An optimized machine learning software vulnerability parallel mining method

Abstract

The present application relates to a kind of optimization machine learning software vulnerability parallel mining method, belong to the field of vulnerability mining.The present application will be mapped to the symbol name domain in the vulnerability code function, parameter, target variable etc.of software vulnerability historical data, and it is normalized to be handled, establishes the multiclass vulnerability information resource library by base class, subclass, code class, and unifies vulnerability coding designation.Using KNN algorithm in machine learning depth clustering mining software features, and introducing the Euclidean distance between any two.The key node that the maximum similarity feature belongs to is defined as software vulnerability.The method of the present application has high feature classification accuracy, and the F1 value of software vulnerability mining can be kept above 0.88, with low false alarm rate;Through parallel tool operation, a variety of software vulnerability parallel mining tasks can be realized in specific scenarios.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of vulnerability mining, and particularly relates to a software vulnerability parallel mining method based on optimized machine learning. BACKGROUND

[0002] With the popularization and development of computers, software support is increasingly indispensable, and the security and usability of software are extremely important for systems and users. When software has vulnerabilities, unauthorized persons can attack authorized access modules through operations, leading to internal confidential information leakage and even system paralysis. In order to improve the stability of software, software developers have researched a series of strict security design criteria and operation processes, but the software itself is complex, and in a multi-source application environment, vulnerabilities can always be mined from angles or dimensions that developers have never considered, seriously threatening network system security.

[0003] Therefore, the application introduces a KNN (K-Nearest Neighbor) deep clustering algorithm in machine learning algorithm, learns software programming rules in massive data, enables the vulnerability mining method to make self-decision, classification and global prediction by using existing rules, maps vulnerability code functions, parameters, target variables and the like in software vulnerability history data to a symbol name domain, and normalizes the same, establishes a multi-class vulnerability information resource library composed of base classes, sub-classes and code classes, unifies vulnerability code naming, constructs a vulnerability information resource library, and then introduces a Euclidean distance to complete parallel operation mining of multi-class vulnerabilities. SUMMARY

[0004] (I) Technical problem to be solved

[0005] The technical problem to be solved by the application is how to provide a software vulnerability parallel mining method based on optimized machine learning to solve the problem of automatic mining of software vulnerabilities.

[0006] (II) Technical scheme

[0007] In order to solve the above technical problem, the application provides a software vulnerability parallel mining method based on optimized machine learning, which comprises the following steps:

[0008] S1, software data normalization processing

[0009] The code function, parameter and target variable information in the software package are subjected to feature mapping and normalization preprocessing, the frequency of occurrence of key nodes in different types of vulnerabilities in the software package is quantified, and the corresponding characteristic values are obtained;

[0010] S2, algorithm design: the characteristic value is input, machine learning is introduced, the classification of software data characteristics is completed; the KNN (K-Nearest Neighbor) deep clustering algorithm in machine learning is used for deep clustering mining of software characteristics, then the similarity of the clustered characteristics and the multi-class vulnerability information resource library corpus label is calculated using the Euclidean distance, and the key node to which the maximum similarity characteristic belongs is defined as the software vulnerability;

[0011] S3, the detection result is evaluated through the performance evaluation index, and the software vulnerability detection is intelligently completed.

[0012] (Three) beneficial effects

[0013] The application proposes a software vulnerability parallel mining method for optimizing machine learning, maps the vulnerability code function, parameters, target variables and the like in the software vulnerability historical data to the symbol name domain, normalizes the same, establishes a multi-class vulnerability information resource library composed of base classes, sub-classes and code classes, and unifies the vulnerability code naming. The KNN algorithm in machine learning is used for deep clustering mining of software characteristics, and the Euclidean distance between any two is calculated. The key node to which the maximum similarity characteristic belongs is defined as the software vulnerability. Simulation proves that the feature classification accuracy of the method is high, the F1 value of software vulnerability mining can be kept above 0.88, and the mining false positive rate is low. Therefore, through the operation of the parallel tool, a variety of software vulnerability parallel mining tasks can be realized in a specific scenario. BRIEF DESCRIPTION OF DRAWINGS

[0014] Figure 1 is a flowchart of the application;

[0015] Figure 2 is a schematic diagram of the processed data set (input training sample of the algorithm). DETAILED DESCRIPTION

[0016] In order to make the purpose, content and advantages of the application clearer, the specific embodiments of the application are further described in detail below in combination with the drawings and examples.

