A method and device for identifying a filtering function based on a large language model, an electronic device, and a storage medium

Abstract

The embodiment of the application provides a method and device for identifying filtering functions based on a large language model, electronic equipment and a storage medium, which comprises: obtaining source code of a project to be analyzed; processing the source code of the project to be analyzed to determine a static value flow graph corresponding to the source code of the project to be analyzed; determining a set of functions to be analyzed corresponding to the source code of the project to be analyzed according to the static value flow graph; determining filtering labels of the functions to be analyzed according to preset prompt words, the set of functions to be analyzed and a pre-trained filtering classification model; and determining whether there is a vulnerability in the source code of the project to be analyzed according to the filtering labels of the functions to be analyzed. The semantic understanding ability of the large language model is used to construct the filtering classification model, accurately determine filtering functions from the function signature and implementation details, more accurately identify the filtering functions, and then detect vulnerabilities in the project, thereby improving the accuracy and efficiency of filtering function identification.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of detection, in particular to a filtering function identification method and device based on a large language model, an electronic device and a storage medium. BACKGROUND

[0002] SAST (Static Application Security Testing) security analysis mainly uses taint data tracking to detect security vulnerabilities, and filtering function identification is an important part. Accurate identification of filtering functions can effectively improve the detection accuracy of SAST. Current filtering function identification methods need to match and identify all user codes, which has a large traversal range and low efficiency. Therefore, how to improve the efficiency of filtering function identification and detect vulnerabilities in programs is a problem that needs to be solved. SUMMARY

[0003] Some embodiments of the present application aim to provide a filtering function identification method and device based on a large language model, an electronic device and a storage medium. Through the technical solutions of the embodiments of the present application, the source code of the project to be analyzed is obtained. The source code of the project to be analyzed is processed to determine a static value flow graph corresponding to the source code of the project to be analyzed. According to the static value flow graph, a set of functions to be analyzed corresponding to the source code of the project to be analyzed is determined. According to the preset prompt word, the set of functions to be analyzed and the pre-trained filtering classification model, the filtering label of the function to be analyzed is determined, wherein the filtering label is used to identify whether the function to be analyzed is a filtering function, and the pre-trained filtering classification model is obtained by training a large language model using a sample set. According to the filtering label of the function to be analyzed, it is determined whether there is a vulnerability in the source code of the project to be analyzed. In the embodiments of the present application, the taint propagation path is constructed to efficiently locate the filtering function to be identified on the taint propagation path, thereby significantly reducing the analysis range. Then, the semantic understanding ability of the large language model is used to construct the filtering classification model to accurately judge the filtering function from the function signature and implementation detail level, more accurately identify the filtering function, and then detect the vulnerability in the project to improve the accuracy and efficiency of filtering function identification.

[0004] In a first aspect, some embodiments of the present application provide a filtering function identification method based on a large language model, comprising:

[0005] Obtaining the source code of the project to be analyzed;

[0006] Processing the source code of the project to be analyzed to determine a static value flow graph corresponding to the source code of the project to be analyzed;

[0007] According to the static value flow graph, a set of to-be-analyzed functions corresponding to source code of the to-be-analyzed project is determined;

[0008] According to a preset prompt word, the set of to-be-analyzed functions, and a pre-trained filtering classification model, a filtering label of the to-be-analyzed function is determined, where the filtering label is used to identify whether the to-be-analyzed function is a filtering function, and the pre-trained filtering classification model is obtained by training a large language model using a sample set;

[0009] According to the filtering label of the to-be-analyzed function, it is determined whether there is a vulnerability in the source code of the to-be-analyzed project.

[0010] Some embodiments of the present application can efficiently locate the to-be-identified filtering function on the taint propagation path, thereby significantly reducing the analysis range, and then use the semantic understanding ability of the large language model to construct the filtering classification model, accurately judge the filtering function from the function signature and implementation detail level, more accurately identify the filtering function, and then detect the vulnerability in the project, thereby improving the accuracy and efficiency of filtering function identification.

[0011] Optionally, the set of to-be-analyzed functions corresponding to the source code of the to-be-analyzed project is determined according to the static value flow graph, comprising:

[0012] Performing static taint analysis on the static value flow graph to determine a taint propagation path related to a taint source;

[0013] Obtaining a first to-be-analyzed function on the taint propagation path related to the taint source;

[0014] Obtaining a second to-be-analyzed function not on the taint propagation path but related to the taint source;

[0015] According to the first to-be-analyzed function and the second to-be-analyzed function, the to-be-analyzed function is determined, and the to-be-analyzed function and function information corresponding to the to-be-analyzed function are stored in the set of to-be-analyzed functions, where the function information corresponding to the to-be-analyzed function at least includes function name, function return type, parameter list, and function body information.

[0016] Some embodiments of the present application obtain a first to-be-analyzed function of a taint on a taint propagation path and a second to-be-analyzed function related to a taint source outside the taint propagation path according to the taint propagation path, so as to obtain a set of to-be-analyzed functions corresponding to the taint propagation path according to the first to-be-analyzed function and the second to-be-analyzed function, thereby expanding the search range and preventing the related filtering function of the taint source from being missed.

[0017] Optionally, the static taint analysis on the static value flow graph to determine the taint propagation path related to the taint source comprises:

[0018] In response to the input of each taint source, each node in the static value flow graph is traversed in turn by using a depth-first traversal algorithm until a vulnerability node is reached.

