A code-level security vulnerability intelligent verification method, an electronic device and a storage medium

Abstract

The application provides a code-level security vulnerability intelligent verification method, an electronic device and a storage medium, and relates to the technical field of artificial intelligence. The method comprises the following steps: analyzing application source code, obtaining a feature vector of the code, obtaining a test parameter list for security vulnerability detection of the application source code, and obtaining a plurality of initial test parameter value lists based on a database; based on attribute information of the application source code and attribute information of the initial test parameter values, obtaining a running environment of the application source code; inputting the plurality of target test parameter value lists, the feature vector of the application source code and the running environment of the application source code into a target AI model; using the target AI model to simulate execution of the application source code for vulnerability identification; obtaining a prediction score of each preset vulnerability; if the prediction score of a preset vulnerability is greater than a preset vulnerability threshold, outputting a first verification result; and accurately identifying a security vulnerability.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, in particular to a code-level security vulnerability intelligent verification method, an electronic device and a storage medium. BACKGROUND

[0002] In the software development process, the identification of code security vulnerabilities is a core link to ensure application security. The current vulnerability verification method usually needs to write and deploy a running system, mainly relying on dynamic testing or manual analysis. Dynamic testing triggers program exceptions by injecting randomized test parameters, which can discover some running vulnerabilities. However, dynamic testing is mainly executed in a blind test form, and the coverage is not enough. Moreover, it cannot effectively associate vulnerabilities with code context, resulting in low vulnerability positioning efficiency. The manual analysis method is very low in efficiency, and requires a large amount of manpower and time cost. Therefore, there is an urgent need for a method for verifying security vulnerabilities without compiling and deploying the running application program. SUMMARY

[0003] To solve the above technical problems, the technical solution adopted by the present application is as follows:

[0004] According to the first aspect of the present application, a code-level security vulnerability intelligent verification method is provided, which comprises the following steps:

[0005] S100, the application source code is parsed to obtain the feature vector of the application source code, and the features corresponding to the feature vector at least include: function name;

[0006] S200, obtaining a plurality of initial test parameter value lists for security vulnerability detection of the application source code based on the database, the initial test parameter value list including initial test parameter values corresponding to a plurality of test parameters;

[0007] S300, based on the attribute information of the application source code and the attribute information of the initial test parameter value, obtaining the running environment of the application source code, the attribute information of the application source code at least including: code programming language; the attribute information of the initial test parameter value at least including: data type, and preset running environment of the initial test parameter value;

[0008] S400, inputting a plurality of target test parameter value lists, the feature vector of the application source code and the running environment of the application source code into a target AI model, and using the target AI model to simulate the execution of the application source code to identify vulnerabilities, and obtaining the prediction score of each preset vulnerability, wherein the target test parameter value list including a plurality of target test parameter values is one of the plurality of initial test parameter value lists;

[0009] S500, if a prediction score of a preset vulnerability is greater than a preset vulnerability threshold, outputting a first verification result; otherwise, outputting a second verification result, wherein the first verification result is different from the second verification result.

[0010] According to a second aspect of the present application, a non-transitory computer readable storage medium is provided, the storage medium storing a computer program, the computer program being loaded and executed by a processor to implement the method described above.

[0011] According to a third aspect of the present application, an electronic device is provided, comprising a processor, a memory, and a computer program stored on the memory and executable on the processor, the processor implementing the method described above when executing the computer program.

[0012] The present application has at least the following beneficial effects: the application source code is parsed to obtain a feature vector of the code, a test parameter list for security vulnerability detection of the application source code is obtained, and a plurality of initial test parameter value lists are obtained based on a database, based on attribute information of the application source code and attribute information of the initial test parameter values, a running environment of the application source code is obtained, a plurality of target test parameter value lists, the feature vector of the application source code, and the running environment of the application source code are input into a target AI model, the target AI model is used to simulate execution of the application source code for vulnerability identification, a prediction score of each preset vulnerability is obtained, if the prediction score of a preset vulnerability is greater than a preset vulnerability threshold, a first verification result is output; otherwise, a second verification result is output, the application simulates code running through an AI model, security vulnerability verification is realized without compiling and deploying the application source code, the application program running result is quickly simulated, and security vulnerabilities are accurately identified. BRIEF DESCRIPTION OF DRAWINGS

[0013] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0014] Figure 1 A flowchart of a code-level security vulnerability intelligent verification method provided by the embodiments of the present application. DETAILED DESCRIPTION

[0015] The technical solutions in the embodiments of the present application will be described clearly and completely in the following with reference to the drawings of the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0016] It is to be understood that the terms "first", "second", and the like, used in the description and the claims of the application as well as the above description of the drawings merely specify the names of similar objects and do not necessarily have specific sequences or orders of precedence. It should be understood that the data used in this way can be interchanged under appropriate circumstances so that the embodiments of the application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or server including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products, or devices.

