organizes each code block of the source code in a tree structure, which can clearly show the relationship and dependencies between code blocks. Through the dependency graph and code relationship tree, auditors can quickly identify and analyze potential problems in the code, thereby improving the efficiency and accuracy of code auditing.

[0043] In one embodiment, according to the code relationship tree, extracting the context code related to the vulnerability in the source code through context slicing to obtain the target code fragment includes: Determine the vulnerabilities in the source code through vulnerability detection rules, and mark the vulnerabilities in the code relationship tree to obtain the starting location; According to the code relationship tree, take the starting point as the starting point, extract the nodes related to the vulnerability forward and backward along the code relationship tree, obtain all the code fragments corresponding to the vulnerability-related nodes, and slice them forward and backward along the control flow and data flow to obtain the target code fragment.

[0044] In one implementation, vulnerabilities in source code are determined through vulnerability detection rules, and the starting point is marked in the code relationship tree, which helps to accurately locate the vulnerability. By starting from the starting point of the vulnerability and extracting nodes related to the vulnerability forward and backward, all context codes that affect the vulnerability can be fully obtained, which helps to understand the root cause and scope of the vulnerability.

[0045] In one implementation, control flow is based on a control dependency graph and data flow is based on a data dependency graph.

[0046] In one implementation, the vulnerability detection tool can use static code analysis tools such as SonarQube, CodeQL, FindBugs, etc.; the detection rules are common vulnerability rules such as OWASP Top 10, CWE vulnerability classification, etc. Once a vulnerability is detected, the specific location of the vulnerability is recorded, such as the line number of the code, the file name, and the vulnerability type such as unvalidated user input. This is the starting point.

[0047] In one implementation, forward slicing starts from the vulnerability point, traces the function call chain, and captures all affected functions and code blocks along the call path. For example, if the vulnerability point is in a function, forward slicing will find all subsequent parts of the function call, as well as other code parts that call the function; forward-backward slicing traces how the variable data of the vulnerability point is passed, identifies which variables are modified at the vulnerability point, and traces their usage scenarios. For example, if the vulnerability point affects a global variable, forward slicing will capture all subsequent code that uses the variable.

[0048] In one implementation, by analyzing the control flow related to the vulnerability, we can understand the triggering conditions and code paths of the vulnerability, helping to identify which conditions and branches may lead to the vulnerability. By analyzing the data flow, we can understand how data propagates in the code and how it affects the manifestation of the vulnerability, thereby identifying potential problems in data processing and transmission. Combining control flow and data flow slicing, we can comprehensively analyze the vulnerability from multiple angles.

[0049] In one implementation, the target code snippet obtained through context slicing is directly related to the vulnerability, which helps developers quickly locate and fix the vulnerability, improves the repair efficiency, focuses on the code snippet related to the vulnerability, reduces the analysis and inspection of irrelevant code, and optimizes the repair process.

[0050] In one embodiment, extracting a feature from the target code segment to obtain a first feature includes: Obtaining a local abstract syntax tree and a local control flow graph corresponding to the target code fragment, and extracting node information in the local abstract syntax tree to obtain first information; Extract the control flow path related to the fault in the local control flow graph to obtain the second information; extract the usage frequency, assignment chain and usage chain of key variables in the code to obtain the third information; The first information, the second information and the third information are substituted into the machine learning model to perform feature extraction to obtain the first feature.

[0051] In one implementation, the local abstract syntax tree provides detailed grammatical structure information of the target code fragment, which helps to understand the grammatical and structural characteristics of the code; by analyzing the abstract syntax tree nodes, potential code patterns, structures and possible errors can be identified, helping to deeply understand the function and logic of the code.

[0052] In one implementation, the local control flow graph provides control flow information for the target code snippet. Extracting relevant control flow paths can help analyze the execution logic of the code and identify control flow paths that may be affected by vulnerabilities; extracting the usage frequency of key variables in the code can identify the importance and influence of variables in the code, helping to understand how variables affect the behavior of the code; analyzing the assignment chain and usage chain of variables can track the life cycle and data flow of variables, helping to identify the role of variables in vulnerabilities and their scope of influence.

