A vulnerability mining system and device based on source code similarity

Abstract

The present application relates to the technical field of software security, and especially relates to a vulnerability mining system and device based on source code similarity. The vulnerability mining system comprises: a vulnerability feature library, comprising vulnerability code segments and feature information associated with the vulnerability code segments; a coarse-grained positioning module, which matches the vulnerability code segments in the vulnerability feature library with source code to be analyzed, determines suspicious code segments, and forms a similar code pair; a feature representation module, which obtains feature information of the suspicious code segments; a fine-grained positioning module, which obtains semantic similarity, structural similarity and subgraph matching degree of the similar code pair according to the feature information associated with the two code segments in the similar code pair, and determines the comprehensive similarity of the similar code pair; and a judgment module, which determines whether the suspicious code segments in the similar code pair have vulnerabilities according to the comprehensive similarity. The present application can guarantee detection accuracy while improving processing efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software security, and in particular to a vulnerability mining system and device based on source code similarity. BACKGROUND

[0002] With the rapid development of software development and the vigorous rise of open source communities, the spread of software vulnerabilities has accelerated, especially in the field of Internet of Things, the attack frequency of connected devices grows exponentially, the severity of vulnerabilities is increasingly highlighted, and the performance of traditional vulnerability detection technologies gradually cannot meet the industry demand.

[0003] Specifically, the traditional vulnerability detection technology has the following shortcomings:

[0004] 1. Code obfuscation and diversity problems: Code obfuscation techniques such as variable name replacement, instruction rearrangement, etc. are widely used in modern software development, resulting in significant differences in code syntax and structure, making it difficult for traditional similarity measurement methods to accurately identify similar code and reducing the precision.

[0005] 2. Difficulty in cross-language vulnerability detection: Different programming languages have fundamental differences in syntax and execution mechanisms, resulting in different manifestations of the same type of vulnerability in different programming languages, making cross-language vulnerability detection a major challenge and reducing recall.

[0006] 3. Low efficiency of vulnerability mining: Existing technologies typically require calculating the distance between the feature vector of each code in the code base and all feature vectors in the vulnerability feature library for accurate search, which requires a large amount of computing resources and is inefficient when analyzing large-scale code bases. For example, the HiddenCPG system takes 16 days and 12 hours to process 739,000 pairs of code, which is relatively slow.

[0007] Based on the above shortcomings of traditional vulnerability detection technology, the existing technology needs to be improved in terms of detection accuracy and processing speed when performing vulnerability mining. SUMMARY

[0008] (I) Technical problems to be solved

[0009] In view of the above shortcomings and deficiencies of the prior art, the present application provides a vulnerability mining system and device based on source code similarity, which solves the technical problems of slow processing speed and low detection accuracy of the prior art when performing vulnerability mining.

[0010] (II) Technical solutions

[0011] In order to achieve the above purpose, the main technical solutions adopted by the present application include:

[0012] In a first aspect, the embodiments of the present application provide a vulnerability mining system based on source code similarity, comprising:

[0013] a vulnerability feature library, comprising a plurality of vulnerability code segments and feature information associated with each vulnerability code segment; the feature information comprises a token sequence and a code attribute graph of the vulnerability code segment;

[0014] a coarse-grained positioning module, configured to, for the source code to be analyzed, match the vulnerability feature library and the source code based on an approximate nearest neighbor search algorithm, determine suspicious code segments similar to the vulnerability code segments in the source code, and form a similar code pair;

[0015] a feature representation module, configured to obtain feature information of the suspicious code segments;

[0016] a fine-grained positioning module, configured to obtain semantic similarity based on a twin neural network according to the feature information associated with the two code segments in a similar code pair, and determine structural similarity and subgraph matching degree according to the code attribute graph in the feature information; and perform weighted summation based on the semantic similarity, the structural similarity and the subgraph matching degree to determine the comprehensive similarity of the similar code pair;

[0017] wherein a multi-head attention fusion module for fusing the feature information is arranged in a shared encoder of the twin neural network;

[0018] a determination module, configured to determine whether the suspicious code segment has a vulnerability according to the comprehensive similarity.

[0019] Optionally, the fine-grained positioning module comprises:

[0020] a twin neural network unit, configured to determine semantic similarity of a similar code pair based on a twin neural network according to feature information associated with the two code segments in the similar code pair;

[0021] a graph structure unit, configured to obtain structural similarity and subgraph matching degree of a similar code pair based on a graph structure matching algorithm according to a code attribute graph associated with the two code segments in the similar code pair;

[0022] a comprehensive unit, configured to perform weighted summation based on the semantic similarity, the structural similarity and the subgraph matching degree as the comprehensive similarity.

[0023] Optionally, in the twin neural network unit, the determination of the semantic similarity of the similar code pair based on the twin neural network comprises:

[0024] the twin neural network is a twin neural network obtained through a pre-training process and having matched model parameters;

[0025] The twin neural network comprises a similarity calculation layer and two branch neural networks of the same structure, and the output ends of the two branch neural networks are connected with the input end of the similarity calculation layer; each of the two branch neural networks comprises a shared encoder sharing weight parameters with each other, and an input end of a convolution block included in the shared encoder is provided with a multi-head attention fusion module;

[0026] The multi-head attention fusion module is configured to perform weighted fusion on the tokens in the feature information of the branch neural network to which the multi-head attention fusion module belongs and the features corresponding to the code attribute graph based on attention weights, to obtain fused features; the attention weights are learned through the pre-training process;

[0027] The convolution block is configured to extract high-dimensional features based on the fused features as the output of the branch neural network in which the convolution block is located;

[0028] The similarity calculation layer is configured to determine the semantic similarity of the pair of similar codes based on the high-dimensional features.

[0029] Optionally, the pre-training process comprises a pre-training process and a fine-tuning training process performed in sequence;

[0030] The pre-training process uses a pre-training data set to train the twin neural network; the pre-training data set comprises a first positive sample pair and a first negative sample pair;

[0031] The first positive sample pair comprises two vulnerability code segments with the same vulnerability mode, or any two of a plurality of variant code segments of the same vulnerability mode; the two code segments in the first positive sample pair are codes written using the same high-level language;

[0032] The first negative sample pair comprises a vulnerability code segment and a repaired code segment of the vulnerability code segment, or a vulnerability code segment and a normal code segment similar in function to the vulnerability code segment and free of vulnerabilities; the two code segments in the first negative sample pair are codes written using the same high-level language.

[0033] Optionally, the fine-tuning training process uses a fine-tuning training data set for training;

[0034] The fine-tuning training data set comprises a second positive sample pair and a second negative sample pair converted into LLVM IR code pairs;

[0035] The second positive sample pair comprises a pair of vulnerability codes with the same vulnerability mode, or any two of a plurality of variant code segments of the same vulnerability mode; the two code segments in the second positive sample pair are codes written using different high-level languages;

[0036] The second negative sample pair includes: a vulnerability code segment and a repair code segment of the vulnerability code segment, or a vulnerability code segment and a normal code segment similar in function to the vulnerability code segment and free of vulnerabilities; the two code segments in the second negative sample pair are codes written using different high-level languages.

[0037] The learning rate, the number of training rounds, and the data volume of the training set of the fine-tuning training process are 10% to 30% of those of the pre-training process.