[0017] The embodiments of the application provide a code-level security vulnerability intelligent verification method, as shown in the method comprises the following steps: Figure 1

[0018] S100, the application source code is parsed, and a feature vector of the application source code is acquired, and the features corresponding to the feature vector at least include: function name.

[0019] S200, a plurality of initial test parameter value lists of the application source code are acquired based on a database for security vulnerability detection, and the initial test parameter value list includes initial test parameter values corresponding to a plurality of test parameters. Specifically, the initial test parameter value is a parameter value used for security vulnerability testing.

[0020] S300, based on the attribute information of the application source code and the attribute information of the initial test parameter value, the running environment of the application source code is acquired, and the attribute information of the application source code at least includes: code programming language; and the attribute information of the initial test parameter value at least includes: data type, and preset running environment of the initial test parameter value.

[0021] Specifically, different programming languages require different interpreters or compilers; the code may depend on third-party libraries, and these libraries have specific version requirements, or some code may only be applicable to a specific operating system. Therefore, based on the programming language of the application source code, the running environment of the application source code is further determined according to the configuration file and the like of the code.

[0022] Specifically, the data type included in the attribute information of the initial test parameter value includes: integer type, floating point type and the like. It can be understood that different initial test parameter values may have fixed running environments, for example, the initial test parameter value of the Windows registry requires a Windows running environment.

[0023] ​S400, input the target test parameter value list, the feature vector of the application source code and the running environment of the application source code into the target AI model, simulate the execution of the application source code using the target AI model to perform vulnerability identification, and obtain the prediction score of each preset vulnerability, wherein the target test parameter value list including a plurality of target test parameter values is one of the plurality of initial test parameter value lists.

[0024] Specifically, the test parameters are determined based on the application source code, and initial test parameter values corresponding to the test parameters are randomly selected from the database as the target test parameter value list.

[0025] Specifically, the target AI model is instructed to simulate the running of the feature vector of the code based on the target test parameter value list, the feature vector of the code and the running environment of the application source code, and to detect the probability score of the existence of the preset vulnerability in the code output by analyzing the logic of the feature vector of the code and the behavior of the target test parameter value list.

[0026] S500, if the prediction score of a preset vulnerability is greater than a preset vulnerability threshold, a first verification result is output; otherwise, a second verification result is output, wherein the first verification result is different from the second verification result.

[0027] In an exemplary description of the present application, the first verification result is that the output of the application source code has a preset vulnerability, and the second verification result is that the application source code is safe and does not have a preset vulnerability.

[0028] In summary, the application source code is parsed to obtain the feature vector of the code, the test parameter list for security vulnerability detection of the application source code is obtained, and a plurality of initial test parameter value lists are obtained based on the database. Based on the attribute information of the application source code and the attribute information of the initial test parameter value, the running environment of the application source code is obtained, a plurality of target test parameter value lists, the feature vector of the application source code and the running environment of the application source code are input into the target AI model, the execution of the application source code is simulated using the target AI model to perform vulnerability identification, the prediction score of each preset vulnerability is obtained, if the prediction score of a preset vulnerability is greater than a preset vulnerability threshold, a first verification result is output; otherwise, a second verification result is output. The present application simulates the running of the code by the AI model, realizes the security vulnerability verification without compiling and deploying the application source code, quickly simulates the running result of the application program, and accurately identifies the security vulnerability.

[0029] Specifically, S100 further comprises obtaining the feature vector of the application source code by the following steps:

[0030] S110, using a compiler to decompose the application source code into syntax units, and constructing a tree-structured application source code based on the syntax units; wherein the syntax units at least include expressions, function names. The syntax units also include statements, etc.

[0031] S120, traversing each node of the tree-structured application source code to obtain code syntax features, the code syntax features including: node types and hierarchical relationships. Wherein the root node represents the entire program, and the child node represents the code block. It can be understood that the AST abstract syntax tree is generated, and the structural features of the AST are extracted.