[0053] In one implementation, the analysis results of the local abstract syntax tree, the local control flow graph, and the key variables are combined to extract the features of the target code fragment from multiple dimensions and improve the accuracy of feature extraction.

[0054] In one implementation, the extracted features are standardized and normalized to ensure that the numerical ranges of different features are consistent, the attribute values ​​of nodes, the conditions of control flow paths, and the usage frequencies of variables are standardized to a unified scale, and discrete features are encoded, such as converting node types, control flow path conditions, etc. into numerical representations. One-hot encoding is used to process categorical features, and features extracted from local abstract syntax trees, local control flow graphs, and key variable analysis are integrated into a feature vector. A support vector machine is selected as a training model, and a machine learning model is trained using training data including features of target code snippets and labeled vulnerability information. The relationship between learning features and labels is adjusted to minimize prediction errors.

[0055] In one embodiment, performing feature fusion on the first feature and the second feature to obtain the target feature includes: Performing linear transformation on the first feature and the second feature respectively to obtain a first linear feature and a second linear feature; The first linear feature is divided into multiple subspaces, and a parallel attention operation is performed to obtain multiple attention heads, and all the attention heads are concatenated to obtain the first target feature; The first target feature and the second linear feature are weightedly fused to obtain the target feature.

[0056] In one implementation, linear transformation can better adapt to the learning requirements of the model by adjusting the weights and biases of the features, making the features more suitable for subsequent processing and fusion. Performing linear transformations on the first feature and the second feature respectively can optimize the representation of the features and make their distribution in the feature space more in line with the learning requirements of the model.

[0057] In one implementation, the weight of the first target feature is 0.6, and the weight of the second target feature is 0.4.

[0058] In one implementation, the attention mechanism can process features from multiple angles to capture different information and patterns in the features. The splicing of multiple attention heads can fuse different feature information to improve the expressiveness and representativeness of the features. The weighted fusion of the first target feature generated by the attention mechanism and the second linear feature can combine the advantages of both and improve the overall expressiveness of the features.

[0059] Based on the same inventive concept, the present invention also provides a security diagnosis and evaluation system for open source software. Figure 2 , Figure 2 A framework diagram of a security diagnosis and evaluation system for open source software provided by an embodiment of the present invention includes: The code relationship tree determination module is used to obtain the source code of the open source software, and parse the source code through the Joern tool to obtain a code attribute graph, extract the dependencies of the code attribute graph to obtain a program dependency graph, and construct a code relationship tree according to the program dependency graph; A first feature extraction module is used to extract context codes related to the vulnerability in the source code through context slicing according to the code relationship tree to obtain a target code fragment, and perform feature extraction on the target code fragment to obtain a first feature; The second feature extraction module is used to anonymize the variable names and function names in the source code, embed the anonymized code sequence through Word2Vec, and use a bidirectional gated recurrent unit model to extract the syntactic information of the target code fragment to obtain the second feature; The feature fusion module is used to fuse the first feature and the second feature to obtain the target feature, substitute the target feature into the multi-layer perceptron model to obtain the probability of vulnerability existence in the source code, and perform security assessment on the open source software based on the probability of vulnerability existence.

[0060] A security diagnosis and assessment system for open source software provided by an embodiment of the present invention generates a code attribute graph (CAG) and extracts a program dependency graph through the Joern tool. The solution can deeply parse the structure of the source code, comprehensively capture the dependencies between the codes, and then extract the target code fragments through context slicing, thereby reducing the amount of code to be analyzed and improving the speed of the overall solution. By fusing the first feature and the second feature, the solution can more comprehensively and accurately identify the location and type of potential vulnerabilities, thereby improving security and reducing the risk of supply chain attacks.

[0061] In one embodiment, the code relationship tree determination module includes: A dependency extraction module is used to obtain data dependency by tracing the data flow graph in the code attribute graph to find the usage relationship between each variable, obtain control dependency by tracing the control flow graph in the code attribute graph, and obtain structural dependency by analyzing the scope and hierarchy in the source code; Dependency integration module, used to integrate data dependency, control dependency and structure dependency to obtain a program dependency graph; The code relationship tree building module is used to obtain the main function in the source code as the root node, identify each code block in the source code as a child node and add it to the root node according to the program dependency graph, and recursively add corresponding child nodes to each child node according to the program dependency graph until all code blocks are identified and the code relationship tree is obtained.

