A development specification pre-checking method and system running in conjunction with static scanning

Abstract

The application discloses a kind of development specification pre-checking method and system of runtime interception and static scanning linkage, it is related to software security and development specification detection technical field, including the following steps: target source code is carried out static scanning, extracts static information, constructs specification atlas;Key path node needing to be intercepted is identified based on specification atlas, and runtime interceptor is deployed in key path node;The behavior data collected by runtime interceptor is aligned with specification atlas on path, and runtime behavior track is generated;Runtime behavior track is used as the context input of rule judgment, and is jointly analyzed with specification atlas, and output rule violation record;According to rule violation record, mode analysis is carried out in combination with corresponding runtime behavior track, and specification feature is extracted;The application constructs static specification atlas and carries out dynamic space-time alignment in combination with runtime interceptor, solves the problem that static analysis and runtime detection are split, key risk node identification is not accurate and rule violation behavior lacks patternization refining.

Description

Technical Field

[0001] This invention relates to the field of software security and development specification detection technology, and more specifically, to a development specification pre-inspection method and system that combines runtime interception and static scanning. Background Technology

[0002] With the rapid increase in the scale and complexity of software systems, security and compliance issues in the software development process are becoming increasingly prominent. Development compliance pre-checking, as a crucial step in ensuring software quality and security, is receiving increasing attention from the industry. Traditional development compliance checks primarily rely on static code analysis techniques, which identify potential code defects and security risks by performing syntax parsing, control flow, and data flow analysis on the source code. These methods can detect problems in the early stages of software development, offering advantages such as strong preventative capabilities and broad detection coverage.

[0003] For example, the invention patent with publication number CN120408635A discloses a method for combined static and dynamic detection of security vulnerabilities in power system software. The method includes: acquiring static source code data and runtime dynamic behavior log data of the power system software; generating a hierarchical abstract syntax tree and structured time-series data; extracting multi-dimensional features from the static source code data and dynamic behavior log data based on a power system vulnerability knowledge graph; generating domain-constrained adversarial samples based on power protocol features and runtime anomaly features, and inputting these samples into a constructed hybrid detection model for adversarial training to obtain a trained hybrid detection model; and automatically detecting the power system software using the trained hybrid detection model, outputting detection results including the location of static code defects and dynamic attack paths. This achieves accurate detection of power system software vulnerabilities throughout their entire lifecycle, improving the network security protection capabilities of power systems.

[0004] For example, the invention patent with publication number CN117668851A discloses a security risk detection method, device, storage medium, and electronic device. The method includes: firstly determining the target controller layer code corresponding to the target controller in a static code security scanning scenario; determining a first tainted link based on the target controller layer code, wherein the first tainted link is a tainted link obtained after performing static code security scanning on the target controller layer code; then obtaining the target custom interceptor corresponding to the target controller and the target custom interceptor code corresponding to the target custom interceptor; performing tainted parameter detection processing on the first tainted link based on the target custom interceptor code to obtain a second tainted link; thereby determining the target tainted link based on the first tainted link and the second tainted link; and finally determining the security risk detection result corresponding to the target controller layer code based on the target tainted link.

[0005] The above-disclosed technical solutions have at least the following technical problems:

[0006] Existing critical path analysis methods largely rely on manual rules or simple control flow and data flow traversal, lacking quantitative assessment based on global dependencies and risk propagation. This can easily lead to unreasonable selection of interception points. Furthermore, traditional runtime detection methods are generally based on logs or simple call stack comparisons, lacking temporal dimensions and multimodal feature fusion, making it impossible to accurately determine whether behavioral trajectories truly conform to the compliant path. To address these issues, this invention proposes a solution. Summary of the Invention

[0007] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a development specification pre-inspection method and system that links runtime interception with static scanning. By constructing a static specification map and combining it with a runtime interceptor for dynamic spatiotemporal alignment, the method solves the problems of the separation between static analysis and runtime detection, inaccurate identification of key risk nodes, and lack of pattern refinement of violations in the prior art.

[0008] To achieve the above objectives, the present invention provides the following technical solution:

[0009] A development specification pre-inspection method that combines runtime interception and static scanning includes: performing static scanning on the target source code to extract static information and construct a specification graph; identifying key path nodes to be intercepted based on the specification graph and deploying runtime interceptors at these key path nodes; aligning the behavioral data collected by the runtime interceptors with the specification graph to generate runtime behavior trajectories; using the runtime behavior trajectories as context input for rule judgment and performing joint analysis with the specification graph to output violation records; and performing pattern analysis based on the violation records and the corresponding runtime behavior trajectories to extract specification features.

