A security patch classification method and system based on pseudo-label learning

Abstract

This application belongs to the field of vulnerability type classification and specifically discloses a security patch classification method and system based on pseudo-label learning. The method includes: obtaining the security patch to be classified; performing feature extraction on the security patch to obtain key semantic features; inputting the key semantic features into a trained security patch model to obtain a classification result for the security patch. The security patch model is obtained by extracting key semantic information from a security-related patch dataset and an unlabeled patch dataset, and performing pseudo-label learning based on the key semantic information. This application can improve the accuracy and efficiency of security patch classification.

Description

Technical Field

[0001] The present application belongs to the field of vulnerability type classification, and more specifically, relates to a security patch classification method and system based on pseudo-label learning. Background Art

[0002] In today's software engineering landscape, open source software has become widely used in the software supply chain for both commercial and non-commercial products. This has led to widespread dissemination of vulnerabilities in open source software. Downstream open source software users are under pressure to promptly identify and fix vulnerabilities in upstream open source software. Vulnerability type information is crucial during the vulnerability remediation process, helping developers understand the root cause of the vulnerability, its potential impact, and the type of mitigation measures to deploy. Therefore, categorizing security patches by vulnerability type is crucial.

[0003] Researchers have proposed numerous methods for classifying security patches. Among them, deep learning-based approaches have attracted widespread attention due to their ability to automatically extract features from code and identify complex patterns. These methods have made some progress in classifying vulnerability types in security patches, demonstrating their potential to reduce manual intervention and improve classification efficiency. However, despite the success of deep learning-based techniques, their classification performance remains limited, primarily due to a lack of high-quality training data, and the current challenges of obtaining annotated datasets.

[0004] On the one hand, manual code review often requires deep expert knowledge, which is not only time-consuming but also susceptible to human bias. On the other hand, while using existing static analysis tools to generate annotated datasets can accelerate the annotation process to a certain extent, the generated data has a high false positive rate, further affecting data quality and model training effectiveness.

[0005] Therefore, in the current deep learning methods, how to use unlabeled data for effective learning, overcome the bottleneck of insufficient labeled data, and improve the accuracy and robustness of classification is a key problem that needs to be solved urgently in current technology. Summary of the Invention

[0006] In response to the shortcomings of the existing technology, the purpose of this application is to provide a security patch classification method and system based on pseudo-label learning, aiming to solve the problem of low accuracy in the current classification of security patch vulnerability types.

[0007] To achieve the above objectives, in a first aspect, the present application provides a security patch classification method based on pseudo-label learning, comprising:

[0008] Get security patches to be classified;

[0009] Performing feature extraction on the security patch to obtain key semantic features;

[0010] Inputting the key semantic features into a trained security patch model to obtain a classification result of the security patch;

[0011] The security patch model is obtained by extracting key semantic information from a security-related patch dataset and an unlabeled patch dataset, and performing pseudo-label learning based on the key semantic information.

[0012] Optionally, the method for obtaining the security patch model includes:

[0013] Eliminate non-security-related repair content, extract key variables related to vulnerabilities, and use code slicing technology combined with data flow analysis to determine vulnerability trigger points. Key variables and vulnerability trigger points are then integrated into key semantic information.

[0014] An initial teacher model is trained using a training set of labeled security patches, and pseudo labels are generated for unlabeled security patches using the initial teacher model. High-quality pseudo-label samples are screened out through a consensus algorithm combined with the key semantic information and added to the training set of labeled security patches to iteratively train the initial teacher model until a trained security patch classification model is obtained.

[0015] Optionally, the process of extracting key semantic information specifically includes:

[0016] Analyzing code modifications of patches in the security-related patch dataset, marking whether code modification blocks are related to security fixes, and obtaining a candidate sample set;

[0017] Selecting similar samples of the input patch of the security-related patch dataset from the candidate sample set using a similar patch retrieval method, and constructing a few-sample prompt based on the similar samples;

[0018] Using a large language model to exclude code modification blocks in the security patch that are not related to the vulnerability based on the few sample prompts;

[0019] Analyze and summarize the patch features of the security patch code modification, design extraction rules based on the patch type and patch line type, and use the extraction rules to extract key variables in the code modification;

[0020] Formulate corresponding vulnerability trigger point rules according to different vulnerability types, perform data flow analysis based on the key variables and vulnerability trigger point rules, until the analysis reaches a preset depth, and obtain code data that meets the vulnerability trigger point rules;

[0021] According to the code data, key variables, and the data flow between the code data and the key variables, vulnerability-related code is determined as the key semantic information.