[0062] In one embodiment, the first feature extraction module includes: A vulnerability marking module is used to determine the vulnerabilities in the source code through vulnerability detection rules, and mark the vulnerabilities in the code relationship tree to obtain the starting location; The target code fragment determination module is used to extract nodes related to the vulnerability forward and backward along the code relationship tree based on the code relationship tree, starting from the starting point, and obtain all code fragments corresponding to the vulnerability-related nodes, and perform forward and backward slicing along the control flow and data flow to obtain the target code fragment.

[0063] In one embodiment, the first feature extraction module further includes: A node information extraction module, used to obtain a local abstract syntax tree and a local control flow graph corresponding to the target code fragment, and extract node information in the local abstract syntax tree to obtain first information; An information extraction module is used to extract the control flow path related to the fault in the local control flow graph to obtain the second information; extract the usage frequency, assignment chain and usage chain of the key variables in the code to obtain the third information; The first feature fusion module is used to substitute the first information, the second information and the third information into the machine learning model to perform feature extraction to obtain the first feature.

[0064] In one embodiment, the feature fusion module includes: A linear transformation module, used to perform linear transformation on the first feature and the second feature respectively to obtain a first linear feature and a second linear feature; A first target feature construction module, used to divide the first linear feature into multiple subspaces, perform parallel attention operations to obtain multiple attention heads, and concatenate all the attention heads to obtain the first target feature; The feature weighted fusion module is used to perform weighted fusion on the first target feature and the second linear feature to obtain the target feature.

[0065] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A security diagnosis and evaluation method for open source software, characterized in that: The method comprises: Obtain source code of open source software, and perform code parsing on the source code using the Joern tool to obtain a code property graph, perform dependency extraction on the code property graph to obtain a program dependency graph, and construct a code relationship tree according to the program dependency graph; According to the code relationship tree, extracting context code related to the vulnerability in the source code through context slicing to obtain a target code fragment, and performing feature extraction on the target code fragment to obtain a first feature; After anonymizing the variable names and function names in the source code, embedding the anonymized code sequence through Word2Vec, and extracting the syntactic information of the target code fragment using a bidirectional gated recurrent unit model to obtain a second feature; The first feature and the second feature are subjected to feature fusion to obtain a target feature, the target feature is substituted into a multi-layer perceptron model to obtain a probability of vulnerability existence in the source code, and a security assessment is performed on the open source software according to the probability of vulnerability existence.

2. A security diagnosis and evaluation method for open source software according to claim 1, characterized in that: Dependency extraction is performed on the code attribute graph to obtain a program dependency graph, and constructing a code relationship tree according to the program dependency graph includes: The data dependency is obtained by tracing the data flow graph in the code attribute graph to find the usage relationship between each variable, the control dependency is obtained by tracing the control flow graph in the code attribute graph, and the structural dependency is obtained by analyzing the scope and hierarchy in the source code; Integrate the data dependency, the control dependency and the structure dependency to obtain a program dependency graph; The main function in the source code is obtained as a root node, and each code block in the source code is identified as a child node and added to the root node according to the program dependency graph, and corresponding child nodes are recursively added to each child node according to the program dependency graph until all code blocks are identified to obtain a code relationship tree.

3. A security diagnosis and evaluation method for open source software according to claim 1, characterized in that: According to the code relationship tree, extracting the context code related to the vulnerability in the source code through context slicing to obtain the target code fragment includes: Determine the vulnerability in the source code by using vulnerability detection rules, and mark the vulnerability in the code relationship tree to obtain a starting point; According to the code relationship tree, nodes related to the vulnerability are extracted forward and backward along the code relationship tree starting from the starting point, and all code fragments corresponding to the vulnerability-related nodes are obtained, and forward and backward slicing is performed along the control flow and data flow to obtain the target code fragment.

