Vulnerability risk positioning method and device based on source code analysis and storage medium

Abstract

The invention discloses a source code analysis-based vulnerability risk positioning method and device and a storage medium, and the method comprises the steps: combining static source code analysis and dynamic source code analysis, carrying out the modeling of a vulnerability code, fusing static features and dynamic features extracted from the vulnerability code into a multi-modal feature vector, and carrying out the modeling of the multi-modal feature vector; then deep learning model training is performed by using a multi-modal feature vector, the model is continuously optimized, and finally, the vulnerability risk positioning method of AI large model intelligent auxiliary analysis is used to solve the problem that static analysis and dynamic analysis are mutually independent and cannot combine the advantages of the static analysis and the dynamic analysis by fusing the advantages of the static analysis and the dynamic analysis in the prior art. Meanwhile, the method is combined with AI large model intelligent auxiliary analysis, the false alarm rate is finally reduced (experiments show that the false alarm rate can be reduced by 30% or above), intelligent repair suggestions are provided, in addition, the method is combined with graphical display of the function call relation, the accuracy of vulnerability positioning is further improved, and clear repair guidance is provided for developers.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of vulnerability identification and repair, in particular to a vulnerability risk positioning method and device based on source code analysis and a storage medium. BACKGROUND

[0002] With the increasing complexity of software development, security problems have become an important challenge in software engineering. Source code vulnerability analysis is an effective means to identify and repair software security vulnerabilities. Source code analysis methods are mainly divided into static analysis and dynamic analysis. Among them, static analysis can quickly detect potential vulnerabilities without executing the program, but the analysis results of static analysis are limited by static code features, so it cannot accurately reflect the dynamic behavior of the program in actual operation, resulting in serious false negatives and false positives. Dynamic analysis can capture real vulnerability performance by actually executing the program to obtain runtime data, but dynamic analysis depends on complex test environment and high test coverage, and if the test is not comprehensive, potential vulnerabilities may still be missed. Therefore, how to effectively combine the advantages of static analysis and dynamic analysis to improve the accuracy and coverage of vulnerability detection and achieve comprehensive and accurate identification of potential vulnerabilities has become a problem to be solved. SUMMARY

[0003] The present application provides a vulnerability risk positioning method and device based on source code analysis and a storage medium to solve the problem that the existing technology cannot effectively combine the advantages of static analysis and dynamic analysis to improve the accuracy and coverage of vulnerability detection and achieve comprehensive and accurate identification of potential vulnerabilities.

[0004] In a first aspect, the present application provides a vulnerability risk positioning method based on source code analysis, which comprises: constructing a vulnerability source code sample set according to the vulnerability source code obtained, wherein the vulnerability source code sample set includes vulnerability source code, a function set related to vulnerability, vulnerability type, vulnerability number, vulnerability harm level and repair scheme; Based on the vulnerability source code sample set, an abstract syntax tree (AST) is constructed, and a control flow graph (CFG) and a data flow graph (DFG) are generated according to the abstract syntax tree, and structured information is extracted from the control flow graph and the data flow graph to generate a static feature vector (Fstatic); The running of the vulnerability source code is monitored by means of a plug-in method, the function call and data flow information in the actual execution process are obtained, the plug-in points of the vulnerability source code are determined by static analysis and the dynamic data feature values generated by the plug-in points are collected, the extracted dynamic data feature values are combined into a vector to form a dynamic feature vector (Fdynamic) of the vulnerability source code; The static feature vector and the dynamic feature vector are fused to generate a multi-modal feature vector; The AI model is a deep learning model, and a convolutional neural network (CNN) is used as a model training basis; The multi-modal features are input into the AI model for training until the AI model converges, and a trained AI model is obtained. The static feature vector and the dynamic feature vector of the source code to be analyzed are extracted, and the extracted static feature vector and dynamic feature vector are fused into a multi-modal feature vector. The multi-modal feature vector and the source code to be analyzed are input into the trained AI model to identify the potential vulnerability type, vulnerability location, and repair scheme of the source code to be analyzed, and the identification result is graphically displayed.

[0005] Optionally, the vulnerability source code sample set is constructed according to the obtained vulnerability source code, including: An automated vulnerability source code model is established, and the obtained vulnerability source code is subjected to static analysis, code context extraction, and cross-version comparison by using the automated vulnerability source code model to obtain the vulnerability source code, a function set related to the vulnerability, a vulnerability type, a vulnerability number, a vulnerability harm level, and a repair scheme of the vulnerability source code, and a vulnerability source code sample set is constructed.

[0006] Optionally, the abstract syntax tree is constructed based on the vulnerability source code sample set, including: performing lexical analysis and syntax analysis on the vulnerability source code, extracting structured information from the vulnerability source code, and constructing the abstract syntax tree.

[0007] Optionally, the abstract syntax tree is constructed by performing lexical analysis and syntax analysis on the vulnerability source code, extracting structured information from the vulnerability source code, and constructing the abstract syntax tree, including: The vulnerability source code is simplified into a series of nodes and edges, and function definitions, function call relationships, loop structures, and conditional judgment information are extracted and parsed. The tree-shaped data structure of the vulnerability source code structure is abstractly represented by nodes and edges, and the abstract syntax tree is constructed to visually display the logical composition of the vulnerability source code.

[0008] Optionally, the control flow graph is generated according to the abstract syntax tree, including: extracting control structures and jump instructions from the abstract syntax tree, converting the extracted control structures and jump instructions into a graphical representation, and forming a control flow graph of the program, wherein the nodes in the control flow graph represent basic blocks in the code, and the edges represent the jump paths of the control flow, and CFG = BuildCFG(AST).

[0009] Optionally, the data flow graph is generated according to the abstract syntax tree, including: identifying definitions, uses and assignment operations of all variables in the abstract syntax tree, and establishing a data flow graph according to the dependency relationship between the variables, wherein nodes in the data flow graph are represented as variables, and edges represent data transmission relationships between the variables: DFG = BuildDFG(AST).

[0010] Optionally, the static feature vector and the dynamic feature vector are subjected to multi-modal feature fusion to generate a multi-modal feature vector, including: splicing and fusing the static feature vector and the dynamic feature vector to generate the multi-modal feature vector, assuming that the dimension of the static feature vector Fstatic is d1, the dimension of the dynamic feature vector Fdynamic is d2, and the dimension of the multi-modal feature vector Fmulti generated by splicing and fusion is (d1+d2): Fmulti = [Fstatic, Fdynamic].

[0011] Optionally, during the training of the AI model, a mean square error is used as a loss function to calculate the average of the square difference between the predicted value and the true value, so that the average is less than a preset threshold, so as to continuously optimize the parameters of the AI model, wherein the loss function N is the number of samples, is the true value of the i th sample, is the predicted value of the i th sample, represents the square of the difference between the true value and the predicted value of the i th sample, and is used to measure the error of a single sample.