[0019] A propagation path from the taint source, the intermediate traversed node, to the vulnerability node is determined as a taint propagation path corresponding to the taint source.

[0020] Some embodiments of the present application can effectively reduce the identification range and greatly improve the identification efficiency by extracting user code functions on the taint propagation path from the taint source to the vulnerability outbreak point through a depth-first traversal algorithm.

[0021] Optionally, the second function to be analyzed that is not on the taint propagation path but is related to the taint source includes:

[0022] The function body that is not on the taint propagation path but corresponds to the taint source is traversed by using an abstract syntax tree;

[0023] If the traversed function body matches a preset function body, the traversed function body is determined as the second function to be analyzed.

[0024] Some embodiments of the present application also obtain a function that is not on the taint propagation path but is related to the taint source and store function information of the function in a set of functions to be analyzed, thereby expanding the search range and preventing false negatives of taint-related filtering functions.

[0025] Optionally, the pre-trained filtering classification model is obtained by the following method:

[0026] A sample set is obtained, the sample set including at least a sample filtering function;

[0027] The sample filtering function is parsed to obtain function information corresponding to the sample filtering function, wherein the function information corresponding to the sample filtering function includes at least a sample function name, a sample function return type, a sample parameter list, and sample function body information;

[0028] The large language model is trained according to the function information corresponding to the sample filtering function to obtain the filtering classification model, and the filtering classification model is used to determine whether a function is a filtering function.

[0029] Some embodiments of the present application train a large language model by using a sample set composed of sample filtering functions to obtain a filtering classification model, and the filtering classification model can determine whether a function obtained is a filtering function.

[0030] Optionally, the sample set is obtained by the following method:

[0031] obtaining a function body, parsing the function body into an abstract syntax tree, and converting the abstract syntax tree into structured data;

[0032] obtaining a pseudo filter function, the pseudo filter function having a filtering function;

[0033] adding the structured data and the pseudo filter function to the sample set as training data.

[0034] Some embodiments of the present application form a training set by collecting filter functions and pseudo filter functions, train a fine-tuned LLM model, and use the LLM model to identify whether a function is a filter function, which can understand the purpose of the function at the semantic level and improve the accuracy of model training.

[0035] Optionally, determining, according to the filter label of the function to be analyzed, whether a vulnerability exists in the project source code to be analyzed comprises:

[0036] If the filter label of the function to be analyzed is a first identifier, it is determined that no vulnerability exists in the project source code to be analyzed.

[0037] If the filter label of the function to be analyzed is a second identifier, it is determined that a vulnerability exists in the project source code to be analyzed.

[0038] Some embodiments of the present application use filter functions to determine vulnerabilities in project programs, thereby determining whether a vulnerability exists according to the obtained filter label, improving the accuracy of vulnerability detection, and reducing the efficiency of false positives.

[0039] In a second aspect, some embodiments of the present application provide a device for identifying filter functions based on a large language model, comprising:

[0040] An obtaining module is configured to obtain project source code to be analyzed.

[0041] A determining module is configured to process the project source code to be analyzed and determine a static value flow graph corresponding to the project source code to be analyzed.

[0042] A constructing module is configured to determine, according to the static value flow graph, a set of functions to be analyzed corresponding to the project source code to be analyzed.

[0043] An identifying module is configured to determine, according to a preset prompt word, the set of functions to be analyzed, and a pre-trained filter classification model, a filter label of the function to be analyzed, wherein the filter label is used to identify whether the function to be analyzed is a filter function, and the pre-trained filter classification model is obtained by training a large language model using a sample set.

[0044] A judgment module is configured to determine whether a vulnerability exists in the project source code to be analyzed according to the filtering label of the function to be analyzed.

[0045] Some embodiments of the present application can significantly reduce the analysis range by constructing a taint propagation path and efficiently locating the filtering function to be identified on the taint propagation path, and then use the semantic understanding ability of a large language model to construct a filtering classification model, accurately determine the filtering function from the function signature and implementation details, more accurately identify the filtering function, and then detect the vulnerability in the project, thereby improving the accuracy and efficiency of filtering function identification.

[0046] Optionally, the construction module is configured to:

[0047] perform static taint analysis on the static value flow graph to determine a taint propagation path related to a taint source;

[0048] obtain a first function to be analyzed on the taint propagation path related to the taint source;

[0049] obtain a second function to be analyzed that is not on the taint propagation path but is related to the taint source;

[0050] determine the function to be analyzed according to the first function to be analyzed and the second function to be analyzed, and store the function to be analyzed and function information corresponding to the function to be analyzed in the set of functions to be analyzed, wherein the function information corresponding to the function to be analyzed at least includes function name, function return type, parameter list, and function body information.

[0051] Some embodiments of the present application obtain a first function to be analyzed of a taint on a taint propagation path according to the taint propagation path, and obtain a second function to be analyzed related to a taint source outside the taint propagation path, so as to obtain a set of functions to be analyzed corresponding to the taint propagation path according to the first function to be analyzed and the second function to be analyzed, thereby expanding the search range and preventing the related filtering function of the taint source from being missed.

[0052] Optionally, the construction module is configured to:

[0053] In response to each input taint source, a depth-first traversal algorithm is used to sequentially traverse each node in the static value flow graph until a vulnerability node is reached.

[0054] The propagation path from the taint source, the intermediate traversed node to the vulnerability node is determined as the taint propagation path corresponding to the taint source.

