Method, system and device for automatic mining and identification of code vulnerabilities

Abstract

The present invention discloses a method, system and device for automatic code vulnerability mining and identification, which relates to the field of data processing technology. The method includes: constructing a source code control flow graph; performing vulnerability introduction risk and vulnerability code comparison confidence analysis on multiple control flow nodes, generating multiple introduction risk indicators and multiple code comparison confidence indicators; dividing multiple control flow nodes into a first type of node and a second type of node; constructing a first type of control flow jump path set and a second type of control flow jump path set; calling a first type of preset vulnerability code to perform jump path code comparison on the first type of control flow jump path set to generate a first vulnerability identification result, calling a symbolic execution module to perform path vulnerability identification on the second type of control flow jump path set to generate a second vulnerability identification result. The method solves the technical problems of low efficiency and high false alarm rate in code vulnerability mining and identification in the prior art, and achieves the technical effect of improving vulnerability identification accuracy and reducing false alarm rate.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method, system and device for automatically mining and identifying code vulnerabilities. Background Art

[0002] With the rapid development of information technology and the increasing complexity of software systems, security vulnerabilities have become a key factor affecting system stability and data security. Currently, existing vulnerability detection methods primarily rely on manual review or static analysis-based tools. However, these methods have significant limitations. They fail to fully cover all potential vulnerabilities and are susceptible to program size and code complexity, resulting in low vulnerability detection efficiency. Furthermore, existing automated vulnerability detection tools often suffer from high false positive and false negative rates when processing large-scale code. This, in turn, requires developers to invest significant time in manual screening and remediation, significantly impacting development efficiency. Summary of the Invention

[0003] This application provides a method, system and equipment for automatic code vulnerability mining and identification, which solves the technical problems of low efficiency and high false alarm rate in code vulnerability mining and identification in the prior art.

[0004] The first aspect of the present application provides a method for automatically mining and identifying code vulnerabilities, the method comprising:

[0005] Collect source code files of the target software and construct a source code control flow graph; perform vulnerability introduction risk and vulnerability code comparison confidence analysis on multiple control flow nodes in the source code control flow graph to generate multiple introduction risk indicators and multiple code comparison confidence indicators; divide the multiple control flow nodes into a first type of nodes and a second type of nodes based on the multiple introduction risk indicators and the multiple code comparison confidence indicators; construct a first type of control flow jump path set and a second type of control flow jump path set for the first type of nodes and the second type of nodes; call the first type of preset vulnerability code to perform jump path code comparison on the first type of control flow jump path set to generate a first vulnerability identification result, call the symbolic execution module to perform path vulnerability identification on the second type of control flow jump path set to generate a second vulnerability identification result.

[0006] The second aspect of the present application provides a system for automatically mining and identifying code vulnerabilities, the system comprising:

[0007] A control flow graph construction module is used to collect source code files of the target software and construct a source code control flow graph; a confidence analysis module is used to perform vulnerability introduction risk and vulnerability code comparison confidence analysis on multiple control flow nodes in the source code control flow graph, and generate multiple introduction risk indicators and multiple code comparison confidence indicators; a division module is used to divide the multiple control flow nodes into first-class nodes and second-class nodes based on the multiple introduction risk indicators and the multiple code comparison confidence indicators; a jump path construction module is used to construct a first-class control flow jump path set and a second-class control flow jump path set for the first-class nodes and the second-class nodes; a comparison module is used to call the first-class preset vulnerability code to perform jump path code comparison on the first-class control flow jump path set, generate a first vulnerability identification result, and call the symbolic execution module to perform path vulnerability identification on the second-class control flow jump path set, and generate a second vulnerability identification result.

[0008] The third aspect of the present application provides an electronic device, comprising: a memory for storing executable instructions; and a processor for executing the executable instructions stored in the memory to implement the method for automatic code vulnerability mining and identification provided by the present application.