[0038] Optionally, the vulnerability mining system further includes:

[0039] The preprocessing module is configured to determine whether the programming languages of the similar code pair are the same before the feature representation module acquires the feature information of the suspicious code segment in the similar code pair, and if so, directly input the two code segments in the similar code pair into the feature representation module to extract the feature information associated with the two code segments, respectively; if not,

[0040] The two code segments in the similar code pair are respectively converted into associated LLVM IR codes, and the LLVM IR codes are respectively input into the feature representation module to extract the feature information associated with the two code segments, respectively.

[0041] Optionally, the code attribute graph includes an abstract syntax tree of the vulnerability code segment and a control flow graph and a data flow graph embedded in the abstract syntax tree.

[0042] The graph structure unit includes:

[0043] The structure analysis subunit is configured to compare the topological structures of the abstract syntax trees associated with the two code segments in the similar code pair based on the code attribute graph and according to a graph structure matching algorithm to determine an AST similarity, compare the control flow paths of the control flow graphs associated with the two code segments in the similar code pair to determine a CFG similarity, and compare the data dependency relationships of the data flow graphs associated with the two code segments in the similar code pair to determine a DFG similarity.

[0044] The structure feature fusion unit is configured to perform weighted summation on the AST similarity, the CFG similarity, and the DFG similarity to determine a structural similarity of the similar code pair.

[0045] Optionally, the graph structure unit further includes:

[0046] The subgraph matching subunit is configured to analyze the code attribute graphs associated with the two code segments in the similar code pair using a VF2 graph isomorphism algorithm and take the similarity scores obtained through the analysis as the subgraph matching degrees.

[0047] Optionally, the vulnerability feature library further comprises attribute information associated with each vulnerability code segment; the attribute information comprises a CVE number, a CWE type and a CVSS score of the vulnerability code segment.

[0048] The vulnerability mining system further comprises:

[0049] The output module is configured to, when the determination module determines that the suspicious code segment in the pair of similar code segments has a vulnerability, determine position information of the suspicious code segment, and output the attribute information and the position information of the vulnerability code segment in the pair of similar code segments as a mining result to show the user the position and the attribute of the vulnerability in the suspicious code segment.

[0050] In a second aspect, an embodiment of the present application provides a computer device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the computer program is executed by the processor to implement the vulnerability mining system based on source code similarity according to the first aspect.

[0051] (Three) beneficial effects

[0052] The vulnerability mining system of the present application is based on a vulnerability feature library, and first determines suspicious code segments similar to vulnerability code segments in source code to be analyzed by a coarse-grained positioning module to form a pair of similar code segments; then acquires feature information of the suspicious code segments by a feature representation module; then determines the comprehensive similarity of the pair of similar code segments according to the feature information by a fine-grained positioning module; and finally determines whether the suspicious code segment in the pair of similar code segments has a vulnerability according to the comprehensive similarity by a determination module.

[0053] Based on the above process, the vulnerability mining system provided by the present application adopts a hierarchical strategy to gradually narrow the range from coarse-grained to fine-grained in the process of detecting vulnerabilities, searches for suspicious code segments in the source code to be analyzed by the coarse-grained positioning module through approximate nearest neighbor search algorithm, and performs fine multi-dimensional similarity analysis on the pair of similar code segments by the fine-grained positioning module. Compared with the processing mode of directly performing accurate search on the full text of the source code to be analyzed in the prior art, the present application can effectively reduce the overall computing amount of the vulnerability mining system, guarantee the detection accuracy and improve the processing efficiency.

[0054] In addition, the fine-grained positioning module of the present application uses a twin neural network to analyze the semantic similarity of similar code pairs, and a multi-head attention fusion module is arranged in the shared encoder of the twin neural network to fuse the feature information. Compared with the existing twin neural network which only performs simple splicing processing on the feature information, the multi-head attention fusion module of the present application intelligently allocates the attention weight of each feature, extracts features with richer perspectives from the feature information, highlights important features in the feature information, suppresses noise in the feature information, and makes the semantic similarity obtained by the twin neural network more accurate, thereby further ensuring the detection accuracy of the present application for vulnerabilities. BRIEF DESCRIPTION OF DRAWINGS

[0055] Figure 1 A schematic diagram of the architecture of a vulnerability mining system based on source code similarity provided for an embodiment is shown in the figure.

[0056] Figure 2 A schematic diagram of the architecture of another vulnerability mining system based on source code similarity provided for an embodiment is shown in the figure.

[0057] Figure 3 A schematic diagram of the architecture of a twin neural network provided for an embodiment is shown in the figure.

[0058] Figure 4 A schematic diagram of the architecture of a pre-processing module in a twin neural network provided for an embodiment is shown in the figure.

[0059] Figure 5 A schematic diagram of the architecture of a shared encoder in a twin neural network provided for an embodiment is shown in the figure. DETAILED DESCRIPTION

[0060] In order to better understand the above technical solutions, the exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a clearer, more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0061] Embodiment 1: As shown in the figure, the present embodiment provides a vulnerability mining system based on source code similarity, which includes a vulnerability feature library, a coarse-grained positioning module, a feature representation module, a fine-grained positioning module, a judgment module and an output module, and the details are as follows: Figure 1

[0062] ​The vulnerability feature library includes a plurality of known vulnerability code snippets and feature information associated with each vulnerability code snippet. The feature information includes a token sequence of the vulnerability code snippet and a code property graph, which includes an abstract syntax tree of the vulnerability code snippet and a control flow graph and a data flow graph embedded in the abstract syntax tree. In addition, the vulnerability feature library can further include attribute information associated with each vulnerability code snippet, which includes a CVE number, a CWE type and a CVSS score of the vulnerability code snippet. The CVE (Common Vulnerabilities and Exposures) refers to an international standard vulnerability numbering system that assigns a unique identifier to each disclosed security vulnerability. The CWE (Common Weakness Enumeration) refers to a classification standard for software security defects, such as CWE-119 indicating a buffer overflow type. The CVSS (Common Vulnerability Scoring System) is a standardized scoring method for assessing the severity of a vulnerability, with a score of 0-10.

[0063] Specifically, the known vulnerability code snippets are collected from the National Vulnerability Database (NVD), GitHub and other code hosting platforms, and can also be collected from public datasets such as the Software Assurance Reference Dataset (SARD) and the MegaVul dataset, and the corresponding repair patches of the vulnerability code snippets are also collected, to ensure that the vulnerability feature library covers multiple programming languages and vulnerability types. The collected vulnerability code snippets are standardized, with code comments and blank lines removed, code format and indentation structure standardized, and feature information and attribute information associated with the vulnerability code snippets saved together in the vulnerability feature library.

[0064] The coarse-grained positioning module is configured to match the vulnerability code snippets in the vulnerability feature library with the source code to be analyzed, to determine suspicious code snippets similar to the vulnerability code snippets in the source code to be analyzed, to form a similar code pair, by using an approximate nearest neighbor search algorithm. The approximate nearest neighbor search algorithm can quickly find the most similar vector to the query vector in a high-dimensional vector space. Compared with the existing vulnerability detection technology which performs accurate search by calculating the distance between the query vector and all vectors in the vulnerability feature library, the approximate nearest neighbor search algorithm sacrifices a slight accuracy in exchange for a great improvement in processing efficiency, and can quickly filter out potential vulnerability candidates, i.e., suspicious code snippets, in a large-scale source code to be analyzed, to provide a basis for subsequent analysis.

[0065] The feature characterization module is configured to obtain feature information of suspicious code snippets in the similar code pair. Specifically, the feature information of the suspicious code snippets, i.e., token sequences and code property graphs associated with the suspicious code snippets. The token sequences can be extracted using a pre-trained CodeBERT model, and the code property graphs can be generated according to the programming language using a corresponding parsing tool.