[0012] In a second aspect, the present application provides a vulnerability risk positioning device based on source code analysis, the device comprising: A construction unit is configured to construct a vulnerability source code sample set according to the obtained vulnerability source code, wherein the vulnerability source code sample set includes vulnerability source code, a function set related to vulnerability, vulnerability type, vulnerability number, vulnerability damage level and repair scheme; A static feature processing unit is configured to construct an abstract syntax tree AST based on the vulnerability source code sample set, and generate a control flow graph CFG and a data flow graph DFG according to the abstract syntax tree, and extract structured information from the control flow graph and the data flow graph to generate a static feature vector Fstatic; A dynamic feature processing unit is configured to monitor the running of the vulnerability source code by means of a plug-in method, acquire function calls and data flow information in the actual execution process, determine a plug-in point of the vulnerability source code by means of static analysis and collect dynamic data feature values generated by the plug-in point, combine the extracted dynamic data feature values into a vector to form a dynamic feature vector Fdynamic of the vulnerability source code; a feature fusion unit configured to perform multi-modal feature fusion on the static feature vector and the dynamic feature vector to generate a multi-modal feature vector; a training unit configured to establish an AI model, input the multi-modal feature into the AI model for training until the AI model converges, and obtain a trained AI model, wherein the architecture of the AI model is a deep learning model, and a convolutional neural network (CNN) is used as a model training basis; a recognition unit configured to extract a static feature vector and a dynamic feature vector of a source code to be analyzed, fuse the extracted static feature vector and dynamic feature vector into a multi-modal feature vector, input the multi-modal feature vector and the source code to be analyzed into the trained AI model, recognize a potential vulnerability type, vulnerability position, and repair scheme of the source code to be analyzed, and graphically display the recognition result.

[0013] In a third aspect, the present application provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the program is executed by a processor to implement any of the methods described above.

[0014] The present application has the following advantages: The present application combines static source code analysis and dynamic source code analysis, fuses the extracted static features and dynamic features in the vulnerability code into a multi-modal feature vector through modeling of the vulnerability code, uses the multi-modal feature vector for deep learning model training, continuously optimizes the model, and finally uses an AI large model to intelligently assist in analyzing the vulnerability risk positioning method, combines the advantages of static analysis and dynamic analysis, solves the problem that static analysis and dynamic analysis are independent of each other in the prior art and cannot combine the advantages of both. At the same time, the present application combines AI large model intelligent assistance analysis, finally reduces the false positive rate (experiments show that it can be reduced by more than 30%), provides intelligent repair suggestions, in addition, the present application combines graphical display of function call relationships, further improves the accuracy of vulnerability positioning, and provides clear repair guidance for developers.

[0015] The above description is only a summary of the technical solutions of the present application. In order to more clearly understand the technical means of the present application, the content of the specification can be implemented, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific embodiments of the present application are described below. BRIEF DESCRIPTION OF DRAWINGS

[0016] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included only to illustrate preferred embodiments and are not intended to limit the present application. Moreover, the same reference numbers in the entire drawings designate the same elements. In the drawings: Figure 1is a flow diagram of a vulnerability risk positioning method based on source code analysis provided by an embodiment of the present application; Figure 2 is a flow diagram of another vulnerability risk positioning method based on source code analysis provided by an embodiment of the present application; Figure 3 is a flow diagram of still another vulnerability risk positioning method based on source code analysis provided by an embodiment of the present application; Figure 4 is a structural diagram of another vulnerability risk positioning device based on source code analysis provided by an embodiment of the present application. DETAILED DESCRIPTION

[0017] The present application will be further described in detail below in combination with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0018] The existing static analysis can only analyze the static structure in the source code, and cannot reflect the dynamic behavior of the program in the actual running, especially in the complex business logic, dynamic input or multi-threading scene, which is easy to produce false positives or false negatives. Dynamic analysis requires executing the program and providing the corresponding test environment, and when the test coverage is not high, it is also impossible to capture all potential vulnerabilities. In addition, dynamic analysis usually requires large computing resources and runtime overhead, which affects the performance of the program, and the implementation and maintenance cost is high. In order to solve the above problems, an embodiment of the present application provides a vulnerability risk positioning method based on source code analysis, as shown in Figure 1 , the method comprises: S101, constructing a vulnerability source code sample set based on the acquired vulnerability source code; Wherein, the user can automatically obtain open source vulnerability information in different languages from various public vulnerability data sources, for example, open source vulnerability information in different languages can be obtained from websites such as NVD, CNVD, CNNVD, and the like, and the vulnerability source code sample set is constructed based on this; It should be noted that the vulnerability source code sample set in the embodiment of the present application includes vulnerability source code, vulnerability-related function set, vulnerability type, vulnerability number, vulnerability harm level and repair scheme, wherein, The vulnerability type in the embodiment of the present application includes but is not limited to buffer overflow, SQL injection, cross-site scripting XSS, command injection, integer overflow, format string vulnerability, use-after-free, double-free, information disclosure, identity authentication problem, authorization problem, configuration error, etc.

[0019] The vulnerability-related function set in the embodiment of the present application can be: F = { f 1,f 2,…, fn}, wherein, F represents a set of vulnerability functions, f i represents different functions in the set, i.e. different functions related to vulnerabilities; In implementation, the functions in the set of functions related to vulnerabilities in the embodiment of the present application are f i = {name, parameters, return_type, body}, name is the name of the function; parameters is the parameter list of the function; return_type is the return type of the function; body is the code body of the function, wherein the set of functions in the embodiment of the present application is related to vulnerabilities, and can be set according to actual conditions, which is not specifically limited by the present application; Wherein, the vulnerability number in the embodiment of the present application is to distinguish each vulnerability, and the specific vulnerability number can be identified by a tagging method. The vulnerability harm level in the embodiment of the present application can be set by a person according to the vulnerability harm degree, or the vulnerability harm level can be directly set according to the vulnerability type, etc., that is, in implementation, a person skilled in the art can also set other various ways to determine the vulnerability harm level according to actual needs, which is not specifically limited by the present application; the repair scheme in the embodiment of the present application is a scheme for repairing vulnerability code, which is specifically set according to different vulnerabilities.

[0020] Of course, the above vulnerability source code sample set is only an example of the present application, and in implementation, a person skilled in the art can set it according to actual needs, which is not specifically limited by the present application; Wherein, the automatic vulnerability source code model in the embodiment of the present application is a deep learning model, uses a convolutional neural network CNN as the training basis of the automatic vulnerability source code model, adjusts and optimizes the automatic vulnerability source code model by comparing the output data of the automatic vulnerability source code model with the expected data, and updates the parameters of the automatic vulnerability source code model using a gradient descent algorithm; The set of functions related to vulnerabilities, the vulnerability type and the vulnerability number of the existing vulnerability source code are used to train and optimize the automatic vulnerability source code model, so that the automatic vulnerability source code model can obtain the set of functions related to vulnerabilities, the vulnerability type, the vulnerability number, the vulnerability harm level and the vulnerability position in the vulnerability source code to be analyzed, thereby constructing a vulnerability source code sample set.

[0021] Specifically, the embodiment of the present application is to extract the vulnerability source code sample set from the existing vulnerability source code by the preset automatic vulnerability source code model, that is, since the existing vulnerability source code may have explicitly indicated the vulnerability position and vulnerability type information, and lacks the vulnerability related function set and vulnerability number, vulnerability damage level information, the present application can locate the vulnerability position by the automatic vulnerability source code model to determine the vulnerability related function set, in addition, in the specific implementation, the vulnerability related function set can also be directly determined according to the vulnerability type according to the existing experience, and the vulnerability damage level is further determined according to the vulnerability type, etc.