[0009] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0010] First, the source code files of the target software are collected and a source code control flow graph is constructed. Then, vulnerability introduction risk and vulnerability code comparison confidence analysis are performed on multiple control flow nodes in the source code control flow graph to generate multiple introduction risk indicators and multiple code comparison confidence indicators. Further, based on the multiple introduction risk indicators and multiple code comparison confidence indicators, the multiple control flow nodes are divided into a first type of nodes and a second type of nodes. Then, a first type of control flow jump path set and a second type of control flow jump path set are constructed for the first type of nodes and the second type of nodes. Finally, the first type of preset vulnerability code is called to perform jump path code comparison on the first type of control flow jump path set to generate a first vulnerability identification result, and the symbolic execution module is called to perform path vulnerability identification on the second type of control flow jump path set to generate a second vulnerability identification result. The technical problems of low efficiency and high false alarm rate in code vulnerability mining and identification in the prior art are solved, and the technical effect of improving vulnerability identification accuracy and reducing false alarm rate is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0012] Figure 1 A flowchart of a method for automatically mining and identifying code vulnerabilities provided in an embodiment of the present application;

[0013] Figure 2 A schematic diagram of the structure of a system for automatically mining and identifying code vulnerabilities provided in an embodiment of the present application;

[0014] Figure 3 This is a schematic diagram of the structure of an exemplary electronic device of this application.

[0015] Explanation of the accompanying symbols: control flow graph construction module 11, confidence analysis module 12, partitioning module 13, jump path construction module 14, comparison module 15, processor 21, memory 22, input device 23, output device 24. DETAILED DESCRIPTION

[0016] This application solves the technical problems of low efficiency and high false alarm rate in code vulnerability mining and identification in the prior art by providing a method, system and equipment for automatic code vulnerability mining and identification.

[0017] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only some of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0018] It should be noted that the terms "including" and "having" are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or modules that are not clearly listed or are inherent to these processes, methods, products or devices.

[0019] Example 1, as Figure 1 As shown, the embodiment of the present application provides a method for automatically mining and identifying code vulnerabilities, wherein the method includes:

[0020] Collect the source code files of the target software and build a source code control flow graph.

[0021] Source code files are retrieved from the target software's codebase and converted into an Abstract Syntax Tree (AST). An AST is a tree-like data structure used to represent the grammatical structure in the source code, with each node representing a syntactic unit in the source code, such as a statement, expression, or variable. The AST identifies the control flow structure in the source code and divides the program into multiple basic blocks, each representing a segment of continuously executed code. Based on the jump relationships between basic blocks, a control flow graph of the source code is constructed. Nodes in the graph represent basic blocks, and edges represent jump relationships within the program execution path, providing structured data support for subsequent vulnerability discovery and identification.

[0022] Furthermore, the source code files of the target software are collected and the source code control flow graph is constructed, including:

[0023] The source code of the source code file is converted into an abstract syntax tree; control flow structure recognition is performed based on the abstract syntax tree, basic blocks are divided, the basic blocks are used as control flow nodes, and the source code control flow graph is generated according to the jump relationship of the basic blocks.

[0024] Obtain source code files from the target software's code repository, call the corresponding language's compiler front-end tool (such as Clang's LibTooling, Java's Eclipse JDT, and Python's AST module) to perform syntax parsing on the source code and generate an abstract syntax tree. Each node in the abstract syntax tree represents a grammatical structure in the source code (such as an expression, statement, or function definition), and the parent-child relationship between nodes represents the syntax hierarchy.

[0025] Based on the constructed abstract syntax tree, control flow structures in the source code are identified. Control flow structures refer to elements that control the execution path in a program, such as conditional statements (such as if and else statements), loop statements (such as for and while statements), and jump statements (such as break and continue statements). Based on the identified control flow structures, the source code is divided into multiple basic blocks. A basic block is a continuous code segment without jump instructions or branches in the source code, representing an execution unit in the program. Based on the jump relationships between basic blocks, a source code control flow graph is constructed. The source code control flow graph is a graphical representation of the program structure. Each node in the graph represents a basic block, and the edges between nodes represent jump relationships from one basic block to another.

[0026] Vulnerability introduction risk and vulnerability code comparison confidence analysis are performed on multiple control flow nodes in the source code control flow graph to generate multiple introduction risk indicators and multiple code comparison confidence indicators.

[0027] In the source code control flow graph, vulnerability introduction risk and vulnerability code comparison confidence analysis are performed on multiple control flow nodes. That is, by evaluating the code features of each control flow node, potential security risks are identified and introduction risk indicators are generated. At the same time, historical vulnerability codes related to the nodes are mined, similarity comparison is performed, and the similarity with known vulnerability codes is calculated to generate code comparison confidence indicators. The comparison confidence indicators are used to indicate whether vulnerabilities can be effectively identified through code comparison methods alone.