[0010] In a preferred embodiment, the static scanning of the target source code, extraction of static information, and construction of a canonical graph are specifically as follows: Syntactic parsing of the target source code to construct an abstract syntax tree; based on the abstract syntax tree, structured traversal of the target source code to extract semantic units, forming a unit set; establishing executable path edges between semantic units using control flow analysis methods, and establishing data dependency edges using data flow analysis methods, forming a dependency graph; identifying candidate nodes associated with a preset set of canonical rules based on the unit set and dependency graph, forming a candidate target set; binding labels to candidate targets according to the preset set of canonical rules, and completing the label attributes of indirect dependency nodes through adjacency relationships in the dependency graph, generating a set of semantically enhanced behavior nodes; constructing a call graph based on the set of semantically enhanced behavior nodes, and marking paths with risk labels in the call chain as paths requiring verification, forming a set of call paths; matching the set of call paths with a preset rule graph template using a subgraph matching algorithm, identifying path subgraphs with the same structure as a certain rule template, and cropping the matching fragments from the complete path to construct a set of sensitive behavior subgraphs; generating a canonical graph based on the set of sensitive behavior subgraphs.

[0011] In a preferred embodiment, the step of generating a standardized graph based on the set of sensitive behavior subgraphs is as follows: Multiple sets of rule-sensitive behavior subgraphs are obtained by matching static scanning with a rule graph template; based on the unique signature information of the code entity corresponding to each node in each subgraph, a unified processing is performed on the nodes in the multiple subgraphs to generate unique node identifiers, and nodes with the same identifier are merged to form a unified node set; the structural edges in each sensitive subgraph are mapped uniformly according to the node identifiers and then merged to generate a connected graph structure; standardized attributes are added to and merged with all nodes and edges in the connected graph structure, and integrity checks are performed to generate a static standardized graph; the static standardized graph is converted to a preset format and output to obtain the standardized graph.

[0012] In a preferred embodiment, the identification of critical path nodes to be intercepted based on the standardized graph and the deployment of runtime interceptors at these critical path nodes specifically involves: characterizing the nodes and edges in the standardized graph to generate a characteristic graph; inputting the characteristic graph into a graph neural network model to output the violation risk value for each node; using a risk weight-based label propagation algorithm, spreading the violation risk value from high-risk nodes along the graph structure to their directly or indirectly related nodes to obtain a set of potential risk nodes, and updating the comprehensive risk score for each node; using the comprehensive risk score as weights, simulating threat paths in the standardized graph, and using a Monte Carlo traversal algorithm to generate attack paths from external entry nodes to sensitive resource nodes; calculating the bottleneck degree and risk contribution rate of nodes in each attack path. The process involves selecting nodes with both high bottleneck and high risk contribution rates in high-risk paths to form a candidate set of key nodes. Lightweight runtime probes are deployed within this candidate set, and the interception benefit ratio of each candidate node is calculated based on a pre-defined performance-risk trade-off function, resulting in an interceptor deployment priority list. According to this priority list, nodes with high risk and low performance impact are prioritized for interceptor injection. The interceptors collect context information and performance data of the intercepted requests, concatenating them in time sequence to form a feature vector. This feature vector is then input into a pre-trained sequence modeling model, outputting a set of risk scores arranged in time series, along with the moving average of the score sequence. The moving average is compared with a pre-defined dynamic threshold to dynamically adjust the interception conditions and risk weights.

[0013] In a preferred embodiment, the step of aligning the behavioral data collected by the runtime interceptor with the canonical graph to generate runtime behavior trajectories is as follows: The deployed interceptor collects behavioral data of the target nodes; the behavioral data is uniformly encoded to generate multi-dimensional feature vectors, and combined with event timestamps to construct a temporal feature sequence representing runtime behavior; based on the canonical graph, the nodes and edges in the call path are extended in time dimension, and edge time constraints and execution order are assigned to form a temporal canonical graph; the temporal feature sequence and the temporal canonical graph are input into a spatiotemporal graph neural network model, which aligns runtime behavior with the dynamic spatiotemporal of the call path through node-level multimodal feature fusion and edge-level time dependency modeling; the path probability distribution of the trajectory is inferred through the spatiotemporal graph neural network model, high-probability runtime behavior trajectories conforming to the canonical graph path are selected, and abnormal nodes and abnormal path segments in the trajectory are marked.

[0014] In a preferred embodiment, the step of extending the nodes and edges in the call path according to the canonical graph by the time dimension, assigning time constraints and execution order to the edges, and forming a temporal canonical graph is as follows: traversing each node contained in the call path, and extracting the execution time window and timestamp of the node by combining static code analysis and call context information, and marking the time attribute into the corresponding node features; calculating the time interval constraint of adjacent nodes based on the call relationship and execution time information between adjacent nodes in the call path, and determining the time constraint of the edge; integrating the nodes with time attributes and the edges with time constraints to construct an initial temporal canonical graph with temporal features; performing structural and attribute standardization processing on the initial temporal canonical graph, unifying the graph format, and embedding canonical attribute fields to generate the final temporal canonical graph.

