A graph neural network detection method for freeRTOS buffer overflow vulnerability

Abstract

The application relates to the technical field of computer security, and particularly discloses a graph neural network detection method for a FreeRTOS buffer overflow vulnerability, which comprises the following steps: obtaining source code of a known vulnerability type; pre-processing and function-level code segmentation are performed on the source code to obtain multiple function codes; a static analysis tool Joern is used to construct a code property graph of the function codes; the JSON text corresponding to the code property graph comprises node information and edge information; an adjacency matrix of the code property graph is constructed according to the code property graph, and a feature matrix of the node information is constructed according to the JSON text; and a graph neural network model is trained according to the adjacency matrix and the feature matrix to detect the buffer overflow vulnerability.

Description

Technical Field

[0001] This invention relates to the field of computer security technology, specifically to a graph neural network detection method for FreeRTOS buffer overflow vulnerabilities. Background Technology

[0002] FreeRTOS is a widely used real-time operating system. Due to its increasing popularity in resource-constrained embedded devices, the security requirements for FreeRTOS are growing.

[0003] Since the first buffer overflow attack in 1988, buffer overflow vulnerabilities have become the most common and serious type of software vulnerability, posing numerous potential risks. Attackers can exploit buffer overflow vulnerabilities to execute malicious code and gain control of the system. In recent years, vulnerabilities related to FreeRTOS have been frequently reported, with buffer overflow vulnerabilities accounting for approximately 72.7%. Attackers can exploit these vulnerabilities to control the RTOS and gain access to the system, leading to system crashes or arbitrary code execution, with severe consequences. However, using machine learning or deep learning methods to detect vulnerabilities in software source code still faces some challenges:

[0004] 1) Existing technologies only focus on whether the software being tested contains vulnerabilities, and cannot detect multiple types of vulnerabilities simultaneously. Because software vulnerabilities arise from many causes, there are also many types of software vulnerabilities. Buffer overflow vulnerabilities include stack overflow vulnerabilities, heap overflow vulnerabilities, integer overflow vulnerabilities, SHE structure fundamental vulnerabilities, buffer lower bound writes, buffer out-of-bounds reads, and many other types.

[0005] 2) Existing technologies, based on single feature analysis procedures, have limited vulnerability detection capabilities. Some existing technologies use text-based features from source code for analysis, but the diversity of software development naming conventions can lead to potential lexical ambiguity. Furthermore, code differs from ordinary text, possessing richer structural and semantic information. Treating code as text inevitably results in the loss of inter-code connection information. This approach remains insufficient in capturing long-distance dependencies where contextual relationships within the code are not tightly linked. Some existing technologies combine graph representation learning to extract more code information, while others use graph-based feature representations for analysis. However, their software graph slicing methods can only traverse all nodes in the graph as input, failing to effectively utilize node edge features or highlight features in the graph that are highly specific and impactful on certain vulnerabilities. Summary of the Invention

[0006] To address the aforementioned problems, the purpose of this invention is to provide a graph neural network detection method for FreeRTOS buffer overflow vulnerabilities. This method utilizes graph analysis and deep learning techniques to automatically detect buffer overflow vulnerabilities in code and identify their types.

[0007] This invention provides a graph neural network detection method for FreeRTOS buffer overflow vulnerabilities, comprising:

[0008] Obtain the source code of known vulnerability types;

[0009] The source code is preprocessed and split into function-level code segments to obtain multiple function codes;

[0010] The code property graph of the function code was constructed using the static analysis tool Joern; the JSON text corresponding to the code property graph includes node information and edge information.

[0011] Construct the adjacency matrix of the code attribute graph based on the code attribute graph, and construct the feature matrix of the node information based on the JSON text;

[0012] A graph neural network model is trained based on the adjacency matrix and the feature matrix to detect buffer overflow vulnerabilities.