[0055] Some embodiments of the present application can effectively reduce the identification range and greatly improve the identification efficiency by extracting the user code functions on the taint propagation path from the taint source to the vulnerability outbreak point through a depth-first traversal algorithm.

[0056] Optionally, the construction module is configured to:

[0057] The function body corresponding to the taint source but not on the taint propagation path is traversed using an abstract syntax tree;

[0058] If the traversed function body matches the preset function body, the traversed function body is determined as a second function to be analyzed.

[0059] Some embodiments of the present application also obtain a function not on the taint propagation path and related to the taint source, and store function information of the function in the set of functions to be analyzed, thereby expanding the search range and preventing the taint-related filtering function from being missed.

[0060] Optionally, the device further comprises a training module configured to:

[0061] Obtain a sample set, the sample set comprising at least a sample filtering function;

[0062] Parse the sample filtering function to obtain function information corresponding to the sample filtering function, wherein the function information corresponding to the sample filtering function comprises at least a sample function name, a sample function return type, a sample parameter list, and sample function body information;

[0063] Train a large language model according to the function information corresponding to the sample filtering function to obtain the filtering classification model, the filtering classification model being configured to determine whether a function is a filtering function.

[0064] Some embodiments of the present application train a large language model using a sample set composed of sample filtering functions to obtain a filtering classification model, which can determine whether a function obtained is a filtering function.

[0065] Optionally, the training module is configured to:

[0066] Obtain a function body, parse the function body into an abstract syntax tree, and convert the abstract syntax tree into structured data;

[0067] Obtain a pseudo-filtering function, the pseudo-filtering function having a filtering function;

[0068] Add the structured data and the pseudo-filtering function to the sample set as training data.

[0069] Some embodiments of the present application form a training set by collecting filtering functions and pseudo filtering functions, train a fine-tuned generation of a new LLM model, and use the LLM model to identify whether a function is a filtering function, which can understand the purpose of the function at the semantic level and improve the accuracy of model training.

[0070] Optionally, the determining module is configured to:

[0071] If the filtering label of the function to be analyzed is the first identifier, it is determined that there is no vulnerability in the project source to be analyzed.

[0072] If the filtering label of the function to be analyzed is the second identifier, it is determined that there is a vulnerability in the project source to be analyzed.

[0073] Some embodiments of the present application use filtering functions to determine vulnerabilities in project programs, thereby determining whether there is a vulnerability according to the obtained filtering label, improving the accuracy of vulnerability detection, and reducing the efficiency of false positives.

[0074] In a third aspect, some embodiments of the present application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the program to achieve the filtering function identification method based on a large language model according to any one of the embodiments of the first aspect.

[0075] In a fourth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, wherein the program is executable by a processor to implement the filtering function identification method based on a large language model according to any one of the embodiments of the first aspect.

[0076] In a fifth aspect, some embodiments of the present application provide a computer program product, including a computer program, wherein the computer program is executable by a processor to implement the filtering function identification method based on a large language model according to any one of the embodiments of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0077] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the following will briefly introduce the drawings needed to be used in some embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor.

[0078] Figure 1 A flowchart of a filtering function identification method based on a large language model according to some embodiments of the present application is provided.

[0079] Figure 2 A schematic diagram of a method for extracting a quadruple of information provided by an embodiment of the present application is shown in FIG. 1.

[0080] Figure 3 A structural schematic diagram of a device for identifying a filtering function based on a large language model provided by an embodiment of the present application is shown in FIG. 2.

[0081] Figure 4 A schematic diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 3. DETAILED DESCRIPTION

[0082] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0083] It should be noted that similar reference numerals and letters refer to similar items in the following drawings, and therefore, once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings. Meanwhile, in the description of the present application, the terms “first”, “second”, etc. are only used for distinguishing description, and cannot be understood as indicating or implying relative importance.

[0084] SAST (Static Application Security Testing) security analysis primarily employs tainted data tracking to detect security vulnerabilities, with filter function identification being a crucial component. Accurate filter function identification significantly improves the detection precision of SAST. Current filter function identification methods require matching and identification across the entire user codebase, resulting in a large traversal range and low efficiency. Therefore, improving the efficiency of filter function identification to detect vulnerabilities in programs is a pressing issue. In light of this, some embodiments of this application provide a filter function identification method based on a large language model. This method includes: acquiring the source code of the project to be analyzed; processing the source code to determine a static value flow graph corresponding to the source code; determining a set of functions to be analyzed corresponding to the source code based on the static value flow graph; and determining the classification function set based on preset prompts, the set of functions to be analyzed, and a pre-trained filter classification model. The analysis function is labeled with a filter tag, which identifies whether the function to be analyzed is a filter function. The pre-trained filter classification model is obtained by training a large language model with a sample set. Based on the filter tag of the function to be analyzed, it is determined whether there are vulnerabilities in the source code of the project to be analyzed. In this embodiment, a taint propagation path is constructed to efficiently locate the filter function to be identified on the taint propagation path, thereby significantly narrowing the scope of analysis. Then, the semantic understanding capability of the large language model is used to construct a filter classification model to accurately judge the filter function from the function signature and implementation details, more accurately identify the filter function, and thus detect vulnerabilities in the project, improving the accuracy and efficiency of filter function identification.

[0085] like Figure 1 As shown, embodiments of this application provide a method for recognizing filtering functions based on a large language model, the method comprising:

[0086] S101. Obtain the source code of the project to be analyzed;

[0087] Specifically, for a particular project, it is necessary to determine whether there are vulnerabilities in the project, and the terminal device obtains the source code of the project to be analyzed.