[0015] In a preferred embodiment, the dynamic spatiotemporal alignment of runtime behavior with the call path is specifically as follows: The node behavior at each time step in the temporal behavior feature sequence is combined with the features of the corresponding node in the temporal canonical graph to construct an initial representation vector for the node; the representations of neighboring nodes and the temporal dependency features of corresponding edges of each node in the temporal canonical graph are collected, and weighted aggregation is performed in combination with the node's own features to generate the node's neighbor context information; the weights of neighboring nodes are calculated using a temporal attention mechanism, and a message vector is generated by combining the neighboring node representations and edge features; the message vector is combined with the node's own representation, and the hidden state of the node is updated using a nonlinear activation function to form the node's representation in the current layer; the node representations of the entire behavior trajectory are aggregated according to the time sequence, and the spatiotemporal similarity between the trajectory and the call path is calculated using a dynamic time warping algorithm; the spatiotemporal similarity is compared with a preset threshold to determine whether the runtime behavior trajectory conforms to the call path, thus achieving the determination of dynamic spatiotemporal path alignment.

[0016] In a preferred embodiment, the step of using the runtime behavior trajectory as the context input for rule judgment and performing joint analysis with the standardized graph to output violation records is as follows: Based on the runtime behavior trajectory, features are extracted from the nodes and path edges in the trajectory to form a trajectory feature vector; using the temporal standardized graph as the rule basis and the trajectory feature vector as the behavior context, the features and time sequence of the corresponding nodes in the trajectory and the standardized graph are compared node by node; according to the preset matching rules, the attributes and time sequence of the trajectory nodes and the nodes in the standardized graph are compared to determine whether there is a violation; for the detected violation, a detailed violation record is generated by combining the rule number and risk value in the standardized graph.

[0017] In a preferred embodiment, the step of performing pattern analysis based on violation records and corresponding runtime behavior trajectories to extract normative features is as follows: Violation records are extracted from the violation database and linked to corresponding runtime behavior trajectories using unique identifiers to form a structured violation behavior trajectory dataset; multi-dimensional feature fusion is performed on the violation behavior trajectories to construct a high-dimensional temporal feature matrix; the high-dimensional temporal feature matrix is ​​input into the pattern analysis engine to obtain a violation pattern set; based on the violation pattern set and a preset normative rule set, potential normative features are extracted through a pattern-rule mapping mechanism to generate a preliminary normative feature set; the preliminary normative feature set is input into the automated verification module to output an automatically verified normative feature set.

[0018] A development specification pre-inspection system that integrates runtime interception and static scanning includes a data acquisition module, a deployment module, an alignment module, an analysis module, and an extraction module, with interconnections between the modules. The data acquisition module performs static scanning on the target source code, extracts static information, and constructs a specification graph. The deployment module identifies key path nodes to be intercepted based on the specification graph and deploys runtime interceptors at these nodes. The alignment module aligns the behavioral data collected by the runtime interceptors with the specification graph to generate runtime behavior trajectories. The analysis module uses the runtime behavior trajectories as contextual input for rule judgment and performs joint analysis with the specification graph to output violation records. The extraction module performs pattern analysis based on the violation records and the corresponding runtime behavior trajectories to extract specification features.

[0019] The technical effects and advantages of the development specification pre-detection method and system that combines runtime interception and static scanning according to the present invention are as follows:

[0020] 1. This invention comprehensively characterizes the syntax, semantics, control flow, and data flow dependencies of the target source code through a specification graph constructed by static scanning. It can identify potential risk points in advance during the development phase and match them with a preset specification rule set to generate a set of sensitive behavior subgraphs. Compared with traditional single static analysis, this method significantly improves the accuracy and comprehensiveness of risk node identification through rule graph template matching, providing a high-quality path benchmark for subsequent runtime interception.

[0021] 2. This invention utilizes graph neural networks and a risk weight propagation algorithm to perform in-depth analysis of the canonical graph, enabling precise screening of critical path nodes. The Monte Carlo traversal algorithm simulates external attack paths, effectively assessing the bottleneck degree and risk contribution rate of nodes. Combined with a performance-risk trade-off function, it ensures that interceptors are deployed at runtime in locations with high risk and low performance impact. This deployment strategy not only improves the interception hit rate but also reduces the impact on system performance, achieving a dynamic balance between detection and performance. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of a development specification pre-inspection method that links runtime interception and static scanning according to the present invention.

[0023] Figure 2 This is a schematic diagram of the development specification pre-inspection system structure that links runtime interception and static scanning according to the present invention. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0025] Example 1, Figure 1 This invention presents a development specification pre-detection method that combines runtime interception and static scanning, comprising:

[0026] S1, perform static scanning on the target source code, extract static information, and construct a standardized graph;

[0027] In this embodiment, static scanning is performed on the target source code to extract static information and construct a canonical graph, as detailed below:

[0028] Perform syntax parsing on the target source code and construct an abstract syntax tree;

[0029] Based on the abstract syntax tree, the target source code is traversed in a structured manner to extract semantic units and form a set of units. The semantic units include function definitions, class inheritance, module dependencies, and configuration points.