[0013] In one possible implementation, the preprocessing and function-level code splitting of the source code to obtain multiple function codes includes:

[0014] Scan and remove source code outside of function definitions, output to a file, and obtain the split function-level code; each file contains only a single function code.

[0015] In one possible implementation, constructing the feature matrix of the node information based on the JSON text includes:

[0016] Extract and remove tags from the JSON text;

[0017] Remove non-ASCII characters from the JSON text and replace each string constant;

[0018] The attribute labels are classified and concatenated in the order of syntax information, data dependencies, and control flow sequence to obtain the encoding sequence of node features.

[0019] In one possible implementation, constructing the feature matrix of the node information based on the JSON text further includes:

[0020] The encoded sequence is trained using the Word2Vec model to obtain the feature vector of node information.

[0021] In one possible implementation, constructing the feature matrix of the node information based on the JSON text further includes:

[0022] Remove feature vectors that are not within the preset length range and fill the remaining bits of the feature vectors with zeros to obtain the feature matrix.

[0023] In one possible implementation, training the graph neural network model based on the adjacency matrix and the feature matrix includes:

[0024] Construct a graph neural network model based on the input layer, embedding layer, graph convolutional layer, attention pooling layer, and output layer;

[0025] The graph convolutional layer includes a first GCN and a second GCN; the activation function of both the first GCN and the second GCN is ReLU.

[0026] In one possible implementation, training the graph neural network model based on the adjacency matrix and the feature matrix includes:

[0027] The adjacency matrix and the feature matrix are imported into the input layer;

[0028] The adjacency matrix and the feature matrix are compressed through the embedding layer, and then the compressed adjacency matrix and feature matrix are transmitted to the graph convolutional layer for learning.

[0029] Attention scores are obtained by assigning different weights to different nodes and aggregating them through an attention mechanism pooling layer.

[0030] The attention scores of the nodes are sorted in descending order, and a preset proportion of nodes are retained based on the descending order result to obtain the mask vector of the graph.

[0031] Update the feature matrix and the adjacency matrix according to the mask vector of the graph;

[0032] The output layer outputs the detected vulnerability type to determine whether the detected vulnerability type is consistent with the known vulnerability type.

[0033] In one possible implementation, the step of compressing the adjacency matrix and the feature matrix through the embedding layer, and then transmitting the compressed adjacency matrix and feature matrix to the graph convolutional layer for learning, includes:

[0034] Forward propagation is performed according to the following formula:

[0035] ;

[0036] ;

[0037] ;

[0038] in, For the characteristic matrix, It is an adjacency matrix. Adjacency matrix The Laplacian matrix obtained by adding self-connection and normalization is... For activation function, This is the output of the first layer GCN. This is the output of the second-layer GCN. The output of the graph convolutional layer, This is the weight parameter matrix.

[0039] In one possible implementation, the process of assigning different weights to different nodes and aggregating them through an attention mechanism pooling layer to obtain an attention score includes:

[0040] Calculate the self-attention score using the following formula:

[0041] ;

[0042] in, The output of the graph convolutional layer, For activation function, The weight parameter matrix, For attention score, Adjacency matrix The Laplace matrix is ​​obtained by adding a self-connect and normalizing it.

[0043] In one possible implementation, the step of sorting the attention scores of the nodes in descending order and retaining a preset proportion of nodes based on the descending order to obtain the graph mask vector includes:

[0044] The mask vector of the graph is obtained using the following formula:

[0045] ;

[0046] in, For attention score, To update the mask vector of the image, This is the index of the nodes retained after sorting by attention score in descending order. The proportion of nodes to be retained. The total number of nodes;

[0047] Updating the feature matrix and the adjacency matrix based on the mask vector of the graph includes:

[0048] Update the feature matrix according to the following formula:

[0049] ;

[0050] in, The attention score for the nodes to be retained. It is the hyperbolic tangent function. For the updated feature matrix, The feature matrix of the nodes to be retained.

