Vulnerability positioning method and system based on cross-modal features

Abstract

The invention provides a vulnerability positioning method and system based on cross-modal features. The method comprises the following steps: firstly, obtaining cross-modal information of a vulnerability to be positioned; the cross-modal information comprises a vulnerability description text and candidate vulnerability function codes; inputting the cross-modal information into a pre-trained vulnerability positioning model, and obtaining a vulnerability positioning result output by the vulnerability positioning model; wherein the pre-trained vulnerability positioning model is used for determining cross-modal alignment features according to the vulnerability description text and the candidate vulnerability function codes, performing correlation calculation and sorting according to the cross-modal alignment features, and taking a correlation sorting result as a vulnerability positioning result; the cross-modal alignment feature is used for aligning the feature of the vulnerability description text and the feature of the candidate vulnerability function code; the pre-trained vulnerability positioning model is obtained by training based on a vulnerability positioning training set, and the vulnerability positioning training set comprises a vulnerability description text sample and a vulnerability function code sample. According to the invention, automatic vulnerability positioning can be realized, and the accuracy and efficiency of vulnerability positioning are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability location, and in particular, to a vulnerability location method and system based on cross-modal features. Background Art

[0002] In recent years, with the wide application of open-source software and the explosive growth of Internet of Things devices, the potential vulnerability risks in software systems have shown a trend of scale and complexity. Due to the chain reuse characteristics of open-source components, the impact scope of a single vulnerability can be exponentially amplified through the supply chain, resulting in large-scale leakage of sensitive data. In the field of software security, vulnerability location usually relies on expert experience and static analysis tools. Traditional vulnerability detection and location work mainly relies on security technicians to manually locate and repair. However, with the explosive growth of the number of vulnerabilities, the traditional manual-dominated mode can no longer meet the requirements of repair timeliness. There is an urgent need for efficient and accurate large-scale automated vulnerability location technology to shorten the vulnerability response time. Summary of the Invention

[0003] The present invention provides a vulnerability location method and system based on cross-modal features to solve the defect that the traditional manual-dominated mode in the prior art can no longer meet the requirements of repair timeliness. The present invention can achieve automated vulnerability location and improve the accuracy and efficiency of vulnerability location.

[0004] The present invention provides a vulnerability location method based on cross-modal features, including: obtaining cross-modal information of the vulnerability to be located; the cross-modal information includes vulnerability description text and candidate vulnerability function code; inputting the cross-modal information into a pre-trained vulnerability location model to obtain a vulnerability location result output by the vulnerability location model; wherein, the pre-trained vulnerability location model is used to determine cross-modal alignment features according to the vulnerability description text and the candidate vulnerability function code, perform correlation calculation and sorting according to the cross-modal alignment features, and use the correlation sorting result as the vulnerability location result; the cross-modal alignment features are used to align the features of the vulnerability description text and the features of the candidate vulnerability function code; the pre-trained vulnerability location model is trained based on a vulnerability location training set, and the vulnerability location training set includes vulnerability description text samples and vulnerability function code samples.

[0005] A vulnerability location method based on cross-modal features provided by the present invention, the vulnerability location model includes a cross-modal feature extraction module, a cross-modal feature alignment module, and a correlation calculation and sorting module; the cross-modal feature extraction module is used to extract features from the vulnerability description text and the candidate vulnerability function code respectively to obtain vulnerability description text features and vulnerability function code features; the cross-modal feature alignment module is used to align the vulnerability description text features and the vulnerability function code features based on a dual-tower model to obtain the cross-modal alignment features; the cross-modal alignment features include a plurality of text-code pair features; the correlation calculation and sorting module is used to calculate the similarity of the cross-modal alignment features according to a preset similarity algorithm and sort the similarity calculation results to obtain the correlation sorting results.

[0006] A vulnerability location method based on cross-modal features provided by the present invention, the cross-modal feature extraction module includes a text feature extraction module and a code feature extraction module; the text feature extraction module is used to encode the vulnerability description text using a pre-trained language model to extract the vulnerability description text features; the code feature extraction module is used to parse the candidate vulnerability function code into a code attribute graph using a code parsing tool, encode the candidate vulnerability function code into a code embedding vector using a code embedding model, and process the code attribute graph and the code embedding vector using a graph neural network, and use the extracted global graph features as the vulnerability function code features.