[0030] Based on the control flow analysis method, executable path edges are established between semantic units, and data dependency edges (such as variable propagation and configuration injection) are established through the data flow analysis method to form a dependency graph;

[0031] Based on the unit set and dependency graph, candidate nodes associated with the preset set of rules are identified to form a candidate target set;

[0032] Based on the preset set of rules, candidate targets are labeled, such as: authentication is required, cross-layer is prohibited, configuration must be externalized, etc., and the label inheritance and derivation are performed through the adjacency relationship in the dependency graph to complete the label attributes of indirect dependent nodes and generate a set of semantically enhanced behavior nodes.

[0033] A call graph is constructed based on a set of semantically enhanced behavior nodes, and paths involving risk labels in the call chain are marked as paths that need to be verified, forming a set of call paths;

[0034] The subgraph matching algorithm matches the set of call paths with a preset rule graph template, identifies the path subgraphs that are consistent with the structure of a certain rule template, and cuts out the matching segments from the complete path to construct a set of sensitive behavior subgraphs. The preset rule graph template describes the path sequence and semantic constraints in a graph structure. For example, "cross-layer access → no authentication → data writing" represents a typical violation chain of multi-layer coupling and lack of authentication, which is used to represent the structural violation patterns of various development specifications.

[0035] Generate a canonical graph based on the set of sensitive behavior subgraphs.

[0036] In this embodiment, a canonical graph is generated based on the set of sensitive behavior subgraphs, as follows:

[0037] Obtain a set of multiple rule-sensitive behavior subgraphs obtained by matching static scanning with rule graph templates. Each rule-sensitive behavior subgraph represents a call path that hits a development specification rule.

[0038] Based on the unique signature information of the code entity corresponding to each node in each subgraph, the nodes in multiple subgraphs are unified to generate unique node identifiers, and nodes with the same node identifiers are merged to form a unified node set.

[0039] After unifying the mapping of structural edges (such as call edges, control edges, and data dependency edges) in each sensitive subgraph according to node identifiers, they are merged to generate a connected graph structure.

[0040] Add and merge standardized attributes to all nodes and edges in the connected graph structure, including but not limited to: set of hit rules, risk labels (such as authentication failure, hard-coded configuration, etc.), node context (function name, class name, file path, etc.) and node type (interface, service, database access, configuration item, etc.).

[0041] The integrity of the fused graph structure is verified, and a cleaned static standard graph is generated.

[0042] The static canonical graph is converted into a preset format for output to obtain a canonical graph. The preset format includes, but is not limited to, GraphML, Neo4j Cypher expressions, or JSON graph structures.

[0043] S2 identifies critical path nodes that need to be intercepted based on the standard graph and deploys runtime interceptors at the critical path nodes.

[0044] In this embodiment, critical path nodes that need to be intercepted are identified based on the canonical graph, and runtime interceptors are deployed at the critical path nodes, as detailed below:

[0045] The nodes and edges in the canonical graph are characterized and encoded to generate a characteristic graph. The encoding includes: node-side features (rule labels, structural centrality index, context semantic vector) and edge-side features (call type, data dependency strength, execution direction).

[0046] Input the feature graph into the graph neural network model and output the violation risk value for each node;

[0047] The risk risk value is propagated from high-risk nodes along the graph structure to their directly or indirectly related nodes through a risk-weighted label propagation algorithm, resulting in a set of potential risk nodes. The comprehensive risk score is updated for each node. The risk-weighted label propagation algorithm refers to using the risk value as the initial seed weight of the label propagation algorithm.

[0048] Using the comprehensive risk score as the weight, threat path simulation is performed in the standardized graph, and the Monte Carlo traversal algorithm is used to generate multiple possible attack paths from external entry nodes to sensitive resource nodes.

[0049] In each attack path, the bottleneck degree and risk contribution rate of the nodes are calculated, and nodes with both high bottleneck degree and high risk contribution rate in high-risk paths are selected to form a candidate set of key nodes.

[0050] In the candidate set of critical nodes, a lightweight runtime probe is deployed to collect runtime characteristics such as call frequency, execution time and exception rate. Based on the preset performance-risk trade-off function, the interception benefit ratio of each candidate node is calculated and sorted from high to low according to the benefit ratio to obtain the interceptor deployment priority list.

[0051] Based on the interceptor deployment priority list, nodes with high risk and low performance impact are selected for interceptor injection first.

