Vulnerability detection method and device, computer equipment and storage medium

Abstract

The invention provides a vulnerability detection method and device, computer equipment and a storage medium. The method comprises the following steps: converting a to-be-tested program code into a code attribute graph; the code attribute graph comprises a plurality of nodes, directed edges corresponding to the nodes and attributes of the directed edges corresponding to the nodes and / or the nodes; encoding the code attribute graph by using a pre-trained graph neural network to generate an encoded attribute graph; the coding attribute graph comprises the plurality of nodes and embedded features corresponding to the plurality of nodes respectively; the embedded feature corresponding to each node in the plurality of nodes is obtained by performing feature aggregation on features of other nodes; and performing feature extraction on the coding attribute graph by using a pre-trained heterogeneous graph neural network to obtain target feature data, and determining a vulnerability detection result corresponding to the to-be-detected program code based on the target feature data.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of artificial intelligence, in particular to a vulnerability detection method and device, computer equipment and a storage medium. BACKGROUND

[0002] A vulnerability refers to a security defect of program code introduced by developers at various stages of program development, such as information technology, product and information system requirements, design, implementation, configuration, operation and other stages, through intentional or unintentional means. Such defects often exist in different forms at various levels and links of information systems. Once exploited by malicious entities, it will cause damage to the security of information systems, thereby affecting the normal operation of services built on information systems, and endangering the security of information systems and information. In recent years, with the rapid development of computer network technology and the popularization and application of new generation network information technologies such as Internet of Things and cloud computing, the global Internet volume has rapidly expanded, and the network space has shown a trend of more intelligent and complex. At the same time, network space security threats are more severe, and the number of security vulnerabilities is showing a rapid growth trend.

[0003] With the application of artificial intelligence in vulnerability detection, efficient detection of program code vulnerabilities is realized. The current vulnerability detection method based on artificial intelligence usually has the problem of low detection accuracy. SUMMARY

[0004] Therefore, the present application provides a vulnerability detection method, device, computer equipment and storage medium. Specifically, the present application is realized by the following technical solutions:

[0005] In a first aspect, the present application provides a vulnerability detection method, comprising:

[0006] Converting the to-be-detected program code into a code attribute graph; the code attribute graph comprises a plurality of nodes, a directed edge corresponding to each node, and an attribute of each node and / or corresponding directed edge;

[0007] Using a pre-trained graph neural network to encode and process the code attribute graph to generate an encoded attribute graph; the encoded attribute graph comprises the plurality of nodes and embedded features corresponding to the plurality of nodes respectively; the embedded feature corresponding to each node in the plurality of nodes is obtained by aggregating the features of other nodes;

[0008] Using a pre-trained heterogeneous graph neural network to extract features from the encoded attribute graph to obtain target feature data, and determining a vulnerability detection result corresponding to the to-be-detected program code based on the target feature data.

[0009] Optionally, the graph neural network is trained in the following manner:

[0010] encoding the sample program code corresponding sample code attribute graph as an encoder, generating the sample code attribute graph; The sample code attribute graph includes: a plurality of sample nodes, and the embedding features corresponding to the plurality of sample nodes respectively;

[0011] The decoder is generated based on the structure of the graph neural network;

[0012] The encoder and the decoder are unsupervised trained by minimizing the difference between the sample code attribute graph and the sample decoding attribute graph, and the trained encoder is used as the trained graph neural network.

[0013] Optionally, the encoder and the decoder are unsupervised trained by minimizing the difference between the sample code attribute graph and the sample decoding attribute graph, comprising:

[0014] For each node in the plurality of nodes, determine the difference feature of each node in the sample code attribute graph and in the sample decoding attribute graph;

[0015] According to the difference feature corresponding to the plurality of nodes respectively, the difference feature variance is determined;

[0016] The difference feature variance is used as a model loss, and the model parameters of the encoder and the decoder are adjusted by minimizing the model loss.

[0017] Optionally, the graph neural network comprises: a graph attention block with one less level, and the graph attention block is used for feature aggregation and update processing of the node and its neighbor nodes based on self-attention mechanism.

[0018] Optionally, the graph attention block is used to aggregate and update the features of the node and its neighbor nodes in the following way:

[0019] The linear feature of the plurality of nodes is transformed respectively to obtain the linear feature corresponding to the plurality of nodes respectively;

[0020] For each node in the plurality of nodes, the linear feature of each node and its corresponding neighbor node is spliced to obtain the splicing feature vector corresponding to each node;

[0021] The splicing vector corresponding to each node is mapped to obtain the score corresponding to each node, and the scores corresponding to the plurality of nodes are normalized to obtain the attention coefficient corresponding to each node;

[0022] The linear features of each neighbor node corresponding to each node are weighted and summed to obtain the aggregation features corresponding to each node.

[0023] Optionally, for the case where the graph attention block has multiple levels, the input data of the first-level graph attention block is the code attribute graph; the input data of the non-first-level graph attention block is the aggregation features corresponding to each node output by the previous-level graph attention block; and the aggregation features of each node output by the last-level graph processing block are the embedding features of the corresponding node.

[0024] Optionally, the heterogeneous graph neural network is configured to extract features of the code attribute graph in the following manner:

[0025] At least one level of heterogeneous graph convolution layer is used to perform convolution processing on the code attribute graph to obtain feature data corresponding to each node in the code attribute graph.

[0026] The feature data corresponding to each node is subjected to nonlinear transformation to obtain nonlinear feature data corresponding to each node.

[0027] The nonlinear feature data corresponding to each node is subjected to pooling processing to obtain pooling feature data corresponding to each node.

[0028] The pooling feature data corresponding to each node is subjected to full connection processing to obtain the target feature data.