[0022] Optionally, the training process of the security patch classification model includes:

[0023] Determining that the initial teacher model includes a code modification classification model and a text description classification model;

[0024] The code modification classification model is trained using the security patch code modifications labeled with vulnerability type labels, and the text description classification model is trained using the security patch text descriptions labeled with vulnerability type labels;

[0025] The code modification classification model and text description classification model are used to predict code modification and text description of unlabeled security patches, respectively, to generate pseudo labels.

[0026] A consensus algorithm based on code modifications and text descriptions is used in combination with key semantic information to confirm the generated pseudo-labels, screen out high-quality pseudo-label samples, add them to the training set of labeled security patches, and iteratively train the initial teacher model until a trained security patch classification model is obtained.

[0027] Optionally, the data flow analysis process includes:

[0028] Build a data flow diagram of the code;

[0029] Locating a target node of the key variable in the data flow graph;

[0030] Traverse from the target node to match the vulnerability trigger point, and when a function call statement is encountered, adjust to the program dependency graph of the called function and continue traversing until a preset depth is reached to obtain code data that meets the vulnerability trigger point rules.

[0031] Optionally, the calculation method of the loss function of the initial teacher model training process includes:

[0032] Compute the first loss between the predicted value of the labeled security patch and the actual label;

[0033] Calculate the second loss between the predicted value of the pseudo-label sample and the pseudo-label;

[0034] The weighted sum of the first loss and the second loss is taken as the total loss of model training.

[0035] Optionally, the pseudo-label acquisition process includes:

[0036] Probabilistically rank the text descriptions of security patches and the predicted results of code modifications, and select the top k categories respectively;

[0037] If the same category exists in the first k categories, the category with the largest average probability is selected as the pseudo label; if the same category does not exist in the first k categories, the current sample is discarded.

[0038] In a second aspect, the present application further provides a security patch classification system based on pseudo-label learning, comprising:

[0039] The acquisition module is used to obtain security patches to be classified;

[0040] A feature extraction module, configured to extract features from the security patch to obtain key semantic features;

[0041] A classification module, configured to input the key semantic features into a trained security patch model to obtain a classification result of the security patch;

[0042] The security patch model is obtained by extracting key semantic information from a security-related patch dataset and an unlabeled patch dataset, and performing pseudo-label learning based on the key semantic information.

[0043] Optionally, the security patch model includes:

[0044] The key semantic information extraction module is used to exclude non-security-related repair content, extract key variables related to vulnerabilities, and use code slicing technology combined with data flow analysis to determine vulnerability trigger points. The key variables and vulnerability trigger points are then integrated into key semantic information.

[0045] The pseudo-label learning module is used to train an initial teacher model using a training set of labeled security patches, generate pseudo labels for unlabeled security patches using the initial teacher model, and screen out high-quality pseudo-label samples through a consensus algorithm combined with the key semantic information. The samples are added to the training set of labeled security patches to iteratively train the initial teacher model until a trained security patch classification model is obtained.

[0046] In a third aspect, the present application provides an electronic device comprising: at least one memory for storing programs; and at least one processor for executing the programs stored in the memory. When the program stored in the memory is executed, the processor is used to execute the method described in the first aspect or any possible implementation of the first aspect.

[0047] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the method described in the first aspect or any possible implementation of the first aspect.

[0048] In a fifth aspect, the present application provides a computer program product, which, when executed on a processor, enables the processor to execute the method described in the first aspect or any possible implementation of the first aspect.

[0049] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here.

[0050] In general, the above technical solutions conceived by this application have the following beneficial effects compared with the existing technologies:

[0051] (1) This application uses labeled security patch datasets and unlabeled patch datasets to generate pseudo labels, which can expand the training set under limited data conditions, thereby significantly improving the learning effect and accuracy of the classification model. Combined with the learning of key semantic information, the model can better understand and classify the characteristics of the patch, especially the variables that are highly correlated with vulnerability repair. This application improves the model's classification effectiveness of security patches in real scenarios through refined training methods, and improves the classification accuracy and robustness of security patches.