[0022] In addition, in the specific implementation, the automatic vulnerability source code model in the embodiment of the present application adopts a deep learning model, uses a convolutional neural network CNN as a model training basis, adjusts and optimizes the model by comparing the model output data with the expected data, and updates the model parameters by using a gradient descent algorithm; and the present application adjusts and optimizes the automatic vulnerability source code model, so that the automatic vulnerability source code model can quickly and accurately construct the vulnerability source code sample set based on the vulnerability source code.

[0023] Of course, in the specific implementation, the embodiment of the present application can also train and optimize the automatic vulnerability source code model by using the vulnerability type, the repair scheme, the vulnerability context function set and the repair scheme, so that the automatic vulnerability source code model can accurately extract the vulnerability type, the vulnerability position and the corresponding repair scheme and other information from the vulnerability source code, thereby constructing the vulnerability source code sample set.

[0024] It should be noted that the automatic vulnerability source code model of the embodiment of the present application is essentially one or more programs, by inputting the obtained vulnerability source code into the automatic vulnerability source code model, and by the automatic vulnerability source code model to perform static analysis, code context extraction and cross-version comparison on the vulnerability source code, the vulnerability type, position and corresponding repair scheme of the vulnerability source code can be obtained, and the vulnerability source code sample set can be constructed by further arranging.

[0025] Specifically, the embodiment of the present application is to input the component name, version and corresponding vulnerability repair scheme of the vulnerability extracted from the obtained vulnerability source code into the automatic vulnerability source code model; then the automatic vulnerability source code model automatically obtains the source code package of the open source component containing the vulnerability and the source code package of the open source component not containing the vulnerability according to the component name and version of the vulnerability, and automatically extracts the vulnerable vulnerability code fragment from the source code package containing the vulnerability, and extracts the corresponding repair code fragment from the source code package not containing the vulnerability; then the vulnerability metadata is grabbed through the API, and the source code packages containing the vulnerability version and the repair version are automatically downloaded according to the component name and version number of the vulnerability; then further according to the vulnerability repair information, the vulnerability code fragment and the corresponding repair code fragment, the context code fragment of the vulnerability source code is extracted by combining the static analysis tool, for subsequent static analysis and dynamic analysis, and the source code containing the vulnerability version and the repair version is subjected to static analysis: the code change fragment in the repair patch is extracted through git diff, and based on the patch change position, the defect code line in the vulnerability version is reversely positioned, the context features of the vulnerability code are extracted by extracting the vulnerability function call chain to identify the hierarchical relationship of the called vulnerability function.

[0026] S102, based on the vulnerability source code sample set, an Abstract Syntax Tree (AST) is constructed, and a Control Flow Graph (CFG) and a DataFlow Diagram (DFG) are generated according to the Abstract Syntax Tree AST, and then structured information is extracted from the control flow graph and the data flow graph to generate a static feature vector Fstatic; In specific implementation, the Abstract Syntax Tree AST in the embodiment of the present application includes: performing lexical analysis and syntax analysis on the vulnerability source code, extracting structured information from the vulnerability source code, i.e. simplifying the vulnerability source code into a series of nodes and edges, and parsing and extracting function definition, function call relationship, loop structure and conditional judgment information, abstractly representing the tree-shaped data structure of the vulnerability source code structure through nodes and edges, and constructing the Abstract Syntax Tree to intuitively display the logical composition of the vulnerability source code; It can be understood that the embodiment of the present application performs lexical analysis and syntax analysis on the vulnerability source code in the sample set to be analyzed, extracts structured information from the source code, and provides a basis for subsequent analysis. The Abstract Syntax Tree is a tree-shaped data structure that abstractly represents the structure of the source code, and intuitively displays the logical composition of the code. Through the AST, the complex structure of the programming language is simplified into a series of nodes and edges, thereby facilitating program understanding and operation.

[0027] Further, in the embodiment of the present application, the control flow graph CFG and the data flow graph DFG are generated according to the abstract syntax tree AST, comprising: extracting control structures and jump instructions from the abstract syntax tree AST, converting these control structures and jump instructions into graphical representation, forming the control flow graph CFG of the program, the nodes in the control flow graph represent the basic blocks in the code, and the edges represent the jump paths of the control flow, CFG = BuildCFG(AST), wherein CFG is the control flow graph constructed, and AST is the abstract syntax tree obtained in the previous step.

[0028] That is, in the embodiment of the present application, the definition, use and assignment operation of all variables in the abstract syntax tree AST are identified, and the data flow graph is established according to the dependency relationship between the variables, the nodes in the data flow graph are represented as variables, and the edges represent the data transmission relationship between the variables: DFG = BuildDFG(AST), wherein DFG is the generated data flow graph, and AST is the abstract syntax tree.

[0029] It should be noted that the control flow graph in the embodiment of the present application is a graph structure reflecting the execution path of the program, and shows the jump relationship between the statements in the execution process. The data flow graph is a graph structure reflecting the data flow in the program, and is used to analyze the dependency relationship between the variables in the program. In the embodiment of the present application, the declaration, assignment and use information of the variables are extracted from the abstract syntax tree of the vulnerability source code in the sample set, and the data flow graph is generated through data flow analysis.

[0030] In general, in the embodiment of the present application, the structured information is extracted from the generated abstract syntax tree AST, control flow graph CFG and data flow graph DFG, and graph2vec (graph2vec: Learning Distributed Representations of Graphs) is used to convert the graph into a vector, and finally a static feature vector Fstatic = graph2vec [AST, CFG, DFG] is generated. S103, the function call and data flow information in the actual execution process are obtained by monitoring the running of the vulnerability source code through the insertion method, the insertion point of the vulnerability source code is determined through static analysis, and the dynamic data feature value generated by the insertion point is collected, the extracted dynamic data feature value is combined into a vector, and a dynamic feature vector Fdynamic of the vulnerability source code is formed. Specifically, in the embodiment of the present application, the runtime monitoring of the vulnerability source code is performed through the insertion technology, and the function call and data flow information in the actual execution process are obtained. That is, the runtime data is collected by inserting specific monitoring code into the source code. In other words, the vulnerability function call information, variable value change and other information in the runtime are collected through insertion.

[0031] Specifically, the embodiment of the present application determines the instrumentation points of the program through static analysis, such as function calls, conditional judgments, loop bodies, etc. By inserting monitoring code in the source code, information such as function call conditions and data flow changes is recorded. Then the program is executed, and the dynamic data generated by instrumentation is collected DynamicData = Instrumentation(Program), wherein DynamicData is the dynamic data obtained through the instrumentation technology, and Program is the program after the instrumentation processing. Finally, the extracted dynamic data feature values are combined into a vector, that is, the dynamic feature vector Fdynamic of the program is obtained.

[0032] S104, the static feature vector and the dynamic feature vector are fused to generate a multi-modal feature vector; Specifically, the embodiment of the present application combines static features and dynamic features after they are extracted respectively, and performs multi-modal feature fusion to generate a multi-modal feature vector. That is, the static feature vector Fstatic and the dynamic feature vector Fdynamic are spliced and fused, and the spliced feature vector is used as the multi-modal feature vector.