[0029] In a second aspect, the embodiments of the present disclosure further provide a vulnerability detection apparatus, which comprises:

[0030] A conversion module is configured to convert a program code to be tested into a code attribute graph; the code attribute graph comprises a plurality of nodes, a directed edge corresponding to each node, and an attribute corresponding to each node and / or the corresponding directed edge.

[0031] A first processing module is configured to use a pre-trained graph neural network to perform encoding processing on the code attribute graph to generate an encoded attribute graph; the encoded attribute graph comprises the plurality of nodes and embedding features corresponding to each node; the embedding features corresponding to each node are obtained by aggregating features of other nodes.

[0032] A second processing module is configured to use a pre-trained heterogeneous graph neural network to extract features of the encoded attribute graph to obtain target feature data, and determine a vulnerability detection result corresponding to the program code to be tested based on the target feature data.

[0033] Optionally, the model training module is further configured to train the graph neural network in the following manner:

[0034] The graph neural network to be trained is used as an encoder to encode and process a sample code attribute graph corresponding to the sample program code, to generate a sample encoded attribute graph; the sample encoded attribute graph includes a plurality of sample nodes and embedding features corresponding to the plurality of sample nodes respectively;

[0035] A decoder is used to decode and process the sample encoded attribute graph, to obtain a sample decoded attribute graph; the decoder is generated based on a structure of the graph neural network;

[0036] The encoder and the decoder are unsupervisedly trained with a target of minimizing a difference between the sample code attribute graph and the sample decoded attribute graph, and the trained encoder is used as the trained graph neural network.

[0037] Optionally, the model training module, when unsupervisedly training the encoder and the decoder with a target of minimizing a difference between the sample code attribute graph and the sample decoded attribute graph, is configured to:

[0038] For each node of the plurality of nodes, a difference feature of the node in the sample code attribute graph and in the sample decoded attribute graph is determined;

[0039] A difference feature variance is determined according to the difference features corresponding to the plurality of nodes respectively;

[0040] The difference feature variance is used as a model loss, and a model parameter of the encoder and the decoder is adjusted with a target of minimizing the model loss.

[0041] Optionally, the graph neural network further includes a graph attention block of one less level, and the graph attention block is configured to perform aggregation and update processing of features of the node and neighbor nodes of the node based on a self-attention mechanism.

[0042] Optionally, the graph attention block is configured to perform the aggregation and update processing of the features of the node and the neighbor nodes of the node in the following manner:

[0043] Linear feature transformation is performed on the plurality of nodes respectively, to obtain linear features corresponding to the plurality of nodes respectively;

[0044] For each node of the plurality of nodes, linear features of the node and corresponding neighbor nodes of the node are spliced to obtain a spliced feature vector corresponding to the node;

[0045] perform feature mapping on the splicing vector corresponding to each node to obtain a score corresponding to each node, and perform normalization processing on the scores corresponding to the plurality of nodes respectively to obtain an attention coefficient corresponding to each node;

[0046] perform weighted sum processing on the linear features of the neighbor nodes corresponding to each node by using the attention coefficients of the neighbor nodes corresponding to each node to obtain aggregated features corresponding to each node.

[0047] Optionally, in the case where the graph attention block has multiple levels, the input data of a first-level graph attention block is the code attribute graph, the input data of a non-first-level graph attention block is the aggregated features corresponding to the plurality of nodes respectively output by a previous-level graph attention block, and the aggregated features of each node output by a last-level graph processing block are the embedding features of the corresponding node.

[0048] Optionally, the heterogeneous graph neural network is configured to extract features from the code attribute graph in the following manner:

[0049] perform convolution processing on the code attribute graph by using at least one level of heterogeneous graph convolution layer to obtain feature data corresponding to the plurality of nodes respectively in the code attribute graph;

[0050] perform nonlinear transformation on the feature data corresponding to the plurality of nodes respectively to obtain nonlinear feature data corresponding to the plurality of nodes respectively;

[0051] perform pooling processing on the nonlinear feature data corresponding to the plurality of nodes respectively to obtain pooled feature data corresponding to the plurality of nodes respectively;

[0052] perform full connection processing on the pooled feature data corresponding to the plurality of nodes respectively to obtain the target feature data.

[0053] In a third aspect, an optional implementation of the present disclosure provides a computer device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the program to implement the steps of the first aspect or any possible implementation of the first aspect.

[0054] In a fourth aspect, an optional implementation of the present disclosure provides a computer-readable storage medium, which stores a computer program executable by a processor to implement the steps of the first aspect or any possible implementation of the first aspect.

[0055] In a fifth aspect, the optional implementation of the present disclosure further provides a computer program product carrying a program code, the program code comprising instructions for executing the steps of the first aspect or any possible implementation of the first aspect.

[0056] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, but not limiting the technical solutions of the present disclosure.

[0057] The vulnerability detection method provided by the embodiments of the present disclosure converts the to-be-tested program code into a code attribute graph, and uses a pre-trained graph neural network to encode and process the code attribute graph to generate an encoded attribute graph. The encoded attribute graph includes the plurality of nodes and the embedding features corresponding to the plurality of nodes respectively; wherein the embedding feature corresponding to each node in the plurality of nodes is obtained by performing feature aggregation on the features of adjacent nodes, and then a pre-trained heterogeneous graph neural network is used to extract features from the encoded attribute graph to obtain feature data, and based on the feature data, the vulnerability information corresponding to the to-be-tested program code is determined. Since the code attribute graph includes the syntax structure of the to-be-tested program code, the execution order and jump relationship between statements or basic blocks in the program, and the flow direction and dependency relationship of data, in addition to being able to represent the structure and syntax of the to-be-tested program code, the code attribute graph also includes more rich semantic information. The embedding features corresponding to the plurality of nodes in the code attribute graph extracted by the graph neural network have the related features of adjacent nodes fused in the embedding feature of each node. Such embedding features can represent the semantic similarity between nodes, which enables the vulnerability detection based on the embedding features by the heterogeneous graph neural network to rely on the semantic similarity between nodes represented by the embedding features corresponding to each node to filter out the nodes that may have vulnerabilities from all nodes, thereby obtaining the vulnerability information of the to-be-tested program code and improving the accuracy of vulnerability detection.