[0007] A vulnerability location method based on cross-modal features provided by the present invention, inputting the cross-modal information into a pre-trained vulnerability location model to obtain a vulnerability location result output by the vulnerability location model, including: inputting the cross-modal information into the cross-modal feature extraction module for feature extraction to obtain the vulnerability description text features and the vulnerability function code features output by the cross-modal feature extraction module; inputting the vulnerability description text features and the vulnerability function code features into the cross-modal feature alignment module for feature alignment to obtain the cross-modal alignment features output by the cross-modal feature alignment module; inputting the cross-modal alignment features into the correlation calculation and sorting module to obtain the vulnerability location result output by the correlation calculation and sorting module.

[0008] A vulnerability location method based on cross-modal features provided by the present invention, the preset similarity algorithm is a cosine similarity algorithm, and the calculation formula of the cosine similarity algorithm is: , where, sim is the cosine similarity, is the vulnerability description text feature after mapping alignment, It is the code feature of the vulnerability function after mapping alignment.

[0009] According to a vulnerability location method based on cross-modal features provided by the present invention, the loss function of the pre-trained vulnerability location model is: , where L is the loss function of the pre-trained vulnerability location model, sim is the cosine similarity, is the feature vector of the vulnerability description text sample node, is the feature vector of the positive sample node of the vulnerability function code, is the feature vector of the negative sample node of the vulnerability function code, is the negative sample node of the vulnerability function code, is the negative sample set of the vulnerability function code, T is the temperature control coefficient of temperature scaling.

[0010] The present invention also provides a vulnerability location system based on cross-modal features, including: a cross-modal information acquisition module for acquiring cross-modal information of the vulnerability to be located; the cross-modal information includes a vulnerability description text and candidate vulnerability function codes; a vulnerability location result acquisition module for inputting the cross-modal information into a pre-trained vulnerability location model to obtain a vulnerability location result output by the vulnerability location model; wherein, the pre-trained vulnerability location model is used to determine cross-modal alignment features according to the vulnerability description text and the candidate vulnerability function codes, perform correlation calculation and sorting according to the cross-modal alignment features, and use the correlation sorting result as the vulnerability location result; the cross-modal alignment features are used to align the features of the vulnerability description text and the features of the candidate vulnerability function codes; the pre-trained vulnerability location model is trained based on a vulnerability location training set, and the vulnerability location training set includes vulnerability description text samples and vulnerability function code samples.

[0011] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored on the memory and running on the processor, and when the processor executes the computer program, it implements the vulnerability location method based on cross-modal features as described in any one of the above.

[0012] The present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the vulnerability location method based on cross-modal features as described in any one of the above.

[0013] The present invention also provides a computer program product, including a computer program, and when the computer program is executed by a processor, it implements the vulnerability location method based on cross-modal features as described in any one of the above.

[0014] A vulnerability location method and system based on cross-modal features provided by the present invention first obtains cross-modal information of the vulnerability to be located; the cross-modal information includes vulnerability description text and candidate vulnerability function code; then the cross-modal information is input into a pre-trained vulnerability location model to obtain a vulnerability location result output by the vulnerability location model; wherein, the pre-trained vulnerability location model is used to determine cross-modal alignment features according to the vulnerability description text and the candidate vulnerability function code, perform correlation calculation and sorting based on the cross-modal alignment features, and use the correlation sorting result as the vulnerability location result; the cross-modal alignment features are used to align the features of the vulnerability description text and the features of the candidate vulnerability function code; the pre-trained vulnerability location model is trained based on a vulnerability location training set, and the vulnerability location training set includes vulnerability description text samples and vulnerability function code samples. The present invention can achieve automated vulnerability location and improve the accuracy and efficiency of vulnerability location. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0016] Figure 1 It is a schematic flow chart of a vulnerability location method based on cross-modal features provided by the present invention.

[0017] Figure 2 It is a schematic flow chart of data set acquisition provided by the present invention.

[0018] Figure 3 It is a schematic flow chart of feature extraction provided by the present invention.

[0019] Figure 4 It is a specific schematic flow chart of a vulnerability location method based on cross-modal features provided by the present invention.

[0020] Figure 5 It is a schematic structural diagram of a vulnerability location system based on cross-modal features provided by the present invention.