[0052] The interceptor collects context information (including caller service identifier, call chain ID, user session ID, parameter hash value, etc.) and performance data (including total call time, CPU usage, memory allocation, and exception flags) of the intercepted request. The collected context information and performance data are concatenated in time series to form a feature vector, which is then input into a pre-trained sequence modeling model. The model outputs a set of risk scores arranged in time series and a moving average of the score series. The score series is a set of risk scores arranged in time series.

[0053] The moving average is compared with a preset dynamic threshold to dynamically adjust the interception conditions and risk weights.

[0054] The dynamic adjustment of interception conditions and risk weights includes:

[0055] When the moving average of the risk score is higher than the dynamic threshold for multiple consecutive sampling periods, the rule optimization module issues a policy adjustment instruction to the corresponding runtime interceptor instance, increases the risk weight of the node in real time through the API interface, and adds additional interception conditions, such as adding parameter validity verification or context consistency verification.

[0056] If the risk score remains below the threshold and the system is in a special operating scenario (operation and maintenance mode, test environment, or whitelisted IP range), the mode switching logic will be triggered to switch the interceptor to a lenient mode, retaining only basic authentication and verification to reduce the performance impact on the business.

[0057] The formula for calculating the risk value of violation is as follows:

[0058]

[0059]

[0060] In the formula: This represents the hidden feature representation of node i at layer l. It is a non-linear activation function, such as ReLU. It is the weight matrix of the l-th layer. This represents the hidden feature vector of node i in the (l-1)th layer of the graph neural network. Let i represent the set of neighboring nodes. It is a message function that combines neighboring nodes and edge features. This represents the hidden feature vector of node u in the (l-1)th layer of the graph neural network. It is the eigenvector of the edge (u,v). This is the weight vector of the output layer, used to map the final hidden features of nodes to risk scores. This represents the transpose of the output layer's weight vector. It is the bias term of the output layer. ∈[0,1] represents the violation risk value of node i (the larger the value, the higher the risk).

[0061] The performance-risk trade-off function is as follows:

[0062]

[0063]

[0064] In the formula: It is the interception benefit ratio of node i. ∈[0,1] represents the violation risk value of node i (the larger the value, the higher the risk). A value greater than 0 indicates a quantitative indicator of the performance impact of node i, typically calculated using a combination of factors including call frequency, execution time, and exception rate. A higher value indicates higher performance overhead. It is a very small positive number (e.g., 10⁻⁶) used to prevent the denominator from being zero and to ensure the stability of the formula's numerical value. , and For preset weighting coefficients, It's the frequency of calls. It is the average execution time. It's the anomaly rate.

[0065] S3 aligns the behavior data collected by the runtime interceptor with the canonical graph to generate runtime behavior trajectories;

[0066] In this embodiment, the behavioral data collected by the runtime interceptor is aligned with the canonical graph to generate a runtime behavioral trajectory, as follows:

[0067] The deployed interceptors collect behavioral data of the target node, including but not limited to function call stacks, runtime parameters, exception stacks, system calls, thread contexts, and memory snapshots, forming a behavioral data set containing multi-dimensional features.

[0068] The behavioral data is uniformly encoded to generate multi-dimensional feature vectors, and combined with the timestamps of events to construct a temporal feature sequence representing runtime behavior;

[0069] Based on the standard graph, the nodes and edges in the call path are extended in the time dimension, and the edges are given time constraints and execution order to form a time sequence standard graph.

[0070] The temporal feature sequence and temporal canonical graph are input into the spatiotemporal graph neural network model. The model achieves dynamic spatiotemporal alignment between runtime behavior and call path through node-level multimodal feature fusion and edge-level time dependency modeling.

[0071] By inferring the path probability distribution of the trajectory using a spatiotemporal graph neural network model, high-probability runtime behavior trajectories that conform to the standard graph path are selected, and abnormal nodes and abnormal path segments in the trajectory are marked.

[0072] The process involves extending the nodes and edges in the call path according to the canonical graph, assigning time constraints and execution order to the edges, and forming a temporal canonical graph, as detailed below:

[0073] Traverse each node contained in the call path, combine static code analysis and call context information to extract the execution time window and timestamp of the node, and mark the time attribute to the corresponding node feature;

[0074] Based on the call relationship and execution time information between adjacent nodes in the call path, the time interval constraint of adjacent nodes is calculated, and the time constraint of the edge is determined. The constraint conditions include minimum call delay, maximum allowed interval and execution order priority.

[0075] Based on the temporal attributes of nodes and the temporal constraints of edges, the calling order of nodes in the calling path is encoded to clarify the execution order of nodes in the path. Combined with the temporal constraint information of edges, a complete temporal dependency chain is formed to ensure the temporal consistency of the path.

[0076] By integrating nodes with time attributes and edges with time constraints, an initial temporal specification graph with temporal characteristics is constructed. The graph, based on reflecting static dependencies, embeds execution time and execution order constraints for spatiotemporal matching of subsequent runtime behaviors.