[0058] Further, the graph neural network in the embodiments of the present disclosure adopts an encoder-decoder framework during training, extracts a sample encoded attribute graph corresponding to a sample code attribute graph corresponding to a sample program code through an encoder; then, a decoder is used to restore the sample encoded attribute graph, and by minimizing the difference between the sample code attribute graph before encoding and the sample decoded attribute graph after decoding and the loss of graph structure reconstruction, the unsupervised training of the encoder in the graph neural network is realized, so that the sample program code does not need to be pre-labeled, and the problem of reduced accuracy caused by inaccurate standard does not exist.

[0059] In order to make the above-mentioned purposes, features and advantages of the present disclosure more obvious and easy to understand, the following preferred embodiments are specifically described below, and the accompanying drawings are referred to for detailed description. BRIEF DESCRIPTION OF DRAWINGS

[0060] Figure 1 is a flowchart of a vulnerability detection method according to an example embodiment of the present application;

[0061] Figure 2 is an example of an encoder-decoder architecture used in training a graph neural network according to an example embodiment of the present application;

[0062] Figure 3 is a flowchart of a specific way in which a graph attention block aggregates and updates features of a node and its neighbor nodes according to an example embodiment of the present application;

[0063] Figure 4 is a flowchart of a specific way in which a heterogeneous graph neural network extracts features from the encoded attributed graph according to an example embodiment of the present application;

[0064] Figure 5 is a specific example of a heterogeneous graph neural network according to an example embodiment of the present application;

[0065] Figure 6 is a schematic diagram of a computer device according to an example embodiment of the present application;

[0066] Figure 7 is a schematic diagram of a vulnerability detection apparatus according to an example embodiment of the present application. DETAILED DESCRIPTION

[0067] The example embodiments will now be described in detail with reference to the drawings. Like reference numerals in different drawings denote like or similar elements. The following description of the example embodiments is not representative of all embodiments consistent with the present application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present application as detailed in the appended claims.

[0068] The terminology used in the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application. As used in the present application and the appended claims, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that the term "and / or," as used herein, refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0069] It should be understood that, although the terms first, second, third, etc. can be employed in this application to describe various information, the information should not be limited to these terms. These terms are only used to differentiate one piece of information from another piece of information. For example, without departing from the scope of the present application, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information. Depending on the context, the word "if' as used herein can be interpreted as "when" or "upon" or "in response to determining".

[0070] In the related art, in the program code vulnerability detection manner relying on artificial intelligence, the program code (i.e. training sample) for each training model is usually converted into a program dependency graph and an abstract syntax tree; then a vulnerability detection graph is generated based on a preset key node type, the program dependency graph and the abstract syntax tree; based on the vulnerability labels of a plurality of program code statements in the training program code, each vulnerability detection graph is classified in a fine-grained manner to obtain a vulnerability detection graph training set containing a plurality of sample types; then, based on the vulnerability detection graph training set, a pre-constructed heterogeneous graph neural network is trained to obtain a program code vulnerability detection model for fine-grained vulnerability detection graph detection and outputting a fine-grained vulnerability detection result.

[0071] The detection accuracy of this method usually depends on the accuracy of data labeling. First, it depends on the preset key node type; if the preset key node type is not comprehensive or not accurate enough, it can cause the model to miss some potential vulnerabilities in the detection process, reducing the accuracy of detection; second, it depends on the accurate labeling of fine-grained classification, and the fine-grained classification based on the vulnerability labels in the training program code can have the case that the vulnerability labels are not accurate or not comprehensive, which also reduces the detection accuracy of the model for vulnerabilities.

[0072] In addition, the information provided by the abstract syntax tree and the program dependency graph is not comprehensive enough. The program dependency graph can provide a certain degree of semantic information, but both of them are mainly used to represent the structure and syntax of the program, and cannot comprehensively describe the semantics of the program code, which causes the model to miss some code vulnerabilities, also reducing the detection accuracy of the model for vulnerabilities.

[0073] To solve the above problems, the disclosure embodiment provides a vulnerability detection method, which converts the to-be-tested program code into a code attribute graph, and uses a pre-trained graph neural network to encode and process the code attribute graph to generate an encoded attribute graph. The encoded attribute graph includes the plurality of nodes and the embedding features corresponding to the plurality of nodes respectively; wherein the embedding feature corresponding to each node in the plurality of nodes is obtained by aggregating the features of adjacent nodes, and then a pre-trained heterogeneous graph neural network is used to extract features from the encoded attribute graph to obtain feature data, and based on the feature data, the vulnerability information corresponding to the to-be-tested program code is determined. Since the code attribute graph includes the syntax structure of the to-be-tested program code, the execution order and jump relationship between statements or basic blocks in the program, and the flow direction and dependency relationship of data, the code attribute graph can not only represent the structure and syntax of the to-be-tested program code, but also include more rich semantic information. The embedding features corresponding to the plurality of nodes in the code attribute graph extracted by the graph neural network, the embedding features of each node fuse the related features of adjacent nodes, and such embedding features can represent the semantic similarity between nodes, which makes it possible to rely on the semantic similarity between nodes represented by the embedding features of each node to filter out nodes that may have vulnerabilities from all nodes when using a heterogeneous graph neural network to detect vulnerabilities based on embedding features, thereby obtaining the vulnerability information of the to-be-tested program code and improving the accuracy of vulnerability detection.