[0066] The fine-grained positioning module is configured to obtain, based on a twin neural network, semantic similarity of the similar code pair according to feature information associated with two code snippets in a certain similar code pair, and determine structural similarity and subgraph matching degree of the similar code pair according to the code property graph in the feature information. The fine-grained positioning module is configured to determine the comprehensive similarity of the similar code pair by performing weighted summation based on the semantic similarity, the structural similarity, and the subgraph matching degree. The shared encoder included in the twin neural network is provided with a multi-head attention fusion module for fusing the feature information. The fine-grained positioning module can accurately analyze the similar code pair filtered by the coarse-grained positioning module to determine the similarity of the similar code pair, so that the determination module can determine whether the suspicious code snippet in the similar code pair has a vulnerability. The fine-grained positioning module can perform multi-dimensional similarity analysis on the similar code pair, which makes up for the insufficient accuracy of the coarse-grained positioning module and ensures the overall detection accuracy of the vulnerability mining system. However, the fine-grained positioning module only performs similarity analysis on the similar code pair matched by the coarse-grained positioning module, which effectively saves computing power compared to the prior art method of performing the same degree of accurate analysis on each segment of the source code to be analyzed.

[0067] Moreover, the shared encoder included in the twin neural network used by the fine-grained positioning module is provided with a multi-head attention fusion module for fusing the feature information. Compared with the prior art method of simply splicing the feature information in the existing twin neural network, the multi-head attention fusion module intelligently allocates attention weights to each feature, highlights important feature information, suppresses noise in the feature information, and makes the semantic similarity output by the twin neural network more accurate, further ensuring the detection accuracy of the vulnerability mining system for vulnerabilities.

[0068] The determination module is configured to determine whether the suspicious code snippet in the similar code pair has a vulnerability according to the comprehensive similarity. Specifically, a determination threshold can be set, and if the comprehensive similarity of the similar code pair is greater than the determination threshold, it is determined that the suspicious code snippet in the similar code pair has a vulnerability. Specifically, the value range of the comprehensive similarity can be adjusted to [0, 1] through normalization processing, and the determination threshold can be set to 0.85.

[0069] The output module is configured to, when the determination module determines that a suspicious code segment in a similar code pair has a vulnerability, determine location information of the suspicious code segment, and output attribute information and location information of the vulnerability code segment in the similar code pair as a mining result to show the user the location and attribute of the vulnerability in the suspicious code segment. Specifically, the location information includes a line number and a file path of the suspicious code segment. The developer can quickly locate the exact location of the code segment with the vulnerability and the specific vulnerability information.

[0070] The vulnerability mining system provided by the present application is based on a vulnerability feature library. First, a coarse-grained positioning module is used to determine suspicious code segments similar to vulnerability code segments in the source code to be analyzed, to form a similar code pair. Then, a feature representation module is used to obtain feature information of the suspicious code segments. Then, a fine-grained positioning module is used to determine the comprehensive similarity of the similar code pair according to the feature information. Finally, a determination module is used to determine whether the suspicious code segment in the similar code pair has a vulnerability according to the comprehensive similarity.

[0071] Based on the above process, the vulnerability mining system provided by the present application adopts a hierarchical strategy to gradually narrow the range from coarse-grained to fine-grained. In the coarse-grained positioning module, an approximate nearest neighbor search algorithm is used to quickly match the suspicious code segments in the source code to be analyzed. In the fine-grained positioning module, a fine multi-dimensional similarity analysis is performed on the similar code pair. Compared with the existing technology which directly performs an accurate search on the entire source code to be analyzed, the present application can effectively reduce the overall computational load of the vulnerability mining system, ensure the detection accuracy, and improve the processing efficiency.

[0072] Embodiment 2: In order to further understand the vulnerability mining system provided in Embodiment 1, the present embodiment will be described in detail in combination with the specific structure of each module in the vulnerability mining system.

[0073] As shown in Figure 2 The present embodiment provides a vulnerability mining system based on source code similarity, which comprises a vulnerability feature library, a coarse-grained positioning module, a feature representation module, a fine-grained positioning module, a determination module and an output module, and specifically comprises the following:

[0074] The vulnerability feature library can be the vulnerability feature library provided in Embodiment 1.

[0075] The coarse-grained positioning module is configured to, for the source code to be analyzed, match the vulnerability code segments in the vulnerability feature library with the source code to be analyzed by using an approximate nearest neighbor search algorithm, determine suspicious code segments similar to the vulnerability code segments in the source code to be analyzed, and form a similar code pair.

[0076] The approximate nearest neighbor search algorithm can be a HNSW (Hierarchical Navigable SmallWorld) algorithm, a SCANN (Scalable Compression-based Accelerated Nearest Neighbors) algorithm, or the source code to be analyzed is divided into a plurality of code segments, a clustering algorithm is used to perform clustering analysis on all the code segments, a plurality of clusters are obtained, similar clusters in all the clusters to the vulnerability code segments in the vulnerability feature library are screened, and the code segments in the screened clusters are taken as suspicious code segments to form a similar code pair with the vulnerability code segments corresponding to the screened clusters.

[0077] Preferably, the embodiment uses a locality sensitive hashing algorithm (LSH) to match the vulnerability code segments in the vulnerability feature library with the source code to be analyzed, determine suspicious code segments similar to the vulnerability code segments in the source code to be analyzed, and form a similar code pair. The locality sensitive hashing algorithm maps similar vectors to the same hash bucket through a hash function to achieve fast retrieval, which includes steps P1 and P2 before starting vulnerability mining and step P3 when mining vulnerabilities in the source code to be analyzed, and the details are as follows:

[0078] P1, a hash table is constructed in advance, specifically including sub-steps P101 to P103:

[0079] P101, 128 random projection vectors r1, r2,..., r128 are generated; each random projection vector is 768-dimensional and obeys N(0, 1) distribution;

[0080] P102, a hash function family is defined: h_k(v)=sign(r_k·v);

[0081] Wherein, r_k represents the kth random projection vector, k is a positive integer less than or equal to 128; v represents a feature vector input into the hash function, h_k(v) represents a feature vector output by the hash function, and sign() represents a sign function.

[0082] The hash function performs dot product operation on the input feature vector v and the random projection vector r_k, and then takes the sign. If the dot product result is positive, +1 is output, if the dot product result is negative, -1 is output, and especially, if the dot product result is 0, the output of the sign() function is defined as +1. Thus, the input continuous feature vector can be converted into simple binary code as the output feature vector.

[0083] P103, 16 hash tables are established, each of which contains 8 hash functions.

[0084] Specifically, the 128 random projection vectors in P101 are divided into 16 vector groups, each group having 8 random projection vectors.

[0085] The 8 hash functions contained in each hash table are obtained by taking a corresponding set of 8 random projection vectors in a vector group through a random projection variable r_k in the hash function family in P102.

[0086] P2, index the pre-established vulnerability feature library, specifically including sub-steps P201 to P203:

[0087] P201, convert each vulnerability code snippet in the vulnerability feature library into a 768-dimensional vulnerability feature vector and perform L2 normalization. Specifically, the vulnerability code snippet can be input into the pre-trained CodeBERT model, and the token sequence output by the CodeBERT model can be used as the vulnerability feature vector. The specific architecture of the CodeBERT model can be the same as the CodeBERT model used in the feature representation module below.