[0052] (2) This application uses a consensus algorithm to screen high-quality pseudo-label samples. By extracting key features from patches from different sources and combining similarity retrieval with few-sample prompts, the diversity of training data is increased, enabling the model to cope with more complex patch forms and repair types. This effectively enhances the model's generalization ability while reducing the risk of overfitting.

[0053] (3) This application automates the patch classification process by automatically extracting key semantic features and using code slicing technology and data flow analysis to identify vulnerability trigger points. The automated extraction and confirmation process not only reduces the need for manual intervention but also significantly improves processing speed and efficiency. Compared with the traditional manual annotation process, the rapid iteration of model training and pseudo-label generation makes the entire patch classification workflow more efficient, able to adapt to the rapidly changing security environment in a short period of time, and improves overall responsiveness.

[0054] (4) This application significantly improves the sample quality by extracting key semantic information that is highly relevant to the vulnerability type as model input samples, making it easier for the model to learn the characteristics of the vulnerability type. Compared with the traditional pseudo-label learning method, this application uses a consensus algorithm based on patch text and code modifications to screen pseudo-label samples, ensuring the accuracy of pseudo-labels while also ensuring a sufficient number of pseudo-label samples. The pseudo-label learning module of this application can be combined with the existing deep learning-based security patch classification method to further enhance its classification effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 This is one of the flow charts of the security patch classification method based on pseudo-label learning provided in an embodiment of the present application;

[0056] Figure 2 This is a schematic diagram of the key variable extraction of the embodiment of the present application;

[0057] Figure 3 This is the second flow chart of the security patch classification method based on pseudo-label learning provided in an embodiment of the present application;

[0058] Figure 4 This is one of the structural diagrams of the security patch classification device based on pseudo-label learning provided in an embodiment of the present application;

[0059] Figure 5 This is the second structural diagram of the security patch classification device based on pseudo-label learning provided in an embodiment of the present application;

[0060] Figure 6 It is a structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0062] The term "and / or" as used herein describes an association between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. The symbol " / " as used herein indicates that the related objects are in an "or" relationship, for example, A / B means either A or B.

[0063] The terms "first" and "second" in this specification and claims are used to distinguish different objects rather than to describe a specific order of objects. For example, "first response message" and "second response message" are used to distinguish different response messages rather than to describe a specific order of response messages.

[0064] In the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0065] In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more, for example, multiple processing units means two or more processing units, etc.; multiple elements means two or more elements, etc.

[0066] The embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application.

[0067] To achieve the above objectives, in a first aspect, the present application provides a security patch classification method based on pseudo-label learning, comprising:

[0068] S101. Obtain security patches to be classified;

[0069] S102. Extract features of the security patch to obtain key semantic features;

[0070] S103. Inputting the key semantic features into the trained security patch model to obtain the classification result of the security patch;

[0071] The security patch model is obtained by extracting key semantic information from a security-related patch dataset and an unlabeled patch dataset, and performing pseudo-label learning based on the key semantic information.

[0072] Optionally, the method for obtaining the security patch model includes:

[0073] Eliminate non-security-related repair content, extract key variables related to vulnerabilities, and use code slicing technology combined with data flow analysis to determine vulnerability trigger points. Key variables and vulnerability trigger points are then integrated into key semantic information.

[0074] An initial teacher model is trained using a training set of labeled security patches, and pseudo labels are generated for unlabeled security patches using the initial teacher model. High-quality pseudo-label samples are screened out through a consensus algorithm combined with the key semantic information and added to the training set of labeled security patches to iteratively train the initial teacher model until a trained security patch classification model is obtained.

[0075] Specifically, first, a security patch to be classified is obtained through S101 to ensure subsequent analysis and classification for a specific patch.

[0076] Next, in step S102, feature extraction is performed on these security patches to obtain key semantic features. In this step, the algorithm analyzes the patch's code modifications and text descriptions to extract important information related to the vulnerability for the next step of classification.

[0077] Finally, through S103, these extracted key semantic features are input into a trained security patch model, and the model can output the classification result of the security patch, thereby realizing an automated patch classification process.