[0074] In addition, the graph neural network in the disclosure embodiment adopts an encoder-decoder framework during training, extracts a sample code attribute graph corresponding to a sample program code through an encoder, and then uses a decoder to restore the sample code attribute graph. By minimizing the difference between the sample code attribute graph before encoding and the sample decoding attribute graph after decoding and the loss of graph structure reconstruction, the encoder in the graph neural network is un supervisedly trained, so that the sample program code does not need to be pre-labeled, and the problem of reduced accuracy caused by inaccurate standard does not exist.

[0075] The above-mentioned defects are the results of the inventors after careful research and practice, so the discovery process of the above-mentioned problems and the solutions proposed by the disclosure to solve the above-mentioned problems in the following should be the contribution of the inventors to the disclosure in the process of the disclosure.

[0076] For the convenience of understanding the present embodiment, first, a vulnerability detection method disclosed by the present embodiment is introduced in detail, the execution subject of the vulnerability detection method provided by the present embodiment is generally a computer device with certain computing capability, which for example includes a terminal device or a server or other processing device, and the terminal device can be a user equipment (User Equipment, UE), a mobile device, a user terminal, a vehicle-mounted device, a wearable device, etc. In some possible implementation manners, the vulnerability detection method can be realized by a processor calling computer readable instructions stored in a memory.

[0077] The vulnerability detection method provided by the present embodiment is described below.

[0078] Referring to Figure 1 The method provided by the present embodiment includes steps S101-S104, wherein:

[0079] S101: converting a to-be-tested program code into a code property graph; the code property graph includes a plurality of nodes, a directed edge corresponding to each node, and a property of each node and / or corresponding directed edge;

[0080] S102: using a pre-trained graph neural network to perform encoding processing on the code property graph to generate an encoded property graph; the encoded property graph includes the plurality of nodes and embedded features corresponding to the plurality of nodes respectively; wherein the embedded feature corresponding to each node in the plurality of nodes is obtained by performing feature aggregation on the features of adjacent nodes;

[0081] S103: using a pre-trained heterogeneous graph neural network to perform feature extraction on the encoded property graph to obtain target feature data, and determining a vulnerability detection result corresponding to the to-be-tested program code based on the target feature data.

[0082] The above S101-S103 are described in detail below.

[0083] For the above S101, in a specific implementation, a code property graph (Code Property Graph, CPG) is a structured representation method for program analysis, which integrates the syntax structure, control flow, data flow and semantic properties of the code into a unified graph model, so as to more efficiently perform code analysis, vulnerability detection, program understanding and other tasks.

[0084] The code property graph generally includes three aspects:

[0085] Abstract Syntax Tree (AST): Captures the syntactic structure of code, such as variable declarations, function calls, expressions, and their hierarchical relationships.

[0086] Control Flow Graph (CFG): Demonstrates the execution order and jump relationships between statements or basic blocks in a program, reflecting the execution path of the program.

[0087] Data Flow Graph (DFG): Tracks how the values of variables are passed, modified, and used in a program, demonstrating the flow and dependency of data.

[0088] Integrating abstract syntax trees, control flow graphs, and data flow graphs, the resulting code property graph includes: multiple nodes, directed edges corresponding to each node, and attributes of each node and / or corresponding directed edges. Wherein, the node represents the code element in the program code to be tested; the directed edge is used to represent the relationship between the code element corresponding to the node and other code elements; the attribute is used to store and describe the characteristics and information corresponding to the node and / or directed edge;

[0089] The code property graph can be represented as: G = (V, E, μ).

[0090] Where V represents the node, for example, the code element in the program code to be tested. Such as functions, classes, variables, constants, expressions, etc. Each node corresponds to a unique identifier and a set of attributes, which are used to describe the characteristics and information of the node. The characteristics and information of the node include: directed edges and attributes.

[0091] E represents a directed edge; a directed edge represents the relationship between code elements, which includes, for example: directed edges in the abstract syntax tree, directed edges in the control flow graph, and directed edges in the data flow graph. It can point from the current node to the corresponding neighbor node, or from the neighbor node to the current node.

[0092] For example, the directed edge in the abstract syntax tree is used to describe the syntax hierarchical relationship, such as the inclusion relationship, the nested relationship, the sequential relationship, etc.

[0093] For example, the directed edge in the control flow graph is used to describe the code execution order, such as the execution order, the jump relationship, the branch dependency, etc.

[0094] For example, the directed edge in the data flow graph is used to describe the data dependency relationship, such as the assignment relationship, the reference relationship, the data source, the transmission relationship, etc.

[0095] In addition, the directed edge can also describe other relationships, such as semantic relationships or logical relationships: such as call relationships, inheritance relationships, implementation relationships, association relationships, override relationships, access relationships, and the like. The specific differences depend on the different program codes, and the embodiments of the present disclosure are not limited.

[0096] μ represents the attribute corresponding to the node and / or directed edge; the attribute is used to store and describe the characteristics and information corresponding to the node and / or directed edge, for example, a function node can include the name and parameter list of the function and the like attributes, and a directed edge can include the source and target function of the call and the like attributes.

[0097] In the conversion of the to-be-tested program code into the code attribute graph, for example, the to-be-tested program code can be first converted into an AST through a compiler or a parser to extract the syntax structure of the to-be-tested program code; then, the execution order between the statements can be analyzed on the basis of the AST to construct a control flow relationship CFG, and then the definition and use relationship of the variables can be analyzed to construct a data flow edge to generate a DFG. Then, the nodes and edges of the AST, the CFG, and the DFG are integrated, and additional attribute information such as the node type, the code line number, and the variable type is supplemented to obtain the code attribute graph.