[0088] P202, for each hash table in the 16 hash tables established in P103, the 768-dimensional vulnerability feature vector converted in P201 is input into the 8 hash functions in the hash table to obtain the hash vector corresponding to the vulnerability feature vector: H(v) = [h1(v), h2(v),..., h8(v)]; v represents the vulnerability feature vector, h1(v), h2(v),..., h8(v) represent the 8 hash values obtained by inputting the vulnerability feature vector into the 8 hash functions, respectively, and the hash vector H(v) actually forms an 8-bit binary code, such as [+1, -1, +1, +1, -1, -1, +1, -1], which is the "fingerprint" of this vulnerability code snippet in this hash table. The 16 hash vectors corresponding to the 16 hash tables of the vulnerability feature vector form the hash matrix of the vulnerability feature vector.

[0089] P203, map the vulnerability code snippets with the same hash matrix to the same hash bucket.

[0090] P3, when performing vulnerability mining on the source code to be analyzed, the source code to be analyzed is divided into multiple code snippets according to the function it implements or other segmentation standards, and for each code snippet, sub-steps P301 to P303 are executed, as follows:

[0091] P301, convert the code snippet to be tested into a 768-dimensional feature vector and perform L2 normalization, denoted as the feature vector q.

[0092] P302、compute the hash vector of the to-be-detected feature vector q in each hash table, obtain a hash matrix of the to-be-detected feature vector q composed of 16 hash vectors, and map the to-be-detected code snippet into a hash bucket with the same feature matrix based on the hash matrix of the to-be-detected feature vector q.

[0093] P303、all vulnerability code snippets in the hash bucket where the to-be-detected code snippet is located are taken as candidate objects, and the similarity between the to-be-detected code snippet and each candidate object is calculated.

[0094] If the similarity between the to-be-detected code snippet and each candidate object is less than a preset threshold, it is determined that the to-be-detected code snippet does not have a vulnerability; if one or more candidate objects have a similarity greater than the preset threshold with the to-be-detected code snippet, the to-be-detected code snippet is taken as a suspicious code snippet, and the candidate object with the highest similarity is taken as a vulnerability code snippet corresponding to the suspicious code snippet, to form a similar code pair.

[0095] Specifically, the similarity between the to-be-detected code snippet and the candidate object can be the cosine similarity (looking at whether the directions are consistent) or the Euclidean similarity (looking at the distance). Preferably, the similarity between the to-be-detected code snippet and the candidate object is a weighted average of the cosine similarity and the Euclidean similarity, and the weight of the cosine similarity is 0.7 and the weight of the Euclidean similarity is 0.3. The preset threshold can be 0.8.

[0096] The feature representation module is configured to obtain feature information of the suspicious code snippet in the similar code pair, and specifically includes a token sequence extraction unit and a code property graph extraction unit. When the vulnerability feature library is pre-constructed, the token sequence and the code property graph of each vulnerability code snippet in the vulnerability feature library can also be generated using the feature representation module.

[0097] The token sequence extraction unit is configured to extract the token sequence of the suspicious code snippet. The token sequence is an ordered sequence of deconstructing the code snippet into lexical units (including keywords, identifiers, and operators), which can represent the structure and semantics of the code snippet.

[0098] Specifically, the token sequence extraction unit includes a CodeBERT model that is pre-trained. The CodeBERT model is a bidirectional encoder model of a Transformer architecture specially oriented to code understanding tasks, with a parameter scale of 125M, containing 12 layers of Transformer encoders, each layer having a 768-dimensional hidden state, and being configured with 12 attention heads, and having the ability to understand code semantic and syntactic structure. The CodeBERT model can be pre-trained on a large-scale code corpus to learn the general representation of codes written in multiple high-level languages (Java, C, Python, etc.).

[0099] The code property graph extraction unit is configured to generate a code property graph of the suspicious code snippet. The code property graph includes an abstract syntax tree of the suspicious code snippet, and a control flow graph and a data flow graph embedded in the abstract syntax tree.

[0100] An abstract syntax tree (AST) represents a tree structure of a code syntax hierarchy. The abstract syntax tree is independent of a specific grammar and independent of language details, and can represent the syntax features of a code snippet.

[0101] A control flow graph (CFG) is a directed graph representation of an execution path of code. The control flow graph represents possible flows of execution of all basic blocks in a process in the form of a graph. The selection of an execution path is determined by conditional statements, such as if, for, switch statements, and the like. The nodes of the control flow graph represent statements or conditions, and the nodes are connected by directed edges, representing the transfer of control. The control flow graph can reflect the control dependency features in a code snippet.

[0102] A data flow graph (DFG) is a graph structure used to describe the definition and use relationship of variables in code. The data flow graph tracks the use of variables in the control flow graph. The edges in the data flow graph represent subsequent access or modification of the same variable. The data flow graph can reflect the data dependency features in a code snippet.

[0103] A code property graph (CPG) is a unified graph structure that integrates an abstract syntax tree, a control flow graph, and a data flow graph.

[0104] The abstract syntax tree, the control flow graph, the data flow graph, and the code property graph that integrates the abstract syntax tree, the control flow graph, and the data flow graph can be generated using a Joern parser. The code property graph can be based on an AST structure, with CFG edges added between AST nodes to represent control flow relationships, and DFG edges added between AST nodes to represent data flow relationships.

[0105] The feature information can represent suspicious code snippets or vulnerability code snippets from multiple dimensions, to enable the fine-grained positioning module to perform fine similarity analysis from multiple dimensions.

[0106] The fine-grained positioning module includes a twin neural network unit, a graph structure unit, and a comprehensive unit.

[0107] The twin neural network unit is configured to determine the semantic similarity of a pair of similar codes based on a twin neural network, according to the feature information associated with the two code snippets in the pair of similar codes.

[0108] The graph structure unit is configured to obtain the structural similarity and the subgraph matching degree of the similar code pair based on a graph structure matching algorithm according to the code property graph associated with the two code segments in the similar code pair.

[0109] The integration unit is configured to perform weighted summation based on the semantic similarity, the structural similarity and the subgraph matching degree as the comprehensive similarity. Preferably, the weights corresponding to the semantic similarity, the structural similarity and the subgraph matching degree are 0.4, 0.3 and 0.3 respectively.

[0110] The integration unit adopts a weighted fusion manner, and the weights are verified by multiple experiments, so that good balance can be maintained in different types of vulnerability detection tasks.

[0111] Specifically, the graph structure unit includes a structural feature analysis subunit, a structural feature fusion unit and a subgraph matching subunit.

[0112] The structural analysis subunit is configured to compare the topological structure of the abstract syntax tree associated with the two code segments in the similar code pair based on the code property graph according to a graph structure matching algorithm, to determine an AST similarity; compare the control flow path of the control flow graph associated with the two code segments in the similar code pair, to determine a CFG similarity; and compare the data dependency relationship of the data flow graph associated with the two code segments in the similar code pair, to determine a DFG similarity.

[0113] The graph structure matching technology (Graph Algorithm) is a computational method for identifying specific patterns in complex graph networks. This technology can find code segments in the code property graph (CPG) of suspicious code segments that are highly consistent with the vulnerability patterns of known vulnerability code segments. The uniqueness of this method lies in its consideration of not only the surface features of the code, but also the internal structural relationships of the program. More preferably, an improved VF2 subgraph isomorphism algorithm (VF2 Subgraph Isomorphism Algorithm) can be used to perform precise matching operations on this basis. This algorithm has been optimized to handle large-scale graph structure matching tasks. When precise matching cannot meet the actual needs, a graph edit distance (Graph Edit Distance, GED) mechanism can be introduced to realize a more flexible approximate matching strategy (Approximate Matching Strategy).