[0017] 1. Technical preparation

[0018] Database: 4 groups of NASA software vulnerability data sets of the open source database Tera-PROMISE are selected as experimental samples.

[0019] Language and platform: python, Sklearn machine learning library.

[0020] 2. Implementation process

[0021] S1, software data normalization processing.

[0022] The code function, parameter and target variable are extracted from the software package,

[0023] Based on the software vulnerability level and type, the multi-class vulnerability definition is an abstract value, which cannot be input into the machine learning algorithm as quantitative data for parallel mining. Therefore, the existing multi-class vulnerability dataset is collected, mapped to the feature vector space in sequence, and the attribute feature values corresponding to different classes of vulnerabilities are determined. Considering the diversity of thoughts and behaviors of different developers and coders, the code functions, parameters, target variables and other information in the software package are mapped and normalized for preprocessing, the frequency of key nodes in different types of vulnerabilities in the software package is quantified, and the corresponding feature values are obtained, which are in a unified format for subsequent calculation. In an embodiment, the software package uses the 4 sets of NASA software vulnerability datasets of the open source database Tera-PROMISE.

[0024] S11, first filter the non-ASCII bytes in the software package which have nothing to do with software vulnerabilities, and map the code functions, parameters, target variables and other information to the symbol names one by one, unify the coding and naming, and after normalization, project them into the feature vector space to obtain the corresponding feature values;

[0025] S12, the frequency of key nodes in different types of vulnerabilities is quantified by natural text language, and the corresponding feature values are obtained;

[0026] S13, the feature values of code functions, parameters, target variables and other information and the feature values of key nodes are used as feature values of software vulnerability data;

[0027] Taking the code function as an example, the S11 specifically includes:

[0028] Suppose that the code function sequence of any software obtained by the scanning system is X={x1,x2,…,x n}, the set of key nodes of any source code file is A, A={α1,α2,…,α m}, and n and m are integers not equal to 0; the mapping process is represented as:

[0029] ψ(x)=λ(x,α)·v α,A

[0030]

[0031] In the formula, v α,A represents the inverse document term frequency parameter, which can eliminate the similarity of a part of software vulnerability sequences and reduce the influence of key nodes of non-occurrence vulnerabilities on vulnerability feature extraction. The calculation formula is:

[0032]

[0033] Where df αtf represents the number of times the key node a appears in the file α,A df represents the number of times the key node a appears in the set A α The ratio between the key node and the total number of nodes N.

[0034] S2, algorithm design: the feature value of software vulnerability data is input, machine learning is introduced, and the classification of software data features is completed. Software data covers all the information required for parallel mining of vulnerabilities, but software programming is complex and information dimension is high. In order to improve the performance of the mining algorithm, the KNN (K-Nearest Neighbor) deep clustering algorithm in machine learning is used, the KNN algorithm deep clustering mines software features, and then the Euclidean distance is used to calculate the similarity of the clustered features and the multi-class vulnerability information resource library corpus label. The key node to which the feature with the maximum similarity belongs is defined as the software vulnerability.

[0035] The deep clustering process mainly includes three steps of software feature specification, feature dimension reduction, and feature clustering. While extracting features, interference noise and repeated and missing data are also removed.

[0036] S21, normalize the feature value;

[0037] If the number of software samples to be mined is M, the feature value of the βth feature in each sample is represented as Q=(q β1 ,q β2 ,…,q βM ), and the normalization process is represented as:

[0038]

[0039] The average value of the βth feature is represented as μ, and the standard deviation of the βth feature is represented as σ. Since the processed features conform to the normal distribution, μ=0 and σ=1.

[0040] S22, use deep learning to reduce the dimension of the normalized high-dimensional feature value to obtain low-dimensional features and improve the performance of the mining algorithm. This step includes an input layer, an output layer, and a hidden layer, and the dimension reduction process is

[0041] ζ=f θ (q)=ω(Wq+b)

[0042] p=g θ' (ζ)=ω'(W'ζ+b')

[0043] q represents the input feature, p represents the feature after dimension reduction, f θ (q) represents a nonlinear function input to the hidden layer, which is used to process irrelevant features of the input, ζ represents an intermediate hidden variable input to the hidden layer, and g θ' ​(z) represents a nonlinear function in the hidden layer to the output layer, which is used to process the irrelevant features of the hidden layer input. ω, ω' describes the activation function of different layers, W, W' describes the weight of different layers, and b, b' describes the offset vector of different layers.