4. A security diagnosis and evaluation method for open source software according to claim 1, characterized in that: Extracting a feature of the target code segment to obtain a first feature includes: Obtaining a local abstract syntax tree and a local control flow graph corresponding to the target code fragment, and extracting node information in the local abstract syntax tree to obtain first information; Extracting the control flow path related to the fault in the local control flow graph to obtain second information; extracting the usage frequency, assignment chain and usage chain of key variables in the code to obtain third information; Substitute the first information, the second information and the third information into a machine learning model to perform feature extraction to obtain a first feature.

5. A security diagnosis and evaluation method for open source software according to claim 1, characterized in that: Performing feature fusion on the first feature and the second feature to obtain a target feature includes: Performing linear transformation on the first feature and the second feature respectively to obtain a first linear feature and a second linear feature; Divide the first linear feature into multiple subspaces, perform parallel attention operations to obtain multiple attention heads, and concatenate all the attention heads to obtain a first target feature; The first target feature and the second linear feature are weightedly fused to obtain a target feature.

6. A security diagnosis and evaluation system for open source software, characterized in that: The system comprises: A code relationship tree determination module is used to obtain the source code of the open source software, and perform code analysis on the source code using the Joern tool to obtain a code attribute graph, perform dependency extraction on the code attribute graph to obtain a program dependency graph, and construct a code relationship tree according to the program dependency graph; A first feature extraction module is used to extract context code related to the vulnerability in the source code through context slicing according to the code relationship tree to obtain a target code fragment, and perform feature extraction on the target code fragment to obtain a first feature; A second feature extraction module is used to anonymize the variable names and function names in the source code, embed the anonymized code sequence through Word2Vec, and use a bidirectional gated recurrent unit model to extract the syntactic information of the target code fragment to obtain a second feature; A feature fusion module is used to fuse the first feature and the second feature to obtain a target feature, substitute the target feature into a multi-layer perceptron model to obtain a probability of vulnerability existence in the source code, and perform a security assessment on the open source software based on the probability of vulnerability existence.

7. A security diagnosis and evaluation system for open source software according to claim 6, characterized in that: The code relationship tree determination module includes: A dependency extraction module, used to obtain data dependency by tracing the data flow graph in the code attribute graph to find the usage relationship between each variable, obtain control dependency by tracing the control flow graph in the code attribute graph, and obtain structural dependency by analyzing the scope and hierarchy in the source code; A dependency integration module, used for integrating the data dependency, the control dependency and the structure dependency to obtain a program dependency graph; A code relationship tree establishment module is used to obtain the main function in the source code as a root node, identify each code block in the source code as a child node and add it to the root node according to the program dependency graph, and recursively add corresponding child nodes to each child node according to the program dependency graph until all code blocks are identified to obtain a code relationship tree.

8. A security diagnosis and evaluation system for open source software according to claim 6, characterized in that: The first feature extraction module comprises: A vulnerability marking module, used to determine the vulnerability in the source code through vulnerability detection rules, and mark the vulnerability in the code relationship tree to obtain a starting point; The target code fragment determination module is used to extract nodes related to the vulnerability forward and backward along the code relationship tree based on the code relationship tree and starting from the starting point, obtain all code fragments corresponding to the vulnerability-related nodes, and perform forward and backward slicing along the control flow and data flow to obtain the target code fragment.

9. A security diagnosis and evaluation system for open source software according to claim 6, characterized in that: The first feature extraction module also includes: A node information extraction module, used to obtain a local abstract syntax tree and a local control flow graph corresponding to the target code fragment, and extract node information in the local abstract syntax tree to obtain first information; An information extraction module is used to extract the control flow path related to the fault in the local control flow graph to obtain second information; extract the usage frequency, assignment chain and usage chain of key variables in the code to obtain third information; The first feature fusion module is used to substitute the first information, the second information and the third information into a machine learning model to perform feature extraction to obtain a first feature.

10. A security diagnosis and evaluation system for open source software according to claim 6, characterized in that: The feature fusion module includes: A linear transformation module, used to perform linear transformation on the first feature and the second feature to obtain a first linear feature and a second linear feature; A first target feature construction module, used to divide the first linear feature into multiple subspaces, perform parallel attention operations to obtain multiple attention heads, and concatenate all the attention heads to obtain a first target feature; The feature weighted fusion module is used to perform weighted fusion on the first target feature and the second linear feature to obtain a target feature.

Images