[0114] Specifically, the steps of obtaining the AST similarity, the CFG similarity and the DFG similarity based on the graph structure matching algorithm are as follows:

[0115] A1, based on calculating the abstract syntax tree AST similarity:

[0116] The structure analysis subunit analyzes the abstract syntax trees of the two code snippets based on a graph structure matching algorithm to calculate the matching degree of node types, hierarchical relationships, and branch structures. This analysis can capture similar patterns of code at the syntax level. The specific analysis dimensions are as follows:

[0117] A101. Compare the node type distribution of the two ASTs (function nodes, variable nodes, expression nodes, etc.) to obtain the node type similarity.

[0118] Node type similarity = |Number of identical node types| / |Total number of node types|.

[0119] A102. Analyze the similarity of the tree topology of the abstract syntax tree (depth, number of branches, hierarchical relationship) to obtain the topology similarity.

[0120] Topology similarity = 1 - graph edit distance (T1, T2) / max(|T1|, |T2|);

[0121] T1 and T2 are the abstract syntax trees corresponding to the two code snippets in the similar code pair, |T1| represents the total number of nodes in T1, and |T2| represents the total number of nodes in T2.

[0122] A103. Evaluate the matching degree of parent-child node relationship (depth matching degree) to obtain the depth similarity.

[0123] Depth similarity = 1 - |Depth(T1) - Depth(T2)| / max(Depth(T1), Depth(T2));

[0124] Depth(T1) and Depth(T2) represent the maximum depth of the abstract syntax trees corresponding to the two code snippets in the similar code pair, and max(Depth(T1), Depth(T2)) represents the maximum value of the maximum depths of the two abstract syntax trees.

[0125] A104. Weighted sum based on the above node type similarity, topology similarity, and depth similarity to obtain the AST similarity. Specifically, the weights corresponding to the node type similarity, topology similarity, and depth similarity are 0.4, 0.4, and 0.2, respectively.

[0126] A2. Calculate CFG similarity based on control flow graph:

[0127] The structure analysis subunit analyzes the similarity of the control flow paths of the similar code pair based on a graph structure matching algorithm. Specifically, the path matching algorithm in the graph structure matching algorithm can identify code snippets with the same control logic. Even if the code has differences in surface form, as long as the control flow structure is similar, the algorithm can detect it. The specific analysis dimensions are as follows:

[0128] A201, analyze the number and type distribution of basic blocks of two code segments in a similar code pair, and get the basic block similarity.

[0129] Basic block similarity = 1-||G1. blocks |-|G2. blocks || / max(|G1. blocks |, |G2. blocks |);

[0130] G1. blocks and G2. blocks respectively represent the number of basic blocks contained in the control flow graph of the two code segments in the similar code pair.

[0131] A202, analyze the similarity of program execution path (sequential execution, conditional branching, loop structure), and get the execution path similarity.

[0132] Execution path similarity = |same path number| / |total path number|.

[0133] A203, compare the mode of control flow transfer, and get the branch structure similarity.

[0134] Branch structure similarity = |same branch structure number| / |total branch structure|.

[0135] A204, based on the above basic block similarity, execution path similarity and branch structure similarity, weighted sum, get CFG similarity. Specifically, the weights corresponding to the basic block similarity, execution path similarity and branch structure similarity are 0.3, 0.4 and 0.3 respectively.

[0136] A3, calculate DFG similarity based on data flow graph:

[0137] The structure analysis subunit compares the matching degree of data dependency relationship based on graph structure matching algorithm. This analysis focuses on the comparison of data flow mode, which is particularly effective for identifying vulnerability code with similar data processing logic. The specific analysis dimensions are as follows:

[0138] A301, compare the number and distribution of data dependency edges, and get the edge number similarity.

[0139] Edge number similarity = 1-||D1. edges |-|D2. edges || / max(|D1. edges |, |D2. edges |)。

[0140] D1. edges and D2. edges respectively represent the number of edges contained in the data flow graph of the two code segments in the similar code pair.

[0141] A302, analyze the definition of the variable using the similar pattern of the relationship to obtain the similarity of the dependency relationship.

[0142] Dependency relationship similarity = | number of same dependencies | / | total number of dependencies |.

[0143] A303, determine the similarity of the data flow path.

[0144] Data flow path similarity = | number of same data flow paths | / | total number of data flow paths |.

[0145] A304, based on the above edge number similarity, dependency relationship similarity and data flow path similarity, weighted sum is obtained to obtain the DFG similarity. Specifically, the weights corresponding to the edge number similarity, the dependency relationship similarity and the data flow path similarity are 0.2, 0.5 and 0.3 respectively.

[0146] The structure feature fusion unit is configured to perform weighted sum on the AST similarity, the CFG similarity and the DFG similarity to determine the structural similarity of the similar code pair.

[0147] Based on the structure feature analysis subunit and the structure feature fusion unit, the graph structure unit provided in the embodiment actually analyzes the code property graph from two levels of dimensions. The structure feature analysis subunit starts from the detailed features of the bottom layer of the code property graph, analyzes the specific features of the AST, CFG and DFG of the code property graph respectively, obtains the corresponding similarity and performs weighted sum to obtain the AST similarity, CFG similarity and DFG similarity of the upper layer; the structure feature fusion unit further performs weighted sum according to the AST similarity, CFG similarity and DFG similarity of the upper layer to obtain the structural similarity of the similar code pair. The similarity analysis method of the two levels can more comprehensively evaluate the structural similarity of the code property graph of the similar code pair.

[0148] The subgraph matching subunit uses the VF2 graph isomorphism algorithm to analyze the code property graphs associated with the two code fragments in the similar code pair, and takes the similarity score obtained by the analysis as the subgraph matching degree.

[0149] The structural similarity output by the structure feature fusion unit, the subgraph matching degree output by the structure feature fusion subunit and the semantic similarity output by the twin neural network unit are all input to the comprehensive unit for weighted sum, so that the comprehensive similarity can be obtained.

[0150] In order to further improve the processing speed of the vulnerability mining system, a Spark or ForkJoin distributed computing framework can also be used to distribute the analysis tasks to multiple computing nodes to realize parallel processing and improve the processing speed. Spark is an Apache open source big data processing engine that supports in-memory computing, and ForkJoin is a Java concurrent programming framework that uses a divide-and-conquer strategy to process parallel tasks.

[0151] Embodiment 3: In order to further understand the vulnerability mining system provided in Embodiment 1 or 2, this embodiment further describes the specific structure of the Siamese neural network included in the Siamese neural network unit and the pre-training process thereof.

[0152] Specifically, the present embodiment provides a vulnerability mining system based on source code similarity, which comprises a fine-grained positioning module, and the fine-grained positioning module comprises a Siamese neural network unit.

[0153] The Siamese neural network unit is configured to determine the semantic similarity of a similar code pair based on a Siamese neural network according to the feature information associated with the similar code pair.

[0154] Preferably, the Siamese neural network unit comprises a Siamese neural network with matched model parameters obtained through a pre-training process.

[0155] The Siamese neural network comprises a similarity calculation layer and two branch neural networks with the same structure, and the output ends of the two branch neural networks are connected to the input end of the similarity calculation layer; each of the two branch neural networks comprises a shared encoder that shares weight parameters with each other, and the input end of the convolution block included in the shared encoder is provided with a multi-head attention fusion module.