[0078] It should be noted that the security patch model described above is derived by extracting key semantic information from both security-related and unlabeled patch datasets. During model construction, non-security-related fixes are initially excluded, focusing on extracting key variables relevant to the vulnerability. To this end, the model combines code slicing technology with data flow analysis to ensure accurate identification of vulnerability triggers. These key variables are then integrated with the identified vulnerability triggers to form complete key semantic information for subsequent training and classification.

[0079] In the process of obtaining the security patch model, an initial teacher model is trained using a training set of labeled security patches. This initial model is then used to generate pseudo-labels for unlabeled security patches. This process provides an effective label prediction mechanism for unlabeled data. Combining the extracted key semantic information, a consensus algorithm is used to select high-quality pseudo-labeled samples. By adding these high-quality pseudo-labeled samples to the training set of labeled security patches, the initial teacher model can be iteratively trained, gradually optimizing, ultimately yielding a well-trained security patch classification model with excellent performance.

[0080] This embodiment combines labeled and unlabeled data, optimizing the model training process through pseudo-label learning, and improving the accuracy and efficiency of patch classification. Through adaptive learning, the model can not only process labeled data but also effectively utilize large amounts of unlabeled data to more comprehensively identify and classify security patches.

[0081] Optionally, the process of extracting key semantic information specifically includes:

[0082] Analyzing code modifications of patches in the security-related patch dataset, marking whether code modification blocks are related to security fixes, and obtaining a candidate sample set;

[0083] Selecting similar samples of the input patch of the security-related patch dataset from the candidate sample set using a similar patch retrieval method, and constructing a few-sample prompt based on the similar samples;

[0084] Using a large language model to exclude code modification blocks in the security patch that are not related to the vulnerability based on the few sample prompts;

[0085] Analyze and summarize the patch features of the security patch code modification, design extraction rules based on the patch type and patch line type, and use the extraction rules to extract key variables in the code modification;

[0086] Formulate corresponding vulnerability trigger point rules according to different vulnerability types, perform data flow analysis based on the key variables and vulnerability trigger point rules, until the analysis reaches a preset depth, and obtain code data that meets the vulnerability trigger point rules;

[0087] According to the code data, key variables, and the data flow between the code data and the key variables, vulnerability-related code is determined as the key semantic information.

[0088] Specifically, key semantic information extraction includes the following steps:

[0089] (1.1) Eliminating security-irrelevant fixes: Manually analyze the code modifications in the patch and annotate the code modification blocks (git hunks) to see if they are related to the security fix, forming a candidate sample set. Using similar patch retrieval technology, select the few samples most similar to the input patch from the candidate sample set, construct a few-shot prompt, input the few-shot prompt into the large language model, and use the large language model (LLM) to eliminate code modification blocks in the security patch that are not related to the vulnerability.

[0090] The code for constructing the specific implementation of the prompt is:

[0091] System prompt:

[0092] Instruction: <instruction>

[0093] Examples:<retrieval system examples>

[0094] User prompt:

[0095] Commit message:<commit message>

[0096] Git-hunk: <git-hunk>.

[0097] The system prompt (i.e., system instructions) consists of two parts: Instruction and Examples. The Instruction part describes the task requirements, while the Examples part provides examples for model reference. The user prompt (i.e., user instructions) consists of Commit Message and Git Hunk. The Commit Message is a text description of the commit, while the Git Hunk is the code block to be modified.

[0098] (1.2) Key variable extraction: Manually analyze the code modifications of security patches to summarize patch characteristics. Based on different patch types (variable assignments, function calls, variable or function definitions, control statements, etc.) and patch line types (additions / deletions or modifications only), we design corresponding rules to extract variables involved in the code modifications that have a significant correlation with the vulnerability, i.e., key variables.

[0099] The specific rules for extracting key variables are as follows: Figure 2 The specific implementation method is to use Tree-sitter to parse the diff file. For each git-hunk, if there are only plus lines or only minus lines, it is an add / delete type, otherwise it is a modification type. Then extract the code before and after the modification, according to Figure 2 The rules extract key variables.