[0051] The graph neural network detection method for buffer overflow vulnerabilities in FreeRTOS provided by this invention aims to intelligently analyze vulnerabilities in FreeRTOS using automation technology, focusing on multi-type classification and identification of buffer overflow vulnerabilities. Its purpose is to reduce the auditing difficulties and experience biases in traditional methods, and help developers locate problems more accurately. Attached Figure Description

[0052] Figure 1 A first flowchart of a graph neural network detection method provided in an embodiment of the present invention;

[0053] Figure 2 This is a schematic diagram of the second process of the graph neural network detection method provided in an embodiment of the present invention;

[0054] Figure 3 This is a schematic diagram of the structure of a graph neural network model provided in an embodiment of the present invention;

[0055] Figure 4 This is a schematic diagram of the operation of the attention pooling layer provided in an embodiment of the present invention. Detailed Implementation

[0056] The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings and examples. The following detailed description of the embodiments and the accompanying drawings are used to illustrate the principles of the present invention by way of example, but should not be used to limit the scope of the present invention. That is, the present invention is not limited to the described preferred embodiments, and the scope of the present invention is defined by the claims.

[0057] In the description of this invention, it should be noted that, unless otherwise stated, "a plurality of" means two or more; the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance; those skilled in the art can understand the specific meaning of the above terms in this invention as appropriate.

[0058] Figure 1 This is a schematic diagram of the first process of a graph neural network detection method provided in an embodiment of the present invention. Figure 2 This is a schematic diagram of the second process of the graph neural network detection method provided in the embodiments of the present invention, combined with Figure 1 and Figure 2 This invention provides a graph neural network detection method for FreeRTOS buffer overflow vulnerabilities, including:

[0059] Step S1: Obtain the source code for known vulnerability types;

[0060] In one example, the source code files for FreeRTOS v10.0.1 are downloaded, including the operating system kernel code and commonly used function libraries that come with FreeRTOS, such as FreeRTOS-Plus-TCP (TCP / IP protocol component), FreeRTOS-Plus-CLI (command line interpreter), FreeRTOS-Plus-Trace (visual tracing), and FreeRTOS-Plus-IO (communication interface that provides hardware I / O pins).

[0061] Step S2 involves preprocessing the source code and splitting it into function-level code segments to obtain multiple function codes;

[0062] In one possible implementation, the source code outside the function definition is scanned and removed, and output to a file to obtain the split function-level function code; each file contains only a single function code.

[0063] In one example, the source code file is scanned, removing comments, spaces, global variables, function declarations, and other code information except for function definitions. Function definitions, as well as curly braces "{" and "}", are matched and output to separate files, resulting in function-level split source code, where each .c file contains only a single function.

[0064] Step S3: Use the static analysis tool Joern to construct the code property graph of the function code;

[0065] In one possible implementation, the static analysis tool Joern is used to abstract the code of each function, constructing a code property graph that describes the internal structure and control flow of the function.

[0066] Code Property Graph (CPG), as a graph-based representation method, combines Abstract Syntax Tree (AST), Control Flow Graph (CFG), and Program Dependency Graph (PDG), and contains various information such as function syntax, semantics, and control flow.

[0067] The JSON text corresponding to the code attribute graph includes node information and edge information. Nodes in the graph represent code elements, such as variables, variable types, parameters, operators, etc.; edges represent the relationships between code elements, such as control flow, data flow, etc.

[0068] Each node in the diagram is uniquely labeled, with the number string preceding the label representing the node's identifier. Each node is represented by two main attributes: type and code. The node's type refers to the semantic label it represents within the code structure, such as a method label, local variable label, or operator. The node's code attribute contains the specific implementation details, such as the method name, parameter types, and return type.

[0069] For example, the node "label="( <operator>.assignment,data=NULL)"".