[0156] The multi-head attention fusion module is configured to perform weighted fusion on the token sequence in the feature information input into the branch neural network to which the multi-head attention fusion module belongs and the features corresponding to the code attribute graph based on attention weights, to obtain fused features; the attention weights are learned through the pre-training process.

[0157] The convolution block is configured to extract high-dimensional features based on the fused features as the output of the branch neural network in which the convolution block is located.

[0158] The similarity calculation layer is configured to determine the semantic similarity of the similar code pair based on the high-dimensional features.

[0159] The input features of the existing twin neural network are usually token sequences when used for text similarity recognition, so the input features can be directly and simply spliced and then sent to a shared encoder to extract high-dimensional features. However, the feature information in the embodiment is multi-dimensional, and in addition to including token sequences, it also includes a code attribute graph that integrates abstract syntax trees, control flow graphs and data flow graphs. If splicing is directly performed according to the prior art, it is equivalent to each input feature having the same importance for the twin neural network. However, in the embodiment, different vulnerability code fragments have different vulnerability types, and their manifestation in the feature information is different. For example, the root cause of the "C language buffer overflow" vulnerability is the absence of memory write length verification, which is specifically reflected in the presence or absence of a "length verification branch" in the control flow graph. The root cause of the "JavaScript code injection" vulnerability is the loss of control of the execution authority of user input, that is, the absence of input purification, which is specifically reflected in the direct dependency relationship between "input-execution" in the data flow graph. Therefore, the embodiment is improved based on the existing twin neural network, and a multi-head attention fusion module is arranged at the input end of the convolution block of the shared encoder of each branch neural network. Based on the attention weights learned through the pre-training process, the feature information input into the branch is weighted and fused, rather than being equally processed, so that the obtained fused features can highlight important features and suppress noise in the feature information, the perspective of the extracted features is also more rich, and thus the semantic similarity obtained by the twin neural network based on the fused features is more accurate.

[0160] Further specifically, as shown in Figures 3 to 5 The twin neural network includes two branch neural networks and a similarity calculation layer. A vulnerability code fragment in a similar code pair is input into one of the two branch neural networks as a code fragment A, and a suspicious code fragment in the similar code pair is input into the other of the two branch neural networks as a code fragment B, high-dimensional features corresponding to the two code fragments are obtained, and the high-dimensional features corresponding to the two code fragments are input into the similarity calculation layer for calculation to obtain the semantic similarity of the two code fragments in the similar code pair.

[0161] The branch neural network includes a pre-processing module, a shared encoder and a residual connection layer connected in sequence.

[0162] The pre-processing module includes a feature splicing layer and a linear projection layer.

[0163] The feature splicing layer is used to simply splice the feature information associated with the code fragments, that is, the token sequence (token feature vector), the abstract syntax tree (AST feature), the control flow graph (CFG feature) and the data flow graph (DFG feature), and align the multiple feature matrices of different sizes.

[0164] The linear projection layer is configured to linearly transform the high-dimensional feature matrix output by the feature stitching layer, and map the high-dimensional feature matrix to a low-dimensional feature space of the Siamese neural network to obtain a low-dimensional feature matrix, which is input into the shared encoder.

[0165] The shared encoder comprises, in sequence, a feature enhancement layer, a multi-head attention fusion module, and a convolution block. The feature enhancement layer performs feature enhancement on the low-dimensional feature matrix input through a ReLU function, and then inputs the feature enhancement result into the multi-head attention fusion module to perform feature fusion, so as to obtain fused features. The convolution block extracts high-dimensional features from the fused features and outputs the high-dimensional features. More specifically, the convolution block comprises, in sequence, three convolution layers, two fully connected layers, a ReLU function activation layer, and a dropout layer, so as to extract high-dimensional features from the fused features. The dropout layer is configured to reduce the risk of overfitting during training, and improve the generalization ability of the Siamese neural network. The dropout layer is only enabled during the training process, and is disabled when processing the source code to be analyzed.

[0166] The multi-head attention fusion module can use 8 attention heads, each of which has 96 dimensions, and the total output is 768-dimensional fused features. The multi-head attention fusion module can automatically learn which features are most important to the current code snippet during a pre-training process, so as to automatically assign different attention weights to the 768-dimensional fused features of different code snippets.

[0167] Taking detection of a buffer vulnerability in a code snippet as an example, the input features of the multi-head attention fusion module are as follows:

[0168] Token features: representing keywords such as “strcpy” and “buffer”;

[0169] AST features: representing function call nodes and variable declaration nodes;

[0170] CFG features: representing the execution path from the function entry to strcpy;

[0171] DFG features: representing the data flow from the input parameter to the buffer.

[0172] The above input features are simultaneously input into the 8 attention heads of the multi-head attention fusion module. Each attention head processes the input features based on the attention weight learned by the attention head, as follows:

[0173] Attention head 1: 70% focus on Token features (dangerous function name);

[0174] Attention head 2: 60% focus on DFG features (data flow path);

[0175] Attention head 3: 50% focus on AST features (syntax structure);

[0176] Attention head 4: 40% focus on CFG feature (control flow);

[0177] Other attention heads: focus on the combination of two or more of the above-mentioned four input features.

[0178] The various features extracted by the above-mentioned eight attention heads are fused to finally obtain a 768-dimensional vector, which includes the weighted information of all features and can comprehensively represent the fusion features of the code snippet.

[0179] The high-dimensional features extracted from the above-mentioned fusion features can be directly used as the output of the branch neural network where the convolution block of the shared encoder is located, or the high-dimensional features extracted by the convolution block can be input into the residual connection layer for further processing.

[0180] The residual connection layer performs residual connection on the high-dimensional features and the low-dimensional feature matrix input into the shared encoder, and then performs layer normalization processing, which is used as the output of the branch neural network where the residual connection layer is located, to prevent gradient vanishing and gradient explosion problems.

[0181] The similarity calculation layer is configured to determine the semantic similarity of the similar code pair based on the high-dimensional features output by the branch neural network.

[0182] Specifically, the similarity calculation layer can calculate the cosine similarity (cos_sim) and Euclidean distance (eucl_dist) of the high-dimensional features output by the two branch neural networks, and determine the semantic similarity of the two code snippets in the similar code pair based on the cosine similarity and Euclidean distance. Specifically, the semantic similarity has a value range of [0, 1].

[0183] Specifically, for the above-mentioned twin neural network, the pre-training process includes a pre-training process and a fine-tuning training process performed in sequence.

[0184] The pre-training process uses a pre-training data set to train the twin neural network; the pre-training data set includes a first positive sample pair and a first negative sample pair. The first positive sample pair and the first negative sample pair can be manually annotated based on a vulnerability pattern. The vulnerability pattern refers to a structured representation of a vulnerability at the code level, and is a code-level feature template defined for identifying a certain type of vulnerability, including syntax structure, data / control flow, judgment condition, etc.

[0185] The first positive sample pair includes two vulnerability code snippets with the same vulnerability pattern, or any two of the multiple variant code snippets of the same vulnerability pattern; the two code snippets in the first positive sample pair are written in the same high-level language.

[0186] That is, the two vulnerability code snippets in the first positive sample pair refer to two code snippets under the same or similar "vulnerability mode", which can be matched in structural features or data / control flow, and thus are determined to be similar.

[0187] The first negative sample pair includes a vulnerability code snippet and a fixed code snippet of the vulnerability code snippet, or a vulnerability code snippet and a normal code snippet that is functionally similar to the vulnerability code snippet and has no vulnerability; the two code snippets in the first negative sample pair are codes written using the same high-level language.