[0100] (1.3) Extraction of vulnerability-related code: Based on different vulnerability types, corresponding vulnerability trigger point rules are formulated. Then, data flow analysis is performed starting from key variables until the predetermined depth is reached. During the process, all code that meets the rules is recorded. Finally, these suspected vulnerability trigger point codes, key variables, and their data flows are regarded as vulnerability-related codes, i.e., key semantic information.

[0101] Optionally, the training process of the security patch classification model includes:

[0102] Determining that the initial teacher model includes a code modification classification model and a text description classification model;

[0103] The code modification classification model is trained using the security patch code modifications labeled with vulnerability type labels, and the text description classification model is trained using the security patch text descriptions labeled with vulnerability type labels;

[0104] The code modification classification model and text description classification model are used to predict code modification and text description of unlabeled security patches, respectively, to generate pseudo labels.

[0105] A consensus algorithm based on code modifications and text descriptions is used in combination with key semantic information to confirm the generated pseudo-labels, screen out high-quality pseudo-label samples, add them to the training set of labeled security patches, and iteratively train the initial teacher model until a trained security patch classification model is obtained.

[0106] The training steps for the security patch classification model are as follows:

[0107] (2.1) Model training: The initial teacher model includes a code modification classification model and a text description classification model;

[0108] In this embodiment, a code modification classification model is trained using security patch code modifications annotated with vulnerability type labels, and a text description classification model is trained using security patch text descriptions annotated with vulnerability type labels.

[0109] The specific implementation method of model training is to calculate the loss between the sample category label and the model prediction value for the labeled data. For unlabeled data, the pseudo label of the sample is used as the label, and the loss between the predicted category of the sample and the pseudo label is calculated The final loss function is:

[0110]

[0111] in, is a hyperparameter. During the training process, Perform reverse gradient propagation to complete the model update.

[0112] (2.2) Pseudo-label generation: Use the code modification classification model and text description classification model to predict the code modification and text description of the unlabeled security patch, and generate pseudo-labels. Specifically, two score lists will be obtained. Assuming that the final vulnerability type category has a total of Each score list contains Each value represents the confidence score that the sample belongs to the vulnerability type.

[0113] (2.3) Pseudo-label confirmation: A consensus algorithm based on code modification and text description is used to confirm the generated pseudo-labels, thereby screening out high-quality pseudo-label samples and adding them to the training set for the next round of training.

[0114] Optionally, the data flow analysis process includes:

[0115] Build a data flow diagram of the code;

[0116] Locating a target node of the key variable in the data flow graph;

[0117] Traverse from the target node to match the vulnerability trigger point, and when a function call statement is encountered, adjust to the program dependency graph of the called function and continue traversing until a preset depth is reached to obtain code data that meets the vulnerability trigger point rules.

[0118] Specifically, the vulnerability-related code extraction process in this embodiment involves first constructing a data flow graph for the code using Joern. The node containing the key variable is then located within the data flow graph. Traversing from this node to match the vulnerability trigger point, the system jumps to the program dependency graph of the called function upon encountering a function call and continues traversing until it reaches a set depth. The system then records all code involved in the traversal. For code that is only added or modified, the vulnerability-related code is extracted from the modified version; for code that is only deleted, the vulnerability-related code is extracted from the original version.

[0119] Optionally, the pseudo-label acquisition process includes:

[0120] Probabilistically rank the text descriptions of security patches and the predicted results of code modifications, and select the top k categories respectively;

[0121] If the same category exists in the first k categories, the category with the largest average probability is selected as the pseudo label; if the same category does not exist in the first k categories, the current sample is discarded.

[0122] Specifically, the consensus algorithm in this embodiment is implemented as follows: for each unlabeled sample Modify the classification model through code and text description classification models After the prediction, two score lists are obtained, which are sorted according to the score size and the top one is taken. The most likely category, assuming that The predicted category set is:

[0123]

[0124] go through The predicted category set is:

[0125]

[0126] if , then the current sample will not be added to the training set, otherwise, Calculate the average probability for each category in , take the category with the largest average probability as the pseudo label of the sample, and add the sample to the training set.

[0127] Repeat the above process until the model effect no longer improves, and select the model with the best final effect for output.