[0088] S102. Process the source code of the project to be analyzed and determine the static value flow graph corresponding to the source code of the project to be analyzed.

[0089] Specifically, the terminal device performs static parsing of the source code of the project to be analyzed and constructs a value flow graph (static value flow graph) that can be called across methods, which serves as the basis for taint analysis.

[0090] S103. Based on the static value flow diagram, determine the set of functions to be analyzed corresponding to the source code of the project to be analyzed;

[0091] The terminal device performs a taint analysis on the static value flow graph according to a taint source, obtains node data in the static value flow graph, the node data at least including string concatenation, assignment or function call, in the embodiment of the application, a node of a function call is searched, and then whether the node is related to the taint source is judged according to the node of the function call, and a function set to be analyzed corresponding to the taint source is extracted, the function set to be analyzed at least including function information of a function, the function information at least including a function name, a function return type, a parameter list and function body information.

[0092] In the embodiment of the application, the function set to be analyzed includes a function determined by all taint propagation paths from a taint source (such as user input) to a vulnerability node (such as a database operation or a command execution interface), or a function not on the taint propagation path but related to the taint.

[0093] S104, determining a filtering label of the function to be analyzed according to the preset prompt word, the function set to be analyzed and the pre-trained filtering classification model, wherein the filtering label is used to identify whether the function to be analyzed is a filtering function, and the pre-trained filtering classification model is obtained by training a large language model using a sample set;

[0094] Specifically, the filtering classification model is pre-trained on the terminal device, and the filtering classification model is obtained by training a large language model using a sample set, and the filtering classification model is used to determine whether the function is a filtering function.

[0095] After obtaining the function set to be analyzed on the terminal device, the function to be analyzed in the function set to be analyzed is input into the pre-trained filtering classification model according to the preset prompt word, and a filtering label of whether the function to be analyzed is a filtering function is obtained, the filtering label can be a filtering function or not a filtering function.

[0096] To identify whether each function in the function set to be analyzed is a filtering function, an automatic prompt (Prompt) construction and analysis process is implemented, and a fine-tuned large language model (LLM) is combined to complete semantic understanding and judgment tasks. In the embodiment of the application, a set of prompt templates is provided by constructing a prompt template, covering different styles and tones to adapt to the performance differences of the language model. These templates guide the model to make judgments in natural language form, and the prompt content explicitly lists the function name, parameters, return type and function body, emphasizing that the model should pay attention to whether there is input filtering, escaping, verification and other logic.

[0097] Example:

[0098] As a static code analysis expert, please determine whether the following Java function will perform security filtering or escaping on the input.

[0099] Function name: {function_name}

[0100] Parameter information: {parameter_list}

[0101] The function is implemented as follows:

[0102] {function_body}

[0103] Does the function have filtering capability? Please answer only "Yes" or "No".

[0104] In the embodiments of the present application, the prompt word is input into the supervised fine-tuned LLM model (i.e., the filtering classification model), and based on the content of the prompt word, it is determined whether the function has filtering behavior from the semantic level, and the label of "Yes" or "No" is returned. To further enhance robustness, the terminal device can use multiple prompt word templates to make multiple rounds of judgments on the same function, and use a voting mechanism to summarize the final label, improving classification accuracy and confidence.

[0105] S105, according to the filtering label of the function to be analyzed, determine whether there is a vulnerability in the source code of the project to be analyzed.

[0106] Specifically, after obtaining the filtering label of the function to be analyzed, the terminal device judges the filtering label. If the filtering label is "Yes", it means that there is no vulnerability in the corresponding pollution propagation path of the source code of the project to be analyzed. If the filtering label is "No", it means that there is a vulnerability in the corresponding pollution propagation path of the source code of the project to be analyzed. In this way, the vulnerability can be detected in real time, and real-time tracking is realized.

[0107] Some embodiments of the present application construct a pollution propagation path, thereby efficiently locating the filtering function to be identified on the pollution propagation path, significantly reducing the analysis range, and then using the semantic understanding ability of the large language model to construct a filtering classification model, accurately judging the filtering function from the function signature and implementation details, more accurately identifying the filtering function, and then detecting the vulnerability in the project, improving the accuracy and efficiency of filtering function identification.

[0108] Another embodiment of the present application further supplements the identification method of the filtering function based on the large language model provided in the above embodiment.

[0109] Optionally, according to the static value flow graph, a set of functions to be analyzed corresponding to the source code of the project to be analyzed is determined, including:

[0110] Performing static pollution analysis on the static value flow graph to determine the pollution propagation path related to the pollution source;

[0111] obtain a first function to be analyzed related to the pollution propagation path of the pollution source;

[0112] obtain a second function to be analyzed not on the pollution propagation path but related to the pollution source;

[0113] determine a function to be analyzed according to the first function to be analyzed and the second function to be analyzed, and store the function to be analyzed and function information corresponding to the function to be analyzed in the function to be analyzed set, wherein the function information corresponding to the function to be analyzed at least includes function name, function return type, parameter list and function body information.

[0114] Some embodiments of the application obtain a first function to be analyzed on the pollution propagation path of the pollution source according to the pollution propagation path, and obtain a second function to be analyzed related to the pollution source outside the pollution propagation path, so as to obtain a function to be analyzed set corresponding to the pollution propagation path according to the first function to be analyzed and the second function to be analyzed, thereby expanding the search range and preventing the related filtering function of the pollution source from being missed.