[0188] The above pre-training process enables the twin neural network to learn rich semantic information and context information contained in the code snippets written in the high-level language, and ensures the similarity recognition ability of the code snippets written in the same high-level language.

[0189] The fine-tuning training process uses a fine-tuning training dataset for training. The learning rate, the number of training rounds, and the data amount of the training set of the fine-tuning training process are 10% to 30% of those of the pre-training process.

[0190] The fine-tuning training dataset includes the converted LLVM IR code pairs of the second positive sample pair and the second negative sample pair.

[0191] The second positive sample pair includes a vulnerability code pair with the same vulnerability mode, or any two of the multiple variant code snippets of the same vulnerability mode; the two code snippets in the second positive sample pair are codes written using non-identical high-level languages.

[0192] For example, the vulnerability code pair in the second positive sample can be a C language code snippet with a buffer overflow vulnerability and a Java code snippet with an array out-of-bound access; or a Python code snippet with a command injection vulnerability and a JavaScript code snippet with a code injection vulnerability; or two code snippets written in different high-level languages with the same CVE vulnerability.

[0193] The second negative sample pair includes a vulnerability code snippet and a fixed code snippet of the vulnerability code snippet, or a vulnerability code snippet and a normal code snippet that is functionally similar to the vulnerability code snippet and has no vulnerability; the two code snippets in the second negative sample pair are codes written using non-identical high-level languages.

[0194] For example, the second negative sample pair can be a C language code snippet and a Java code snippet that implement the same function, the C language code snippet has a vulnerability, and the Java code snippet has no vulnerability; or a vulnerability Python code snippet and a fixed code snippet of the Python code snippet, the fixed code snippet is implemented using JavaScript.

[0195] The second positive sample pair and the second negative sample pair can be converted into corresponding LLVM IR code pairs using various conversion tools under Tokenizer, and different language identifiers such as [C], [Java], or [Python] are added for different languages. For variables involved in the code snippets, a static single assignment (SSA) is performed, and each variable is assigned only once, and finally a fine-tuning training data set is formed.

[0196] For example, for a C language code snippet, Clang can be used to generate its LLVM IR code snippet; for a Java code snippet, LLVM-Java can be used to generate its LLVM IR code snippet; and similar tools are available for other languages to generate unified LLVM IR code.

[0197] After the above LLVM IR code input feature representation module, the generated feature information is different from the feature information of the high-level language code. Specifically, in terms of Token sequence, LLVM IR code is standardized, while high-level language code has diversified expression methods; in terms of abstract syntax tree, LLVM IR code is basically a low-level instruction similar to assembly language, while high-level language contains many high-level syntax; in terms of control flow graph, corresponding to the abstract syntax tree, the control of LLVM IR code is at the instruction level, while the high-level language is at the statement level; and in terms of data flow graph, the variable name of LLVM IR code is an SSA value, while the high-level language retains the specific variable name.

[0198] Based on the differences between the feature information corresponding to the LLVM IR code and the high-level language, the twin neural network after the above pre-training and fine-tuning learns the different features of the high-level language and the LLVM IR code. Source code can provide more semantics, while IR code can provide precision. Different feature weight combinations exist for different vulnerability types, which allows the representation of high-level language and the representation of LLVM IR code to intelligently integrate various features through a multi-head attention mechanism, playing a complementary role, which can improve the semantic richness of the source code and the accuracy of the twin neural network recognition.

[0199] Based on the twin neural network obtained by sequentially performing the pre-training process and the fine-tuning process, the vulnerability mining system provided by the embodiment also adaptively includes a preprocessing module.

[0200] The preprocessing module is configured to determine whether the programming languages of the similar code pair are the same before the feature representation module extracts the feature information of the suspicious code segments in the similar code pair. If the programming languages are the same, the two code segments in the similar code pair are directly input into the feature representation module to extract the feature information associated with the two code segments. If the programming languages are different,

[0201] The two code segments in the similar code pair are converted into associated LLVM IR codes, and the LLVM IR codes are input into the feature representation module to extract the feature information associated with the two code segments.

[0202] That is, when processing the source code to be analyzed, for the similar code pair output by the coarse-grained positioning module, the preprocessing module is first used to determine whether the programming languages of the similar code pair are the same. If the programming languages are the same, the two code segments are directly input into the feature representation module. If the programming languages are different, the two code segments are converted into LLVM IR codes and then input into the feature representation module. The feature information associated with the two code segments is extracted, and the feature information associated with the two code segments in the similar code pair is input into the twin neural network unit in the fine-grained positioning module to determine the semantic similarity of the similar code pair.

[0203] In actual applications, the similar code pair identified by the coarse-grained positioning module can be written in the same programming language or different high-level languages. In order to enable the twin neural network to have the cross-language semantic similarity recognition capability, the training process including the pre-training process and the fine-tuning training process is provided. After the pre-training process enables the twin neural network to have a good semantic similarity recognition capability for the similar code pair written in the same high-level language, the twin neural network is fine-tuned using the LLVM IR code pair converted from the similar code pair formed by different high-level languages, so that the twin neural network also has a good semantic similarity recognition capability for the similar code pair formed by two code segments written in different high-level languages.

[0204] The existing vulnerability detection technology usually tends to convert all code snippets written in high-level languages into LLVM IR code, and then performs similarity recognition based on the LLVM IR code when solving cross-language problems. However, in general, the source code written in a high-level language carries rich semantic information, and after being converted into LLVM IR code, a certain degree of semantic loss is caused, so that the result accuracy of the similarity analysis based on the LLVM IR code is not ideal. The twin neural network obtained based on the above two-stage training process provided in the embodiment can still extract rich semantic information when processing similar code pairs written in the same high-level language, and can perform similarity recognition based on the LLVM IR code converted from the similar code pairs when processing similar code pairs written in different high-level languages, so as to have the semantic similarity recognition capability of cross languages while retaining the semantic similarity recognition capability of similar code pairs written in high-level languages. Therefore, the vulnerability mining system provided in the embodiment is significantly superior to the prior art in terms of precision, recall rate and processing speed, can effectively detect vulnerabilities after code obfuscation, supports multiple programming languages such as C, Java and Python, is suitable for large-scale code library analysis, and provides an efficient and accurate vulnerability mining solution for software security.

[0205] In addition, the embodiment provides a computer device, which comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the computer program is executed by the processor to implement the vulnerability mining system based on source code similarity according to the first to third embodiments.

[0206] In the description of the present application, it should be understood that the terms "first", "second" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" can explicitly or implicitly include one or more of the features. In the description of the present application, the meaning of "a plurality of" is two or more, unless otherwise specifically limited.

[0207] In the present application, unless otherwise specifically defined and limited, the terms "mounting", "connection", "connection", "fixing" and the like should be understood in a broad sense, for example, can be fixedly connected, or can be detachably connected, or can be integrated; can be mechanically connected, or can be electrically connected; can be directly connected, or can be indirectly connected through an intermediate medium; can be the internal communication of two elements or the interaction relationship between two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0208] In the present application, unless otherwise explicitly specified and limited, a first feature is "on" or "under" a second feature can mean that the first and second features are in direct contact, or the first and second features are in indirect contact through an intermediate medium. Moreover, a first feature is "over", "above" and "on top of" a second feature can mean that the first feature is directly above or obliquely above the second feature, or simply means that the first feature is horizontally higher than the second feature. A first feature is "under", "below" and "underneath" a second feature can mean that the first feature is directly below or obliquely below the second feature, or simply means that the first feature is horizontally lower than the second feature.