[0070] in,' <operator>`.assignment` indicates an assignment operation, and `data=NULL` indicates code. Similar operators include basic operations, logical operations, bitwise operations, ternary operators, compile-time operators, indexed access, address access, and type casting.

[0071] Each edge of the graph is represented by "node number" → "node number".

[0072] Step S4: Construct the adjacency matrix of the code attribute graph based on the code attribute graph, and construct the feature matrix of node information based on the JSON text;

[0073] In one possible implementation, constructing the adjacency matrix of the code attribute graph based on the code attribute graph includes: parsing the data file of the code attribute graph, extracting the link relationships between nodes in the graph, constructing the adjacency matrix of the graph, and realizing the vectorization of graph topology information.

[0074] In one example, if the graph structure G of function V contains N nodes, the adjacency matrix is ​​represented as A(N×N), and there is a directed edge i→j, then A(i,j)=1, which maps the calling, passing, and dependency relationships between nodes.

[0075] In one possible implementation, constructing the feature matrix of node information based on JSON text includes: extracting and removing tags from the JSON text; removing non-ASCII characters from the JSON text and replacing each string constant; classifying and concatenating the attribute tags according to the order of syntax information, data dependencies, and control flow sequence to obtain the encoded sequence of node features. The encoded sequence is trained using a Word2Vec model to obtain the feature vector of node information. Feature vectors outside the preset length range are removed, and the remaining bits of the feature vectors are filled with zeros to obtain the feature matrix.

[0076] Specifically, the JSON text is processed. Tags are extracted and removed from the data file, non-ASCII characters are removed, and each string constant is replaced; for example, printf("vTaskStartScheduler") is replaced with printf("str"). The attribute tags are then categorized and concatenated according to syntax information, data dependencies, and control flow sequence to form an encoded sequence of node features.

[0077] In one example, the data dependency of a certain function A is represented as:

[0078] [METHOD, eARPProcessPacket,… <operator>.equals,ulTargetProtocolAddress,==,ulSenderProtocolAddress,METHOD_RETURN,eFrameProcessingResult_t];

[0079] Control dependency B is represented as:

[0080] [ <operator>.equals,ulTargetProtocolAddress,==,ulSenderProtocolAddress,memcpy,memcpy,(,pxARPHeader,->,xTargetHardwareAddress,…),…,METHOD_RETURN,

[0081] eFrameProcessingResult_t];

[0082] Therefore, the encoded sequence C of the node features is represented as:

[0083] [[METHOD,eARPProcessPacket,… <operator>.equals,ulTargetProtocolAddress,==,ulSenderProtocolAddress,METHOD_RETURN,eFrameProcessingResult_t,… <operator>.equals,ulTargetProtocolAddress,==,ulSenderProtocolAddress,memcpy,memcpy,(,pxARPHeader,->,xTargetHardwareAddress,…),…,METHOD_RETURN,eFrameProcessingResult_t].

[0084] The encoded sequence C is the result of combining multiple different pieces of information from A and B by concatenating A and B.

[0085] Next, the encoding sequence obtained by training the Word2Vec model is used to obtain the feature vector of node information.

[0086] In one example, "(METHOD RETURN, void, <operator>The assignment, data, ...) is mapped to (0.12, -0.45, 0.78, 0.67, ...).

[0087] Finally, the length of the feature vectors is standardized. Samples with feature vector lengths greater than 200 and less than 10 are discarded, as these samples constitute a small proportion and have little impact on the results. Furthermore, excessively long vectors contain a significant amount of information unrelated to buffer overflow vulnerabilities, affecting the subsequent learning of the neural network model. For samples with feature vector lengths less than 200 but greater than 10, the remaining bits are padded with zeros.

[0088] Step S5: Train a graph neural network model based on the adjacency matrix and feature matrix to detect buffer overflow vulnerabilities.

