Code vulnerability detection method and vulnerability detection system based on graph simplification

Abstract

The present invention relates to a code vulnerability detection method and vulnerability detection system based on graph simplification. The code vulnerability detection method based on graph simplification includes the following steps: S1, preprocessing the original software code code0 to remove noise to obtain the preprocessed software code code1; performing image generation processing on code1 to obtain a program dependency graph PDG; S2, performing graph simplification processing on the PDG to obtain a program simplification graph CSG. The present invention can represent vulnerable code as a graph while eliminating redundant information unrelated to the vulnerability, and then perform centrality analysis on the graph after removing redundant information to obtain a weighted image with the importance of all code lines, and capture relevant features in the weighted image through a CNN model to complete the vulnerability detection task. The vulnerability detection efficiency and accuracy of this method are higher than some existing code vulnerability detection methods, and it provides a more effective and feasible solution strategy for vulnerability detection in large-scale projects.

Description

Technical Field

[0001] The present invention relates to the technical field of code vulnerability detection, and in particular to a code vulnerability detection method and a vulnerability detection system based on graph simplification. Background Art

[0002] In the context of open source software, dependencies between programs and software are becoming increasingly strong. Complex software is often composed of multiple open source software packages. These interdependencies, combined with the maintainers and developers who contribute to each open source software package, together constitute the open source software supply chain. Development methods that use open source components inevitably spread high-risk vulnerabilities to other components or projects through inter-component dependencies, further expanding the risk. In recent years, cybersecurity incidents such as cyberattacks and user information leaks have occurred frequently. Therefore, the security of open source software plays a vital role in the security of the entire software supply chain.

[0003] Vulnerability detection is a critical issue in software supply chain security, but the diversity and complexity of the syntax and semantics of real-world vulnerability code make it difficult to effectively extract vulnerability signatures when analyzing large programs. In addition, real-world vulnerability code contains a large amount of redundant information that is irrelevant to the vulnerability, which further exacerbates the above problems. Traditional detection methods are limited by predefined rules, while existing vulnerability detection models based on graph neural networks typically retain all code information to extract vulnerability signatures. Since the proportion of vulnerability code in actual functions is very small, the rich information in the composite graph that is irrelevant to any vulnerability pattern hinders the accurate learning of vulnerability patterns. And due to the large number of nodes in the graph, vulnerability detection based on graph neural network models (GNNs) is usually very time-consuming, resulting in low efficiency in vulnerability detection in existing technologies. Summary of the Invention

[0004] Based on this, it is necessary to provide a code vulnerability detection method and vulnerability detection system based on graph simplification to address the problems of low detection efficiency and accuracy of existing vulnerability methods based on graph neural networks.

[0005] In a first aspect, the present invention provides a code vulnerability detection method based on graph simplification, which comprises the following steps:

[0006] S1, preprocessing the original software code code0 to remove noise, and obtaining the preprocessed software code code1; wherein code1 includes K1 lines of code;

[0007] Perform image generation processing on code1 to obtain the program dependency graph PDG;

[0008] Among them, PDG includes K1 original nodes and K2 original node edges;

[0009] The k1th original node represents the k1th line of code in code1; k1∈[1, K1];

[0010] K2 original node edges represent the dependency relationships between K1 original nodes;

[0011] S2, perform graph simplification on PDG to obtain program simplified graph CSG;

[0012] CSG includes N1 simplified nodes and N2 simplified node edges; N1<K1, N2<K2;

[0013] The graph simplification processing method includes:

[0014] S21, merging adjacent original nodes in the PDG according to node type, the merged simplified nodes inherit the original node edges of the original nodes before the merger, and forming simplified node edges;

[0015] S22, remove the noise nodes and free nodes in the PDG, and delete the original node edges connected to the noise nodes and free nodes;

[0016] S3, perform vector embedding on the N1 simplified nodes in the CSG to obtain N1 simplified node vectors, and update the CSG into a code vector graph;

[0017] S4, performing centrality analysis on the code vector graph based on simplified nodes, simplified node edges and simplified node vectors to generate a weight image;

[0018] S5 adjusts the weight image to the input specification requirements of the CNN model and performs a binary classification task to complete the vulnerability detection of the software code.

[0019] As a preferred example, in S21, the method for merging adjacent original nodes according to node type includes the following steps:

[0020] Determine whether the adjacent original nodes meet the merging rules;

[0021] If the adjacent original nodes meet the merging rules, the adjacent original nodes are merged;

[0022] The merging rules include:

[0023] If the parent node type is an expression statement and the child node type is also an expression statement, then they are merged;

[0024] If the parent node type is an identifier declaration statement and the child node type is an identifier, then they are merged;

[0025] If the parent node type is a conditional statement, all child nodes of any type will be merged;

[0026] If the parent node type is a for loop statement and the child node type is a parameter list, they will be merged;

[0027] If the parent node type is a function call statement and the child node type is an identifier or parameter list, they will be merged;

[0028] The method of merging adjacent original nodes includes retaining the original nodes of the parent node type, deleting the original nodes of the child node type, and retaining the original node edges corresponding to the original nodes of the child node type;

[0029] Among adjacent original nodes, the parent node is the original node located in front, and the child node is the original node located in the back.