[0098] For S102 described above:

[0099] In a specific implementation, a graph neural network (GNN) is a deep learning model specially used for processing graph structure data. It can capture the features of nodes, edges, and overall structure in the graph by simulating the way in which humans understand relational data.

[0100] The graph neural network provided by the embodiments of the present disclosure includes at least one graph attention block, which can also be referred to as a graph attention network (GAT). The graph attention block can perform aggregation and update processing of features of the node and its neighbor nodes based on a self-attention mechanism.

[0101] By stacking multiple graph attention blocks to form a graph neural network, embedding features corresponding to each node in the graph are generated. The multiple graph attention blocks can be used to perform multiple times of aggregation and update of features of each node and its neighbor nodes in the code attribute graph, so that the features of each node are gradually propagated to other nodes, and the aggregated features corresponding to each node can capture global information of the graph structure. Then, the heterogeneous graph neural network is used to perform feature extraction on the encoded attribute graph, and the obtained feature data includes more rich features of each node, so that more accurate classification can be performed based on the obtained feature data, and more accurate vulnerability detection results can be obtained.

[0102] Specifically, the graph neural network can be trained in the following manner:

[0103] The graph neural network to be trained is used as an encoder to encode a sample code attribute graph corresponding to a sample program code to generate a sample encoded attribute graph; the sample encoded attribute graph includes a plurality of sample nodes and embedding features corresponding to the plurality of sample nodes respectively.

[0104] A decoder is used to decode the sample encoded attribute graph to obtain a sample decoded attribute graph; the decoder is generated based on a structure of the graph neural network.

[0105] The encoder and the decoder are unsupervisedly trained with a target of minimizing a difference between the sample code attribute graph and the sample decoded attribute graph, and the trained encoder is used as the trained graph neural network.

[0106] In specific implementation, the sample program code is, for example, a program code used to train the graph neural network; the sample program code can be converted into a sample code attribute graph. The conversion manner is similar to the manner of converting the program code to be tested into a code attribute graph, which will not be described herein again. The sample code attribute graph is encoded by the encoder to obtain a sample encoded attribute graph. The process of encoding the sample code attribute graph by the encoder is the same as the process of encoding the code attribute graph corresponding to the program code to be tested by the trained graph neural network.

[0107] In specific implementation, referring to FIG. 1, Figure 2 It is shown that the encoder-decoder architecture used when training the graph neural network is provided.

[0108] The graph neural network to be trained, that is, the encoder includes n GATs. Correspondingly, the decoder also includes N GATs. The code attribute graph is input into the encoder, and the sample code attribute graph is encoded by the encoder to obtain a sample encoded attribute graph corresponding to the sample code attribute graph. The encoded attribute graph can be represented by nodes and embedding features corresponding to the nodes.

[0109] Afterwards, the sample code attribute graph is input to a decoder, and n GATs in the decoder all attempt to perform the encoding process in reverse by the features of the nodes and their neighbor nodes to reconstruct the representation of the nodes, and thus obtain a reconstructed attribute graph, i.e., a sample decoding attribute graph. In the embodiments of the present disclosure, since the nodes are endowed with initial features, and the directed edges only represent the data flow direction and the control flow direction between the nodes, and do not have specific feature representations, when constructing a reconstruction loss for reconstructing the code attribute graph, the difference between the sample code attribute graph and the sample decoding attribute graph is minimized. Since the encoder-decoder structure is used to train the graph neural network, and no labeling is required for the sample program code, the training process is an unsupervised training process based on the encoder-decoder architecture.

[0110] Specifically, when the encoder and the decoder are unsupervised trained by minimizing the difference between the sample code attribute graph and the sample decoding attribute graph, the following method can be used, for example:

[0111] For each node in the plurality of nodes, a difference feature of the node in the sample code attribute graph and in the sample decoding attribute graph is determined;

[0112] According to the difference features corresponding to the plurality of nodes respectively, a difference feature variance is determined.

[0113] The difference feature variance is taken as a model loss, and the model loss is minimized as the target to adjust the model parameters of the encoder and the decoder.

[0114] In specific implementation, since the sample code attribute graph and the sample decoding attribute graph are both expressed in the form of vectors, when the difference attribute corresponding to each node is determined, for each node, the vector distance between the first vector of the node in the sample code attribute graph and the second vector of the node in the sample decoding attribute graph can be calculated, for example. The difference feature corresponding to each node can be represented by at least one of the following, such as Euclidean distance, Manhattan distance, Chebyshev distance, cosine similarity, Pearson correlation coefficient, Hamming distance, and Jaccard similarity coefficient.

[0115] The loss function thereof can be realized in the form of variance, and is represented by the following formula (1):

[0116] L = Var(x) (1)

[0117] Wherein, L represents the loss; Var(·) represents the variance, and x represents the feature difference between the same node in the sample code attribute graph and in the sample decoding attribute graph. Assuming that there are K nodes, the loss function represents the variance of the difference features corresponding to the K nodes respectively.

[0118] In addition, the loss can also be determined by determining the mean value between the different node corresponding difference features, and the specific loss determination manner is not limited by the embodiments of the present disclosure.

[0119] After obtaining the loss, the parameters of the encoder and the decoder can be adjusted with the goal of minimizing the loss. After multiple rounds of adjustment of the parameters of the encoder and the decoder, when the loss meets certain training stop conditions, the encoder obtained in the last round of training is taken as the trained graph neural network. The stop conditions include at least one of the following: the number of training rounds reaches a preset number threshold, the loss is less than a preset loss threshold, the change rate of the loss in continuous N rounds of training is less than a preset change rate threshold, and the like. In addition, other training stop conditions can also be set, and the embodiments of the present disclosure are not limited.

[0120] After the training of the graph neural network is completed, the graph neural network can be applied to the encoding processing of the code attribute graph.