[0028] Furthermore, vulnerability introduction risk and vulnerability code comparison confidence analysis are performed on multiple control flow nodes in the source code control flow graph to generate multiple introduction risk indicators and multiple code comparison confidence indicators, including:

[0029] A jump path is constructed for each of the multiple control flow nodes to generate multiple jump paths; the path complexity, code complexity and data flow risk analysis of the multiple jump paths are integrated to generate the multiple introduced risk indicators; the code structure and path type of the multiple jump paths are collected, historical vulnerability codes are mined based on the path type, discrimination comparison is performed, and the multiple code comparison confidence indicators are generated.

[0030] When analyzing vulnerability introduction risk and vulnerability code comparison confidence for multiple control flow nodes in the source code control flow graph, a jump path is constructed for each control flow node, generating multiple jump paths. Each jump path represents the path along the program execution flow starting from a control flow node. These jump paths are comprehensively analyzed, including path complexity, code complexity, and data flow risk.

[0031] Path complexity analysis involves counting the length of paths and the number of branches within them. Paths with longer paths and longer branches often increase the risk of errors or vulnerabilities being introduced during execution. Code complexity analysis assesses code complexity by identifying lengthy code and complex function call chains along the path. Complex code structures can easily conceal potential vulnerabilities. Data flow risk analysis assesses the security of data flows by analyzing data flow dependencies within the path, specifically the risks of missing input data validation and sensitive data exposure. These three analysis results are combined to generate multiple risk indicators, which are used to assess the vulnerability introduction risk of each jump path.

[0032] The code structure and path types of multiple jump paths are collected. Based on the path types, historical vulnerability codes are mined and compared for discrimination, generating multiple code comparison confidence indicators. Specifically, the code comparison confidence indicators are generated by comparing the similarities between historical safe code and historical vulnerability code of the jump paths.

[0033] Furthermore, the plurality of jump paths are subjected to a fusion analysis of path complexity, code complexity, and data flow risk to generate the plurality of introduced risk indicators, including:

[0034] Construct a path analysis mechanism, a code analysis mechanism and a data flow analysis mechanism; wherein, the path analysis mechanism performs complexity conversion mapping by counting the path length and the number of path branches, wherein the path complexity is proportional to the path length and the number of branches; the code analysis mechanism performs code complexity mapping by identifying code redundancy and function call chain security risks; the data flow analysis mechanism performs data flow risk conversion mapping by performing input verification missing, data flow dependency analysis and sensitive data exposure analysis; call the path analysis mechanism, code analysis mechanism and data flow analysis mechanism to process the multiple jump paths respectively, and generate the path complexity, code complexity and data flow risk corresponding to the multiple jump paths respectively; perform weighted fusion on the path complexity, code complexity and data flow risk corresponding to the multiple jump paths respectively, and generate the multiple introduced risk indicators.

[0035] The path analysis mechanism evaluates path complexity by counting the length and number of path branches of each jump path. Path length represents the number of code segments contained in the path, while the number of path branches indicates the number of possible jump points within the path. The path complexity calculation formula is: C = W1 × L + W2 × B, where C is the path complexity value, W1 and W2 are weighting coefficients for path length and number of branches, respectively. L is the length of the path, and B is the number of branches in the path. The weighting coefficients can be adjusted based on actual conditions; generally, longer paths and paths with multiple branches are given higher weights.

[0036] The code analysis mechanism assesses code complexity by identifying potentially lengthy code and complex function call chains. The longer the code path and the more complex the logic, the greater the likelihood of vulnerabilities being missed or introduced. The code analysis mechanism also assesses whether the function calls involved in the path pose security risks, such as calls to third-party libraries or external systems. The code analysis mechanism maps these lengthy sections and potential security risks and generates a corresponding code complexity value to quantify the code's complexity.

[0037] The data flow analysis mechanism assesses data flow risk by analyzing risk factors such as missing input validation, data flow dependencies, and sensitive data exposure within the jump path. Missing input validation can lead to unsafe data processing, errors in data flow dependencies can cause information leakage or execution errors, and sensitive data exposure can lead to data leaks or attacks. The data flow analysis mechanism uses these risk factors to generate a data flow risk map to quantify the risks associated with the data flow within the path.