[0030] As a preferred example, in S22, the method for determining a noise node includes the following steps:

[0031] S221, determining the attributes of a predefined noise node;

[0032] S222, compare the attributes of the K1 original nodes and the predefined noise nodes in the PDG one by one;

[0033] If the attributes of an original node are consistent with the attributes of a predefined noise node, the original node is determined to be a noise node.

[0034] As a preferred example, the method for determining the predefined noise node includes the following steps:

[0035] S2211, preprocessing the sample software code to remove noise, and performing image generation processing on the preprocessed sample software code to obtain a program dependency graph PDG';

[0036] The sample software code is software code that is known to have vulnerabilities;

[0037] S2212, counting the node types in PDG';

[0038] S2213, conduct an ablation experiment on each node type of PDG', and regard the node types with negative impact on the detection results as suspicious node types;

[0039] S2214, performing an ablation experiment on each node in the suspicious node type, and determining the nodes that have a negative impact on the detection results as noise nodes;

[0040] Record the properties of the noise node and save it as a predefined noise node.

[0041] As a preferred embodiment, in S22, the method for determining a free node includes the following steps:

[0042] S2215, calculate the degrees of K1 original nodes in PDG;

[0043] S2216: The original node with a degree of 0 is regarded as a free node.

[0044] As a preferred embodiment, in S4, the method for generating a weight image includes the following steps:

[0045] S41, calculate the destructibility metrics x1~x1 of N1 simplified nodes in the code vector graph N1 , eigenvector centrality EC1~EC N1 and closeness centrality CC1~CC N1 ;

[0046] S42, based on the destructibility metrics x1~x1 of N1 simplified nodes N1 The destructibility measurement channel is calculated;

[0047] According to the eigenvector centrality of N1 simplified nodes EC1~EC N1 Calculate the eigenvector channel;

[0048] According to the closeness centrality of N1 simplified nodes CC1~CC N1 The approach channel is calculated;

[0049] S43, generating a weight image according to the destructibility metric channel, the feature vector channel, and the proximity channel;

[0050] The weight image is used to represent the importance of the simplified nodes in the N1 row.

[0051] As a preferred embodiment, the method for calculating the destructibility measurement channel includes the following steps:

[0052] S411, calculate the destructibility measure x of the n1th simplified node n1 , n1∈[1, N1], the calculation formula is:

[0053]

[0054] Where n reachable Indicates the number of simplified node edges between the n1th simplified node and its adjacent simplified nodes, n total Indicates the number of all simplified nodes in the code vector graph;

[0055] S412, multiplying the n1th simplified node vector by the destructibility measure x of the n1th simplified node n1 Get channel value one;

[0056] S413, traverse N1 simplified nodes to obtain N1 channel values ​​1;

[0057] Arrange the N1 channel values ​​in the order of code lines to obtain the destructibility measurement channel.

[0058] As a preferred embodiment, the method for calculating the feature vector channel includes the following steps:

[0059] S421, calculate the eigenvector centrality EC of the n1th simplified node n1 , n1∈[1, N1], the calculation formula is:

[0060]

[0061] Where α represents the proportional constant, and β represents the eigenvector centrality EC of the n1th simplified node. n1 The initial value of; A represents the adjacency matrix; A n1j1 represents the edge weight or connection relationship between the n1th simplified node and the j1th simplified node; x j1 Represents the eigenvector centrality EC of the j1th simplified node j1 , the j1th simplified node and the n1th simplified node are adjacent nodes, j1∈[1,N1];

[0062] S422, multiply the vector of the n1th simplified node by the eigenvector centrality EC of the n1th simplified node n1 Get channel value two;

[0063] S423, traverse N1 simplified nodes to obtain N1 channel values ​​2;

[0064] Arrange the N1 channel values ​​in the order of code lines to obtain the feature vector channel;

[0065] The method for calculating the proximity channel includes the following steps:

[0066] S431, calculate the closeness centrality CC of the n1th simplified node n1 , and its calculation formula is:

[0067]

[0068] Where, d n1j2 represents the shortest distance between the n1th simplified node and the j2th node; j2∈[1, N1]; N represents the number of all simplified nodes in CSG;

[0069] S432, multiply the vector of the n1th simplified node by the closeness centrality CC of the n1th simplified node n1 Get channel value three;

[0070] S433, traverse N1 simplified nodes to obtain N1 channel values ​​three;

[0071] Arrange the N1 channel values ​​in the order of code lines to obtain the approximate channel.

[0072] As a preferred embodiment, in S5, the method for adjusting the weight image to the CNN model input specification requirements includes the following steps:

[0073] If the size of the weight image is less than the threshold, zero vectors are filled at the ends of the destructibility metric channel, feature vector channel, and proximity channel;

[0074] If the size of the weight image is larger than the threshold, the destructibility metric channel, the feature vector channel, and the end data of the near channel are deleted.

[0075] In a second aspect, the present invention also proposes a code vulnerability detection system based on graph simplification, which uses the code vulnerability detection method based on graph simplification in the first aspect. The code vulnerability detection system based on graph simplification includes: a preprocessing module, a graph simplification module, a node embedding module, an image generation module, and a classification module.

[0076] The preprocessing module is used to preprocess the original software code code0 to remove noise and obtain the preprocessed software code code1; it is also used to perform image generation processing on the preprocessed software code to obtain the program dependency graph PDG.