[0077] The initial time series canonical graph is standardized in terms of structure and attributes to unify the graph format and embed canonical attribute fields to generate the final time series canonical graph.

[0078] In this embodiment, the temporal feature sequence and temporal canonical graph are input into the spatiotemporal graph neural network model. The model achieves dynamic spatiotemporal alignment between runtime behavior and call path through node-level multimodal feature fusion and edge-level temporal dependency modeling, as detailed below:

[0079] The node behavior at each time step in the temporal behavior feature sequence is combined with the features of the corresponding node in the temporal canonical graph to construct an initial representation vector for the node. The representation vector contains multimodal coding features and timestamp information.

[0080] For each node, collect the representations of its neighboring nodes and the temporal dependency features of its corresponding edges in the temporal canonical graph, including call latency and execution order weights, and perform weighted aggregation in combination with the node's own features to generate the neighboring context information of that node.

[0081] The weights of neighboring nodes are calculated using a time attention mechanism. Message vectors are generated by combining the representations of neighboring nodes with edge features. The message vectors are then combined with the node's own representation, and the hidden state of the node is updated using a non-linear activation function to form the node's representation in the current layer.

[0082] The node representations of the entire behavioral trajectory are aggregated according to the time series order, and the spatiotemporal similarity between the trajectory and the calling path is calculated by the dynamic time warping algorithm;

[0083] By comparing the spatiotemporal similarity with a preset threshold, it is determined whether the runtime behavior trajectory conforms to the call path, thus realizing the determination of dynamic spatiotemporal path alignment.

[0084] S4 takes the runtime behavior trajectory as the context input for rule judgment and performs joint analysis with the specification graph to output violation records;

[0085] In this embodiment, the runtime behavior trajectory is used as the context input for rule judgment and jointly analyzed with the specification graph to output violation records, as follows:

[0086] Based on the runtime behavior trajectory, features are extracted from the nodes and path edges in the trajectory. The features include call context, runtime parameters, timestamps, exception stacks, and environment configurations to form a trajectory feature vector.

[0087] Using the temporal specification graph as the rule basis and the trajectory feature vector as the behavioral context, the features and temporal order of the trajectory are compared with the corresponding nodes in the specification graph node by node.

[0088] Based on the preset matching rules, the attributes and time sequence of trajectory nodes and standard map nodes are compared to determine whether there are any violations such as abnormal call order, missing permission verification or illegal data access.

[0089] For detected violations, a detailed violation record is generated by combining the rule number and risk value in the standard map, including the violation path, violation type, occurrence time and cause of the anomaly.

[0090] S5: Based on violation records and corresponding runtime behavior trajectories, perform pattern analysis to extract normative features;

[0091] In this embodiment, pattern analysis is performed based on violation records and corresponding runtime behavior trajectories to extract normative features, as detailed below:

[0092] Extract violation records from the violation database, combine them with the corresponding runtime behavior trajectories, establish associations through unique identifiers, and form a structured violation behavior trajectory dataset;

[0093] Multi-dimensional feature fusion is performed on the violation behavior trajectory, including node call context, exception stack, execution time series and environment configuration, to construct a high-dimensional time series feature matrix;

[0094] The high-dimensional temporal feature matrix is ​​input into the pattern analysis engine. In the structural dimension, the frequent subgraph mining algorithm is used to identify high-frequency illegal call chains. In the temporal dimension, the sequence pattern mining algorithm (such as PrefixSpan) is used to capture common temporal order patterns of illegal behavior, thereby obtaining a set of illegal patterns.

[0095] Based on the set of violation patterns and combined with the preset set of normative rules, potential normative features are extracted through a pattern-rule mapping mechanism, such as "authentication required for calls", "cross-layer access prohibited", and "configuration must be externalized", to generate a preliminary set of normative features.

[0096] The initial set of standardized features is input into the automated verification module, which outputs the automatically verified set of standardized features. The automated verification module performs feature comparison calculations based on the historical violation trajectory database and the compliance trajectory database.

[0097] The feature comparison calculation based on the historical violation trajectory database and the compliance trajectory database is as follows:

[0098] Obtain the support and confidence of candidate features in violation and compliance trajectories.

[0099] When the support of a candidate feature in the compliance trajectory exceeds a preset threshold, it is determined to be a false alarm feature and automatically removed.

[0100] An association rule mining algorithm is executed on the remaining candidate feature set to discover hidden features that are highly correlated with existing candidate features and appear in violation trajectories. The completed hidden features are then added to the candidate set to expand the feature coverage.

[0101] The retained features are weighted using the Gini index to generate a set of standardized features that have undergone automated verification.

[0102] Example 2, Figure 2 This invention presents a development specification pre-inspection system that combines runtime interception and static scanning, comprising a data acquisition module, a deployment module, an alignment module, an analysis module, and an extraction module, with connections between the modules;

[0103] The data acquisition module is used to perform static scanning of the target source code, extract static information, and construct a standardized graph.