[0128] Reference Figure 3 , Figure 3 This is a complete flow chart of an embodiment of the present application, including:

[0129] Takes a security-related patch dataset and an unlabeled patch dataset as input;

[0130] Perform key semantic information extraction and pseudo-label learning to output key semantic information sets and security patch classification models respectively;

[0131] Key semantic information extraction includes security-irrelevant fix exclusion, key variable extraction, and vulnerability-related code extraction; pseudo-label learning includes: pseudo-label generation, pseudo-label confirmation, and model training.

[0132] Reference Figure 4 , this application also provides a security patch classification system based on pseudo-label learning, including:

[0133] An acquisition module 410 is used to acquire security patches to be classified;

[0134] A feature extraction module 420 is used to extract features from the security patch to obtain key semantic features;

[0135] A classification module 430 is configured to input the key semantic features into a trained security patch model to obtain a classification result of the security patch;

[0136] The security patch model is obtained by extracting key semantic information from a security-related patch dataset and an unlabeled patch dataset, and performing pseudo-label learning based on the key semantic information.

[0137] Reference Figure 5 , the security patch model includes:

[0138] The key semantic information extraction module is used to exclude non-security-related repair content, extract key variables related to vulnerabilities, and use code slicing technology combined with data flow analysis to determine vulnerability trigger points. The key variables and vulnerability trigger points are then integrated into key semantic information.

[0139] The pseudo-label learning module is used to train an initial teacher model using a training set of labeled security patches, generate pseudo labels for unlabeled security patches using the initial teacher model, and screen out high-quality pseudo-label samples through a consensus algorithm combined with the key semantic information. The samples are added to the training set of labeled security patches to iteratively train the initial teacher model until a trained security patch classification model is obtained.

[0140] Optionally, the key semantic information extraction module specifically includes:

[0141] A security-irrelevant fix exclusion submodule is used to analyze the code modifications of the patches in the security-relevant patch dataset, mark whether the code modification blocks are related to security fixes, and obtain a candidate sample set;

[0142] Selecting similar samples of the input patch of the security-related patch dataset from the candidate sample set using a similar patch retrieval method, and constructing a few-sample prompt based on the similar samples;

[0143] Using a large language model to exclude code modification blocks in the security patch that are not related to the vulnerability based on the few sample prompts;

[0144] A key variable extraction submodule is used to analyze and summarize the patch features of the security patch code modification, design extraction rules based on the patch type and patch line type, and use the extraction rules to extract key variables in the code modification;

[0145] The vulnerability-related code extraction submodule is used to formulate corresponding vulnerability trigger point rules according to different vulnerability types, perform data flow analysis based on the key variables and vulnerability trigger point rules, and obtain code data that meets the vulnerability trigger point rules until the analysis reaches a preset depth;

[0146] According to the code data, key variables, and the data flow between the code data and the key variables, vulnerability-related code is determined as the key semantic information.

[0147] Optionally, the pseudo-label learning module specifically includes:

[0148] A model training submodule, configured to determine that the initial teacher model includes a code modification classification model and a text description classification model;

[0149] The code modification classification model is trained using the security patch code modifications labeled with vulnerability type labels, and the text description classification model is trained using the security patch text descriptions labeled with vulnerability type labels;

[0150] A pseudo-label generation submodule is used to generate pseudo-labels for code modification prediction and text description prediction of unlabeled security patches using a code modification classification model and a text description classification model, respectively.

[0151] The pseudo-label confirmation submodule is used to confirm the generated pseudo-labels using a consensus algorithm based on code modifications and text descriptions combined with key semantic information. It then screens out high-quality pseudo-label samples, adds them to the training set of labeled security patches, and iteratively trains the initial teacher model until a trained security patch classification model is obtained.

[0152] Optionally, the data flow analysis process includes:

[0153] Build a data flow diagram of the code;

[0154] Locating a target node of the key variable in the data flow graph;

[0155] Traverse from the target node to match the vulnerability trigger point, and when a function call statement is encountered, adjust to the program dependency graph of the called function and continue traversing until a preset depth is reached to obtain code data that meets the vulnerability trigger point rules.

[0156] Optionally, the calculation method of the loss function of the initial teacher model training process includes:

[0157] Compute the first loss between the predicted value of the labeled security patch and the actual label;

[0158] Calculate the second loss between the predicted value of the pseudo-label sample and the pseudo-label;

[0159] The weighted sum of the first loss and the second loss is taken as the total loss of model training.