[0021] Figure 6 It is a schematic structural diagram of an electronic device provided by the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0022] To make the objectives, technical solutions and advantages of the present invention more clear, the following will, in conjunction with the accompanying drawings in the present invention, clearly and completely describe the technical solutions in the present invention. Obviously, the described embodiments are some but not all of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present invention without creative efforts shall fall within the scope of protection of the present invention.

[0023] Please refer to Figure 1 , Figure 1 , which is a schematic flowchart of a vulnerability location method based on cross-modal features provided by the present invention.

[0024] The present invention provides a vulnerability location method based on cross-modal features, including: 101: Obtain the cross-modal information of the vulnerability to be located; the cross-modal information includes the vulnerability description text and the candidate vulnerability function code; 102: Input the cross-modal information into the pre-trained vulnerability location model to obtain the vulnerability location result output by the vulnerability location model; wherein, the pre-trained vulnerability location model is used to determine the cross-modal alignment features according to the vulnerability description text and the candidate vulnerability function code, and perform correlation calculation and sorting according to the cross-modal alignment features, and use the correlation sorting result as the vulnerability location result; the cross-modal alignment features are used to align the features of the vulnerability description text and the features of the candidate vulnerability function code; the pre-trained vulnerability location model is trained based on the vulnerability location training set, and the vulnerability location training set includes vulnerability description text samples and vulnerability function code samples.

[0025] This embodiment provides a vulnerability location method based on cross-modal features, the core of which is to align the features of the vulnerability description text and the candidate vulnerability function code through a pre-trained vulnerability location model, and determine the vulnerability location through correlation calculation and sorting.

[0026] First, obtain the cross-modal information of the vulnerability to be located from a vulnerability database (such as CVE / NVD) or a code repository (such as GitHub). This information includes the vulnerability description text and the candidate vulnerability function code. The vulnerability description text usually contains the natural language description of the vulnerability, such as the vulnerability type, trigger conditions and impact scope, etc.; the candidate vulnerability function code is the code snippet that may contain the vulnerability extracted from the relevant project.

[0027] Then input the cross-modal information into the pre-trained vulnerability location model, and the vulnerability location model will respectively extract the features of the vulnerability description text and the candidate vulnerability function code to obtain the vulnerability description text features h t and the vulnerability function code features h g. To enable the comparison of vulnerability description text features and vulnerability function code features in the same space, both can be mapped to a shared feature space through a linear projection layer. Then, cosine similarity can be used as a similarity measurement method to calculate the correlation between the aligned feature vulnerability description text features and vulnerability function code features , and sort all candidate vulnerability function codes according to the similarity score, and output the Top-K candidate vulnerability function codes as the vulnerability location result.

[0028] The pre-trained vulnerability location model is trained based on the vulnerability location training set, which includes vulnerability description text samples and vulnerability function code samples. During the training process, a contrastive learning loss function (such as the InfoNCE loss function) is used to optimize the model, making the features of the matching text-code pairs closer and the features of the non-matching pairs farther away.

[0029] Please refer to Figure 2 , Figure 2 for the process schematic diagram of the dataset acquisition provided by the present invention.

[0030] The vulnerability location training set is constructed by collecting relevant information such as vulnerability description texts of publicly disclosed vulnerabilities and project source codes of corresponding versions from platforms such as Github, CVE / NVD, etc., through data filtering and screening, source code function partitioning, etc., or directly using publicly available datasets containing information such as vulnerability descriptions and vulnerability functions. Specifically, from public platforms such as Github, CVE / NVD, obtain vulnerability-related information such as CVE numbers, CVE reports, software names and versions, vulnerability descriptions, vulnerability classifications, vulnerability root causes, vulnerability impacts, attack vectors, vulnerability function names, vulnerability file paths, project source codes, and commit records. Combine information such as CVE numbers, CVE reports, vulnerability descriptions, vulnerability classifications, vulnerability root causes, vulnerability impacts, and attack vectors to form a complete and detailed vulnerability description text, containing as much natural language description information of the vulnerability as possible. Combine information such as CVE numbers, CVE reports, vulnerability function names, vulnerability file paths, project source codes, and commit records to preprocess the source code, including function partitioning, removing comments, empty lines, standardizing function signatures using regular expressions, etc., to obtain the vulnerability function source code and all functions of the same project version as the vulnerability. Corresponding the above information according to the CVE number to form the final vulnerability location dataset. If an open-source dataset containing the corresponding information is used, the processing method is the same as the above steps. Finally, divide the training set, validation set, and test set according to 8:1:1, and construct positive and negative samples. The positive samples are the matching vulnerability description text and vulnerability function code pairs, and the negative samples are randomly matched non-related pairs.