[0121] In the application stage of the graph neural network and the training node of the graph neural network, the processing process of the graph attention block in the graph neural network on the input data is similar. The embodiments of the present disclosure take the application stage of the graph neural network as an example, and refer to FIG. 8, which shows a specific manner of the graph attention block for aggregating and updating the features of the nodes and the neighbor nodes, comprising: Figure 3

[0122] S301: performing linear feature transformation on the plurality of nodes respectively to obtain linear features corresponding to the plurality of nodes respectively.

[0123] Specifically, the graph attention block can perform linear transformation on the features of each node and the corresponding neighbor nodes by using shared weights. The linear features of each node and the corresponding neighbor nodes obtained respectively satisfy the following formula (2) and formula (3):

[0124] T i =w×F i (2)

[0125] T j =w×F j (3)

[0126] Wherein, F i represents the relevant feature data of the i th node before linear transformation; T i represents the linear feature of the i th node after linear transformation, F j represents the relevant feature data of the neighbor node corresponding to the i th node; T j represents the linear feature of the neighbor node after linear transformation, and w represents the shared weight. ​

[0127] For the case that the graph neural network includes multiple graph attention blocks, the input data of the first-level graph attention block is the code attribute graph; the input data of the i-th graph attention block in the non-first-level graph attention block is the aggregated features of each node output by the (i-1)-th graph attention block. The output data of the last-level graph attention block is the code attribute graph; the output data of the j-th graph attention block in the non-last-level graph attention block is the new aggregated features obtained by performing the aggregation and update processing of the features again on the aggregated features of each node output by the (j-1)-th graph attention block. For the description of the aggregated features, please refer to the following Figure 3 The corresponding specific embodiments are not described here again.

[0128] That is, the relevant feature data before the linear transformation of each node corresponding to the input of the first-level graph attention block, that is, the data composed of each node, the corresponding directed edge in the code attribute graph, and the conversion of the node and / or the corresponding directed edge into a vector.

[0129] The relevant feature data before the linear transformation of each node corresponding to the input of the i-th graph attention block in the non-first-level is the aggregated features of each node corresponding to the output of the (i-1)-th graph attention block.

[0130] S302: For each node in the plurality of nodes, the linear features of the each node and its corresponding neighbor nodes are spliced to obtain a spliced feature vector corresponding to the each node.

[0131] Here, for the i-th node, the linear features of the i-th node and its neighbor nodes are spliced to obtain a spliced feature vector concatenatedi, which satisfies, for example, the following formula (4):

[0132] concatenatedi i =[T i ,T j ] (4)

[0133] Where [·] represents the splicing operation of the vector.

[0134] S303: The spliced vector corresponding to the each node is mapped to obtain a score corresponding to the each node, and the scores corresponding to the plurality of nodes are normalized to obtain an attention coefficient corresponding to the each node.

[0135] Here, for example, a single-layer feedforward neural network layer can be used to map the spliced feature vector to a real number, which is the score corresponding to each node. For example, the score corresponding to the i-th node scorei i satisfies the following formula (5):

[0136] score i =f(concatenated i ) (5)

[0137] wherein f(·) denotes a mapping function, which corresponds to a single-layer feedforward neural network layer.

[0138] Here, it is assumed that there are K nodes in the code attribute graph, and the K nodes correspond to a score respectively.

[0139] After that, the scores corresponding to the K nodes can be normalized by using a softmax function to obtain attention coefficients corresponding to the K nodes respectively.

[0140] wherein the attention coefficients corresponding to the nodes satisfy the following formula (6):

[0141] attention=softmax(score) (6)

[0142] Here, there will be an attention coefficient for each node.

[0143] S304: The linear features of the neighbor nodes corresponding to each node are weighted and summed using the attention coefficients of the neighbor nodes corresponding to each node to obtain the aggregated features corresponding to each node.

[0144] Here, the aggregated features updated_F i satisfy the following formula (7):

[0145] updated_F i =∑(attention j ×T j ) (7)attention j each represents the attention coefficient corresponding to the neighbor node j of the i-th node.

[0146] The plurality of nodes and the aggregated features corresponding to the plurality of nodes constitute an encoding attribute graph.

[0147] For the above S103:

[0148] Heterogeneous Graph Convolutional Network (HGCN) is a graph neural network (GNN) variant specially designed for processing heterogeneous graphs. It can capture multiple types of nodes, edges, and their complex semantic relationships.

[0149] The core of the HGCN is to learn the low-dimensional embedding representation of the nodes in the heterogeneous graph, so as to retain the node features and fuse the information of different types of neighbors (including semantic relationships), and finally be used for node classification. The pre-trained HGCN is used in the embodiment of the disclosure, the encoded attribute graph input to the heterogeneous graph convolutional network is subjected to convolution processing through the heterogeneous graph convolutional layer, the differences between the vulnerable codes and the non-vulnerable codes are extracted through the convolution, then the convolution result is subjected to nonlinear transformation optimization, and the linear transformation result is compressed through the pooling operation, so as to reduce the dimension of the feature vector and extract the main features. All the features are connected by using the full connection layer to obtain the feature data of the encoded attribute graph, and finally the feature data is sent to the classifier for classification, and the category to which the code attribute graph belongs is output. The category is the vulnerability detection result corresponding to the program code to be detected.

[0150] Specifically, referring to FIG. 1, Figure 4 As shown in the figure, the embodiment of the disclosure also provides a specific way of feature extraction of the encoded attribute graph by the heterogeneous graph neural network, comprising:

[0151] S401: Convolution processing is performed on the encoded attribute graph by using at least one level of heterogeneous graph convolutional layer to obtain feature data corresponding to a plurality of nodes in the encoded attribute graph respectively;

[0152] Specifically, the heterogeneous graph convolutional layer is used to extract the heterogeneous connection information between nodes. For node i, the feature data thereof can be represented as At least one level of heterogeneous graph convolutional layer can be used for transmission of the heterogeneous connection information. It is assumed that there are M types of edges in the code attribute graph, and each type of edge has a different weight matrix W (M) , where m e {1, 2,..., M}. For the mth type of neighbor node set of node i The feature data thereof satisfies the following formula (8), for example:

[0153]

[0154] wherein, represents an attention coefficient, which is generated when the code attribute graph is encoded and processed by using the graph neural network, and can be specifically referred to formula (6) above.