[0077] The graph simplification module is used to simplify the PDG to obtain the program simplified graph CSG.

[0078] The node embedding module is used to perform vector embedding on the N1 simplified nodes in the CSG, obtain N1 simplified node vectors, and update the CSG into a code vector graph.

[0079] The image generation module is used to perform centrality analysis on the code vector graph based on simplified nodes, simplified node edges and simplified node vectors to generate a weight image.

[0080] The classification module is used to adjust the weight image to the input specification requirements of the CNN model and perform binary classification tasks.

[0081] The beneficial effects of the present invention are:

[0082] This paper designs a novel code vulnerability detection method based on graph simplification. This method represents vulnerable code as a graph while minimizing redundant information irrelevant to the vulnerability. Centrality analysis is then performed on the de-redundant graph to generate a weighted image representing the importance of all code lines. A CNN model is then used to capture relevant features in this weighted image, thereby completing the vulnerability detection task. Experimental testing has shown that this method significantly improves the efficiency and accuracy of code vulnerability detection compared to existing methods, providing a more effective and feasible solution for vulnerability detection in large-scale projects.

[0083] 2. The present invention simplifies the graph by reducing the size of the program dependency graph to reduce the distance between nodes and deleting free nodes and noise nodes. The simplified graph can retain the structural features in the code while reducing other noise interference unrelated to the vulnerability, thereby improving the accuracy of vulnerability identification and reducing vulnerability detection time. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0085] Figure 1 A diagram showing the steps of a code vulnerability detection method based on graph simplification in an embodiment;

[0086] Figure 2 Flowchart of the code vulnerability detection method based on graph simplification in an embodiment;

[0087] Figure 3 This is a data chart comparing the detection efficiency of the code vulnerability detection method based on graph simplification provided by the present invention and existing vulnerability detection methods. DETAILED DESCRIPTION

[0088] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0089] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this invention pertains. The terms used herein in the specification of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The term "or / and" as used herein includes any and all combinations of one or more of the associated listed items.

[0090] See also Figure 1 and Figure 2 This embodiment provides a code vulnerability detection method based on graph simplification, which includes the following steps:

[0091] S1. Preprocess the original software code code0 to remove noise. The preprocessed software code code1 consists of K1 lines of code. Perform image generation on code1 to obtain a program dependency graph (PDG). The PDG consists of K1 original nodes and K2 original node edges. The k1th original node represents the k1th line of code in code1; k1∈[1, K1]. Original node edges represent dependencies between original nodes.

[0092] In this step, preprocessing the software code code0 can reduce noise. Specifically, the first step is to remove comments and blank lines from the software code code0, as these are often irrelevant to the actual semantics of the program. The second step is to map user-defined variables to uniform symbolic names (for example, mapping all variables to "VAR1," "VAR2," and so on). The final step is to map user-defined function names to standardized symbolic names, such as mapping functions to "FUN1," "FUN2," and so on. This normalization process ensures that when extracting the program dependency graph (PDG) of the software code code1, the focus is on its structure and logical functionality, rather than specific naming or formatting details. The open source tool Joern is used to generate a program dependency graph (PDG) for the preprocessed software code1. This PDG is a graphical representation of the software code. The PDG contains information about the data flow and control within the code, and each node in the graph represents a line of code data in the software code code1.

[0093] S2. Simplify the PDG to obtain a program simplified graph CSG. The CSG includes N1 simplified nodes and N2 simplified node edges; N1 < K1, N2 < K2.

[0094] It is well known that existing vulnerability detection methods based on graph neural network models (GNNs) have limitations in handling long-distance connections between nodes that are not directly adjacent to each other. Although stacking multiple layers of GNNs can be used to learn the global information of the graph (i.e., the long-term dependencies between nodes), the over-smoothing problem caused by deep GNNs will lead to similar embeddings of nodes with different labels, thereby reducing overall performance. Existing vulnerability detection methods still have difficulties in capturing the global information of source code, which hinders their performance in detecting software vulnerabilities, especially for complex graphs.

[0095] In this step, graph simplification is achieved through two aspects, including:

[0096] S21. Merge adjacent original nodes in the PDG according to node type. The merged simplified nodes inherit the original node edges of the original nodes before the merge and form simplified node edges. That is, the distance between nodes is reduced by reducing the size of the program dependency graph PDG.

[0097] S22: Remove the noise nodes and free nodes in the PDG, and delete the original node edges connected to the noise nodes and free nodes.

[0098] The program dependency graph (PDG) in the present invention aims to compress repeated information into the graph through type-based graph simplification, which can reduce the size of the graph and the distance between nodes.

[0099] Specifically, in S21, the method for reducing the size of the program dependency graph includes merging adjacent original nodes according to node type. Specifically, the method for merging adjacent original nodes according to node type includes the following steps:

[0100] Determine whether the adjacent original nodes meet the merging rules;

[0101] If the adjacent original nodes meet the merging rules, the adjacent original nodes are merged.

[0102] In this embodiment, five type-based graph simplification merging rules are determined, as shown in Table 1.