[0089] In one possible implementation, the graph neural network model trained based on the adjacency matrix and the feature matrix includes:

[0090] Construct a graph neural network model based on the input layer, embedding layer, graph convolutional layer, attention pooling layer, and output layer;

[0091] The graph convolutional layer consists of a first GCN and a second GCN; the activation function for both the first and second GCNs is ReLU. Figure 3 This is a schematic diagram of the structure of a graph neural network model provided in an embodiment of the present invention.

[0092] In order to amplify the impact of the parts of the features related to buffer overflow vulnerabilities, this invention introduces an attention mechanism pooling layer, which can aggregate different nodes after assigning different weights in message passing, so that the neural network can focus on more important node features on the feature map of each layer.

[0093] In one possible implementation, training a graph neural network model based on the adjacency matrix and feature matrix includes: importing the adjacency matrix and feature matrix into the input layer; compressing the adjacency matrix and feature matrix through an embedding layer, and then transmitting the compressed adjacency matrix and feature matrix to the graph convolutional layer for learning; assigning different weights to different nodes through an attention mechanism pooling layer and aggregating them to obtain attention scores; where the attention scores are node importance scores obtained using GCN. The attention scores of the nodes are sorted in descending order, and a predetermined proportion of nodes are retained based on the descending order to obtain the graph mask vector; the feature matrix and adjacency matrix are updated based on the graph mask vector; and the detected vulnerability type is output through the output layer to determine whether the detected vulnerability type is consistent with the known vulnerability type.

[0094] In one example, the adjacency matrix A (N×N) and the feature matrix X (N×D) are imported into the input layer; where N is the number of nodes and D is the feature dimension. The embedding layer is set to have a hidden dimension of M. The original features are dimensionality-reduced using a fully connected network. Then, the compressed feature matrix X (N×M) and the self-connected and normalized Laplacian matrix are used. (N×N) data are transmitted to a two-layer graph convolutional network for learning;

[0095] In one possible implementation, to improve computational speed, batch processing is employed. This invention creates multiple graphs concurrently during processing, sorts the attention scores of each subgraph in descending order, and obtains a mask vector for each subgraph. The proportion of important nodes is set to k, and key code features with high influence are selected. The mask vectors of all subgraphs are concatenated to obtain an updated feature matrix.

[0096] Specifically, the attention scores corresponding to the nodes in the graph are extracted, and the results are sorted in descending order to obtain the indices of the nodes to be retained. These indices are then set to True to obtain the mask vector for each subgraph node. The mask vectors of all graphs are concatenated to obtain the updated feature matrix.

[0097] In one possible implementation, forward propagation is performed according to the following formula:

[0098] ;

[0099] ;

[0100] ;

[0101] in, For the characteristic matrix, It is an adjacency matrix. Adjacency matrix The Laplacian matrix obtained by adding self-connection and normalization is... For activation function, This is the output of the first layer GCN. This is the output of the second-layer GCN. The output of the graph convolutional layer, This is the weight parameter matrix.

[0102] In one possible implementation, the self-attention score is calculated according to the following formula:

[0103] ;

[0104] in, The output of the graph convolutional layer is the feature matrix of the node after learning the feature matrix X. For activation function, The weight parameter matrix, For attention score, Adjacency matrix The Laplace matrix is ​​obtained by adding a self-connect and normalizing it.

[0105] In one possible implementation, the step of sorting the attention scores of the nodes in descending order and retaining a preset proportion of nodes based on the descending order to obtain the graph mask vector includes:

[0106] The mask vector of the graph is obtained using the following formula:

[0107] ;

[0108] in, For attention score, To update the mask vector of the image, This is the index of the nodes retained after sorting by attention score in descending order. The proportion of nodes to be retained. The total number of nodes;

[0109] Updating the feature matrix and the adjacency matrix based on the mask vector of the graph includes:

[0110] Update the feature matrix according to the following formula:

[0111] ;

[0112] in, The attention score for the nodes to be retained. It is the hyperbolic tangent function. For the updated feature matrix, The feature matrix of the nodes to be retained.