[0031] Through the above steps, the present invention can efficiently locate vulnerable functions, significantly improving the accuracy and efficiency of vulnerability detection.

[0032] As a preferred embodiment, the vulnerability location model includes a cross-modal feature extraction module, a cross-modal feature alignment module, and a correlation calculation and sorting module; the cross-modal feature extraction module is used to extract features from the vulnerability description text and the candidate vulnerable function code respectively, obtaining the vulnerability description text features and the vulnerable function code features; the cross-modal feature alignment module is used to align the vulnerability description text features and the vulnerable function code features based on a two-tower model, obtaining cross-modal aligned features; the cross-modal aligned features include a number of text-code pair features; the correlation calculation and sorting module is used to calculate the similarity of the cross-modal aligned features according to a preset similarity algorithm, and sort the similarity calculation results to obtain a correlation sorting result.

[0033] Please refer to Figure 3 , Figure 3 which is a schematic flow diagram of the feature extraction provided by the present invention.

[0034] As a preferred embodiment, the cross-modal feature extraction module includes a text feature extraction module and a code feature extraction module; the text feature extraction module is used to encode the vulnerability description text using a pre-trained language model to extract the vulnerability description text features; the code feature extraction module is used to parse the candidate vulnerable function code into a code property graph using a code parsing tool, encode the candidate vulnerable function code into a code embedding vector using a code embedding model, and process the code property graph and the code embedding vector using a graph neural network, taking the extracted global graph features as the vulnerable function code features.

[0035] In this embodiment, the cross-modal feature extraction module is responsible for extracting the vulnerability description text features and the vulnerable function code features from the vulnerability description text and the candidate vulnerable function code respectively.

[0036] Specifically, the text feature extraction module first preprocesses the vulnerability description text using the stop word list defined by NLTK (Natural Language Toolkit), including removing special symbols, stop word processing, etc., such as removing meaningless words like a, an, the, is, etc., but retaining security domain terms (such as buffer, overflow, SQLi, etc.). Then, using the tokenizer of BERT, as well as operations such as normalization (e.g., lowercasing), it is converted into tokens. Limit the maximum length to 512 tokens, truncate the excess, and pad the shortage. Use a pre-trained language model (such as the SecBERT model, a variant of BERT (Bidirectional Encoder Representations from Transformers) pre-trained for cybersecurity texts) to process the description text Encode it into a sequence of hidden layer vectors , extract the CLS vector of the last hidden layer to obtain the text feature vector h t , carrying the semantics and key attributes of the vulnerability (such as vulnerability type, trigger conditions, etc.) The code feature extraction module first parses the candidate vulnerability function code into a code property graph (CPG, Code Property Graph) through a code parsing tool (such as Joern), , which includes AST (Abstract Syntax Tree), CFG (Control Flow Graph), and DFG (Data Flow Graph). The node types include variables, function calls, etc., and the edge types are divided into AST parent-child relationships, CFG control flows, and DFG data dependencies. Then decompose the candidate vulnerability function code into a series of statements , each c i is directly mapped to the nodes within the CPG . Each statement processes the code sequence using CodeBERT to obtain token-level code embedding vectors . Finally, use a graph attention network (GAT, Graph Attention Network) to hierarchically aggregate neighbor information and capture the structural characteristics of the CPG. GAT uses an attention mechanism in each layer to calculate the influence weights of neighbor nodes on the target node, thereby achieving information aggregation. In GAT, the feature vector l of the node at the +1 layer is obtained by weighted aggregation of its neighbor node information, and its calculation formula is: , where is a non-linear activation function, is the set of neighbor nodes of node , is the feature vector of the node at the l layer , is the weight matrix of the l layer. The attention weights used to weight the influence of neighbor nodes can effectively measure the importance of node to node , and its calculation formula is: , where is the normalization function, is the activation function, is the transpose of the weight vector used in the attention mechanism, is the learnable weight matrix, is the node 's feature vector, is the node 's feature vector.