[0103] Table 1: Merge rules in type-based graph simplification

[0104] rule Parent node type Child node type 1 Expression Statements Expression Statements 2 Identifier declaration statement Identifier 3 Conditional Statements Any type after the parent node 4 for loop statement Parameter List 5 Function call statement Identifier, parameter list

[0105] Among them, in a pair of adjacent original nodes, the parent node is the original node located in front of the original node edge, and the child node is the original node located behind the original node edge. Its front and back are determined according to the control dependency direction of the original node edge. For a pair of adjacent original nodes that match a merge rule, the merge content includes retaining the original node of the parent node type, deleting the original node of the child node type, and retaining the original node edge of the original node of the child node type. The original node of the child node type will be deleted because its information is a refinement of its parent node and can also be reflected in the nodes behind it. For example, according to the merge rule in Table 1, the information in the child node "(malloc,malloc(50*sizeof(char)))" is replaced by the parent node "( <operator>.assignment,VAR1=(char*)malloc(50*sizeof(char)))", the child node and parent node are merged and the child node is deleted. Since the parent node and child node are "merged two by two", but still on the same path (edge). If only the noise node is removed individually, the path (edge) between node A in front of the noise node and node B behind the noise node may be directly disconnected. In this way, if there is another connected path (edge) between nodes A and B, the distance between nodes A and B will be longer. Therefore, merging adjacent nodes according to node type can indirectly reduce the distance between nodes.

[0106] In S22, some original nodes in the program dependency graph (PDG) obtained in S1 are irrelevant to understanding and learning vulnerability patterns in the code and are defined as "noise nodes." For example, the original node ("method," FUN1) only defines the name of a function, but it is connected to many other original nodes, which may cause interference when extracting feature information from other original nodes. To this end, it is necessary to identify and eliminate the interference of these noise nodes as much as possible. The method for determining whether an original node in the program dependency graph (PDG) is a noise node includes the following steps:

[0107] S221, determining the attributes of a predefined noise node;

[0108] S222. Compare the attributes of the K1 original nodes and the predefined noise nodes in the program dependency graph PDG one by one:

[0109] If the attributes of the original node in the program dependency graph PDG are consistent with the attributes of the predefined noise node, then the original node in the program dependency graph PDG is determined to be a noise node.

[0110] Among them, the predefined noise node as a judgment benchmark plays a key role. To this end, it is important to determine the predefined noise node. The method for determining the predefined noise node includes the following steps:

[0111] S2211: Preprocess the sample software code to remove noise, and perform image generation processing on the preprocessed sample software code to obtain a program dependency graph PDG'. The sample software code is software code known to have vulnerabilities.

[0112] S2212: Count the node types in PDG'.

[0113] In order to identify the types of noise nodes in the program dependency graph PDG', we first counted the number of all node types in the program dependency graph PDG' and classified each node in the graph according to its attributes or functions. The main node types can be divided into identifiers, arithmetic and logical operations, declaration statements, function calls, literals, unknowns, etc.

[0114] S2213. Perform an ablation experiment on each node type of PDG' and regard the node types with negative impact on the detection results as suspicious node types.

[0115] In this step, ablation experiments are performed on the node types identified. By comparing the detection results with and without these node types, node types that negatively impact the detection results are identified as suspicious. This step preliminarily identifies possible noise node types.

[0116] S2214: Perform an ablation experiment on each node in the suspicious node type, determine the node with a negative impact on the detection result as a noise node, record the attributes of the noise node, and save it as a predefined noise node.

[0117] This step performs a separate removal experiment on each node in the suspicious node category. Ablation experiments are performed to examine the specific impact of removing each node on overall detection performance. Nodes that negatively impact detection results are classified as noise nodes. The properties of these noise nodes are recorded and saved as predefined noise nodes, which are then divided into five types:

[0118] "METHOD": declare the function name

[0119] "METHOD_RETURN": the return value of the main function

[0120] "RETURN": return value

[0121] "LITERAL": literal

[0122] "UNKNOWN": unknown type

[0123] The existence of these predefined noise nodes in the program dependency graph PDG' interferes with the detection results, and removing them can improve the detection accuracy.

[0124] During the entire process of determining predefined noise nodes, the Sent2vec model was used for node vector embedding. During the detection result readout phase, the TextCNN model was used for feature extraction. Table 2 shows a comparison of the impact of different node types on the results.

[0125] Table 2: Comparison of different types of nodes

[0126]

[0127]

[0128] The superscript a in Table 2 indicates that no noise nodes are removed; the superscript b indicates that all noise nodes are removed. <op>.indirectFieldAccess (FIELD_IDENTIFIER is a field identifier; indirectFieldAccess is an indirect field access) has a significant impact on the detection results, compared to PDG without removing noise nodes a In terms of accuracy (Acc), it results in a drop of about 3%. On the other hand, removing the predefined noise nodes METHOD, METHOD_RETURN, and RETURN will have a positive impact on the accuracy, thereby improving the detection accuracy. These predefined noise nodes are connected to many other nodes and may cause interference when other nodes extract feature information. For several other types of predefined noise nodes, removing them individually has little effect on the overall detection accuracy. However, when all types of predefined noise nodes are removed, the detection results are the best. This shows that comprehensively considering and removing all predefined noise nodes can optimize the performance of the detection model and improve the final detection accuracy.