[0115] Optionally, the static value flow graph is subjected to static pollution analysis to determine the pollution propagation path related to the pollution source, comprising:

[0116] In response to each input pollution source, a depth-first traversal algorithm is used to traverse each node in the static value flow graph in turn until the vulnerability node;

[0117] The propagation path from the pollution source, the intermediate traversed node to the vulnerability node is determined as the pollution propagation path corresponding to the pollution source.

[0118] Specifically, after the terminal device obtains the static value flow graph, the user can input the pollution source or the pollution source can be pre-set, and based on each pollution source and the vulnerability node, the pollution propagation path is determined, wherein the depth-first traversal algorithm (Depth-First Search, DFS) is executed with each pollution source as the starting point, and the directed edge representing value propagation in the graph is pushed forward. In each step, all successor nodes (i.e. the target to which the value can propagate) of the current node are accessed in turn and are added to the current path. Whenever a vulnerability sink is encountered, which means that the value flow propagation has reached the sensitive point, the current complete path is recorded as an effective path. During the traversal process, loops in the path need to be avoided to prevent dead loops, and an "access stack" or "access set" is usually used to track the nodes that have been accessed in the current path. Repeat the process until all pollution source nodes are processed, and finally form a propagation path set from all pollution sources to the vulnerability node.

[0119] Example code:

[0120] protected void doGet(HttpServletRequest request, HttpServletResponseresponse) throws IOException {

[0121] / / Get user input parameters

[0122] String userInput = request.getParameter("cmd");

[0123] / / Perform simple filtering on the input

[0124] String sanitizedInput = sanitize(userInput);

[0125] / / Command execution point

[0126] Runtime.getRuntime().exec(sanitizedInput);

[0127] }

[0128] The code snippet above, where request.getParameter("cmd") retrieves HTTP request parameter data, is a tainted input;

[0129] Runtime.getRuntime().exec(sanitizedInput) executes the command for the vulnerable node.

[0130] Specifically, the terminal device extracts the functions to be analyzed on the taint propagation path, that is, it traverses the effective taint propagation path and extracts the function information on the taint propagation path, including function name, function return type, parameter list, and function body information, and adds them as a quadruple to the set of filtering functions to be analyzed.

[0131] The extraction process involves traversing the nodes along the propagation path, excluding tainted inputs and vulnerability convergence points, obtaining the set of function calls along the propagation path, and for each function within the function call set, obtaining the four-tuple information for each function, such as... Figure 2 As shown in the example code, the propagation process involves three function calls. Since 1 and 3 are the tainted input and the vulnerability convergence point, respectively, 2 is extracted and added to the function call set. The quadruple of the function `sanitize` called by 2 is obtained.

[0132] {

[0133] "function_name": "sanitize",

[0134] "return_type": "String",

[0135] "parameters": ["String input"],

[0136] "function_body": "if (input == null) return \"\";

[0137] return input.replaceAll(\"[;&|]\", \"\");"

[0138] }

[0139] Some embodiments of the application can effectively reduce the identification range and greatly improve the identification efficiency by extracting the user code functions on the taint propagation path from the taint source to the vulnerability outbreak point through a depth-first traversal algorithm.

[0140] Optionally, a second to-be-analyzed function not on the taint propagation path but related to the taint source is obtained, including:

[0141] The function body corresponding to the taint source is traversed using an abstract syntax tree (AST) if the function body is not on the taint propagation path.

[0142] If the traversed function body matches a preset function body, the traversed function body is determined as the second to-be-analyzed function.

[0143] Embodiments of the application can also obtain a to-be-analyzed function not on the taint propagation path but related to the taint source. For the function body in which the taint data is located in each propagation process, the abstract syntax tree (AST) of the function body is traversed. If the function call with the taint data as the parameter meets the matching condition, the function call related to the taint data in the function body is extracted, and the function information including the function name, the function return type, the parameter list, and the function body information is extracted as a four-tuple and added to the to-be-analyzed filtering function set.

[0144] Exemplarily:

[0145] protected void doGet(HttpServletRequest request, HttpServletResponseresponse) throws IOException {

[0146] / / Get user input parameters

[0147] String userInput = request.getParameter("cmd");

[0148] if (!isValid(userInput)){

[0149] return;

[0150] }

[0151] / / Perform simple filtering on the input

[0152] String sanitizedInput = sanitize(userInput);

[0153] / / Command execution point

[0154] Runtime.getRuntime().exec(sanitizedInput);

[0155] }

[0156] As shown in the code example above, the propagation path is that the isValid function call is not on the propagation path. We can extract the function quadruple information of isValid by traversing the AST of the doGet function. Here, isValid(userInput) is a function call with tainted data as the parameter, and add it to the set of filter functions to be analyzed.

[0157] Some embodiments of this application also obtain functions that are not in the taint propagation path but are related to the taint source, and store the function information of the function in the set of functions to be analyzed. In this way, the search scope is expanded and taint-related filtering functions are not missed.

[0158] Optionally, the pre-trained filtering classification model is obtained as follows:

[0159] Obtain a sample set, which must include at least a sample filtering function;

[0160] The sample filtering function is parsed to obtain the function information corresponding to the sample filtering function. The function information corresponding to the sample filtering function includes at least the sample function name, sample function return type, sample parameter list and sample function body information.