[0113] The classification process is performed using a multilayer perceptron at the output layer, and the output vulnerability types include:

[0114] Output the detected vulnerability type based on the following formula:

[0115] ;

[0116] in, To detect vulnerability types, For activation function, The feature matrix output by the pooling layer. This is the weight parameter matrix.

[0117] Figure 4 This is a schematic diagram of the operation of the attention pooling layer provided in an embodiment of the present invention, as shown below. Figure 4 As shown, the structure on the left (1) represents the input training samples, where circles represent the feature matrices of each node, and solid lines represent the adjacency matrix that reflects the relationships between nodes. In the structure on the left (2), circles represent one-dimensional attention scores. In the structure on the left (3), dashed lines represent nodes with smaller attention scores, i.e., nodes that are removed; solid lines represent nodes that are retained. When node information changes, the adjacency matrix based on the node is also updated accordingly to filter out unimportant nodes. After non-linear dynamic adjustment of the attention scores of the retained nodes, they are multiplied with the feature matrices of the retained nodes to obtain the updated feature matrix, as shown in the structure on the left (4). The purpose of this step is mainly to enhance the feature strength of the retained nodes.

[0118] The training samples of this invention are function-level source code with known vulnerability types. The graph neural network model learns the characteristics of different types of overflows, thereby training the potential type patterns of buffer overflow vulnerabilities, realizing the automatic identification of potential overflow vulnerabilities in each module of the FreeRTOS source code, and outputting the vulnerability type or the judgment result of no overflow vulnerability.

[0119] In one example, the present invention selects the most common vulnerability types as CWE-121: Stack-based BufferOverflow, CWE-122: Heap-based Buffer Overflow, and CWE-190: Integer Overflow or Wraparound, which has been frequently reported as a vulnerability in FreeRTOS in recent years.

[0120] The training samples used code files related to CWE-119 (buffer overflow) from the VulDeePecker open-source project's CGD dataset. The required training data extracted from these files included: 3669 vulnerability-free code files, 1827 heap overflow code files, 201 integer overflow code files, and 1386 stack overflow code files.

[0121] The test sample is a function-level split file of the FreeRTOS v10.0.1 source code. Table 1 lists the known vulnerabilities and their types in FreeRTOS.

[0122] Table 1

[0123]

[0124] The output values ​​0, 1, 2, and 3 represent "no overflow vulnerability", "heap overflow vulnerability", "stack overflow vulnerability", and "integer overflow vulnerability", respectively.

[0125] Through experiments, using the detection method of this invention, 7 out of 8 reported overflow vulnerabilities in FreeRTOS were correctly identified, with an accuracy of Pr=77.8% and a recall of Re=87.5%.

[0126] This invention provides a graph neural network detection method for FreeRTOS buffer overflow vulnerabilities. It detects three common types of buffer overflow vulnerabilities in FreeRTOS: stack overflow, heap overflow, and integer overflow. The method uses code features based on a combination of various graphical representations of the FreeRTOS source code as samples, fully preserving information such as syntax semantics, control dependencies, and data dependencies in the code. To effectively preserve the topological structure and node information of the graph feature vectors, a graph neural network is used to train buffer overflow vulnerability feature patterns in FreeRTOS, and a self-attention mechanism is introduced to highlight features that have a greater impact on buffer overflow vulnerabilities.

[0127] The graph neural network detection method for FreeRTOS buffer overflow vulnerabilities provided by this invention has the following technical effects:

[0128] (1) Efficiency and accuracy: This invention combines graph neural networks for static analysis and uses module-level code segmentation, which is beneficial to the integrity of the graph structure representation. It can effectively capture the potential patterns of buffer overflow vulnerabilities from the graph structure of the source code, and has higher accuracy and robustness than traditional methods.

[0129] (2) Automation and intelligence: This invention significantly reduces the workload of manual analysis by automatically generating code attribute graphs and using deep learning models for vulnerability detection, while also avoiding human bias in traditional methods.