[0129] In addition, the free nodes in the program dependency graph (PDG) are judged by the size of the degree centrality. The judgment method includes the following steps:

[0130] S215. Calculate the degrees of K1 original nodes in the program dependency graph PDG.

[0131] S216. Nodes with a degree of 0 are nodes without edges and are generally called isolated nodes. These nodes have little impact on the entire software code, but can increase the difficulty of vulnerability detection. Therefore, we traverse the degrees of the K1 original nodes in the program dependency graph (PDG). Nodes with a degree of 0 are considered to be isolated nodes and removed.

[0132] CFG (Control Flow Graph), PDG (Program Dependency Graph), and CPG (Code Property Graph) were used as benchmarks for program representation on the QEMU and FFmpeg datasets. The CSG in this paper achieved superior results. A comparative experiment was conducted on these four program representations, using Sent2vec and CodeBERT as node embedding methods. During the model readout phase, TextCNN was uniformly used for feature extraction. The results are shown in Table 3.

[0133] Table 3: Vulnerability detection results using different program representations and node embedding methods

[0134]

[0135]

[0136] As can be seen from Table 3, the detection effect of using PDG as code representation is slightly better than CFG. Although CFG can describe control logic such as branches and loops in the program structure, it does not consider the correlation between data, which limits it in detecting vulnerabilities including data flow and variable operations. PDG's more comprehensive information makes it possible to more accurately capture possible defects in the code. In contrast, CPG provides more information about code properties, covering aspects such as grammatical structure, data flow, and control flow. However, the inclusion of a lot of irrelevant information may interfere with the model's learning of vulnerability patterns, and this effect is exacerbated when CodeBERT is used as a semantic extractor. The CSG proposed in this invention combines graph-based representation and graph simplification to delete some nodes that are not related to vulnerabilities. At the same time, as can be seen from Table 3, CSG did achieve better results in the experiment.

[0137] S3. Perform vector embedding on the N1 simplified nodes in the CSG to obtain N1 simplified node vectors, and update the CSG into a code vector graph.

[0138] In this step, the pre-trained CodeBERT model is used for vector embedding. The CodeBERT model consists of a bidirectional transformer that can capture long-range code sequence dependencies. Furthermore, it effectively maintains relationships between contexts, collects potentially fragile code patterns, and minimizes information loss. The CodeBERT model also employs a multi-attention head structure, enabling the model to focus on multiple key points in a code sequence. At this point, the CSG is transformed into a new form, known as a code vector graph. Each node in this code vector graph is embedded with a vector.

[0139] S4. Perform centrality analysis on the code vector graph based on simplified nodes, simplified node edges, and simplified node vectors to generate a weight image.

[0140] The purpose of this step is to effectively convert the code vector graph into a weighted image that can take into account the contribution of different code lines to the program semantics. To this end, the code vector graph is considered as a social network and social network centrality analysis is applied to obtain the importance of all code lines. This embodiment uses three types of centrality to calculate the importance of N1 simplified nodes, including the destructibility metric x n1 , eigenvector centrality EC n1 and closeness centrality CC n1 It uses the destructibility measure x1~x N1 Calculate the destructibility measurement channel; use the eigenvector centrality EC1~EC N1 Calculate the eigenvector channel; use the proximity centrality CC1~CC N1 Calculate the proximity channel. The calculation methods of the three channels are as follows:

[0141] 1. The method for calculating the destructibility measurement channel includes the following steps:

[0142] S411. Calculate the destructibility measure x of the n1th simplified node n1 , n1∈[1, N1], the calculation formula is:

[0143]

[0144] Where n reachable Indicates the number of simplified node edges between the n1th simplified node and its subsequent adjacent simplified nodes, ignoring the simplified node edges between the n1th simplified node and its preceding simplified nodes. total represents the number of simplified nodes in the code vector graph. n1 It is based on computing the reachability of a simplified node that is known to have data flow or control flow dependencies. In other words, the destructibility metric x n1 Is a value between 0 and 1, where 0 indicates if a simplification node is affected or broken by the attack in any way, it will not affect any part of the code. A simplification node with a value of 1 indicates that the code has a high probability of causing side effects / breakage in the code.

[0145] S412. Multiply the n1th simplified node vector by the destructibility measure x of the n1th simplified node. n1 Get channel value one.

[0146] S413: Traverse N1 simplified nodes to obtain N1 channel values ​​1. Arrange the N1 channel values ​​1 in the order of code lines to obtain a destructibility measurement channel.

[0147] 2. The method for calculating the eigenvector channel includes the following steps:

[0148] S421. Calculate the eigenvector centrality EC of the n1th simplified node n1 , n1∈[1, N1], the calculation formula is:

[0149]

[0150] Where α represents the proportional constant. β represents the eigenvector centrality EC of the n1th simplified node n1 The initial value of A. A represents the adjacency matrix, its eigenvalue is represented by λ, and α must satisfy the condition α<1 / λ. n1j1 Represents the edge weight or connection relationship between the n1th simplified node and the j1th simplified node. j1 Represents the eigenvector centrality EC of the j1th simplified node j1 , where the j1th simplified node and the n1th simplified node are adjacent nodes, j1∈[1, N1]. The eigenvector centrality EC n1 It means that the centrality of a simplified node depends on the centrality of its adjacent simplified nodes. In other words, the importance of a simplified node is proportional to the importance of the simplified nodes it is connected to.