[0037] In the last layer of GAT, the global graph features are calculated by combining all node features through graph attention pooling to obtain the graph structure features, encoding program semantic information such as control flow and data dependence.

[0038] Please refer to Figure 4 , Figure 4 which is the schematic flow diagram of a vulnerability location method based on cross-modal features provided by the present invention.

[0039] As a preferred embodiment, the cross-modal information is input into a pre-trained vulnerability location model to obtain the vulnerability location result output by the vulnerability location model, including: inputting the cross-modal information into a cross-modal feature extraction module for feature extraction to obtain the vulnerability description text features and vulnerability function code features output by the cross-modal feature extraction module; inputting the vulnerability description text features and vulnerability function code features into a cross-modal feature alignment module for feature alignment to obtain the cross-modal alignment features output by the cross-modal feature alignment module; and inputting the cross-modal alignment features into a correlation calculation and sorting module to obtain the vulnerability location result output by the correlation calculation and sorting module.

[0040] In this embodiment, a two-tower model framework is adopted in the cross-modal feature alignment module to process and align features by combining the text tower and the code tower.

[0041] The text tower is used to process the vulnerability description text features. The input is the feature vector generated by SecBERT h t . The code tower is used to process the CPG graph features with CodeBERT embeddings. The input is the feature obtained by embedding the graph features generated by GAT through CodeBERT h g . The text tower and the code tower extract features from their respective modalities and process them independently to avoid over-fusing features of different modalities.

[0042] To enable the vulnerability description text features and the vulnerability function code features to be mapped to the same space for comparison, the vulnerability description text features are projected through a linear projection layer h t and the vulnerability function code features h g are respectively mapped into the shared feature space, and its calculation formula is: , where is the projection matrix of the vulnerability description text features, is the projection matrix of the vulnerability function code features, is the vulnerability description text features after mapping and alignment, is the vulnerability function code features after mapping and alignment.

[0043] As a preferred embodiment, the preset similarity algorithm is the cosine similarity algorithm, and the calculation formula of the cosine similarity algorithm is: , where sim is the cosine similarity, is the vulnerability description text features after mapping and alignment, is the vulnerability function code features after mapping and alignment.

[0044] In this embodiment, the correlation calculation and sorting module calculates the correlation between the vulnerability description text and the candidate vulnerability function code according to the cross-modal alignment features learned by the model, sorts the candidate vulnerability functions according to the scores, and outputs the ranking, and finally selects the most relevant vulnerability function.

[0045] In the two-tower model, to measure the similarity between the vulnerability description text features and the vulnerability function code features, the cosine similarity is used as the similarity measurement method.

[0046] As a preferred embodiment, the loss function of the pre-trained vulnerability localization model is: , where L is the loss function of the pre-trained vulnerability localization model, sim is the cosine similarity, is the feature vector of the vulnerability description text sample node, is the feature vector of the positive sample node of the vulnerability function code, is the feature vector of the negative sample node of the vulnerability function code, is the negative sample node of the vulnerability function code, is the negative sample set of the vulnerability function code, TThe temperature scaling control coefficient for temperature scaling.

[0047] In this embodiment, the contrastive learning InfoNCE cross-entropy loss function is used to train the vulnerability location model, encouraging the features of matching text-code pairs to be close and non-matching pairs to be far away, so that the correlation score between the correctly matched function code and the text description is significantly higher than that of other candidate functions. For the temperature scaling control coefficient in the loss function of each text-code pair, it is used to control the smoothness of the similarity score. After the vulnerability location model is trained, when a new vulnerability description text is input, the model can sort all candidate codes according to the correlation score. The sorting result returns the Top-K candidate vulnerability functions.

[0048] The present invention significantly improves the location efficiency of vulnerability functions by integrating the multi-modal information of vulnerability description texts and vulnerability function codes and combining deep learning techniques, and has important innovation and practical application value.

[0049] The following describes the vulnerability location system based on cross-modal features provided by the present invention. The vulnerability location system based on cross-modal features described below can be correspondingly referred to the vulnerability location method based on cross-modal features described above.

[0050] Please refer to Figure 5 , Figure 5 which is a schematic structural diagram of a vulnerability location system based on cross-modal features provided by the present invention.