[0160] Optionally, the pseudo-label acquisition process includes:

[0161] Probabilistically rank the text descriptions of security patches and the predicted results of code modifications, and select the top k categories respectively;

[0162] If the same category exists in the first k categories, the category with the largest average probability is selected as the pseudo label; if the same category does not exist in the first k categories, the current sample is discarded.

[0163] It is understandable that the detailed functional implementation of each of the above units / modules can be found in the introduction of the aforementioned method embodiment, and will not be repeated here.

[0164] It should be understood that the above-mentioned device is used to execute the method in the above-mentioned embodiment. The implementation principle and technical effect of the corresponding program module in the device are similar to those described in the above-mentioned method. The working process of the device can refer to the corresponding process in the above-mentioned method and will not be repeated here.

[0165] Reference Figure 6 Based on the method in the above embodiment, an embodiment of the present application provides an electronic device, which may include: a processor (Processor) 610, a communication interface (Communications Interface) 620, a memory (Memory) 630 and a communication bus 640, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other via the communication bus 640. The processor 610 can call the logic instructions in the memory 630 to execute the method in the above embodiment.

[0166] In addition, the logic instructions in the aforementioned memory 630 can be implemented in the form of a software functional unit and, when sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the portion that contributes to the prior art, or the portion of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application.

[0167] Based on the method in the above embodiment, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the method in the above embodiment.

[0168] Based on the method in the above embodiment, an embodiment of the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the method in the above embodiment.

[0169] It is understood that the processor in the embodiments of the present application may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0170] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and storage medium can be located in an ASIC.

[0171] The above embodiments can be implemented in whole or in part using software, hardware, firmware, or any combination thereof. When implemented using software, they can be implemented in whole or in part in the form of a computer program product. The computer program product comprises one or more computer instructions. When loaded and executed on a computer, the computer program instructions fully or partially produce the processes or functions described in the embodiments of this application. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted via the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be magnetic media (e.g., floppy disk, hard disk, tape), optical media (e.g., DVD), or semiconductor media (e.g., solid-state drive (SSD)).

[0172] It will be understood that the various numerical numbers involved in the embodiments of the present application are merely distinctions for the convenience of description and are not intended to limit the scope of the embodiments of the present application.

[0173] It is easy for those skilled in the art to understand that the above is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the scope of protection of the present application. < / instruction>

Claims

1. A security patch classification method based on pseudo-label learning, characterized in that: include: Get security patches to be classified; Performing feature extraction on the security patch to obtain key semantic features; Inputting the key semantic features into a trained security patch model to obtain a classification result of the security patch; The security patch model is obtained by extracting key semantic information from a security-related patch dataset and an unlabeled patch dataset, and performing pseudo-label learning based on the key semantic information. The method for obtaining the security patch model includes: Eliminate non-security-related repair content, extract key variables related to vulnerabilities, and use code slicing technology combined with data flow analysis to determine vulnerability trigger points. Key variables and vulnerability trigger points are then integrated into key semantic information. An initial teacher model is trained using a training set of labeled security patches. Pseudo-labels are generated for unlabeled security patches using the initial teacher model. High-quality pseudo-label samples are screened using a consensus algorithm combined with the key semantic information and added to the training set of labeled security patches to iteratively train the initial teacher model until a trained security patch classification model is obtained. The process of extracting key semantic information specifically includes: Analyzing code modifications of patches in the security-related patch dataset, marking whether code modification blocks are related to security fixes, and obtaining a candidate sample set; Selecting similar samples of the input patch of the security-related patch dataset from the candidate sample set using a similar patch retrieval method, and constructing a few-sample prompt based on the similar samples; Using a large language model to exclude code modification blocks in the security patch that are not related to the vulnerability based on the few sample prompts; Analyze and summarize the patch features of the security patch code modification, design extraction rules based on the patch type and patch line type, and use the extraction rules to extract key variables in the code modification; Formulate corresponding vulnerability trigger point rules according to different vulnerability types, perform data flow analysis based on the key variables and vulnerability trigger point rules, until the analysis reaches a preset depth, and obtain code data that meets the vulnerability trigger point rules; According to the code data, key variables, and the data flow between the code data and the key variables, vulnerability-related code is determined as the key semantic information.