[0155] S402: Nonlinear transformation is performed on the feature data corresponding to the plurality of nodes respectively to obtain nonlinear feature data corresponding to the plurality of nodes respectively.

[0156] Specifically, for example, the ReLU function can be used to perform nonlinear transformation on the feature data corresponding to the plurality of nodes respectively.

[0157] S403: Pooling processing is performed on the nonlinear feature data corresponding to the plurality of nodes respectively, to obtain pooled feature data corresponding to the plurality of nodes respectively.

[0158] Here, for example, the Maxpooling layer can be used to perform the pooling processing on the nonlinear feature data corresponding to the plurality of input nodes respectively, to realize the compression of the nonlinear feature data corresponding to the plurality of input nodes respectively, reduce the dimension of the feature vector, and extract the main features. For each feature channel, the maximum value is taken as the pooling result of the channel. Assuming that there are n feature channels, the result of the pooling operation satisfies, for example, the following formula (9):

[0159] P = MaxPool(C) (9)

[0160] Wherein, P represents the pooled feature data; C represents the nonlinear feature data. MaxPool(·) represents the maximum pooling processing.

[0161] S404: Full connection processing is performed on the pooled feature data corresponding to the plurality of nodes respectively, to obtain the target feature data.

[0162] Here, for example, the full connection layer can be used to perform the full connection processing on the pooled feature data P corresponding to the plurality of nodes respectively, and the ReLU activation function can be used to activate the result of the full connection processing, to obtain the target feature data.

[0163] After obtaining the target feature data, the target feature data is input into the Softmax classifier for graph classification, to obtain the probability distribution of each class corresponding to the code attribute graph. According to the probability distribution of each class corresponding to the code attribute graph, the class with the maximum probability is selected as the vulnerability detection result corresponding to the program code to be tested.

[0164] For example, the class can include two types, namely normal and abnormal.

[0165] The classification result Y can be represented as the following formula (10):

[0166] Y = Softmax(F x P + b') (10)

[0167] Wherein, F and b' represent the weight matrix and the bias parameter of the full connection layer respectively.

[0168] As shown in FIG. 1, the disclosure embodiment further provides a specific example of a heterogeneous graph neural network, which includes a multi-level heterogeneous graph convolution layer, an activation layer, a Maxpooling layer, a full connection layer, and a softmax classifier. Figure 5

[0169] ​The multi-level heterogeneous graph convolution layer is configured to perform convolution processing on the encoded attribute graph to obtain nonlinear feature data; the activation layer is configured to perform nonlinear transformation on the nonlinear feature data to obtain nonlinear feature data; the Maxpooling layer is configured to perform maximum pooling processing on the nonlinear feature data to obtain pooled feature data; the fully connected layer is configured to perform full connection processing on the pooled feature data to obtain target feature data; and the softmax classifier is configured to perform classification processing on the encoded attribute graph based on the target feature data to obtain a vulnerability detection result corresponding to the program code to be tested.

[0170] Corresponding to the foregoing embodiments of the vulnerability detection method, the present application also provides embodiments of a vulnerability detection device.

[0171] The embodiments of the vulnerability detection device of the present application can be applied to a computer device. The device embodiments can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a logical device, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory and running by the processor of the computer device where it is located. From the hardware level, as shown in Figure 6 , it is a hardware structure diagram of the computer device where the vulnerability detection device of the present application is located. In addition to the processor, the memory, the network interface, and the non-volatile memory shown in Figure 6 , the computer device where the device in the embodiments is located usually includes other hardware according to the actual function of the vulnerability detection device, and details are not repeated.

[0172] Please refer to Figure 7 , the vulnerability detection device provided by the embodiments of the present disclosure includes:

[0173] The conversion module 71 is configured to convert the program code to be tested into a code attribute graph; the code attribute graph includes a plurality of nodes, a directed edge corresponding to each node, and an attribute of each node and / or corresponding directed edge;

[0174] The first processing module 72 is configured to use a pre-trained graph neural network to encode the code attribute graph to generate an encoded attribute graph; the encoded attribute graph includes the plurality of nodes and embedded features corresponding to the plurality of nodes respectively; the embedded feature corresponding to each node in the plurality of nodes is obtained by aggregating the features of other nodes;

[0175] The second processing module 53 is configured to use a pre-trained heterogeneous graph neural network to extract features of the encoded attribute graph to obtain target feature data, and determine a vulnerability detection result corresponding to the program code to be tested based on the target feature data.

[0176] Optionally, the model training module 74 is further configured to train the graph neural network in the following manner:

[0177] The graph neural network to be trained is used as an encoder to encode and process a sample code attribute graph corresponding to the sample program code, to generate a sample encoded attribute graph; the sample encoded attribute graph includes a plurality of sample nodes and embedding features corresponding to the plurality of sample nodes respectively;

[0178] A decoder is used to decode and process the sample encoded attribute graph, to obtain a sample decoded attribute graph; the decoder is generated based on a structure of the graph neural network;

[0179] The encoder and the decoder are unsupervisedly trained with a target of minimizing a difference between the sample code attribute graph and the sample decoded attribute graph, and the trained encoder is used as the trained graph neural network.