[0051] The present invention also provides a vulnerability location system based on cross-modal features, including: a cross-modal information acquisition module 501 for acquiring cross-modal information of the vulnerability to be located; the cross-modal information includes a vulnerability description text and candidate vulnerability function codes; a vulnerability location result acquisition module 502 for inputting the cross-modal information into a pre-trained vulnerability location model to obtain the vulnerability location result output by the vulnerability location model; wherein, the pre-trained vulnerability location model is used to determine cross-modal alignment features according to the vulnerability description text and candidate vulnerability function codes, perform correlation calculation and sorting according to the cross-modal alignment features, and use the correlation sorting result as the vulnerability location result; the cross-modal alignment features are used to align the features of the vulnerability description text and the features of the candidate vulnerability function codes; the pre-trained vulnerability location model is trained based on a vulnerability location training set, and the vulnerability location training set includes vulnerability description text samples and vulnerability function code samples.

[0052] Figure 6 Illustrates a schematic structural diagram of an electronic device, such as Figure 6As shown in the figure, the electronic device may include: a processor 601, a communications interface 602, a memory 603, and a communication bus 604. Among them, the processor 601, the communications interface 602, and the memory 603 complete communication with each other through the communication bus 604. The processor 601 may call the logical instructions in the memory 603 to execute a vulnerability location method based on cross-modal features. The method includes: obtaining cross-modal information of the vulnerability to be located; the cross-modal information includes a vulnerability description text and candidate vulnerability function codes; inputting the cross-modal information into a pre-trained vulnerability location model to obtain a vulnerability location result output by the vulnerability location model; wherein, the pre-trained vulnerability location model is used to determine cross-modal alignment features according to the vulnerability description text and the candidate vulnerability function codes, and perform correlation calculation and sorting based on the cross-modal alignment features, and use the correlation sorting result as the vulnerability location result; the cross-modal alignment features are used to align the features of the vulnerability description text and the features of the candidate vulnerability function codes; the pre-trained vulnerability location model is trained based on a vulnerability location training set, and the vulnerability location training set includes vulnerability description text samples and vulnerability function code samples.

[0053] In addition, when the logical instructions in the above-mentioned memory 603 can be implemented in the form of software functional units and sold or used as an independent product, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0054] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the vulnerability location method based on cross-modal features provided by the above-mentioned various methods. The method includes: obtaining cross-modal information of the vulnerability to be located; the cross-modal information includes a vulnerability description text and candidate vulnerability function codes; inputting the cross-modal information into a pre-trained vulnerability location model to obtain a vulnerability location result output by the vulnerability location model; wherein, the pre-trained vulnerability location model is used to determine cross-modal alignment features according to the vulnerability description text and the candidate vulnerability function codes, perform correlation calculation and sorting based on the cross-modal alignment features, and use the correlation sorting result as the vulnerability location result; the cross-modal alignment features are used to align the features of the vulnerability description text and the features of the candidate vulnerability function codes; the pre-trained vulnerability location model is trained based on a vulnerability location training set, and the vulnerability location training set includes vulnerability description text samples and vulnerability function code samples.

[0055] In yet another aspect, the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it realizes the vulnerability location method based on cross-modal features provided by the above-mentioned various methods. The method includes: obtaining cross-modal information of the vulnerability to be located; the cross-modal information includes a vulnerability description text and candidate vulnerability function codes; inputting the cross-modal information into a pre-trained vulnerability location model to obtain a vulnerability location result output by the vulnerability location model; wherein, the pre-trained vulnerability location model is used to determine cross-modal alignment features according to the vulnerability description text and the candidate vulnerability function codes, perform correlation calculation and sorting based on the cross-modal alignment features, and use the correlation sorting result as the vulnerability location result; the cross-modal alignment features are used to align the features of the vulnerability description text and the features of the candidate vulnerability function codes; the pre-trained vulnerability location model is trained based on a vulnerability location training set, and the vulnerability location training set includes vulnerability description text samples and vulnerability function code samples.

[0056] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art can understand and implement it without creative efforts.

[0057] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the essence of the above technical solution, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0058] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features. And these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A vulnerability location method based on cross-modal features, characterized in that Including: Obtain cross-modal information of the vulnerability to be located; The cross-modal information includes vulnerability description text and candidate vulnerability function code; Input the cross-modal information into a pre-trained vulnerability location model to obtain the vulnerability location result output by the vulnerability location model; Among them, the pre-trained vulnerability location model is used to determine cross-modal alignment features according to the vulnerability description text and the candidate vulnerability function code, perform correlation calculation and sorting according to the cross-modal alignment features, and use the correlation sorting result as the vulnerability location result; the cross-modal alignment features are used to align the features of the vulnerability description text and the features of the candidate vulnerability function code; the pre-trained vulnerability location model is trained based on a vulnerability location training set, and the vulnerability location training set includes vulnerability description text samples and vulnerability function code samples.