2. The security patch classification method based on pseudo-label learning according to claim 1, characterized in that: The training process of the security patch classification model includes: Determining that the initial teacher model includes a code modification classification model and a text description classification model; The code modification classification model is trained using the security patch code modifications labeled with vulnerability type labels, and the text description classification model is trained using the security patch text descriptions labeled with vulnerability type labels; The code modification classification model and text description classification model are used to predict code modification and text description of unlabeled security patches, respectively, to generate pseudo labels. A consensus algorithm based on code modifications and text descriptions is used in combination with key semantic information to confirm the generated pseudo-labels, screen out high-quality pseudo-label samples, add them to the training set of labeled security patches, and iteratively train the initial teacher model until a trained security patch classification model is obtained.

3. The security patch classification method based on pseudo-label learning according to claim 2, characterized in that: The data flow analysis process includes: Build a data flow diagram of the code; Locating a target node of the key variable in the data flow graph; Traverse from the target node to match the vulnerability trigger point, and when a function call statement is encountered, adjust to the program dependency graph of the called function and continue traversing until a preset depth is reached to obtain code data that meets the vulnerability trigger point rules.

4. The security patch classification method based on pseudo-label learning according to claim 1, characterized in that: The calculation method of the loss function of the initial teacher model training process includes: Compute the first loss between the predicted value of the labeled security patch and the actual label; Calculate the second loss between the predicted value of the pseudo-label sample and the pseudo-label; The weighted sum of the first loss and the second loss is taken as the total loss of model training.

5. The security patch classification method based on pseudo-label learning according to claim 1, characterized in that: The pseudo-label acquisition process includes: Probabilistically rank the text descriptions of security patches and the predicted results of code modifications, and select the top k categories respectively; If the same category exists in the first k categories, the category with the largest average probability is selected as the pseudo label; if the same category does not exist in the first k categories, the current sample is discarded.

6. A security patch classification system based on pseudo-label learning, characterized in that: include: The acquisition module is used to obtain security patches to be classified; A feature extraction module, configured to extract features from the security patch to obtain key semantic features; A classification module, configured to input the key semantic features into a trained security patch model to obtain a classification result of the security patch; The security patch model is obtained by extracting key semantic information from a security-related patch dataset and an unlabeled patch dataset, and performing pseudo-label learning based on the key semantic information. The security patch model includes: The key semantic information extraction module is used to exclude non-security-related repair content, extract key variables related to vulnerabilities, and use code slicing technology combined with data flow analysis to determine vulnerability trigger points. The key variables and vulnerability trigger points are then integrated into key semantic information. A pseudo-label learning module is used to train an initial teacher model using a training set of labeled security patches, generate pseudo labels for unlabeled security patches using the initial teacher model, and filter out high-quality pseudo-label samples using a consensus algorithm combined with the key semantic information. These samples are added to the training set of labeled security patches and iteratively trained on the initial teacher model until a trained security patch classification model is obtained. The process of extracting key semantic information specifically includes: Analyzing code modifications of patches in the security-related patch dataset, marking whether code modification blocks are related to security fixes, and obtaining a candidate sample set; Selecting similar samples of the input patch of the security-related patch dataset from the candidate sample set using a similar patch retrieval method, and constructing a few-sample prompt based on the similar samples; Using a large language model to exclude code modification blocks in the security patch that are not related to the vulnerability based on the few sample prompts; Analyze and summarize the patch features of the security patch code modification, design extraction rules based on the patch type and patch line type, and use the extraction rules to extract key variables in the code modification; Formulate corresponding vulnerability trigger point rules according to different vulnerability types, perform data flow analysis based on the key variables and vulnerability trigger point rules, until the analysis reaches a preset depth, and obtain code data that meets the vulnerability trigger point rules; According to the code data, key variables, and the data flow between the code data and the key variables, vulnerability-related code is determined as the key semantic information.

7. An electronic device, characterized in that: include: at least one memory for storing a computer program; At least one processor is used to execute the program stored in the memory. When the program stored in the memory is executed, the processor is used to execute the method according to any one of claims 1 to 5.

Images