[0151] S422, multiply the vector of the n1th simplified node by the eigenvector centrality EC of the n1th simplified node n1 Get channel value two.

[0152] S423: Traverse N1 simplified nodes to obtain N1 channel values ​​2. Arrange the N1 channel values ​​2 in the order of code lines to obtain a feature vector channel.

[0153] 3. The method for calculating the approach channel includes the following steps:

[0154] S431, calculate the closeness centrality CC of the n1th simplified node n1 , and its calculation formula is:

[0155]

[0156] Where, d n1j2 represents the shortest distance between the n1th simplified node and the j2th node. N represents the number of all simplified nodes in the CSG. Closeness centrality CC n1 Indicates how close a node is to all other nodes in the code vector graph. It is calculated as the average of the shortest path lengths from the simplified node to every other simplified node in the code vector graph. The smaller the average shortest distance of a simplified node, the greater the closeness centrality of the simplified node.

[0157] S432, multiply the vector of the n1th simplified node by the closeness centrality CC of the n1th simplified node n1 Get channel value three.

[0158] S433: Traverse N1 simplified nodes to obtain N1 channel values ​​3. Arrange the N1 channel values ​​3 in the order of code lines to obtain an approximate channel.

[0159] At this point, we have obtained three channels: destructibility metric channel, feature vector channel and proximity channel, and generated a weighted image based on the RGB three color channels. Specifically, an image usually has three color channels (i.e., red (R), green (G), and blue (B)), which work together to produce a complete image. The destructibility metric channel, feature vector channel and proximity channel are respectively mapped to the three color channels, so that the destructibility metric x used in this method is n1 , eigenvector centrality EC n1 and closeness centrality CC n1 The importance of all lines of code in the software is calculated from three different perspectives. This fully considers the contribution of different lines of code to the semantics of the software program. The final result is a weighted image of the importance of all lines of code.

[0160] S5. Adjust the weight image to the input specification requirements of the CNN model and perform a binary classification task to complete the vulnerability detection of the software code.

[0161] In this step, a CNN model with an attention mechanism is used to identify weight images, i.e., detect vulnerabilities. The CNN model is trained using pre-generated images. Since CNNs use images of the same size as input, and different functions have different lines of code, the size of the input weight image needs to be adjusted. In this embodiment, 100 lines of code is used as the threshold for generating the weight image. When the number of lines of code in a software program is less than 100, zero vectors are padded at the ends of the code lines (i.e., zero vectors are padded at the ends of the destructibility metric channel, feature vector channel, and proximity channel) until the code lines are filled to the threshold size. When the number of lines of code in a software program is greater than 100, the end lines of code are deleted in sequence (i.e., the end data of the destructibility metric channel, feature vector channel, and proximity channel are deleted). The final weight image size input to the CNN model is 3*100*768. Here, "3" corresponds to the three channels (i.e., the destructibility metric channel, feature vector channel, and proximity channel), "100" corresponds to the threshold number of lines of code, and "768" represents the dimension of the node vector embedding. The weighted image is calculated by the CNN model, and then convolution, pooling, and fully connected layer dimension conversion are performed. Finally, the softmax layer is applied to normalize the output probability and perform a binary classification task. The result of the binary classification task is yes or no, thereby obtaining the vulnerability detection result of the software code.

[0162] The code vulnerability detection method based on graph simplification (hereinafter referred to as GSVD) provided by the present invention has the advantages of high vulnerability detection efficiency and high detection accuracy. For this purpose, a comparative experiment was conducted. GSVD was tested with some existing vulnerability detection methods. Existing vulnerability detection methods include VulDeePecker, SySeVR, a detection method based on the CodeBERT model, a detection method based on the GraphCodeBERT model, a detection method based on the ReVeal model, a detection method based on the ReGVD model, a detection method based on the Devign model, and a detection method based on the VulCNN model. The experimental results are shown in Table 4.

[0163] Table 4: Data results of comparison between GSVD and other methods

[0164]

[0165] Table 4 shows that GSVD achieves higher accuracy (Acc), recall (R), and F1 scores than existing vulnerability detection methods. This analysis demonstrates that VulDeePecker and SySeVR extract code information through slicing, while CodeBERT and GraphCodeBERT treat code as a sequence. Both lack structural information about the program. Consequently, the extracted defect features are insufficient, impacting defect prediction. In contrast, GSVD represents the program as a graph and preserves its structural features. Consequently, GSVD achieves higher accuracy, recall, and F1 scores. In ReVeal and ReGVD, edges are ordered, which is essentially a natural ordering relationship rather than an inherent structural relationship within the code itself. Devign uses a CPG (Code Property Graph) to represent code and a GGNN model to detect vulnerabilities. However, many nodes and edges in the CPG are irrelevant to the semantics of the vulnerability, potentially reducing accuracy and increasing time overhead. GSVD uses PDG as the input of the model, simplifies PDG according to the type of node to obtain CSG, and uses a pre-trained model for vector embedding, which better enhances the representation of global information.