[0032] S130, splitting the application source code into a graph structure, the graph structure including a plurality of linearly connected basic blocks, and the edge of the connection between two basic blocks being a control transfer statement, and the basic block containing a group of sequentially executed statements. Specifically, a control flow graph CFG is constructed. The control transfer statement includes: conditional branching, loop jumping, function calling, etc.

[0033] S140, obtaining graph structure attribute features based on the graph structure of the application source code, the graph structure attribute features including: the number of basic blocks, edge types.

[0034] S150, respectively vectorizing the code syntax features and the graph structure attribute features, and vector fusing the vectorized code syntax features and the vectorized graph structure attribute features to obtain a feature vector of the application source code.

[0035] In an embodiment of the application, a graph neural network GNN is used to convert the graph structure attribute features into a vector. The vectorized code syntax features and the vectorized graph structure attribute features are aggregated into a code feature vector through a pooling operation.

[0036] Specifically, in S400, the target test parameter value list is obtained through the following steps:

[0037] S410, obtaining a target weight of each attribute information of the initial test parameter value.

[0038] S420, clustering the initial test parameter vector converted from the initial test parameter value list based on the attribute information of the initial test parameter value and the target weight of the attribute information, to obtain a plurality of clustering clusters.

[0039] Specifically, based on the application source code, a test parameter is determined, a plurality of initial test parameter values corresponding to the test parameter are obtained, the initial test parameter values corresponding to the test parameter are converted into an initial test parameter vector, and a target weight of each dimension of the initial test parameter vector is determined based on the target weight of the preset attribute information and the attribute information of the initial test parameter value.

[0040] In an example of the present application, the test parameters X1 and X2 are tested, the initial test parameter value FX1 corresponding to X1 is obtained, the initial test parameter value FX2 corresponding to X2 is obtained, the initial test parameter vector (FX1, FX2) is determined, the target weight of FX1 is determined based on the attribute information of FX1, and the target weight of FX2 is determined based on the attribute information of FX2.

[0041] S430, a fixed number of initial test parameter vectors are extracted from each cluster as specified parameter vectors, and the initial test parameter value list corresponding to the specified parameter vectors is taken as the target test parameter value list.

[0042] In an embodiment of the present application, the fixed number is 1, and the initial test parameter vector with the smallest distance from the center vector of the cluster is taken as the specified parameter vector.

[0043] In summary, the target weight of each preset attribute information is obtained based on the application source code, the initial test parameter vector converted from the initial test parameter value is obtained, the target weight of each dimension of the initial test parameter vector is obtained based on the target weight of each attribute information, the initial test parameter vector is clustered based on the initial test parameter vector and the target weight of each dimension of the initial test parameter vector, a plurality of clusters are obtained, a fixed number of initial test parameter vectors are extracted from each cluster as specified parameter vectors, and the initial test parameter value list corresponding to the specified parameter vectors is taken as the target test parameter value list. The present application clusters the initial test parameter vector, selects from each cluster respectively, ensures that the test parameter data of each type is contained, and thus makes the prediction of the target AI model more accurate.

[0044] Further, S410 further includes obtaining the target weight of the attribute information of the initial test parameter value by the following steps:

[0045] S411, a plurality of historical codes and a historical attribute weight list of parameters of each historical code when performing security vulnerability testing are obtained, and the historical attribute weight list includes the weights of a plurality of historical attributes. It can be understood that different attribute information has different effects on the security vulnerability detection of different codes. Therefore, each historical code has its corresponding attribute weight list.

[0046] S412, a historical feature vector corresponding to the historical code is obtained, and a historical feature vector with the smallest distance from the feature vector of the application source code is taken as a specified feature vector. By finding the historical feature vector closest to the feature vector of the code, the weight of the attribute information in the historical feature vector is taken as the weight of the same attribute information in the application source code.

[0047] S413, determining the target weight of the attribute information of the initial test parameter value based on the historical attribute weight list of the historical use code corresponding to the specified feature vector. It can be understood that if the attribute information and the historical attribute are the same, the weight of the historical attribute is taken as the target weight of the attribute information of the initial test parameter.

[0048] The historical attribute weight list of the historical use code is obtained by the following steps:

[0049] S001, obtaining a historical attribute list of parameters of the historical use code when performing the security vulnerability test, wherein the historical attribute list includes a plurality of historical attributes. Specifically, the historical attribute is an attribute of the parameter of the historical use code when performing the security vulnerability test.