[0161] The large language model is trained based on the function information corresponding to the sample filtering function to obtain the filtering classification model, which is used to determine whether a function is a filtering function.

[0162] Some embodiments of the present application train a large language model by using a sample set composed of sample filtering functions to obtain a filtering classification model, which can determine whether a obtained function is a filtering function.

[0163] Specifically, in the embodiments of the present application, a set of known filtering functions is collected and labeled, and each function is parsed into a four-tuple, function name, return type, parameter list, and function body.

[0164] public static String sanitizeHtml(String input){

[0165] if(input!= null)

[0166] return input.replaceAll("<", "<");

[0167] else return "";

[0168] }

[0169] The above function is parsed into a four-tuple as follows:

[0170] {

[0171] "function name function_name": "sanitizeHtml",

[0172] "return type return_type": "String",

[0173] "parameter list parameters": ["String input"],

[0174] "function body function_body": "..."

[0175] }

[0176] Then, a general base model, such as a large language LMM, is selected for supervised fine-tuning. The training uses a cross-entropy loss function, and the training input is the above function four-tuple, and the output is a classification label of whether it is a filtering function.

[0177] Optionally, obtaining the sample set further includes:

[0178] Obtaining the function body, parsing the function body into an abstract syntax tree, and converting the abstract syntax tree into structured data;

[0179] Obtaining a pseudo-filtering function, the pseudo-filtering function having a filtering function;

[0180] Add structured data and pseudo filter functions to the sample set as training data.

[0181] Specifically, in the model training in the embodiments of the present application, other performance improvement strategies are introduced, for example, the function of the training set is parsed into an abstract syntax tree and converted into structured data, which is trained together with the function information described above, which can enhance the model's understanding of the internal structure of the function. At the same time, difficult examples can be added, and pseudo filter functions (similar in function but not filter functions) can be introduced, so that the model can identify subtle differences in filtering logic during training and enhance discrimination ability.

[0182] Some embodiments of the present application collect filter functions and pseudo filter functions to form a training set, train and fine-tune a new LLM model, and use the LLM model to identify whether it is a filter function, which can understand the function purpose at the semantic level and improve the accuracy of model training.

[0183] Optionally, according to the filtering label of the function to be analyzed, it is determined whether there is a vulnerability in the project source code to be analyzed, comprising:

[0184] If the filtering label of the function to be analyzed is the first identifier, it is determined that there is no vulnerability in the project source to be analyzed;

[0185] If the filtering label of the function to be analyzed is the second identifier, it is determined that there is a vulnerability in the project source to be analyzed;

[0186] Specifically, the terminal device matches whether there is a filter function on the propagation path for all vulnerability propagation paths. If there is a filter function, i.e., the filtering label is the first identifier, it means that there is no vulnerability. For functions not on the propagation path, get the function call whose parameter is the tainted data, and match whether the function is a filter function that has been identified. If so, there is no vulnerability.

[0187] Some embodiments of the present application use filter functions to judge vulnerabilities in project programs, so as to determine whether there is a vulnerability according to the obtained filtering label, improve the accuracy of vulnerability detection, and reduce the efficiency of false positives.

[0188] In the embodiments of the present application, the filter function to be identified is efficiently located on the tainted propagation path, so as to significantly reduce the analysis range and greatly improve the analysis efficiency; the semantic understanding ability of the large-scale language model is used to accurately judge the filter function from the function signature and implementation detail level, and the filter function is more accurately identified. Reduce the false positive rate of vulnerability detection and improve the detection accuracy.

[0189] It should be noted that each implementable manner in the present embodiment can be implemented alone or in any combination without conflict.

[0190] Another embodiment of the present application provides a device for identifying a filtering function based on a large language model, which is used to execute the method for identifying a filtering function based on a large language model provided by the above embodiment.

[0191] As shown in Figure 3 FIG. 1 is a structural schematic diagram of the device for identifying a filtering function based on a large language model provided by an embodiment of the present application. The device for identifying a filtering function based on a large language model comprises an acquisition module 301, a determination module 302, a construction module 303, an identification module 304, and a judgment module 305, wherein:

[0192] The acquisition module 301 is configured to acquire source code of a project to be analyzed.

[0193] The determination module 302 is configured to process the source code of the project to be analyzed, and determine a static value flow graph corresponding to the source code of the project to be analyzed.

[0194] The construction module 303 is configured to determine a set of functions to be analyzed corresponding to the source code of the project to be analyzed according to the static value flow graph.

[0195] The identification module 304 is configured to determine a filtering label of the function to be analyzed according to a preset prompt word, the set of functions to be analyzed, and a pre-trained filtering classification model, wherein the filtering label is used to identify whether the function to be analyzed is a filtering function, and the pre-trained filtering classification model is obtained by training a large language model using a sample set.

[0196] The judgment module 305 is configured to determine whether there is a vulnerability in the source code of the project to be analyzed according to the filtering label of the function to be analyzed.

[0197] As to the device in the embodiment, the specific manner in which each module performs an operation has been described in detail in the embodiment related to the method, and will not be described in detail here.

[0198] Some embodiments of the present application can efficiently locate the filtering function to be identified on the pollution propagation path by constructing the pollution propagation path, thereby significantly reducing the analysis range, and then using the semantic understanding ability of the large language model to construct the filtering classification model, accurately judging the filtering function from the function signature and implementation detail level, more accurately identifying the filtering function, and then detecting the vulnerability in the project, thereby improving the accuracy and efficiency of the filtering function identification.