[0166] Then the GSVD provided by the present invention was verified in terms of detection efficiency. GSVD was compared with some existing vulnerability detection methods, and the time required to detect vulnerabilities in 1000 software programs was uniformly calculated. The experimental results are as follows: Figure 3 As shown. Figure 3 It can be seen that GSVD only takes about 25 seconds to classify 1,000 images. Among some existing vulnerability detection methods, VulDeePecker uses BiLSTM to learn vulnerability features, which is a variant of recurrent neural network (RNN) that specializes in processing sequential data and therefore has a relatively small time overhead. Although Reveal only uses MLP to classify vulnerabilities, it still requires some time overhead due to the introduction of the smoke algorithm. Devign combines different code representations into a composite graph, and since the composite graph contains a large number of edges, it has a relatively high time overhead in vulnerability detection. DeepKoko selected the GCN model, which needs to execute additional convolutional layers compared to the GNN model, so it has a larger time overhead. Therefore, the comparison results show that the GSVD provided by the present invention has a competitive advantage in vulnerability detection efficiency, and further proves the effectiveness and practicality of GSVD in vulnerability detection tasks, providing a more effective and feasible solution strategy for vulnerability detection in large-scale projects.

[0167] In other embodiments, a code vulnerability detection system based on graph simplification is proposed, which uses the above-described code vulnerability detection method based on graph simplification. The code vulnerability detection system based on graph simplification includes a preprocessing module, a graph simplification module, a node embedding module, an image generation module, and a classification module.

[0168] Specifically, the preprocessing module is used to preprocess the original software code code0 to remove noise, thereby obtaining the preprocessed software code code1. It is also used to perform image generation processing on the preprocessed software code to obtain a program dependency graph PDG.

[0169] The graph simplification module is used to simplify the PDG to obtain the program simplified graph CSG.

[0170] The node embedding module is used to perform vector embedding on the N1 simplified nodes in the CSG, obtain N1 simplified node vectors, and update the CSG into a code vector graph.

[0171] The image generation module is used to perform centrality analysis on the code vector graph based on simplified nodes, simplified node edges and simplified node vectors to generate a weight image.

[0172] The classification module is used to adjust the weight image to the input specification requirements of the CNN model and perform binary classification tasks.

[0173] In other embodiments, an electronic device is provided. The electronic device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the steps of the aforementioned code vulnerability detection method based on graph simplification are implemented.

[0174] Some other embodiments also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the aforementioned code vulnerability detection method based on graph simplification.

[0175] Some other embodiments also provide a software program product, which includes program instructions that, when executed on an electronic device, cause the electronic device to execute the steps of the code vulnerability detection method based on graph simplification as described above.

[0176] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0177] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be determined by the appended claims.< / op> < / operator>

Claims

1. A code vulnerability detection method based on graph simplification, characterized in that: It includes the following steps: S1, preprocessing the original software code code0 to remove noise, and obtaining the preprocessed software code code1; wherein code1 includes K1 lines of code; Perform image generation processing on code1 to obtain the program dependency graph PDG; Among them, PDG includes K1 original nodes and K2 original node edges; The k1th original node represents the k1th line of code in code1; k1∈[1, K1]; K2 original node edges represent the dependency relationships between K1 original nodes; S2, perform graph simplification on PDG to obtain program simplified graph CSG; CSG includes N1 simplified nodes and N2 simplified node edges; N1<K1, N2<K2; The graph simplification processing method includes: S21, merging adjacent original nodes in the PDG according to node type, the merged simplified nodes inherit the original node edges of the original nodes before the merger, and forming simplified node edges; S22, remove the noise nodes and free nodes in the PDG, and delete the original node edges connected to the noise nodes and free nodes; S3, perform vector embedding on the N1 simplified nodes in the CSG to obtain N1 simplified node vectors, and update the CSG into a code vector graph; S4, performing centrality analysis on the code vector graph based on simplified nodes, simplified node edges and simplified node vectors to generate a weight image; S5 adjusts the weight image to the input specification requirements of the CNN model and performs a binary classification task to complete the vulnerability detection of the software code.

2. The code vulnerability detection method based on graph simplification according to claim 1 is characterized in that: In S21, the method for merging adjacent original nodes according to node type includes the following steps: Determine whether the adjacent original nodes meet the merging rules; If the adjacent original nodes meet the merging rules, the adjacent original nodes are merged; The merging rules include: If the parent node type is an expression statement and the child node type is also an expression statement, then they are merged; If the parent node type is an identifier declaration statement and the child node type is an identifier, then they are merged; If the parent node type is a conditional statement, all child nodes of any type will be merged; If the parent node type is a for loop statement and the child node type is a parameter list, they will be merged; If the parent node type is a function call statement and the child node type is an identifier or parameter list, they will be merged; The method of merging adjacent original nodes includes retaining the original nodes of the parent node type, deleting the original nodes of the child node type, and retaining the original node edges corresponding to the original nodes of the child node type; Among the adjacent original nodes, the parent node is the original node located in front of the original node edge, and the child node is the original node located behind the original node edge.

3. The code vulnerability detection method based on graph simplification according to claim 1 is characterized in that: In S22, the method for determining a noise node includes the following steps: S221, determining the attributes of a predefined noise node; S222, compare the attributes of the K1 original nodes and the predefined noise nodes in the PDG one by one; If the attributes of an original node are consistent with the attributes of a predefined noise node, the original node is determined to be a noise node.