[0044] S23, the application is a parallel mining algorithm based on multi-class vulnerabilities, which performs deep clustering on low-dimensional features as "feature source" features. M For any feature category set in the to-be-mined sample, o α The clustering center obtained by the KNN algorithm is represented, and the deep clustering can be described as:

[0045]

[0046] sim(p, o α ) represents the cosine distance between p and o α , and η represents the clustering process.

[0047] Using the classification mining algorithm can classify and identify the nearest neighbor feature set of different "feature source".

[0048] S24, the application uses the Euclidean distance to calculate the similarity between the features x of the "feature source" and the corpus label y in the multi-class vulnerability information resource library, and defines the key node to which the feature with the maximum similarity belongs as a software vulnerability, wherein the multi-class vulnerability information resource library is a resource library composed of base class, subclass and code class. The calculation formula is:

[0049]

[0050] Wherein, n is the corresponding dimension.

[0051] S3, the detection result is evaluated by performance evaluation indicators, and the software vulnerability detection is intelligently completed.

[0052] The evaluation of the mining result can be described as a two-classification problem, that is, the mining without error is the positive example, and the error is the negative example. The specific calculation formula of each indicator is:

[0053] 1) The precision describes the ratio of the number of software vulnerabilities correctly mined to the number of all mined, and the calculation formula is

[0054]

[0055] 2) The recall rate describes the ratio of the number of software vulnerabilities correctly mined to the number of real software vulnerabilities, and the calculation formula is

[0056]

[0057] 3) F1 value describes the harmonic mean between recall rate and precision, because there is a nonlinear relationship between the two, there may be a high recall rate but low precision. Thus the larger the F1 value, the smaller the inconsistency between the two values, and the calculation process is

[0058]

[0059] In the formula, the true case TP represents the data actually mined out as a bug, the true negative TN represents the data actually not mined out as a bug, the false positive FP represents the data actually not a bug but mined out, and the false negative FN represents the data actually a bug but not mined out.

[0060] The F1 value in the result increases with the number of experiments and appears a certain shock, and is stable in [0.86, 0.89] as a whole, indicating that the technical method has high recall rate and mining precision, and the difference between the two values is small and uniform.

[0061] Beneficial effects:

[0062] In order to enhance the security of software, the application provides a kind of software bug parallel mining method of optimized machine learning. The bug code function, parameter, target variable and the like in the software bug historical data are mapped to the symbol name domain, and are normalized, a multi-class bug information resource library composed of base class, subclass and code class is established, and the bug code naming is unified. Software features are mined by using KNN algorithm deep clustering in machine learning, and the Euclidean distance between any two is introduced. The key node to which the feature with the maximum similarity belongs is defined as a software bug. Simulation proves that the feature classification accuracy of the method is high, and the F1 value of software bug mining can be kept above 0.88, and the false positive rate is low. Therefore, by running the parallel tool, a variety of software bug parallel mining tasks can be realized in a specific scene.

[0063] The above only describes the preferred embodiments of the application, and it should be pointed out that for ordinary skilled persons in the technical field, several improvements and modifications can be made without departing from the technical principles of the application, and these improvements and modifications should also be considered as the protection scope of the application.

Claims

1. A parallel software vulnerability mining method optimized for machine learning, characterized in that, The method includes the following steps: S1, Software Data Normalization Processing The code functions, parameters, and target variable information in the software package are preprocessed by feature mapping and normalization. The frequency of key nodes in different types of vulnerabilities in the software package is quantified to obtain the corresponding feature values. S2. Algorithm Design: Input the feature values ​​and introduce machine learning to classify the software data features; use the KNN (K-Nearest Neighbor) deep clustering algorithm in machine learning to deeply cluster and mine software features, and then use Euclidean distance to calculate the similarity between the clustered features and the tags of the multi-class vulnerability information resource library corpus. Define the key node to which the feature with the highest similarity belongs as a software vulnerability. S3. The detection results are evaluated through performance evaluation indicators, and the detection of software vulnerabilities is completed intelligently. in, S2 specifically includes: S21. Normalize the eigenvalues; S22. Use deep learning to reduce the dimensionality of the normalized high-dimensional feature values ​​to obtain low-dimensional features; S23. Perform deep clustering on features that are low-dimensional features as "feature sources"; S24. Use Euclidean distance to calculate the similarity between the features of the "feature source" and the tags in the corpus of multiple vulnerability information resource databases. Define the key node to which the feature with the highest similarity belongs as a software vulnerability. The multiple vulnerability information resource database is a resource database composed of base class, subclass, and code class.