[0209] In the description of the present application, the description of the terms "one embodiment", "some embodiments", "embodiment", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are contained in at least one embodiment or example of the present application. In the present specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, the person skilled in the art can combine and combine the different embodiments or examples described in the present specification and the features of the different embodiments or examples without contradiction.

[0210] Although the embodiments of the present application have been shown and described above, it is understood that the above-described embodiments are exemplary and are not to be construed as limiting the present application, and the person skilled in the art can make changes, modifications, replacements and variations to the above-described embodiments within the scope of the present application.

Claims

1. A vulnerability mining system based on source code similarity, characterized by, The method comprises the following steps: a vulnerability feature library comprising a plurality of vulnerability code segments and feature information associated with each vulnerability code segment; the feature information comprises a token sequence and a code attribute graph of the vulnerability code segment; a coarse-grained positioning module configured to match the vulnerability feature library with source code by using an approximate nearest neighbor search algorithm to determine suspicious code segments similar to the vulnerability code segments in the source code based on the matching, and to form a similar code pair; a feature representation module configured to obtain feature information of the suspicious code segments; a fine-grained positioning module configured to determine a semantic similarity based on a twin neural network according to the feature information associated with the two code segments in a similar code pair, and to determine a structural similarity and a subgraph matching degree according to the code attribute graph in the feature information; and to determine a comprehensive similarity of the similar code pair by performing weighted summation based on the semantic similarity, the structural similarity and the subgraph matching degree; wherein a multi-head attention fusion module for fusing the feature information is arranged in a shared encoder of the twin neural network; a determination module configured to determine whether the suspicious code segments have vulnerabilities based on the comprehensive similarity.

2. The vulnerability mining system of claim 1, wherein, The fine-grained positioning module comprises: a twin neural network unit configured to determine a semantic similarity of a similar code pair based on a twin neural network according to the feature information associated with the two code segments in the similar code pair; a graph structure unit configured to obtain a structural similarity and a subgraph matching degree of a similar code pair based on a graph structure matching algorithm according to a code attribute graph associated with the two code segments in the similar code pair; a comprehensive unit configured to perform weighted summation based on the semantic similarity, the structural similarity and the subgraph matching degree as a comprehensive similarity.

3. The vulnerability mining system of claim 2, wherein, In the twin neural network unit, the determination of the semantic similarity of the similar code pair based on the twin neural network comprises: the twin neural network is a twin neural network obtained through a pre-training process and having matched model parameters; the twin neural network comprises a similarity calculation layer and two structurally identical branch neural networks, and the output ends of the two branch neural networks are connected to the input end of the similarity calculation layer; each of the two branch neural networks comprises a shared encoder sharing weight parameters with each other, and a multi-head attention fusion module is arranged at the input end of a convolution block included in the shared encoder; the multi-head attention fusion module is configured to fuse the features corresponding to the token sequence and the code attribute graph in the feature information input into the branch neural network to which the multi-head attention fusion module belongs based on attention weights, and to obtain fused features; the attention weights are learned through the pre-training process; the convolution block is configured to extract high-dimensional features based on the fused features as the output of the branch neural network in which the convolution block is located; the similarity calculation layer is configured to determine the semantic similarity of the similar code pair based on the high-dimensional features.

4. The vulnerability mining system of claim 3, wherein, the pre-training process comprises a pre-training process and a fine-tuning training process performed in sequence; the pre-training process uses a pre-training data set to train the twin neural network; The pre-training data set comprises: a first positive sample pair and a first negative sample pair; The first positive sample pair comprises: two vulnerability code segments with the same vulnerability mode, or any two of a plurality of variant code segments of the same vulnerability mode; the two code segments in the first positive sample pair are codes written using the same high-level language; The first negative sample pair comprises: a vulnerability code segment and a fixed code segment of the vulnerability code segment, or a vulnerability code segment and a normal code segment similar in function to the vulnerability code segment and free of vulnerabilities; the two code segments in the first negative sample pair are codes written using the same high-level language.

5. The vulnerability mining system of claim 4, wherein, The fine-tuning training process is trained using a fine-tuning training data set; The fine-tuning training data set comprises: a second positive sample pair and a second negative sample pair of converted LLVM IR code pairs; The second positive sample pair comprises: a vulnerability code pair with the same vulnerability mode, or any two of a plurality of variant code segments of the same vulnerability mode; the two code segments in the second positive sample pair are codes written using different high-level languages; The second negative sample pair comprises: a vulnerability code segment and a fixed code segment of the vulnerability code segment, or a vulnerability code segment and a normal code segment similar in function to the vulnerability code segment and free of vulnerabilities; the two code segments in the second negative sample pair are codes written using different high-level languages; The learning rate, the number of training rounds, and the data volume of the training set of the fine-tuning training process are 10% to 30% of those of the pre-training process.

6. The vulnerability mining system of claim 5, wherein, The vulnerability mining system further comprises: A preprocessing module is configured to determine whether the programming languages of the similar code pair are the same before the feature representation module obtains the feature information of the suspicious code segments in the similar code pair; if yes, the two code segments in the similar code pair are directly input into the feature representation module to extract the feature information associated with the two code segments, respectively; if not, The two code segments in the similar code pair are converted into associated LLVM IR codes, respectively, and the LLVM IR codes are input into the feature representation module to extract the feature information associated with the two code segments, respectively.

7. The vulnerability mining system of claim 2, wherein, The code attribute graph comprises: an abstract syntax tree of the vulnerability code segment or the suspicious code segment, and a control flow graph and a data flow graph embedded in the abstract syntax tree; The graph structure unit comprises: A structural feature analysis subunit is configured to compare the topological structures of the abstract syntax trees associated with the two code segments in the similar code pair based on the code attribute graph and according to a graph structure matching algorithm to determine an AST similarity; compare the control flow paths of the control flow graphs associated with the two code segments in the similar code pair to determine a CFG similarity; and compare the data dependency relationships of the data flow graphs associated with the two code segments in the similar code pair to determine a DFG similarity; A structural feature fusion subunit is configured to perform weighted summation on the AST similarity, the CFG similarity, and the DFG similarity to determine a structural similarity of the similar code pair.

8. The vulnerability mining system of claim 2, wherein, The graph structure unit further comprises: The subgraph matching subunit analyzes the code attribute graphs associated with the two code segments in the similar code pair using a VF2 graph isomorphism algorithm, and uses a similarity score obtained by the analysis as the subgraph matching degree.

9. The vulnerability mining system of claim 1, wherein, The vulnerability feature library further includes attribute information associated with each vulnerability code segment, and the attribute information includes a CVE number, a CWE type, and a CVSS score of the vulnerability code segment. The vulnerability mining system further includes: An output module configured to, when the determination module determines that a suspicious code segment in a similar code pair has a vulnerability, determine position information of the suspicious code segment, and output attribute information and position information of a vulnerability code segment in the similar code pair as a mining result to show the user the position and attribute of the vulnerability in the suspicious code segment.

10. A computer apparatus, comprising: The computer program is stored in the memory and executable on the processor, and when executed by the processor, implements the source code similarity-based vulnerability mining system of any one of claims 1 to 9. The computer program is stored in the memory and executable on the processor, and when executed by the processor, implements the source code similarity-based vulnerability mining system of any one of claims 1 to 9.

Images