4. The code vulnerability detection method based on graph simplification according to claim 3 is characterized in that: The method for determining the predefined noise node includes the following steps: S2211, preprocessing the sample software code to remove noise, and performing image generation processing on the preprocessed sample software code to obtain a program dependency graph PDG'; The sample software code is software code that is known to have vulnerabilities; S2212, counting the node types in PDG'; S2213, conduct an ablation experiment on each node type of PDG', and regard the node types with negative impact on the detection results as suspicious node types; S2214, performing an ablation experiment on each node in the suspicious node type, and determining the nodes that have a negative impact on the detection results as noise nodes; Record the properties of the noise node and save it as a predefined noise node.

5. The code vulnerability detection method based on graph simplification according to claim 1 is characterized in that: In S22, the method for determining a free node includes the following steps: S2215, calculate the degrees of K1 original nodes in PDG; S2216: The original node with a degree of 0 is regarded as a free node.

6. The code vulnerability detection method based on graph simplification according to claim 1, characterized in that: In S4, the method for generating a weight image includes the following steps: S41, calculate the destructibility metrics x1~x1 of N1 simplified nodes in the code vector graph N1 , eigenvector centrality EC1~EC N1 and closeness centrality CC1~CC N1 ; S42, based on the destructibility metrics x1~x1 of N1 simplified nodes N1 The destructibility measurement channel is calculated; According to the eigenvector centrality of N1 simplified nodes EC1~EC N1 Calculate the characteristic vector channel; According to the closeness centrality of N1 simplified nodes CC1~CC N1 The approach channel is calculated; S43, generating a weight image according to the destructibility metric channel, the feature vector channel, and the proximity channel; The weight image is used to represent the importance of the simplified nodes in the N1 row.

7. The code vulnerability detection method based on graph simplification according to claim 6 is characterized in that: The method for calculating the destructibility metric channel includes the following steps: S411, calculate the destructibility measure x of the n1th simplified node n1 , n1∈[1, N1], the calculation formula is: Where n reachable Indicates the number of simplified node edges between the n1th simplified node and its adjacent simplified nodes, n total Indicates the number of all simplified nodes in the code vector graph; S412, multiplying the n1th simplified node vector by the destructibility measure x of the n1th simplified node n1 Get channel value one; S413, traverse N1 simplified nodes to obtain N1 channel values ​​1; Arrange the N1 channel values ​​in the order of code lines to obtain the destructibility measurement channel.

8. The code vulnerability detection method based on graph simplification according to claim 6, characterized in that: The method for calculating the eigenvector channel includes the following steps: S421, calculate the eigenvector centrality EC of the n1th simplified node n1 , n1∈[1, N1], the calculation formula is: Where α represents the proportional constant, and β represents the eigenvector centrality EC of the n1th simplified node. n1 The initial value of; A represents the adjacency matrix; A n1j1 represents the edge weight or connection relationship between the n1th simplified node and the j1th simplified node; x j1 Represents the eigenvector centrality EC of the j1th simplified node j1 , the j1th simplified node and the n1th simplified node are adjacent nodes, j1∈[1,N1]; S422, multiply the vector of the n1th simplified node by the eigenvector centrality EC of the n1th simplified node n1 Get channel value two; S423, traverse N1 simplified nodes to obtain N1 channel values ​​2; Arrange the N1 channel values ​​in the order of code lines to obtain the feature vector channel; The method for calculating the proximity channel includes the following steps: S431, calculate the closeness centrality CC of the n1th simplified node n1 , and its calculation formula is: Where, d n1j2 represents the shortest distance between the n1th simplified node and the j2th node; j2∈[1, N1]; N represents the number of all simplified nodes in CSG; S432, multiply the vector of the n1th simplified node by the closeness centrality CC of the n1th simplified node n1 Get channel value three; S433, traverse N1 simplified nodes to obtain N1 channel values ​​three; Arrange the N1 channel values ​​in the order of code lines to obtain the approximate channel.

9. The code vulnerability detection method based on graph simplification according to claim 1, characterized in that: In S5, the method for adjusting the weight image to the CNN model input specification requirements includes the following steps: If the size of the weight image is less than the threshold, zero vectors are filled at the ends of the destructibility metric channel, feature vector channel, and proximity channel; If the size of the weight image is larger than the threshold, the destructibility metric channel, the feature vector channel, and the end data of the near channel are deleted.

10. A code vulnerability detection system based on graph simplification, characterized in that: It uses the code vulnerability detection method based on graph simplification as described in any one of claims 1 to 9; The code vulnerability detection system based on graph simplification includes: A preprocessing module is used to preprocess the original software code code0 to remove noise and obtain the preprocessed software code code1; it is also used to perform image generation processing on the preprocessed software code to obtain a program dependency graph PDG; A graph simplification module is used to simplify the PDG to obtain a program simplified graph CSG; A node embedding module is used to perform vector embedding on the N1 simplified nodes in the CSG, obtain N1 simplified node vectors, and update the CSG into a code vector graph; An image generation module is used to perform centrality analysis on the code vector graph based on simplified nodes, simplified node edges and simplified node vectors to generate a weight image; The classification module is used to adjust the weight image to the input specifications of the CNN model and perform binary classification tasks.

Images