[0033] For example, assuming that Fstatic is a static feature vector with a dimension of (d1), Fdynamic is a dynamic feature vector with a dimension of (d2), and the spliced feature vector Fmulti has a dimension of (d1+d2): Fmulti = [Fstatic, Fdynamic] Among them, the embodiment of the present application splices and fuses different feature vectors to form a longer feature vector. That is, the static feature vector and the dynamic feature vector are spliced, and the spliced feature vector is used as the multi-modal feature vector. For example, the static and dynamic feature vectors extracted from the existing vulnerability source code through the above steps are as follows: the static feature vector Fstatic = [3, 2, 4, 5], wherein the number of functions is 3, the number of loop structures is 2, the number of conditional judgments is 4, and the number of variables is 5; the dynamic feature vector Fdynamic = [10, 50, 6, 0], wherein the function call frequency is 10, the execution time (ms) is 50, the memory usage (MB) is 6, and the number of exceptions is 0. The multi-modal feature vector after splicing and fusion is Fmulti = [3, 2, 4, 5, 10, 50, 6, 0].

[0034] That is, the application effectively integrates the workflows and mechanisms of static and dynamic analysis, ensures the complementarity of the two analysis methods, and improves the comprehensiveness and accuracy of vulnerability detection. Simply put, the application effectively reduces false positives and false negatives by combining the two analysis methods.

[0035] S105, constructing an AI model, and inputting the multi-modal features into the AI model for training until the AI model converges, obtaining a trained AI model; Wherein, the architecture of the AI model in the embodiment of the application is a deep learning model, and a convolutional neural network CNN is used as the basis for model training, that is, the embodiment of the application classifies and detects vulnerability codes by using machine learning technology.

[0036] In specific implementation, the step of constructing the AI model in the embodiment of the application specifically includes: The vulnerability source code sample set obtained in step S101 is used as a data set for AI model training, static features Fstatic and dynamic features Fdynamic of the source code in the data set are extracted, and are further fused into multi-modal features Fmulti as input of the AI model.

[0037] Wherein, the AI model architecture in the embodiment of the application adopts a deep learning model, uses a convolutional neural network CNN as the basis for model training, and combines the multi-modal features fused from the static feature vector and the dynamic feature vector for training. First, the multi-modal feature vector obtained in the multi-modal feature fusion stage is used as model input data, and the model parameters are optimized by using existing vulnerability information.

[0038] The output of the AI model is a vulnerability risk positioning result. The model will predict whether the tested source code has a vulnerability according to the input multi-modal feature vector, and mark the specific vulnerability type. For example: “0” indicates that the code has no vulnerability, “1” indicates that the code has an SQL injection vulnerability, “2” indicates an XSS vulnerability, etc.

[0039] In specific implementation, the embodiment of the application inputs the multi-modal features of the sample set obtained by modeling the vulnerability code into the CNN model of the AI model for training, and outputs prediction results such as whether there is a vulnerability and the vulnerability type. The vulnerability information of the source code (whether it contains a vulnerability, and if it does, the vulnerability type) is used as feedback information for model training to adjust the model parameters until the AI model converges. Through repeated training and adjustment, the AI model can gradually improve the recognition ability of the source code vulnerability, and finally output accurate vulnerability prediction results.

[0040] Through the process of pre-training and fine-tuning, a high-accuracy and high-efficiency vulnerability detection AI model is finally obtained, which can identify potential vulnerabilities in source code in real time and provide repair suggestions, thereby greatly improving the automation and intelligence level of vulnerability repair.

[0041] In the process of training the AI model, the mean square error is used as the loss function, which is calculated by the average value of the square difference between the predicted value and the true value, and the model parameters are constantly optimized. The calculation formula of the loss function is as follows: Wherein, N is the number of samples, is the true value of the i th sample, is the predicted value of the i th sample, represents the square of the difference between the true value and the predicted value of the i th sample, which is used to measure the error of a single sample.

[0042] That is, the embodiment of the application compares the identified potential vulnerabilities of the source code to be analyzed with the actual vulnerabilities of the source code to be analyzed, and optimizes the AI model according to the comparison result to obtain the final AI model.

[0043] That is, the embodiment of the application models the vulnerability code, extracts the static features and dynamic features of the vulnerability code, fuses the static features and dynamic features into a multi-modal feature vector, and then uses the multi-modal feature vector for deep learning model training, constantly optimizes the model, covers the static logic and runtime context of the code, and improves the detection coverage. Finally, through AI large model intelligent auxiliary analysis, the false positive rate is reduced (experiments show that it can be reduced by more than 30%), and intelligent repair suggestions are provided.

[0044] S106, extract the static feature vector and dynamic feature vector of the source code to be analyzed, and fuse the extracted static feature vector and dynamic feature vector into a multi-modal feature vector, input the multi-modal feature vector into the trained AI model, identify the type, location and repair scheme of the potential vulnerabilities of the source code to be analyzed, and display the identification result in a graphical manner.

[0045] In specific implementation, through the AI model of the application, not only can the vulnerability be located in the source code, but also a detailed security report can be generated according to the type, location and impact range of the vulnerability, so as to help developers repair the vulnerability in time. And with the continuous optimization of AI model training, its accuracy, efficiency and generalization ability will gradually improve, and finally realize efficient and accurate vulnerability detection and repair.

[0046] In summary, the method described in the embodiments of the present application combines static source code analysis and dynamic source code analysis to propose a vulnerability risk positioning method, which effectively makes up for the deficiencies of traditional methods in precision, coverage, and detection efficiency. Moreover, the present application displays the function call relationship in a graphical manner, combines static analysis source code information and dynamic analysis execution data, models the vulnerability code, extracts the static features and dynamic features of the vulnerability code, fuses the static features and dynamic features into a multi-modal feature vector, combines AI large model intelligent auxiliary analysis, and thus provides a more accurate and comprehensive vulnerability detection method. In actual use, the present application not only improves the detection precision and coverage, but also reduces false positives and false negatives through the organic combination of dynamic and static analysis, ensuring that developers can quickly and accurately locate and repair potential vulnerabilities.

[0047] In short, the method described in the embodiments of the present application effectively improves the efficiency of vulnerability detection, especially in the early development stage, which can cover more potential risk points while ensuring low computational overhead, avoiding the blind spots in traditional vulnerability detection methods, and ultimately achieving a balance between precision and efficiency, promoting the further development of vulnerability analysis technology.

[0048] The method described in the embodiments of the present application will be explained and described in detail below with reference to the accompanying drawings: Figure 2 and Figure 3 The method described in the embodiments of the present application will be explained and described in detail below with reference to the accompanying drawings: Referring to Figure 2 and Figure 3 The embodiments of the present application provide a vulnerability risk positioning method based on source code analysis, which comprises: S1. The step of constructing a vulnerability source code sample set: In the embodiments of the present application, the vulnerability source code sample set is realized based on an automatic vulnerability code model. The automatic vulnerability code model automatically collects, parses, and labels vulnerability codes from public vulnerability data sources by fusing static analysis, code context extraction, and cross-version comparison technology, and generates a training sample set containing vulnerability features, repair schemes, and multi-dimensional context. For vulnerability codes, a large number of source code samples and their corresponding labels (i.e. vulnerability types and positions) are collected, and then the vulnerability codes are modeled to construct a vulnerability source code sample set. The vulnerability source code sample set in the embodiments of the present application includes vulnerability source codes, vulnerability-related function sets, and information such as vulnerability types, vulnerability numbers, and vulnerability hazard levels. The sample set is continuously trained and optimized by the automatic vulnerability code model, so that the model can accurately obtain the vulnerability types and vulnerability-related function sets of all vulnerabilities, and finally a vulnerability source code sample set is constructed.