[0038] The path analysis mechanism, code analysis mechanism, and data flow analysis mechanism process each jump path separately, generating the path complexity, code complexity, and data flow risk value for each jump path. The path analysis mechanism calculates the path complexity by counting the length and number of branches of the path; the code analysis mechanism calculates the code complexity by identifying lengthy code and potential security risks; and the data flow analysis mechanism generates the data flow risk value by checking input validation, data flow dependencies, and sensitive data exposure issues. The path complexity, code complexity, and data flow risk values ​​are weighted and fused. Weighted fusion assigns different weights to each risk factor based on its importance in the overall vulnerability introduction. The individual complexity values ​​and risk values ​​are then combined to derive the introduction risk index for each jump path. The introduction risk index reflects the overall risk of a vulnerability that may be caused by the jump path during execution. Path complexity, code complexity, and data flow risk are all taken into consideration to comprehensively assess the vulnerability risk of each path.

[0039] Furthermore, collecting the code structure and path type of the multiple jump paths, mining historical vulnerability codes, performing discrimination comparison, and generating the multiple code comparison confidence indicators include:

[0040] Using the code structures and path types of the multiple jump paths as index elements, respectively, historical vulnerability codes and historical security codes corresponding to various historical vulnerability types are retrieved; similarity analysis of vulnerability codes and security codes is performed based on the historical vulnerability codes and the historical security codes to generate multiple similarity indices corresponding to the multiple jump paths; and the multiple similarity indices are subtracted from 1 to generate the multiple code comparison confidence indices.

[0041] Preferably, the code structure and path type of each jump path are extracted and used as index elements. The code structure reflects the specific code implementation method in the jump path, while the path type indicates the execution mode of the path, such as conditional jump, loop, or exception handling. Based on this information, the system will retrieve historical vulnerability code and historical security code, which correspond to different vulnerability types and security standards. Based on the retrieved historical vulnerability code and historical security code, similarity analysis is performed, using an appropriate similarity measurement method (such as cosine similarity, Jaccard similarity, or edit distance) to quantify the similarity between historical vulnerability code and historical security code. The higher the similarity, the more difficult it is to identify the vulnerable code through code comparison. For each jump path, the code comparison confidence index is generated by subtracting the similarity index from 1.

[0042] Based on the multiple introduction risk indicators and the multiple code comparison confidence indicators, the multiple control flow nodes are divided into first-category nodes and second-category nodes.

[0043] For each control flow node, the potential vulnerability risk and the difficulty of vulnerability identification are determined by evaluating its introduction risk index and code comparison confidence index. The introduction risk index quantifies the risk of introducing a vulnerability during node execution, typically using a comprehensive assessment based on factors such as path complexity, code verbosity, and data flow dependencies. The code comparison confidence index indicates whether the vulnerability can be effectively identified through code comparison alone. A higher code comparison confidence index indicates the ease of identification using code comparison.

[0044] By comprehensively introducing risk indicators and code comparison confidence indicators, multiple control flow nodes are divided into first-class nodes and second-class nodes. Among them, first-class nodes only identify vulnerabilities through code comparison, while second-class nodes use symbolic execution, which is more accurate.

[0045] Furthermore, based on the multiple introduction risk indicators and the multiple code comparison confidence indicators, the multiple control flow nodes are divided into first-category nodes and second-category nodes, including:

[0046] Based on the confidence index threshold and the risk index threshold, the multiple control flow nodes are classified to generate the first type of nodes and the second type of nodes, wherein the first type of nodes are control flow nodes whose introduced risk index is less than the risk index threshold and whose code comparison confidence index is greater than the confidence index threshold; wherein, when the classification is performed, a classification contradiction between the confidence index threshold and the risk index threshold occurs, and the classification priority of the risk index threshold is greater than the classification priority of the risk index threshold.

[0047] Control flow nodes are classified based on risk indicator thresholds and confidence indicator thresholds. Specifically, if a control flow node's introduced risk indicator is less than the preset risk indicator threshold, and the node's code comparison confidence indicator is greater than the preset confidence indicator threshold, then the node is classified as a Class I node. Class I nodes generally indicate that these nodes have a low vulnerability risk and can effectively identify vulnerabilities through code comparison methods. Therefore, vulnerability detection can be performed solely through code comparison, without the need for other complex vulnerability detection methods.

[0048] If a node's introduced risk index exceeds the risk index threshold and its code comparison confidence index falls below the confidence index threshold, the node is classified as a Category II node. Category II nodes typically represent nodes with a higher degree of vulnerability identification difficulty and a higher potential vulnerability risk, making them difficult to identify through simple code comparison methods. For Category II nodes, more precise vulnerability detection methods, such as symbolic execution, are used to improve the precision and accuracy of vulnerability detection.