[0050] S002, obtaining a historical attribute value list corresponding to the historical attribute list, and obtaining a test vector converted from the historical attribute value list, wherein the historical attribute value list includes a first historical attribute value corresponding to a first attribute and a second historical attribute value corresponding to a second attribute, the first attribute is a historical attribute randomly selected from the historical attribute list, and the first historical attribute value corresponding to the first attribute is a corresponding preset extreme value, and the second attribute is a historical attribute different from the first attribute in the historical attribute list.

[0051] It can be understood that a plurality of historical attributes are randomly selected from the historical attribute list as the first attribute, the first historical attribute value corresponding to the first attribute is set as the corresponding preset extreme value, and the historical attributes other than the first attribute in the historical attribute list are taken as the second attribute. In an embodiment of the present application, the second historical attribute value corresponding to the second attribute is the corresponding attribute value selected from the database. In another embodiment of the present application, the second historical attribute value corresponding to the second attribute is the normal attribute value of the historical use code.

[0052] S003, substituting each test vector into the historical use code for execution, obtaining a real vulnerability judgment result corresponding to each test vector in the execution process of the historical use code, and taking the test vector and the real vulnerability judgment result as a piece of training data. Specifically, the real vulnerability judgment result is that there is a vulnerability or there is no vulnerability. In an embodiment of the present application, the existence of the vulnerability is marked as 1, and the non-existence of the vulnerability is marked as 0.

[0053] S004, based on a plurality of pieces of training data, using a logistic regression model to obtain a weight coefficient between each historical attribute and the real vulnerability judgment result, thereby obtaining the historical attribute weight list of the historical use code. The influence of the test parameter on the real vulnerability judgment result is learned based on the logistic regression model.

[0054] In summary, the history attribute list of the parameters of the history code when performing the security vulnerability test is obtained, the history attribute value list corresponding to the history attribute list is obtained, and the test vector converted from the history attribute value list is obtained, each test vector list is substituted into the history code for execution, the real vulnerability judgment result corresponding to each measurement vector is obtained, and the test vector and the real vulnerability judgment result are taken as a training data, based on a plurality of training data, the weight coefficient between each history attribute and the real vulnerability judgment result is obtained using a logistic regression model, thereby obtaining the history attribute weight list of the history code, and the attribute weight of the application source code is found by the attribute weight of the history code, so that the target test parameter is more accurately found.

[0055] Specifically, the target AI model is obtained by the following steps:

[0056] S401, an initial AI model is constructed.

[0057] S402, a first training data set and a second training data set are obtained, the first training data set includes a plurality of first training data lists, and the first training data list includes: a preset vulnerability code of a first vulnerability type and a real vulnerability result corresponding to the preset vulnerability code of the first vulnerability type.

[0058] The second training data includes a plurality of second training data lists, and the second training data list includes: a preset vulnerability code of a second vulnerability type and a real vulnerability result corresponding to the preset vulnerability code of the second vulnerability type; wherein the first vulnerability type is different from the second vulnerability type. Specifically, the preset vulnerability code of the first vulnerability type is a common vulnerability type and a secure vulnerability type. The preset vulnerability code of the second vulnerability type is a preset vulnerability code of an adversarial type, for example: a real vulnerability code but with variable renaming / inserting invalid code, a secure code but simulating a vulnerability mode, etc.

[0059] S403, a mixed training sample of the first training data set and the second training data set is obtained, and the initial AI model is trained using the mixed training sample to obtain a target AI model.

[0060] Specifically, the training result of the initial AI model trained by the mixed training sample is obtained, and if the training result meets a preset training condition, the initial AI model after training is taken as the target AI model.

[0061] In summary, the AI model is trained using common type vulnerabilities and adversarial type vulnerabilities, so that the AI model can better identify vulnerabilities.

[0062] Further, after outputting the first verification result, it further includes:

[0063] S510, divide the application source code into several statements, obtain a statement list, the statement list includes several statements.

[0064] Specifically, the statement list A = {A1, A2, ..., A...} i A m}, A i It is the i-th statement.

[0065] Specifically, the statements include declaration statements and executable statements.

[0066] In one embodiment of the present invention, N-gram is used to divide the application source code into several statements.