2. The vulnerability location method based on cross-modal features according to claim 1, wherein The vulnerability location model includes a cross-modal feature extraction module, a cross-modal feature alignment module, and a correlation calculation and sorting module; The cross-modal feature extraction module is used to extract features from the vulnerability description text and the candidate vulnerability function code respectively to obtain vulnerability description text features and vulnerability function code features; The cross-modal feature alignment module is used to align the vulnerability description text features and the vulnerability function code features based on a dual-tower model to obtain the cross-modal alignment features; The cross-modal alignment features include a number of text-code pair features; The correlation calculation and sorting module is used to calculate the similarity of the cross-modal alignment features according to a preset similarity algorithm and sort the similarity calculation results to obtain the correlation sorting result.

3. The vulnerability location method based on cross-modal features according to claim 2, wherein The cross-modal feature extraction module includes a text feature extraction module and a code feature extraction module; The text feature extraction module is used to encode the vulnerability description text using a pre-trained language model to extract the vulnerability description text features; The code feature extraction module is used to parse the candidate vulnerability function code into a code attribute graph using a code parsing tool, encode the candidate vulnerability function code into a code embedding vector using a code embedding model, and process the code attribute graph and the code embedding vector using a graph neural network, and use the extracted global graph features as the vulnerability function code features.

4. The vulnerability location method based on cross-modal features according to claim 2, characterized in that The step of inputting the cross-modal information into a pre-trained vulnerability location model to obtain the vulnerability location result output by the vulnerability location model includes: Input the cross-modal information into the cross-modal feature extraction module for feature extraction to obtain the vulnerability description text features and the vulnerability function code features output by the cross-modal feature extraction module; Input the vulnerability description text features and the vulnerability function code features into the cross-modal feature alignment module for feature alignment to obtain the cross-modal alignment features output by the cross-modal feature alignment module; Input the cross-modal alignment features into the correlation calculation and sorting module to obtain the vulnerability location result output by the correlation calculation and sorting module.

5. The vulnerability location method based on cross-modal features according to claim 2, wherein The preset similarity algorithm is the cosine similarity algorithm, and the calculation formula of the cosine similarity algorithm is: ， Among them, sim is the cosine similarity, is the vulnerability description text feature after mapping alignment, is the vulnerability function code feature after mapping alignment.

6. The vulnerability location method based on cross-modal features according to any one of claims 1 to 5, characterized in that The loss function of the pre-trained vulnerability location model is as follows: ， Where L is the loss function of the pre-trained vulnerability location model, sim is the cosine similarity, is the feature vector of the vulnerability description text sample node, is the feature vector of the positive sample node of the vulnerability function code, is the feature vector of the negative sample node of the vulnerability function code, is the negative sample node of the vulnerability function code, is the negative sample set of the vulnerability function code, T is the temperature control coefficient of temperature scaling.

7. A vulnerability location system based on cross-modal features, characterized in that, including: A cross-modal information acquisition module for acquiring cross-modal information of the vulnerability to be located; The cross-modal information includes vulnerability description text and candidate vulnerability function code; A vulnerability location result acquisition module for inputting the cross-modal information into the pre-trained vulnerability location model to obtain the vulnerability location result output by the vulnerability location model; Among them, the pre-trained vulnerability location model is used to determine cross-modal alignment features according to the vulnerability description text and the candidate vulnerability function code, perform correlation calculation and sorting according to the cross-modal alignment features, and use the correlation sorting result as the vulnerability location result; the cross-modal alignment features are used to align the features of the vulnerability description text and the features of the candidate vulnerability function code; the pre-trained vulnerability location model is trained based on a vulnerability location training set, and the vulnerability location training set includes vulnerability description text samples and vulnerability function code samples.

8. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the cross-modal feature-based vulnerability location method according to any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the cross-modal feature-based vulnerability location method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the cross-modal feature-based vulnerability location method according to any one of claims 1 to 6.

Images