[0049] During the classification process, if there's a conflict between the confidence threshold and the risk threshold (i.e., a node meets the criteria for a Category 1 node under certain conditions but meets the criteria for a Category 2 node under other conditions), the risk threshold will be prioritized over the confidence threshold. This means that if a node has a higher risk index (i.e., a higher risk), it will be prioritized as a Category 2 node, even though its code comparison confidence is higher. This ensures that higher-risk vulnerabilities are detected.

[0050] A first-type control flow jump path set and a second-type control flow jump path set are constructed for the first-type nodes and the second-type nodes.

[0051] Based on the first-class nodes and the second-class nodes, each jump path is analyzed and assigned to the corresponding path set. By analyzing the type of each jump path, it is divided into the first-class control flow jump path set and the second-class control flow jump path set. For the first-class nodes, since their vulnerability risk is low and vulnerabilities can be effectively identified through code comparison, the jump paths related to these nodes are classified into the first-class path set for subsequent code comparison vulnerability detection. For the second-class nodes, these nodes have a high vulnerability risk and are difficult to identify through code comparison. Their related jump paths are classified into the second-class path set for subsequent use by precise detection methods such as symbolic execution.

[0052] Furthermore, constructing a first-type control flow jump path set and a second-type control flow jump path set for the first-type nodes and the second-type nodes includes:

[0053] The first type of nodes and the second type of nodes are distinguished and marked in the source code control flow graph to generate a marked control flow graph; in the marked control flow graph, the first type of control flow jump path set is generated according to the coverage path of the first type of marked nodes, and the second type of control flow jump path set is generated according to the coverage path of the second type of marked nodes.

[0054] In the source code's control flow graph, control flow nodes that have been classified as first-category nodes and second-category nodes are distinguished and marked to form a marked control flow graph. In the marked control flow graph, based on the labels of the first-category nodes, the coverage paths associated with these nodes are identified and extracted. Each coverage path represents all possible paths during program execution starting from the first-category nodes. All these paths are aggregated to form the first-category control flow jump path set. Similarly, based on the labels of the second-category nodes, the coverage paths associated with the second-category nodes are extracted from the marked control flow graph. All paths involving the second-category nodes are aggregated to form the second-category control flow jump path set.

[0055] The first type of preset vulnerability code is called to perform jump path code comparison on the first type of control flow jump path set to generate a first vulnerability identification result, and the symbolic execution module is called to perform path vulnerability identification on the second type of control flow jump path set to generate a second vulnerability identification result.

[0056] Different vulnerability identification methods are used for the first and second control flow jump path sets. For the first control flow jump path set, which contains paths that can effectively identify vulnerabilities through code comparison, the system calls the preset first-category vulnerability code, which is constructed based on common vulnerability patterns in the historical vulnerability database. By comparing the code structure, grammatical features, and functional implementation of the first-category path, the system identifies potential vulnerability paths and generates a first vulnerability identification result, identifying the possible vulnerability types. For the second control flow jump path set, which contains complex paths with higher vulnerability risks that cannot be accurately identified through code comparison, the system calls the symbolic execution module to identify path vulnerabilities. Symbolic execution simulates program execution and tracks each branch path to deeply analyze potential vulnerabilities, such as memory leaks and buffer overflows. Through the symbolic execution module, the system generates a second vulnerability identification result, including possible vulnerabilities in the path and their specific locations.

[0057] Furthermore, the first type of preset vulnerability code is a historical vulnerability code retrieved based on the path type and path code structure in the first type of control flow jump path set; the symbolic execution module is a symbolic execution engine built based on the preset symbolic execution tool.

[0058] The first category of preset vulnerability codes is historical vulnerability codes retrieved based on the path types and code structures in the first category of control flow jump path sets. Specifically, the system analyzes the type (such as conditional judgment, loop, exception handling, etc.) and code structure (such as variable operations and function calls in the code) of each path in the first category of path sets. It then retrieves known vulnerability codes from the historical vulnerability database that match these path types and code structures. This historical vulnerability code represents common vulnerability patterns that occur in similar code structures and path types, and serves as the preset vulnerability code for subsequent vulnerability comparison and analysis.

[0059] The symbolic execution module is a symbolic execution engine built on pre-defined symbolic execution tools, such as KLEE, Angr, Manticore, and SymbEX. Symbolic execution is a program analysis technique that simulates program execution and replaces specific values ​​with symbolic variables to explore all possible execution paths under different input conditions. The symbolic execution module uses a symbolic execution engine built using pre-defined symbolic execution tools. This engine can deeply analyze complex paths within the second-category control flow jump path set and identify potential security vulnerabilities.