[0049] It should be noted that the vulnerability types in the embodiments of the present application include but are not limited to buffer overflow, SQL injection, cross-site scripting XSS, command injection, integer overflow, format string vulnerability,.use-after-free, double-free, information disclosure, authentication problem, authorization problem, configuration error, etc.

[0050] In specific implementation, the vulnerability function set of the embodiments of the present application can be represented as: F = { f 1, f 2,…, fn}wherein, F represents the vulnerability function set, f i represents each function in the set. In the vulnerability function set, each function f i = {name,parameters,return_type,body}, wherein: name is the name of the function; parameters is the parameter list of the function; return_type is the return type of the function; and body is the code body of the function.

[0051] The vulnerability damage level in the embodiments of the present application can generally be divided into the following levels: Critical: which can cause system crash, data loss or theft, etc.; High: which can cause sensitive data leakage, remote code execution, etc.; Medium: which can cause system performance degradation, partial function unavailability, etc.; Low: which can cause slight information leakage or affect user experience. Of course, in specific implementation, those skilled in the art can also set other various vulnerability damage levels, and the present application does not make specific limitation thereto.

[0052] In specific implementation, the steps of constructing the vulnerability source code sample set of the embodiments of the present application include: S11, the step of data collection and input; That is, open source vulnerability information involving different languages is automatically obtained from various public vulnerability data sources (NVD, CNVD, CNNVD website), including vulnerability type, component name and version affected by vulnerability, vulnerability repair information (such as GitHub historical vulnerability repair submission (Patch Commits), open source project security patch), etc. Label vulnerability type (such as CWE-79: XSS, CWE-89: SQL injection), vulnerability location (code line), repair scheme. Extract the component name and version containing the vulnerability and the corresponding repair version from the open source vulnerability information as the input of the model.

[0053] S12, the step of automatic acquisition; The embodiment of the application automatically downloads source code packages of open source components containing vulnerabilities and source code packages of open source components not containing vulnerabilities from an open source component website (such as a mavenrepository warehouse) according to the component name and version obtained from S11, and then automatically extracts vulnerable code fragments from the source code package containing vulnerabilities and extracts corresponding repair code fragments from the source code package not containing vulnerabilities.

[0054] That is, the automated vulnerability code model captures vulnerability metadata (such as CVE-2023-1234 affecting libfoo v1.0, and the repair version is v1.1) through an API. And according to the component name and version number, automatically download the source code package containing the vulnerability version (libfoo-v1.0) and the repair version (libfoo-v1.1).

[0055] S13, extracting vulnerability code analysis and features; Specifically, the present application extracts the context code fragments of the code in combination with a static analysis tool (such as Joern) according to the vulnerability repair information obtained from S11, the vulnerability code fragments and the non-vulnerability code fragments obtained from S12, for subsequent static analysis and dynamic analysis. The model performs static analysis on the source code of the vulnerability version and the repair version, and the static analysis includes difference comparison, vulnerability positioning and extraction of context features of vulnerability code, wherein, The difference comparison is to extract the code change fragments (such as deleting the dangerous function strcpy and adding input filtering logic) in the repair patch through git diff; the vulnerability positioning is to locate the defect code line (such as the unfiltered strcpy(dest, src) call) in the vulnerability version based on the patch change position; and the context features of the vulnerability code are extracted by extracting the vulnerability function call chain to identify the hierarchical relationship of the vulnerability function call (such as main() → parse_input() → strcpy()).

[0056] S14, model training and optimization; The present application uses the vulnerability-related feature data (including vulnerability type, repair scheme, vulnerability context function set, source code modification, etc.) extracted by the above steps to train and optimize the model. The vulnerability code model model architecture uses a deep learning model, uses a convolutional neural network CNN as the basis for model training, optimizes the model by comparing the data output by the model with the expected data, and updates the model parameters using a gradient descent algorithm (such as Adam, SGD, etc.). Finally, for each vulnerability, the model can obtain its vulnerability type and vulnerability-related function set information.

[0057] S15, sample set generation; For each open source vulnerability, the embodiment of the application extracts a vulnerability-related function set of the vulnerability code model, and stores the vulnerability type, vulnerability number, vulnerability damage level, vulnerability source code and the like in a sample set, and finally generates a vulnerability source code sample set.

[0058] S2, static feature extraction, specifically comprising: S21, a step of constructing an abstract syntax tree (AST); Specifically, the present application performs lexical analysis and syntax analysis on the vulnerability source code in the sample set to be analyzed, extracts structured information from the source code, and provides a basis for subsequent analysis. Abstract Syntax Tree (AST) is a tree-shaped data structure that abstractly represents the structure of source code. It presents the logical composition of the code in an intuitive way. Through AST, the complex structure of the programming language is simplified as a series of nodes and edges, which is convenient for program understanding and operation.

[0059] The specific process of constructing an abstract syntax tree (AST) is as follows: first, input the vulnerability source code in the sample set into an abstract syntax tree construction tool to parse the source code. Then extract function definitions, function call relationships, loop structures, conditional judgments and the like from the parsing results, and use these information for subsequent control flow graph (CFG) and data flow graph (DFG) construction.

[0060] The parsing algorithm of the embodiment of the present application uses existing static analysis tools, such as Clang front end or Python AST library. This step provides accurate static code structure for subsequent dynamic analysis and vulnerability detection.

[0061] S22, a step of generating a control flow graph (CFG): The control flow graph in the embodiment of the present application is a graph structure reflecting the execution path of the program, which shows the jump relationship between the statements in the execution process of the program. In this step, the control flow graph is generated based on the abstract syntax tree (AST).

[0062] In specific implementation, the step of generating a control flow graph (CFG) in the embodiment of the present application includes: first, extracting control structures (such as if statements, for loops, while loops, etc.) and jump instructions (such as break, continue, return, etc.) from the AST. Then, these control structures and jump instructions are converted into graphical representation to form the control flow graph (CFG) of the program. The nodes in the control flow graph represent the basic blocks in the code, and the edges represent the jump paths of the control flow. CFG = BuildCFG(AST), wherein CFG is the control flow graph constructed, and AST is the abstract syntax tree obtained in the previous step.

[0063] S23, a step of generating a data flow graph (DFG); The data flow graph in the embodiment of the present application is a graph structure reflecting the data flow in the program, which is used to analyze the dependency relationship between program variables. In this step, the declaration, assignment and use information of variables are extracted from the abstract syntax tree of the vulnerability source code in the sample set, and a data flow graph (DFG) is generated through data flow analysis.

[0064] Specifically, the specific steps of generating the data flow graph (DFG) in the embodiment of the present application are as follows: identifying the definition, use, assignment and other operations of all variables in the AST. According to the dependency relationship between variables (such as the value of one variable affecting the value of another variable), a data flow graph is established, and the nodes in the data flow graph are represented as variables, and the edges represent the data transmission relationship between variables. DFG = BuildDFG(AST), wherein DFG is the generated data flow graph, and AST is the abstract syntax tree.

[0065] S24, the step of static feature extraction: The structured information is extracted from the abstract syntax tree AST, the control flow graph CFG and the data flow graph DFG generated from S21, S22 and S23, the graph is converted into a vector using graph2vec (graph2vec: Learning Distributed Representations of Graphs), and finally a static feature vector is generated; Fstatic =graph2vec [AST, CFG, DFG]; S3, the step of dynamic feature extraction; The embodiment of the present application performs runtime monitoring on the program through the instrumentation technology, and obtains the function call and data flow information in the actual execution process. The instrumentation technology collects runtime data by inserting specific monitoring code into the source code. In this step, the runtime vulnerability function call information, variable value change and the like are mainly collected through instrumentation.