[0104] The deployment module is used to identify critical path nodes that need to be intercepted based on the standard graph, and to deploy runtime interceptors on the critical path nodes.

[0105] The alignment module is used to align the behavior data collected by the runtime interceptor with the canonical graph to generate runtime behavior trajectories;

[0106] The analysis module is used to take runtime behavior trajectories as context input for rule judgment, and perform joint analysis with the specification graph to output violation records;

[0107] The extraction module is used to perform pattern analysis based on violation records and corresponding runtime behavior trajectories to extract normative features.

[0108] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0109] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, in the form of a computer program product.

[0110] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0111] In addition, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0112] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0113] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A development specification pre-check method that combines runtime interception and static scanning, characterized in that, The application relates to a method for detecting abnormal behaviors in target source code, comprising the following steps: performing a static scan on target source code, extracting static information, and constructing a specification graph; identifying key path nodes that need to be intercepted based on the specification graph, and deploying a runtime interceptor at the key path nodes; aligning behavior data collected by the runtime interceptor with the specification graph to generate a runtime behavior track; inputting the runtime behavior track as a context for rule judgment, and jointly analyzing the runtime behavior track and the specification graph to output a violation record; extracting specification features based on the violation record and the corresponding runtime behavior track; the step of aligning the behavior data collected by the runtime interceptor with the specification graph to generate a runtime behavior track is specifically as follows: collecting behavior data of target nodes by using the deployed interceptor; unifying the behavior data to generate a multi-dimensional feature vector, and combining the time stamp of the event to construct a time sequence feature sequence representing the runtime behavior; according to the specification graph, extending the nodes and edges in the calling path in the time dimension, giving the edges time constraints and execution order, and forming a time sequence specification graph; inputting the time sequence feature sequence and the time sequence specification graph into a spatio-temporal graph neural network model, and aligning the runtime behavior with the dynamic space-time of the calling path through node-level multi-modal feature fusion and edge-level time dependence modeling; inference of the path probability distribution of the track by the spatio-temporal graph neural network model, screening out high-probability runtime behavior tracks conforming to the path of the specification graph, and marking abnormal nodes and abnormal path segments in the track; the step of inputting the runtime behavior track as a context for rule judgment, and jointly analyzing the runtime behavior track and the specification graph to output a violation record is specifically as follows: extracting features of the nodes and path edges in the runtime behavior track to form a track feature vector; taking the time sequence specification graph as a rule basis, taking the track feature vector as a behavior context, and comparing the features and time sequence of the corresponding nodes in the track and the specification graph node by node; according to a preset matching rule, comparing the attributes and time sequence of the track nodes and the specification graph nodes to determine whether there is a violation behavior; for the detected violation behavior, generating a detailed violation record in combination with the rule number and risk value in the specification graph.

2. The development specification pre-check method of claim 1, wherein, the step of performing a static scan on target source code, extracting static information, and constructing a specification graph is specifically as follows: performing syntax analysis on the target source code to construct an abstract syntax tree; based on the abstract syntax tree, performing structured traversal on the target source code to extract semantic units and form a unit set; according to a control flow analysis method, establishing executable path edges between the semantic units, and establishing data dependency edges through a data flow analysis method to form a dependency graph; according to the unit set and the dependency graph, identifying candidate nodes associated with a preset specification rule set to form a candidate target set; according to the preset specification rule set, binding labels to the candidate targets, and through the adjacent relationship in the dependency graph, complementing the label attributes of indirect dependent nodes to generate a semantic enhanced behavior node set; constructing a calling graph based on the semantic enhanced behavior node set, and marking the paths of risk labels in the calling chain as paths that need to be verified to form a calling path set; The calling path set is matched with the preset rule graph template through a subgraph matching algorithm, a path subgraph consistent with a rule template structure is recognized, a matching segment is cropped from a complete path, and a sensitive behavior subgraph set is constructed; A specification graph is generated according to the sensitive behavior subgraph set.

3. The development specification pre-check method of claim 2, wherein, The specification graph is generated according to the sensitive behavior subgraph set, and specifically as follows: A plurality of rule sensitive behavior subgraphs are obtained by static scanning and rule graph template matching; Uniform processing is performed on nodes in the plurality of subgraphs based on unique signature information of code entities corresponding to the nodes, unique node identifiers are generated, and nodes with the same node identifier are merged to form a uniform node set; After the structure edges in each sensitive subgraph are mapped and unified according to the node identifiers, the structure edges are merged to generate a connected graph structure; All nodes and edges in the connected graph structure are added and fused with specification attributes, and integrity checking is performed to generate a static specification graph; The static specification graph is converted into a preset format for output to obtain the specification graph.