[0060] In summary, the embodiments of the present application have at least the following technical effects:

[0061] First, the source code files of the target software are collected and a source code control flow graph is constructed. Then, vulnerability introduction risk and vulnerability code comparison confidence analysis are performed on multiple control flow nodes in the source code control flow graph to generate multiple introduction risk indicators and multiple code comparison confidence indicators. Further, based on the multiple introduction risk indicators and multiple code comparison confidence indicators, the multiple control flow nodes are divided into a first type of nodes and a second type of nodes. Then, a first type of control flow jump path set and a second type of control flow jump path set are constructed for the first type of nodes and the second type of nodes. Finally, the first type of preset vulnerability code is called to perform jump path code comparison on the first type of control flow jump path set to generate a first vulnerability identification result, and the symbolic execution module is called to perform path vulnerability identification on the second type of control flow jump path set to generate a second vulnerability identification result. The technical problems of low efficiency and high false alarm rate in code vulnerability mining and identification in the prior art are solved, and the technical effect of improving vulnerability identification accuracy and reducing false alarm rate is achieved.

[0062] Example 2, based on the same inventive concept as the method for automatically mining and identifying code vulnerabilities in the previous embodiment, Figure 2 As shown, this application provides a system for automatically mining and identifying code vulnerabilities, wherein the system includes:

[0063] A control flow graph construction module 11 is used to collect source code files of the target software and construct a source code control flow graph; a confidence analysis module 12 is used to perform vulnerability introduction risk and vulnerability code comparison confidence analysis on multiple control flow nodes in the source code control flow graph, and generate multiple introduction risk indicators and multiple code comparison confidence indicators; a division module 13 is used to divide the multiple control flow nodes into first-class nodes and second-class nodes based on the multiple introduction risk indicators and the multiple code comparison confidence indicators; a jump path construction module 14 is used to construct a first-class control flow jump path set and a second-class control flow jump path set for the first-class nodes and the second-class nodes; a comparison module 15 is used to call the first-class preset vulnerability code to perform jump path code comparison on the first-class control flow jump path set, generate a first vulnerability identification result, and call the symbolic execution module to perform path vulnerability identification on the second-class control flow jump path set, and generate a second vulnerability identification result.

[0064] Furthermore, the confidence analysis module 12 is configured to perform the following method:

[0065] A jump path is constructed for each of the multiple control flow nodes to generate multiple jump paths; the path complexity, code complexity and data flow risk analysis of the multiple jump paths are integrated to generate the multiple introduced risk indicators; the code structure and path type of the multiple jump paths are collected, historical vulnerability codes are mined based on the path type, discrimination comparison is performed, and the multiple code comparison confidence indicators are generated.

[0066] Furthermore, the confidence analysis module 12 is configured to perform the following method:

[0067] Construct a path analysis mechanism, a code analysis mechanism and a data flow analysis mechanism; wherein, the path analysis mechanism performs complexity conversion mapping by counting the path length and the number of path branches, wherein the path complexity is proportional to the path length and the number of branches; the code analysis mechanism performs code complexity mapping by identifying code redundancy and function call chain security risks; the data flow analysis mechanism performs data flow risk conversion mapping by performing input verification missing, data flow dependency analysis and sensitive data exposure analysis; call the path analysis mechanism, code analysis mechanism and data flow analysis mechanism to process the multiple jump paths respectively, and generate the path complexity, code complexity and data flow risk corresponding to the multiple jump paths respectively; perform weighted fusion on the path complexity, code complexity and data flow risk corresponding to the multiple jump paths respectively, and generate the multiple introduced risk indicators.

[0068] Furthermore, the confidence analysis module 12 is configured to perform the following method:

[0069] Using the code structures and path types of the multiple jump paths as index elements, respectively, historical vulnerability codes and historical security codes corresponding to various historical vulnerability types are retrieved; similarity analysis of vulnerability codes and security codes is performed based on the historical vulnerability codes and the historical security codes to generate multiple similarity indices corresponding to the multiple jump paths; and the multiple similarity indices are subtracted from 1 to generate the multiple code comparison confidence indices.

[0070] Furthermore, the division module 13 is configured to perform the following method:

[0071] Based on the confidence index threshold and the risk index threshold, the multiple control flow nodes are classified to generate the first type of nodes and the second type of nodes, wherein the first type of nodes are control flow nodes whose introduced risk index is less than the risk index threshold and whose code comparison confidence index is greater than the confidence index threshold; wherein, when the classification is performed, a classification contradiction between the confidence index threshold and the risk index threshold occurs, and the classification priority of the risk index threshold is greater than the classification priority of the risk index threshold.