[0066] The instrumentation points of the program are determined through static analysis, such as function calls, conditional judgments, loop bodies and the like. Monitoring code is inserted into the source code to record function call conditions, data flow changes and the like. Then the program is executed, and the dynamic data generated by instrumentation is collected. DynamicData = Instrumentation(Program) Wherein, DynamicData is the dynamic data obtained through the instrumentation technology, and Program is the program processed through the instrumentation.

[0067] The dynamic data feature values extracted above are combined into a vector to form the dynamic feature vector Fdynamic = [DynamicData] of the program.

[0068] S4, a step of multi-modal feature fusion; Specifically, the embodiment of the present application combines static features and dynamic features after they are extracted respectively, performs multi-modal feature fusion, and generates a multi-modal feature vector. The static feature vector Fstatic and the dynamic feature vector Fdynamic are spliced and fused, and the spliced feature vector is taken as the multi-modal feature vector.

[0069] In view of the fact that the existing multi-modal fusion method usually simply splices or averages the static and dynamic features, without considering the feasibility of the code execution path, which may cause the model to pay excessive attention to the static features of the unreachable path, thereby causing false positives, the present application introduces a path-sensitive cross-modal attention mechanism to avoid false positives, that is, the feature fusion is guided by dynamic path constraints. Specifically, in the feature fusion layer, the path constraint condition generated by symbolic execution (such as input>0&&buffer_size<100) is introduced as prior knowledge for attention calculation. If the static features (such as branch paths in CFG) contradict the dynamic instrumentation data or the symbolic execution verification result (such as the path is actually unreachable), the weight of the features corresponding to the path is automatically reduced, thereby avoiding false positives and improving user experience.

[0070] Suppose Fstatic is a static feature vector with a dimension of (d1), Fdynamic is a dynamic feature vector with a dimension of (d2), and the spliced feature vector Fmulti has a dimension of (d1+d2): F multi = [F static, F dynamic ] In the embodiment of the present application, the spliced and fused feature vector is spliced together to form a longer feature vector. For example, the static feature vector and the dynamic feature vector are spliced. The spliced feature vector is taken as the multi-modal feature vector. For example, the static and dynamic feature vectors extracted from the existing vulnerability source code through the above steps are as follows: The static feature vector Fstatic = [3, 2, 4, 5], wherein the number of functions: 3, the number of loop structures: 2, the number of condition judgments: 4, and the number of variables: 5.

[0071] The dynamic feature vector Fdynamic = [10, 50, 6, 0], wherein the function call frequency: 10, the execution time (ms): 50, the memory usage (MB): 6, and the number of exceptions: 0.

[0072] The spliced and fused feature vector is: Fmulti = [3, 2, 4, 5, 10, 50, 6, 0] S5, the step of AI model construction and training: After the extraction of static features and dynamic features and the fusion of multi-modal features, the next step is to construct an AI model to classify and detect vulnerability codes using machine learning techniques.

[0073] S51, the step of data set preparation: The vulnerability source code sample set obtained by modeling the vulnerability code in step 1 is used as the data set for model training.

[0074] S52, the step of data set feature extraction: The present application extracts the static features (Fstatic) and dynamic features (Fdynamic) of the source code in the data set, further fuses them into multi-modal features (Fmulti), and combines the vulnerability source code sample set as the input of the model.

[0075] S53, the step of model architecture selection: The AI model architecture uses a deep learning model, using a convolutional neural network (CNN) as the basis for model training, and combining the multi-modal features obtained by fusing the static feature vector and the dynamic feature vector. First, the multi-modal feature vector obtained in the multi-modal feature fusion stage will be used as the input data of the model, and the model parameters will be optimized based on the existing vulnerability information.

[0076] The output of the model is the vulnerability risk positioning result. The model will predict whether the code has vulnerabilities based on the input features and mark the specific type of vulnerability. For example: an output of "0" indicates that the code has no vulnerabilities, "1" indicates that the code has SQL injection vulnerabilities, "2" indicates XSS vulnerabilities, etc.

[0077] S54, the step of model pre-training and fine-tuning: The multi-modal features of the sample set obtained by modeling the vulnerability code are input into the CNN model for training, and the prediction results of whether there are vulnerabilities and the type of vulnerabilities are output. The vulnerability information of the source code (whether it contains vulnerabilities, and if it does, the type of vulnerability) is used as feedback information for model training to adjust the model parameters until the model converges. Through repeated training and adjustment, the model can gradually improve its ability to identify vulnerabilities in source code, and finally output accurate vulnerability prediction results.

[0078] To address the problem that existing AI models rely only on code text or structural features and lack an understanding of program logic constraints, making it difficult to distinguish between real vulnerabilities and surface risks, the present application performs symbolic analysis on each vulnerability sample during the training phase to verify whether the vulnerability path is reachable, and inputs the result (Boolean value) as an additional label into the model, thereby improving the accuracy of model identification.

[0079] Through the process of pre-training and fine-tuning, a high-accuracy and high-efficiency vulnerability detection AI model is finally obtained. This model can identify potential vulnerabilities in source code in real time and provide repair suggestions, greatly improving the automation and intelligence level of vulnerability repair.

[0080] S55, loss function and optimization steps: During training, the mean square error is used as the loss function, which continuously optimizes the model parameters by calculating the average of the square difference between the predicted value and the true value. The calculation formula of the loss function is as follows: In practical applications, this model not only locates vulnerabilities in source code, but also generates detailed security reports according to the type, location and impact range of vulnerabilities, helping developers to repair vulnerabilities in a timely manner. With continuous optimization of model training, its accuracy, efficiency and generalization ability will gradually improve, and ultimately achieve efficient and accurate vulnerability detection and repair.

[0081] S56, online learning mechanism of dynamic verification feedback In view of the problem that the existing model is statically deployed after training and cannot be dynamically optimized according to the false positives / misses in actual application, the present application introduces an online learning mechanism of dynamic verification feedback, which automatically adds the false positive cases (the model predicts vulnerabilities but dynamic verification is safe) and the missed cases (not detected but actually exist vulnerabilities) found in actual deployment to the training set.

[0082] And through the incremental training of the model, it dynamically adapts to new vulnerability patterns. In specific implementation, the embodiment of the present application is realized through an automatic pipeline: user labels false positive / miss samples → triggers retraining → model updates and gray release.

[0083] In the continuous deployment scenario, the false positive rate of the control model is reduced by 5%-8% per month (relative to the static model).

[0084] S6, steps of vulnerability risk intelligent positioning: For the source code to be analyzed, its static features and dynamic features are extracted and fused into a multi-modal feature vector, which is input into the trained AI large model to locate the potential vulnerabilities of the source code to be analyzed. Referring to Figure 3 , the specific steps are as follows: For example, the specific implementation of detecting SQL injection vulnerabilities is as follows: S61, steps of inputting source code: String id = request.getParameter("id"); String query = "SELECT * FROM users WHERE id = " + id; Statement stmt = conn.createStatement(); ResultSet rs = stmt.executeQuery(query); / / Vulnerability S62, static feature extraction: extract the static feature Fstatic, the dimension is 256 S63, dynamic feature extraction: extract dynamic features Fdynamic, dimension is 256 S64, multimodal feature fusion: Static features and dynamic features are fused into a multimodal feature Fmulti with a dimension of 512. S65: Input the fused multimodal features into the AI ​​model to locate vulnerability risks and output: Classification result: SQL injection vulnerability (98% probability).