2. The parallel software vulnerability mining method for optimized machine learning as described in claim 1, characterized in that, The software package is a NASA software vulnerability dataset.

3. The parallel software vulnerability mining method for optimizing machine learning as described in claim 1, characterized in that, S1 specifically includes: S11. First, filter out non-ASCII bytes in the software package that are not related to the software vulnerability, map the code function, parameter, and target variable information to symbol names one by one, encode and name them uniformly, and after normalization, project them into the feature vector space to obtain the corresponding feature values. S12. By quantifying the frequency of key nodes in different types of vulnerabilities using natural text language, the corresponding feature values ​​can be obtained; S13. Combine the feature values ​​of code functions, parameters, target variables, and other information with the feature values ​​of key nodes as the feature values ​​of software vulnerability data.

4. The parallel software vulnerability mining method for optimized machine learning as described in claim 3, characterized in that, For code functions, S11 includes: Suppose that the code function sequence of any software can be obtained by scanning the system. Let A be the set of key nodes corresponding to any source code file. Where n and m both represent non-zero integers; the mapping process is expressed as: In the formula, The term frequency parameter representing the inverse document can eliminate some of the similarity in software vulnerability sequences and reduce the impact of non-vulnerability critical nodes on vulnerability feature extraction; the calculation formula is: in, Represented as a key node The number of times the file appears Represented as key nodes in set A Number of times The ratio between the key node and the total number of key nodes N.

5. The parallel software vulnerability mining method for optimizing machine learning as described in claim 1, characterized in that, S21 includes: If the number of samples to be mined is M, then the first sample in each sample... The eigenvalues ​​of each feature are represented as follows: The normalization process is represented as: = Indicates the first The average of the features, Indicates the first The standard deviation of each feature.

6. The parallel software vulnerability mining method for optimizing machine learning as described in claim 5, characterized in that, The S22 includes: an input layer, an output layer, and a hidden layer. The dimensionality reduction process is as follows: in, Indicates input features, Represents the features after dimensionality reduction. This represents a nonlinear function input to the hidden layer, used to handle unrelated features of the input. This represents the intermediate hidden variables input to the hidden layer. This represents a nonlinear function from the hidden layer to the output layer, used to process unrelated features of the hidden layer input; Describe the activation functions of different layers. Describing the weights of different layers Describe the offset vectors of different layers.

7. The parallel software vulnerability mining method for optimizing machine learning as described in claim 6, characterized in that, S23 includes: a parallel mining algorithm based on multiple types of vulnerabilities, which performs deep clustering on low-dimensional features as "feature sources"; Let be any set of feature types in the sample to be mined. The cluster centers obtained by the KNN algorithm represent the cluster centers. Deep clustering is described as follows: express , The cosine distance between them This represents the clustering process, where classification mining algorithms can classify and identify the nearest neighbor feature sets of different "feature sources".

8. The parallel software vulnerability mining method for optimized machine learning as described in claim 7, characterized in that, S24 includes: calculating the features of the "feature source" using Euclidean distance. Tags in multiple vulnerability information resource databases The similarity is calculated using the following formula: Where n is the corresponding dimension.

9. The parallel software vulnerability mining method for optimizing machine learning as described in claim 1, characterized in that, S3 includes: evaluating the mining results can be described as a binary classification problem, i.e., mining without errors is a positive example, and mining with errors is a negative example. The specific calculation formulas for each indicator are as follows: Precision describes the ratio of the number of software vulnerabilities correctly discovered to the total number of vulnerabilities discovered. The formula is as follows: Recall rate describes the ratio of the number of software vulnerabilities that are correctly discovered to the actual number of software vulnerabilities. The formula is: The F1 score describes the harmonic mean between recall and precision. A larger F1 score indicates a lower degree of discrepancy between the two values. The calculation process is as follows: In the formula, true positive TP represents data that is actually a vulnerability and has been discovered, true negative TN represents data that is actually a vulnerability and has not been discovered, false positive FP represents data that is actually not a vulnerability but has been discovered, and false negative FN represents data that is actually a vulnerability and has not been discovered.

Images