[0067] In another embodiment of the invention, a single-line statement is treated as a single statement.

[0068] S520, obtain the vulnerability prediction score B of the first i statements of the application source code for the preset vulnerability. i The value of i ranges from 1 to m, where m is the number of statements.

[0069] Specifically, the first i statements, i.e., A1 to Ai, will transfer A1 to A... i Input the target AI model with a list of several target test parameter values ​​and the runtime environment of the application source code, and obtain a prediction score B for a preset vulnerability. i .

[0070] S530, Obtain the score C for a single statement i Mark C i Statements exceeding the threshold are considered vulnerable statements, with a single statement receiving a score of C. i equals B i Subtract B i-1 The difference, B i-1 C1 is the vulnerability prediction score for the first i-1 statements in the applied source code for a preset vulnerability. When i=1, C1 equals B1. Specifically, when i equals 1, C1 is the score of the first statement.

[0071] In summary, the application source code is divided into several statements, a list of statements is obtained, and A1 to A2 are retrieved. i For a predefined vulnerability, the predicted score is obtained by acquiring the score of individual statements. Statements with scores greater than a threshold are marked as vulnerable statements. Based on these steps, the location of the vulnerability is accurately determined. Compared to directly predicting each statement, the method of using multiple statements to jointly predict the predefined score of a predefined vulnerability is more accurate.

[0072] The embodiment of the present application further provides a non-transitory computer readable storage medium, which can be arranged in an electronic device to store a computer program related to a method in the method embodiment, and the computer program is loaded and executed by the processor to implement the method provided by the above embodiment.

[0073] The embodiment of the present application further provides an electronic device, comprising a processor, a memory and a computer program stored in the memory and executable on the processor, and the processor implements the method provided by the above embodiment when executing the computer program.

[0074] The embodiment of the present application further provides a computer program product, comprising program codes, which are used to make the electronic device execute the steps in the method according to various exemplary embodiments of the present application described in the specification when the program product is executed on the electronic device.

[0075] Although some specific embodiments of the present application have been described in detail by examples, those skilled in the art should understand that the above examples are only for illustration, but not for limiting the scope of the present application. Those skilled in the art should also understand that various modifications can be made to the embodiments without departing from the scope and spirit of the present application.

Claims

1. A method for intelligent verification of security vulnerabilities at code level, characterized in that, The method comprises the following steps: S100, parsing the application source code to obtain a feature vector of the application source code, the features corresponding to the feature vector at least including a function name; S200, obtaining a plurality of initial test parameter value lists of the application source code based on a database for security vulnerability detection, the initial test parameter value list including initial test parameter values corresponding to a plurality of test parameters; S300, obtaining a running environment of the application source code based on attribute information of the application source code and attribute information of the initial test parameter values, the attribute information of the application source code at least including a code programming language, and the attribute information of the initial test parameter values at least including a data type and a preset running environment of the initial test parameter values; S400, inputting a plurality of target test parameter value lists, the feature vector of the application source code and the running environment of the application source code into a target AI model, simulating execution of the application source code by using the target AI model to perform vulnerability identification, and obtaining a prediction score of each preset vulnerability, wherein the target test parameter value list including a plurality of target test parameter values is one of the plurality of initial test parameter value lists; in S400, the target test parameter value list is obtained by the following steps: S410, obtaining a target weight of each attribute information of the initial test parameter values; S410 further comprises obtaining a target weight of each attribute information of the initial test parameter values by the following steps: S411, obtaining a plurality of historical codes and a historical attribute weight list of parameters of each historical code during security vulnerability testing, the historical attribute weight list including weights of a plurality of historical attributes; S412, obtaining a historical feature vector corresponding to the historical code, and obtaining a historical feature vector with the smallest distance from the feature vector of the application source code as a specified feature vector; S413, determining the target weight of the attribute information of the initial test parameter values based on the historical attribute weight list of the historical feature vector corresponding to the historical code; S420, clustering an initial test parameter vector converted from the initial test parameter value list based on the attribute information of the initial test parameter values and the target weight of the attribute information, and obtaining a plurality of clustering clusters; S430, extracting a fixed number of initial test parameter vectors from each clustering cluster as specified parameter vectors, and taking the initial test parameter value list corresponding to the specified parameter vectors as the target test parameter value list; S500, if the prediction score of a preset vulnerability is greater than a preset vulnerability threshold, outputting a first verification result; otherwise, outputting a second verification result, wherein the first verification result is different from the second verification result.