[0085] Positioning result: Mark the 4th line of code as the vulnerability point.

[0086] Repair suggestion: Replace with PreparedStatement and parameterize the query.

[0087] S7, Graphical Display To help developers intuitively understand the call hierarchy between functions and the vulnerability propagation path, this invention uses a graphical interface to display the function call relationship diagram, showing the call relationship, hierarchical structure, file path, etc. between each function. The graphical display of information such as the code line of potential vulnerabilities and function call paths helps developers quickly locate vulnerabilities.

[0088] The graphical display is generated using the existing visualization framework Graphviz, showing the call tree between functions, data flow paths, and potential security vulnerabilities. Specifically, the graphical display might show node A calling B and C, and node B calling D and E. Within the graphical interface, vulnerability detection tools can identify vulnerable functions and highlight them with color or special markers. For example, node B might be marked red to indicate a vulnerability.

[0089] Based on the graphical display of function calls, the system provides detailed information for each function, including: Function file name: Displays the source code file where the function is located.

[0090] File Path: Displays the full path of the file.

[0091] Function annotation: Show the description information of the function, help the developer understand the specific function of the function.

[0092] For example, when clicking on a certain function node in the graphical display, the interface will pop up the detailed information of the function: Function name: process_user_input File path: / src / user_input.c Line number: 150 Vulnerability type: SQL injection vulnerability Repair suggestion: Replace with PreparedStatement and parameterized query Annotation: Process user input and verify, if the input is illegal, return an error This display method not only helps developers understand the specific function of the function, but also helps quickly locate the source of possible vulnerabilities.

[0093] Overall, the graphical display method of the present application constructs a function call graph, identifies the call relationship between functions and its influence on vulnerability propagation. Through visual presentation of function call hierarchy, vulnerability risk and related information, the efficiency of vulnerability positioning and repair is improved.

[0094] Correspondingly, the embodiment of the present application also provides a vulnerability risk positioning device based on source code analysis, see Figure 4 , the device comprises: A construction unit for constructing a vulnerability source code sample set according to the obtained vulnerability source code, wherein the vulnerability source code sample set includes vulnerability source code, vulnerability-related function set, vulnerability type, vulnerability number, vulnerability damage level and repair scheme; The construction unit of the embodiment of the present application is to establish an automated vulnerability source code model, use the automated vulnerability source code model to perform static analysis, code context extraction and cross-version comparison on the obtained vulnerability source code, obtain the vulnerability source code, vulnerability-related function set, vulnerability type, vulnerability number and vulnerability damage level of the vulnerability source code, and perform labeling to construct the vulnerability source code sample set. Specifically, the automated vulnerability source code model in the embodiment of the present application is a deep learning model, uses a convolutional neural network CNN as the training basis of the automated vulnerability source code model, adjusts and optimizes the automated vulnerability source code model by comparing the output data of the automated vulnerability source code model with expected data, and updates the parameters of the automated vulnerability source code model using a gradient descent algorithm; at the same time, the construction unit in the embodiment of the present application is also used to train and optimize the automated vulnerability source code model using the vulnerability type, vulnerability-related function set and repair scheme, so that the automated vulnerability source code model can obtain the vulnerability source code, vulnerability-related function set, vulnerability type, vulnerability damage level, vulnerability location and corresponding repair scheme in the vulnerability source code to be analyzed.

[0095] a static feature processing unit configured to construct an abstract syntax tree (AST) based on the vulnerability source code sample set, generate a control flow graph (CFG) and a data flow graph (DFG) according to the abstract syntax tree, and extract structured information from the control flow graph and the data flow graph to generate a static feature vector (Fstatic); It should be noted that in the specific implementation, the static feature processing unit in the embodiment of the present application extracts control structures and jump instructions from the abstract syntax tree, converts the extracted control structures and jump instructions into graphical representations, forms a control flow graph of the program, wherein the nodes in the control flow graph represent basic blocks in the code, and the edges represent the jump paths of the control flow, CFG = BuildCFG(AST). Then all the definitions, uses and assignment operations of the variables in the abstract syntax tree are identified, and a data flow graph is established according to the dependency relationship between the variables, the nodes in the data flow graph are represented as variables, and the edges represent the data transmission relationship between the variables: DFG = BuildDFG(AST). Then the static feature vector and the dynamic feature vector are spliced and fused to generate the multi-modal feature vector, assuming that the dimension of the static feature vector Fstatic is d1, the dimension of the dynamic feature vector Fdynamic is d2, and the dimension of the multi-modal feature vector Fmulti generated by splicing and fusion is (d1 + d2): Fmulti = [Fstatic, Fdynamic].

[0096] a dynamic feature processing unit configured to monitor the execution of the vulnerability source code by means of a method of inserting a probe, to obtain function calls and data flow information in the actual execution process, to determine a probe point of the vulnerability source code by means of static analysis and to collect a dynamic data feature value generated by the probe point, to combine the extracted dynamic data feature value into a vector, and to form a dynamic feature vector Fdynamic of the vulnerability source code; a feature fusion unit configured to perform multi-modal feature fusion on the static feature vector and the dynamic feature vector, and to generate a multi-modal feature vector; a training unit configured to establish an AI model, to input the multi-modal feature into the AI model for training until the AI model converges, and to obtain a trained AI model, wherein the architecture of the AI model is a deep learning model, and a convolutional neural network (CNN) is used as a basis for model training. In a specific implementation, the training unit of the embodiment of the present application is further configured to use a mean square error as a loss function during the training of the AI model, to calculate the average value of the square difference between a predicted value and an actual value, and to make the average value less than a preset threshold, so as to continuously optimize the parameters of the AI model, wherein the loss function N is the number of samples, is the actual value of the i th sample, is the predicted value of the i th sample, represents the square of the difference between the actual value and the predicted value of the i th sample, and is used to measure the error of a single sample.

[0097] a recognition unit configured to extract a static feature vector and a dynamic feature vector of a source code to be analyzed, to fuse the extracted static feature vector and dynamic feature vector into a multi-modal feature vector, to input the multi-modal feature vector and the source code to be analyzed into the trained AI model, to recognize the potential vulnerability type, vulnerability position and repair scheme of the source code to be analyzed, and to graphically display the recognition result.

[0098] That is, the embodiment of the present application can fully utilize the advantages of static source code analysis and dynamic source code analysis by combining the two, thereby improving the accuracy, coverage and effectiveness of vulnerability detection.

[0099] The related content of the device embodiment of the present application can be understood by referring to the method embodiment of the present application, and will not be discussed in detail here.

[0100] In addition, the embodiment of the present application also provides a computer readable storage medium, and the storage medium stores a computer program, and the program is executed by a processor to implement the method of any one of the method embodiments of the present application. Specific implementation can be understood by referring to the method embodiment of the present application, and will not be discussed in detail here.