[0199] Still another embodiment of the present application further supplements the device for identifying a filtering function based on a large language model provided by the above embodiment.

[0200] Optionally, the construction module is configured to:

[0201] perform static pollution analysis on the static value flow graph to determine a pollution propagation path related to a pollution source.

[0202] obtain a first function to be analyzed on the path of the propagation of the pollution related to the pollution source;

[0203] obtain a second function to be analyzed not on the path of the propagation of the pollution but related to the pollution source;

[0204] determine a function to be analyzed according to the first function to be analyzed and the second function to be analyzed, and store the function to be analyzed and function information corresponding to the function to be analyzed in the set of functions to be analyzed, wherein the function information corresponding to the function to be analyzed at least includes function name, function return type, parameter list and function body information.

[0205] Some embodiments of the present application obtain a first function to be analyzed on the path of the propagation of the pollution related to the pollution source, and obtain a second function to be analyzed not on the path of the propagation of the pollution but related to the pollution source, so as to obtain a set of functions to be analyzed corresponding to the path of the propagation of the pollution according to the first function to be analyzed and the second function to be analyzed, thereby expanding the search range and preventing the missing report of the filtering function related to the pollution source.

[0206] Optionally, the constructing module is configured to:

[0207] in response to each input pollution source, perform traversal on each node in the static value flow graph in turn by using a depth-first traversal algorithm until the vulnerability node;

[0208] determine the propagation path from the pollution source, the intermediate traversed node to the vulnerability node as the path of the propagation of the pollution corresponding to the pollution source.

[0209] Some embodiments of the present application extract the user code function on the path of the propagation of the pollution from the pollution source to the vulnerability explosion point, i.e., the path of the propagation of the pollution, by using the depth-first traversal algorithm, which can effectively reduce the identification range and greatly improve the identification efficiency.

[0210] Optionally, the constructing module is configured to:

[0211] perform traversal on the function body not on the path of the propagation of the pollution but corresponding to the pollution source by using an abstract syntax tree;

[0212] if the traversed function body matches the preset function body, determine the traversed function body as the second function to be analyzed.

[0213] Some embodiments of the present application further obtain the function not on the path of the propagation of the pollution but related to the pollution source, and store the function information of the function in the set of functions to be analyzed, thereby expanding the search range and preventing the missing report of the filtering function related to the pollution.

[0214] Optionally, the apparatus further includes a training module configured to:

[0215] obtain a sample set, the sample set comprising at least a sample filter function;

[0216] analyze the sample filter function to obtain function information corresponding to the sample filter function, wherein the function information corresponding to the sample filter function comprises at least a sample function name, a sample function return type, a sample parameter list, and sample function body information;

[0217] train a large language model according to the function information corresponding to the sample filter function to obtain a filter classification model, the filter classification model being used to determine whether a function is a filter function.

[0218] Some embodiments of the present application train a large language model by using a sample set composed of sample filter functions to obtain a filter classification model, which can determine whether a function obtained is a filter function.

[0219] Optionally, the training module is configured to:

[0220] obtain a function body, parse the function body into an abstract syntax tree, and convert the abstract syntax tree into structured data;

[0221] obtain a pseudo filter function, the pseudo filter function having a filtering function;

[0222] add the structured data and the pseudo filter function to the sample set as training data.

[0223] Some embodiments of the present application collect filter functions and pseudo filter functions to form a training set, train a fine-tuned LLM model, and use the LLM model to identify whether a function is a filter function, which can understand the purpose of a function at a semantic level and improve the accuracy of model training.

[0224] Optionally, the determining module is configured to:

[0225] if the filter label of the function to be analyzed is the first identifier, it is determined that there is no vulnerability in the project source to be analyzed;

[0226] if the filter label of the function to be analyzed is the second identifier, it is determined that there is a vulnerability in the project source to be analyzed;

[0227] Some embodiments of the present application use filter functions to determine vulnerabilities in a project program, thereby determining whether there is a vulnerability according to the obtained filter label, improving the accuracy of vulnerability detection, and reducing the efficiency of false positives.

[0228] As to the apparatus in the present embodiment, the specific manners in which various modules perform operations have been described in detail in the embodiments relating to the method, and will not be described herein in detail.

[0229] It should be noted that each implementable manner in the embodiment can be implemented alone or in any combination without conflict.

[0230] The embodiment of the application further provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to realize the operation of the method corresponding to any embodiment of the identification method of the filtering function based on a large language model provided in the above embodiment.

[0231] The embodiment of the application further provides a computer program product, which includes a computer program, and the computer program is executed by a processor to realize the operation of the method corresponding to any embodiment of the identification method of the filtering function based on a large language model provided in the above embodiment.

[0232] As shown in Figure 4 Some embodiments of the application provide an electronic device 400, which includes a memory 410, a processor 420, and a computer program stored in the memory 410 and executable on the processor 420, wherein the processor 420 reads the program from the memory 410 through a bus 430 and executes the program to realize the method of any embodiment included in the identification method of the filtering function based on a large language model provided in the above embodiment.

[0233] The processor 420 can process digital signals and can include various computing structures, such as a complex instruction set computer structure, a reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, the processor 420 can be a microprocessor.

[0234] The memory 410 can be used to store instructions executed by the processor 420 or data related to the execution of the instructions. These instructions and / or data can include code for implementing some or all of the functions of one or more modules described in the embodiments of the application. The processor 420 of the embodiments of the disclosure can be used to execute the instructions in the memory 410 to implement the methods shown above. The memory 410 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memory well known to those skilled in the art.