4. The development specification pre-check method of claim 3, wherein, The key path node to be intercepted is identified based on the specification graph, and a runtime interceptor is deployed at the key path node, and specifically as follows: The nodes and edges in the specification graph are feature-coded to generate a feature graph; The feature graph is input into a graph neural network model to output a violation risk value of each node; The violation risk value is diffused from a high-risk node to directly or indirectly associated nodes along the graph structure based on a label propagation algorithm based on a risk weight to obtain a potential risk node set, and a comprehensive risk score is updated for each node; The threat path simulation is performed in the specification graph by taking the comprehensive risk score as a weight, and a Monte Carlo traversal algorithm is used to generate an attack path from an external entry node to a sensitive resource node; The bottleneck degree and risk contribution rate of the nodes in each attack path are calculated, and nodes with high bottleneck degree and high risk contribution rate in a high-risk path are screened to form a key node candidate set; In the key node candidate set, a lightweight runtime probe is deployed, and an interception benefit ratio of each candidate node is calculated based on a preset performance-risk trade-off function to obtain an interceptor deployment priority list; According to the interceptor deployment priority list, a node with high risk and low performance impact is preferentially selected for interceptor injection; Context information and performance data of the intercepted request are collected by the interceptor, and a feature vector is formed by time sequence splicing; The feature vector is input into a pre-trained sequence modeling model to output a set of risk scores arranged in time sequence, and a sliding average value of the score sequence is output; The sliding average value is compared with a preset dynamic threshold to dynamically adjust the interception condition and the risk weight.

5. The development specification pre-check method of claim 4, wherein, According to the specification graph, the nodes and edges in the calling path are extended in the time dimension, the edges are given time constraints and execution orders, and a time sequence specification graph is formed, and specifically as follows: Each node contained in the calling path is traversed, the execution time window and the timestamp of the node are extracted in combination with static code analysis and calling context information, and the time attribute is marked in the corresponding node feature. Based on the calling relationship and execution time information between adjacent nodes in the calling path, the time interval constraint of the adjacent nodes is calculated to determine the time constraint of the edge; The nodes with time attributes and the edges with time constraints are integrated to construct an initial timing specification graph with timing characteristics; The initial timing specification graph is subjected to structure and attribute standardization processing to unify the graph format and embed the specification attribute field to generate a final timing specification graph.

6. The development specification pre-check method of claim 5, wherein, The dynamic space-time alignment of the runtime behavior and the calling path is specifically as follows: The node behavior of each time step in the timing behavior feature sequence is combined with the features of the corresponding node in the timing specification graph to construct an initial representation vector of the node; The neighbor node representation and corresponding edge time dependency features of each node in the timing specification graph are collected and weighted aggregated in combination with the node features to generate neighbor context information of the node; The neighbor node weight is calculated using a time attention mechanism, the message vector is generated in combination with the neighbor node representation and edge features, the message vector is combined with the node representation, and the node hidden state is updated through a nonlinear activation function to form the representation of the node in the current layer; The node representations of the entire behavior trajectory are aggregated according to the time sequence order, and the space-time similarity of the trajectory and the calling path is calculated through a dynamic time warping algorithm; The space-time similarity is compared with a preset threshold to determine whether the runtime behavior trajectory conforms to the calling path, thereby achieving the determination of dynamic space-time path alignment.

7. The development specification pre-check method of claim 6, wherein, The mode analysis of the violation record in combination with the corresponding runtime behavior trajectory is specifically as follows: The violation records are extracted from the violation database, combined with the corresponding runtime behavior trajectory, and associated through unique identification to form a structured violation behavior trajectory dataset; The violation behavior trajectory is subjected to multi-dimensional feature fusion to construct a high-dimensional time sequence feature matrix; The high-dimensional time sequence feature matrix is input into a mode analysis engine to obtain a violation mode set; According to the violation mode set, in combination with a preset specification rule set, potential specification features are extracted through a mode-rule mapping mechanism to generate a preliminary specification feature set; The preliminary specification feature set is input into an automatic verification module to output an automatic verification specification feature set.

8. A system for using a development specification pre-checking method with runtime interception in conjunction with static scanning as claimed in any one of claims 1-7, characterized in that, The system comprises a data acquisition module, a deployment module, an alignment module, an analysis module and an extraction module, and the modules are connected; The data acquisition module is used for static scanning of the target source code, extracting static information and constructing a specification graph; The deployment module is used for identifying key path nodes that need to be intercepted based on the specification graph and deploying a runtime interceptor at the key path nodes; The alignment module is used for path alignment of the behavior data collected by the runtime interceptor and the specification graph to generate a runtime behavior trajectory; The analysis module is used for inputting the runtime behavior trajectory as a context for rule judgment and performing joint analysis with the specification graph to output a violation record; The extraction module is used for mode analysis of the violation record in combination with the corresponding runtime behavior trajectory to extract specification features.

Images