[0101] Overall, the embodiment of the present application is based on the known vulnerability source code to construct the vulnerability source code sample set, and according to the vulnerability source code sample set to build abstract syntax tree AST, control flow graph CFG and data flow graph DFG, and then get static feature vector and dynamic feature vector, then through the static feature vector and dynamic feature vector are multi-modal feature fusion, generate multi-modal feature vector, then use the multi-modal feature vector training obtains AI model, so that the trained AI model can accurately and quickly identify the potential vulnerability type, vulnerability location and repair scheme of the source code to be analyzed, finally the recognition result is graphically displayed, so that the user can quickly and accurately locate the vulnerability. Ultimately, it effectively solves the problem that the existing cannot effectively combine the advantages of static analysis and dynamic analysis to improve the accuracy and coverage of vulnerability detection, and realizes comprehensive and accurate identification of potential vulnerabilities.

[0102] Although the preferred embodiments of the present application have been disclosed for illustrative purposes, those skilled in the art will realize that various improvements, additions and substitutions are also possible, therefore, the scope of the present application should not be limited to the above embodiments.

Claims

1. A vulnerability risk positioning method based on source code analysis, characterized in that, The method comprises: According to the obtained vulnerability source code, a vulnerability source code sample set is constructed, wherein the vulnerability source code sample set comprises vulnerability source code, a vulnerability-related function set, a vulnerability type, a vulnerability number, a vulnerability harm level and a repair scheme; Based on the vulnerability source code sample set, an abstract syntax tree (AST) is constructed, and a control flow graph (CFG) and a data flow graph (DFG) are generated according to the abstract syntax tree, and structured information is extracted from the control flow graph and the data flow graph to generate a static feature vector (Fstatic); The running of the vulnerability source code is monitored by a method of inserting a plug-in, function calls and data flow information in the actual execution process are obtained, a plug-in point of the vulnerability source code is determined by static analysis, and dynamic data feature values generated by the plug-in point are collected, the extracted dynamic data feature values are combined into a vector, and a dynamic feature vector (Fdynamic) of the vulnerability source code is formed; The static feature vector and the dynamic feature vector are fused to generate a multi-modal feature vector; An AI model is established, wherein the AI model is a deep learning model, and a convolutional neural network (CNN) is used as a model training basis; The multi-modal feature vector is input into the AI model for training until the AI model converges, and a trained AI model is obtained; Static feature vectors and dynamic feature vectors of the source code to be analyzed are extracted, the extracted static feature vectors and dynamic feature vectors are fused into a multi-modal feature vector, the multi-modal feature vector and the source code to be analyzed are input into the trained AI model, potential vulnerability types, vulnerability positions and repair schemes of the source code to be analyzed are identified, and the identification results are graphically displayed.

2. The method of claim 1, wherein, The vulnerability source code sample set is constructed according to the obtained vulnerability source code, comprising: An automatic vulnerability source code model is established, and the automatic vulnerability source code model is used for static analysis, code context extraction and cross-version comparison of the obtained vulnerability source code, to obtain vulnerability source code, a vulnerability-related function set, a vulnerability type, a vulnerability number, a vulnerability harm level and a repair scheme of the vulnerability source code, and to construct the vulnerability source code sample set.

3. The method according to claim 1, characterized in that The abstract syntax tree is constructed based on the vulnerability source code sample set, comprising: The vulnerability source code is subjected to lexical analysis and syntax analysis, and structured information is extracted from the vulnerability source code to construct the abstract syntax tree.

4. The method of claim 3, wherein, The vulnerability source code is subjected to lexical analysis and syntax analysis, and structured information is extracted from the vulnerability source code to construct the abstract syntax tree, comprising: The vulnerability source code is simplified into a series of nodes and edges, and function definitions, function call relationships, loop structures and conditional judgment information are extracted and parsed, a tree-shaped data structure of the vulnerability source code structure is abstractly represented by nodes and edges, and the abstract syntax tree is constructed to intuitively display the logical composition of the vulnerability source code.

5. The method according to any one of claims 1 to 4, characterized in that, The control flow graph is generated according to the abstract syntax tree, comprising: The control structure and the jump instruction are extracted from the abstract syntax tree, the extracted control structure and the jump instruction are converted into a graphical representation, and a control flow graph of the program is formed, wherein a node in the control flow graph represents a basic block in the code, and an edge represents a jump path of the control flow.

6. The method according to any one of claims 1 to 4, characterized in that, According to the abstract syntax tree, a data flow graph is generated, including: In the abstract syntax tree, the definition, use and assignment operation of all variables are identified, and a data flow graph is established according to the dependency relationship between the variables, and the nodes in the data flow graph are represented as variables, and the edges represent the data transmission relationship between the variables.

7. The method according to any one of claims 1 to 4, characterized in that, The static feature vector and the dynamic feature vector are fused to generate a multi-modal feature vector, including: The static feature vector and the dynamic feature vector are spliced and fused to generate the multi-modal feature vector. Assuming that the dimension of the static feature vector Fstatic is d1, the dimension of the dynamic feature vector Fdynamic is d2, and the dimension of the multi-modal feature vector Fmulti generated by splicing and fusion is (d1+d2): Fmulti=[Fstatic,Fdynamic].

8. The method of any one of claims 1-4, wherein the device comprises: In the process of training the AI model, the mean square error is used as a loss function to calculate the average of the square difference between the predicted value and the true value, so that the average is less than a preset threshold, to continuously optimize the parameters of the AI model, wherein the loss function ; N is the number of samples, is the true value of the i-th sample, is the predicted value of the i-th sample, represents the square of the difference between the true value and the predicted value of the i-th sample, which is used to measure the error of a single sample.

9. A vulnerability risk positioning apparatus based on source code analysis, characterized by, The construction unit is configured to construct a vulnerability source code sample set according to the obtained vulnerability source code, wherein the vulnerability source code sample set includes vulnerability source code, a function set related to the vulnerability, a vulnerability type, a vulnerability number, a vulnerability harm level, and a repair scheme; The static feature processing unit is configured to construct an abstract syntax tree (AST) based on the vulnerability source code sample set, generate a control flow graph (CFG) and a data flow graph (DFG) according to the abstract syntax tree, and extract structured information from the control flow graph and the data flow graph to generate a static feature vector (Fstatic); The dynamic feature processing unit is configured to monitor the running of the vulnerability source code by using a method of inserting a plug-in, obtain function calls and data flow information in an actual execution process, determine a plug-in point of the vulnerability source code by static analysis, collect dynamic data feature values generated by the plug-in point, combine the extracted dynamic data feature values into a vector, and form a dynamic feature vector (Fdynamic) of the vulnerability source code. The feature fusion unit is configured to fuse the static feature vector and the dynamic feature vector to generate a multi-modal feature vector. The training unit is configured to establish an AI model, input the multi-modal feature into the AI model for training until the AI model converges, and obtain a trained AI model, wherein the architecture of the AI model is a deep learning model, and a convolutional neural network (CNN) is used as a basis for model training. The identification unit is configured to extract a static feature vector and a dynamic feature vector of the source code to be analyzed, fuse the extracted static feature vector and the dynamic feature vector into a multi-modal feature vector, input the multi-modal feature vector and the source code to be analyzed into the trained AI model, identify a potential vulnerability type, a vulnerability position and a repair scheme of the source code to be analyzed, and display the identification result in a graphical form. ​ 10. A computer readable storage medium, having stored thereon a computer program, which, when executed by a processor, implements the source code analysis based vulnerability risk positioning method according to any one of claims 1-8.

Images