[0072] Furthermore, the jump path construction module 14 is used to execute the following method:

[0073] The first type of nodes and the second type of nodes are distinguished and marked in the source code control flow graph to generate a marked control flow graph; in the marked control flow graph, the first type of control flow jump path set is generated according to the coverage path of the first type of marked nodes, and the second type of control flow jump path set is generated according to the coverage path of the second type of marked nodes.

[0074] Furthermore, the comparison module 15 is used to perform the following method:

[0075] The first type of preset vulnerability code is a historical vulnerability code retrieved based on the path type and path code structure in the first type of control flow jump path set; the symbolic execution module is a symbolic execution engine built based on a preset symbolic execution tool.

[0076] Furthermore, the control flow graph construction module 11 is used to execute the following method:

[0077] The source code of the source code file is converted into an abstract syntax tree; control flow structure recognition is performed based on the abstract syntax tree, basic blocks are divided, the basic blocks are used as control flow nodes, and the source code control flow graph is generated according to the jump relationship of the basic blocks.

[0078] Example 3, Figure 3 This is a structural diagram of an electronic device provided in accordance with a third embodiment of the present invention, showing a block diagram of an exemplary electronic device suitable for implementing the embodiments of the present invention. Figure 3The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present invention. Figure 3 As shown, the electronic device includes a processor 21, a memory 22, an input device 23 and an output device 24; the number of processors 21 in the electronic device can be one or more. Figure 3 Taking a processor 21 as an example, the processor 21, memory 22, input device 23 and output device 24 in the electronic device can be connected through a bus or other means. Figure 3 The bus connection is taken as an example.

[0079] Memory 22, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and modules, such as the program instructions / modules corresponding to the automatic code vulnerability mining and identification method in the embodiments of the present invention. Processor 21 executes the software programs, instructions, and modules stored in memory 22 to execute various functional applications and data processing of the electronic device, thereby implementing the automatic code vulnerability mining and identification method described above.

[0080] It should be noted that the order in which the embodiments of the present application are presented is for illustrative purposes only and does not necessarily represent the superiority or inferiority of the embodiments. Furthermore, the foregoing descriptions of specific embodiments of this specification are provided. The processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0081] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

[0082] This specification and drawings are merely illustrative of the present application and are intended to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Obviously, those skilled in the art may make various modifications and variations to this application without departing from the scope of this application. Thus, this application is intended to include such modifications and variations as fall within the scope of this application and its equivalents.

Claims

1. A method for automatically mining and identifying code vulnerabilities, characterized in that: The method comprises: Collect the source code files of the target software and build the source code control flow graph; Performing vulnerability introduction risk and vulnerability code comparison confidence analysis on multiple control flow nodes in the source code control flow graph to generate multiple introduction risk indicators and multiple code comparison confidence indicators; Based on the multiple introduction risk indicators and the multiple code comparison confidence indicators, the multiple control flow nodes are divided into a first type of nodes and a second type of nodes; Constructing a first type of control flow jump path set and a second type of control flow jump path set for the first type of nodes and the second type of nodes; Calling the first type of preset vulnerability code to perform jump path code comparison on the first type of control flow jump path set to generate a first vulnerability identification result, calling the symbolic execution module to perform path vulnerability identification on the second type of control flow jump path set to generate a second vulnerability identification result; The vulnerability introduction risk and vulnerability code comparison confidence analysis are performed on multiple control flow nodes in the source code control flow graph to generate multiple introduction risk indicators and multiple code comparison confidence indicators, including: Constructing a jump path for each of the multiple control flow nodes to generate multiple jump paths; Performing path complexity, code complexity, and data flow risk analysis on the multiple jump paths to generate the multiple introduced risk indicators; Collecting the code structures and path types of the multiple jump paths, mining historical vulnerability codes based on the path types, performing discrimination comparison, and generating the multiple code comparison confidence indicators; The method further comprises dividing the plurality of control flow nodes into first-category nodes and second-category nodes based on the plurality of introduction risk indicators and the plurality of code comparison confidence indicators. Based on the confidence index threshold and the risk index threshold, the multiple control flow nodes are classified to generate the first type of nodes and the second type of nodes, wherein the first type of nodes are control flow nodes whose introduced risk index is less than the risk index threshold and whose code comparison confidence index is greater than the confidence index threshold; if the introduced risk index of a node is greater than the risk index threshold and its code comparison confidence index is less than the confidence index threshold, then the node is classified as the second type of node; Wherein, when a classification contradiction occurs between the confidence index threshold and the risk index threshold during classification, the classification priority of the risk index threshold is greater than the classification priority of the risk index threshold; The first type of preset vulnerability code is a historical vulnerability code retrieved based on the path type and path code structure in the first type of control flow jump path set; The symbolic execution module is a symbolic execution engine built based on a preset symbolic execution tool.