[0235] The above is only an embodiment of the application and does not limit the protection scope of the application. For those skilled in the art, the application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the application shall be included in the protection scope of the application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0236] The above descriptions are merely specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0237] It should be noted that, in this document, relational terms such as first and second and the like can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

Claims

1.A method for identifying a filtering function based on a large language model, characterized in that, The method comprises: acquiring source code of a project to be analyzed; processing the source code of the project to be analyzed to determine a static value flow graph corresponding to the source code of the project to be analyzed; determining a set of functions to be analyzed corresponding to the source code of the project to be analyzed according to the static value flow graph; determining a filtering label of the function to be analyzed according to a preset prompt word, the set of functions to be analyzed, and a pre-trained filtering classification model, wherein the filtering label is used to identify whether the function to be analyzed is a filtering function, and the pre-trained filtering classification model is obtained by training a large language model using a sample set; determining whether there is a vulnerability in the source code of the project to be analyzed according to the filtering label of the function to be analyzed; The method comprises: performing static taint analysis on the static value flow graph to obtain node data in the static value flow graph, wherein the node data at least includes string concatenation, assignment, or function call, and a taint propagation path related to a taint source is determined; acquiring a first function to be analyzed on the taint propagation path related to the taint source; acquiring a second function to be analyzed not on the taint propagation path but related to the taint source; determining the function to be analyzed according to the first function to be analyzed and the second function to be analyzed, and storing the function to be analyzed and function information corresponding to the function to be analyzed in the set of functions to be analyzed, wherein the function information corresponding to the function to be analyzed at least includes function name, function return type, parameter list, and function body information, and the functions in the set of functions to be analyzed are determined from all taint propagation paths from the taint source to a vulnerability node and are functions not on the taint propagation path but related to the taint. 2.The method of claim 1, wherein, The method comprises: in response to input of each taint source, using a depth-first traversal algorithm to traverse each node in the static value flow graph in turn until a vulnerability node is reached; determining a propagation path from the taint source, an intermediate traversed node, to the vulnerability node as a taint propagation path corresponding to the taint source. 3.The method of claim 1, wherein, The method comprises: using an abstract syntax tree to traverse a function body not on the taint propagation path but corresponding to the taint source; if the traversed function body matches a preset function body, determining the traversed function body as the second function to be analyzed. 4.The method of claim 1, wherein, The pre-trained filtering classification model is obtained by the following method: acquiring a sample set, wherein the sample set at least includes sample filtering functions; analyzing the sample filtering functions to obtain function information corresponding to the sample filtering functions, wherein the function information corresponding to the sample filtering functions at least includes sample function name, sample function return type, sample parameter list, and sample function body information; According to the function information corresponding to the sample filtering function, the large language model is trained to obtain the filtering classification model, and the filtering classification model is used to determine whether the function is a filtering function. 5.The method of claim 4, wherein, The obtaining of the sample set further includes: Obtaining a function body, parsing the function body into an abstract syntax tree, and converting the abstract syntax tree into structured data; Obtaining a pseudo-filtering function, the pseudo-filtering function having a filtering function; The structured data and the pseudo-filtering function are added to the sample set as training data. 6.The method of claim 1, wherein, The determining of whether the vulnerability exists in the source code of the project to be analyzed according to the filtering label of the function to be analyzed includes: If the filtering label of the function to be analyzed is the first identifier, it is determined that the vulnerability does not exist in the source code of the project to be analyzed; If the filtering label of the function to be analyzed is the second identifier, it is determined that the vulnerability exists in the source code of the project to be analyzed. 7.A device for identifying a filtering function based on a large language model, characterized by, The device includes: An obtaining module for obtaining source code of a project to be analyzed; A determining module for processing the source code of the project to be analyzed to determine a static value flow graph corresponding to the source code of the project to be analyzed; A constructing module for determining a set of functions to be analyzed corresponding to the source code of the project to be analyzed according to the static value flow graph; An identifying module for determining a filtering label of the function to be analyzed according to a preset prompt word, the set of functions to be analyzed, and a pre-trained filtering classification model, wherein the filtering label is used to identify whether the function to be analyzed is a filtering function, and the pre-trained filtering classification model is obtained by training a large language model using a sample set; A judging module for determining whether a vulnerability exists in the source code of the project to be analyzed according to the filtering label of the function to be analyzed; The constructing module is configured to: Perform static taint analysis on the static value flow graph to obtain node data in the static value flow graph, the node data at least including string concatenation, assignment, or function call, determine a taint propagation path related to a taint source, obtain a first function to be analyzed on the taint propagation path related to the taint source, obtain a second function to be analyzed not on the taint propagation path but related to the taint source, and determine the function to be analyzed according to the first function to be analyzed and the second function to be analyzed, and store the function to be analyzed and function information corresponding to the function to be analyzed in the set of functions to be analyzed, wherein the function information corresponding to the function to be analyzed at least includes function name, function return type, parameter list, and function body information, the functions in the set of functions to be analyzed are determined from all taint propagation paths from the taint source to the vulnerability node, and the functions are not on the taint propagation path but related to the taint. A computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the filtering function identification method based on a large language model according to any one of claims 1-6. ​ ​ 8. An electronic device, comprising: ​ 9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the program is executed by a processor to implement the method for identifying the filtering function based on the large language model according to any one of claims 1-6.

Images