[0130] (3) Overflow type classification: Unlike the traditional binary classification method, this invention can classify buffer overflow vulnerabilities into multiple types, helping developers to accurately locate problems and take more targeted remediation measures.

[0131] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.< / operator> < / operator> < / operator> < / operator> < / operator> < / operator> < / operator>

Claims

1. A graph neural network detection method for FreeRTOS buffer overflow vulnerabilities, characterized in that, The method comprises the following steps: obtaining source code of a known vulnerability type; preprocessing and function-level code segmentation are performed on the source code to obtain a plurality of function codes; a code property graph of the function code is constructed using a static analysis tool Joern; the code property graph includes node information and edge information in the corresponding JSON text; an adjacency matrix of the code property graph is constructed according to the code property graph, and a feature matrix of the node information is constructed according to the JSON text; a graph neural network model is trained according to the adjacency matrix and the feature matrix to detect buffer overflow vulnerabilities; the training of the graph neural network model according to the adjacency matrix and the feature matrix comprises: a graph neural network model is constructed according to an input layer, an embedding layer, a graph convolution layer, an attention pooling layer and an output layer; the graph convolution layer comprises a first layer GCN and a second layer GCN; the activation functions of the first layer GCN and the second layer GCN are both ReLU; the training of the graph neural network model according to the adjacency matrix and the feature matrix comprises: the adjacency matrix and the feature matrix are imported into the input layer; the adjacency matrix and the feature matrix are compressed through the embedding layer, and then the compressed adjacency matrix and feature matrix are transmitted to the graph convolution layer for learning; different weights are assigned to different nodes through the attention mechanism pooling layer, and then the attention scores are aggregated to obtain attention scores; the attention scores of the nodes are arranged in descending order, and a preset proportion of nodes are retained according to the descending order arrangement result to obtain a mask vector of the graph; the feature matrix and the adjacency matrix are updated according to the mask vector of the graph; the output layer is used to output a detected vulnerability type to determine whether the detected vulnerability type is consistent with the known vulnerability type; the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the adjacency matrix and the feature matrix through the embedding layer, and then the compression of the ​ wherein, is a feature matrix, is an adjacency matrix, is an adjacency matrix is a Laplacian matrix with self-loops and normalization, is an activation function, is an output of the first layer GCN, is an output of the second layer GCN, is an output of the graph convolutional layer, is a weight parameter matrix, is a first layer weight parameter matrix, is a second layer weight parameter matrix.

2. The graph neural network detection method of claim 1, wherein, ​ ​ 3. The graph neural network detection method of claim 1, wherein, ​ ​ ​ ​ 4. The graph neural network detection method of claim 3, wherein, ​ ​ 5. The graph neural network detection method of claim 4, wherein, ​ ​ 6. The graph neural network detection method of claim 1, wherein, The attention mechanism pooling layer assigns different weights to different nodes and aggregates to obtain an attention score, including: The self-attention score is calculated according to the following formula: wherein, is the output of the graph convolution layer, is an activation function, is a weight parameter matrix, is an attention score, is an adjacency matrix is a Laplacian matrix obtained after adding self-connections and normalization.

7. The graph neural network detection method according to claim 1, characterized in that, The attention score of the node is arranged in descending order, and a node with a preset proportion is reserved according to the descending order arrangement result to obtain a mask vector of the graph, including: The mask vector of the graph is obtained according to the following formula: wherein, is the attention score, is the mask vector of the updated graph, is the index of the retained nodes after sorting in descending order of the attention score, is the proportion of the retained nodes, is the total number of nodes; Updating the feature matrix and the adjacency matrix according to the mask vector of the graph includes: The feature matrix is updated according to the following formula: wherein, is an attention score for a retained node, is a hyperbolic tangent function, is an updated feature matrix, is a feature matrix for a retained node.

Images