2. The method for intelligent verification of security vulnerabilities at code level as claimed in claim 1 wherein, S100 further comprises the following steps of obtaining the feature vector of the application source code: S110, decomposing the application source code into syntax units by using a compiler, and constructing a tree-structured application source code based on the syntax units; wherein the syntax units at least include an expression and a function name; S120, traversing each node of the tree-structured application source code to obtain code syntax features, the code syntax features including a node type and a hierarchical relationship; S130, split the application source code into a graph structure, the graph structure comprising a plurality of linearly connected basic blocks, the edge of the connection between two basic blocks being a control transfer statement, and the basic block comprising a set of sequentially executed statements; S140, based on the application source code of the graph structure, obtaining graph structure attribute features, the graph structure attribute features comprising: the number of basic blocks, edge types; S150, vectorizing the code syntax features and the graph structure attribute features respectively, and vector fusing the vectorized code syntax features and the vectorized graph structure attribute features to obtain the feature vector of the application source code.

3. The method of claim 1, wherein, The historical attribute weight list of the historical code is obtained through the following steps: S001, obtaining a historical attribute list of parameters of the historical code during security vulnerability testing, wherein the historical attribute list comprises a plurality of historical attributes; S002, obtaining a historical attribute value list corresponding to the historical attribute list, and obtaining a test vector converted from the historical attribute value list, wherein the historical attribute value list comprises a first historical attribute value corresponding to a first attribute and a second historical attribute value corresponding to a second attribute, the first attribute is a historical attribute randomly selected from the historical attribute list, and the first historical attribute value corresponding to the first attribute is a corresponding preset extreme value, and the second attribute is a historical attribute different from the first attribute in the historical attribute list; S003, substituting each test vector into the historical code for execution to obtain a real vulnerability judgment result corresponding to each measurement vector in the execution process of the historical code, and taking the test vector and the real vulnerability judgment result as a training data; S004, based on a plurality of training data, using a logistic regression model to obtain a weight coefficient between each historical attribute and the real vulnerability judgment result, thereby obtaining the historical attribute weight list of the historical code.

4. The method of claim 1, wherein, The initial test parameter vector with the smallest distance to the center vector of the clustering cluster is taken as the specified parameter vector.

5. The method for intelligent verification of security vulnerabilities at code level as claimed in claim 1, wherein, The target AI model is obtained through the following steps: S401, constructing an initial AI model; S402, obtaining a first training data set and a second training data set, the first training data set comprising a plurality of first training data lists, and the first training data list comprising: a preset vulnerability code of a first vulnerability type and a real vulnerability result corresponding to the preset vulnerability code of the first vulnerability type; The second training data set comprises a plurality of second training data lists, and each second training data list comprises: a preset vulnerability code of a second vulnerability type and a real vulnerability result corresponding to the preset vulnerability code of the second vulnerability type; wherein the first vulnerability type is different from the second vulnerability type; S403, obtaining a mixed training sample of the first training data set and the second training data set, and training the initial AI model using the mixed training sample to obtain the target AI model.

6. The method of claim 5, wherein, The training result of training the initial AI model using the mixed training sample is obtained, and if the training result meets a preset training condition, the trained initial AI model is taken as the target AI model.

7. The method of claim 1, wherein, After outputting the first verification result, further comprising: S510, divide the application source code into a plurality of statements, obtain a statement list, the statement list comprising a plurality of statements; S520, obtaining a vulnerability prediction score B of the first i statements of the application source code for the preset vulnerability i The value range of i is 1 to m, and m is the number of statements. S530, obtaining a single statement score C i , marking C i The statement greater than the threshold value as a vulnerability statement, wherein the single statement score C i is equal to B i Subtract the difference value of B i-1 , B i-1 is the vulnerability prediction score of the previous i-1 statements of the application source code for the preset vulnerability, when i=1, C1 is equal to B1.

8. A non-transitory computer-readable storage medium, comprising: The storage medium has a computer program stored therein, and the computer program is loaded and executed by the processor to implement the code-level security vulnerability intelligent verification method according to any one of claims 1-7.

9. An electronic device comprising: Processor, memory and computer program stored on the memory and executable on the processor, characterized in that the processor executes the computer program to implement the code-level security vulnerability intelligent verification method according to any one of claims 1-7.

Images