2. The method for automatically mining and identifying code vulnerabilities according to claim 1, wherein: Performing a fusion analysis of path complexity, code complexity, and data flow risk on the multiple jump paths to generate the multiple introduced risk indicators, including: Build path analysis mechanism, code analysis mechanism and data flow analysis mechanism; The path analysis mechanism performs complexity conversion mapping by counting the path length and the number of path branches, where the path complexity is proportional to the path length and the number of branches; the code analysis mechanism performs code complexity mapping by identifying code redundancy and function call chain security risks; the data flow analysis mechanism performs data flow risk conversion mapping by performing input verification missing, data flow dependency analysis, and sensitive data exposure analysis; Calling the path analysis mechanism, the code analysis mechanism, and the data flow analysis mechanism to process the multiple jump paths respectively, and generating path complexity, code complexity, and data flow risk corresponding to the multiple jump paths respectively; The path complexity, code complexity and data flow risk corresponding to the multiple jump paths are weighted and integrated to generate the multiple introduction risk indicators.

3. The method for automatically mining and identifying code vulnerabilities according to claim 1, wherein: Collecting the code structure and path type of the multiple jump paths, mining historical vulnerability codes, performing discrimination comparison, and generating the multiple code comparison confidence indicators, including: Using the code structures and path types of the multiple jump paths as index elements, respectively, to retrieve historical vulnerability codes and historical security codes corresponding to various historical vulnerability types; Performing similarity analysis of vulnerability codes and security codes based on the historical vulnerability codes and the historical security codes, and generating multiple similarity indicators corresponding to the multiple jump paths; The multiple similarity indices are respectively subtracted from 1 to generate the multiple code comparison confidence indices.

4. The method for automatically mining and identifying code vulnerabilities according to claim 1, wherein: Constructing a first-type control flow jump path set and a second-type control flow jump path set for the first-type nodes and the second-type nodes, including: Marking the first type of nodes and the second type of nodes in the source code control flow graph to generate a marked control flow graph; In the marked control flow graph, the first type of control flow jump path set is generated according to the coverage path of the first type of marked nodes, and the second type of control flow jump path set is generated according to the coverage path of the second type of marked nodes.

5. The method for automatically mining and identifying code vulnerabilities according to claim 1, wherein: Collect the source code files of the target software and build a source code control flow graph, including: Converting the source code file into an abstract syntax tree; Control flow structure recognition is performed based on the abstract syntax tree, basic blocks are divided, the basic blocks are used as control flow nodes, and the source code control flow graph is generated according to the jump relationship of the basic blocks.

6. Code vulnerability automatic mining and identification system, characterized by: A system for implementing the method for automatically mining and identifying code vulnerabilities according to any one of claims 1 to 5, comprising: Build a control flow graph module to collect the source code files of the target software and build a source code control flow graph; A confidence analysis module, configured to perform vulnerability introduction risk and vulnerability code comparison confidence analysis on multiple control flow nodes in the source code control flow graph, and generate multiple introduction risk indicators and multiple code comparison confidence indicators; a division module, configured to divide the plurality of control flow nodes into first-category nodes and second-category nodes based on the plurality of introduction risk indicators and the plurality of code comparison confidence indicators; A jump path construction module is used to construct a first type of control flow jump path set and a second type of control flow jump path set for the first type of node and the second type of node; The comparison module is used to call the first type of preset vulnerability code to perform jump path code comparison on the first type of control flow jump path set to generate a first vulnerability identification result, and call the symbolic execution module to perform path vulnerability identification on the second type of control flow jump path set to generate a second vulnerability identification result.

7. An electronic device, characterized in that: The electronic device comprises: a memory for storing executable instructions; The processor is configured to implement the method for automatically mining and identifying code vulnerabilities according to any one of claims 1 to 5 when executing the executable instructions stored in the memory.

Images