[0180] Optionally, the model training module 74 is configured to, when unsupervisedly training the encoder and the decoder with a target of minimizing a difference between the sample code attribute graph and the sample decoded attribute graph:

[0181] For each node of the plurality of nodes, a difference feature of the node in the sample code attribute graph and in the sample decoded attribute graph is determined;

[0182] A variance of the difference features corresponding to the plurality of nodes is determined;

[0183] The variance of the difference features is used as a model loss, and a model parameter of the encoder and the decoder is adjusted with a target of minimizing the model loss.

[0184] Optionally, the graph neural network further includes a graph attention block of one less level, the graph attention block being configured to perform aggregation and update processing of features of the node and neighbor nodes of the node based on a self-attention mechanism.

[0185] Optionally, the graph attention block is configured to perform the aggregation and update processing of the features of the node and the neighbor nodes of the node in the following manner:

[0186] Linear feature transformation is performed on the plurality of nodes respectively, to obtain linear features corresponding to the plurality of nodes respectively;

[0187] For each node of the plurality of nodes, linear features of the node and corresponding neighbor nodes of the node are spliced to obtain a spliced feature vector corresponding to the node;

[0188] perform feature mapping on the splicing vector corresponding to each node to obtain a score corresponding to each node, and perform normalization processing on the scores corresponding to the plurality of nodes respectively to obtain an attention coefficient corresponding to each node;

[0189] perform weighted sum processing on the linear features of the neighbor nodes corresponding to each node by using the attention coefficients of the neighbor nodes corresponding to each node to obtain the aggregated features corresponding to each node.

[0190] Optionally, in the case where the graph attention block has multiple levels, the input data of the first-level graph attention block is the code attribute graph, the input data of the non-first-level graph attention block is the aggregated features corresponding to the plurality of nodes respectively output by the previous-level graph attention block, and the aggregated features of each node output by the last-level graph processing block are the embedding features of the corresponding node.

[0191] Optionally, the heterogeneous graph neural network is configured to perform feature extraction on the code attribute graph in the following manner:

[0192] perform convolution processing on the code attribute graph by using at least one level of heterogeneous graph convolution layer to obtain feature data corresponding to the plurality of nodes respectively in the code attribute graph;

[0193] perform nonlinear transformation on the feature data corresponding to the plurality of nodes respectively to obtain nonlinear feature data corresponding to the plurality of nodes respectively;

[0194] perform pooling processing on the nonlinear feature data corresponding to the plurality of nodes respectively to obtain pooled feature data corresponding to the plurality of nodes respectively;

[0195] perform full connection processing on the pooled feature data corresponding to the plurality of nodes respectively to obtain the target feature data.

[0196] The implementation process of the functions and roles of each unit in the above apparatus is specifically described in the implementation process of the corresponding steps in the above method, which will not be repeated here.

[0197] For the device embodiment, since it basically corresponds to the method embodiment, the relevant part can be seen from the part of the method embodiment. The device embodiments described above are only illustrative, and the units described as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, that is, they can be located in one place or distributed on multiple network units. According to actual needs, part or all of the modules can be selected to achieve the purpose of the scheme of the present application. Those skilled in the art can understand and implement it without creative labor.

[0198] The embodiment of the present disclosure further provides a computer readable storage medium, which stores a computer program. When the computer program is run by a processor, steps of the vulnerability detection method described in the above method embodiment are executed. The storage medium can be a volatile or non-volatile computer readable storage medium.

[0199] The embodiment of the present disclosure further provides a computer program product, which carries a program code. The program code includes instructions for executing steps of the vulnerability detection method described in the above method embodiment. Details can be referred to the above method embodiment, and will not be described here.

[0200] The computer program product can be specifically implemented by hardware, software or a combination thereof. In an optional embodiment, the computer program product is specifically embodied as a computer storage medium. In another optional embodiment, the computer program product is specifically embodied as a software product, such as a software development kit (SDK) and the like.

[0201] The computer program or instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer program or instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center through wired or wireless manner. The computer readable storage medium can be any available medium accessible by a computer or a data storage device such as a server, data center and the like integrated with one or more available media. The available medium can be a magnetic medium, such as a floppy disk, a hard disk, a magnetic tape; or an optical medium, such as a digital video disc; or a semiconductor medium, such as a solid state disk. The computer readable storage medium can be a volatile or non-volatile storage medium, or can include both volatile and non-volatile storage media.

[0202] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the scope of protection of the present application.

Claims

1. A vulnerability detection method, characterized in that, The method includes: The code of the program under test is converted into a code attribute graph; the code attribute graph includes multiple nodes, directed edges corresponding to each node, and attributes of each node and / or its corresponding directed edges; The code attribute map is encoded using a pre-trained graph neural network to generate an encoded attribute map. The encoded attribute map includes multiple nodes and embedding features corresponding to each of the multiple nodes. The embedding features corresponding to each of the multiple nodes are obtained by feature aggregation of the features of other nodes. The encoded attribute graph is used to extract features using a pre-trained heterogeneous graph neural network to obtain target feature data, and the vulnerability detection result corresponding to the code under test is determined based on the target feature data.

2. The method according to claim 1, characterized in that, The graph neural network is trained in the following manner: The graph neural network to be trained is used as an encoder to encode the sample code attribute map corresponding to the sample program code, thereby generating a sample encoding attribute map; the sample encoding attribute map includes: multiple sample nodes and the embedded features corresponding to the multiple sample nodes respectively; The sample encoded attribute map is decoded using a decoder to obtain a sample decoded attribute map; wherein the decoder is generated based on the structure of the graph neural network. With the goal of minimizing the difference between the sample code attribute map and the sample decoding attribute map, the encoder and the decoder are trained in an unsupervised manner, and the trained encoder is used as a trained graph neural network.

3. The method according to claim 2, characterized in that, The unsupervised training of the encoder and the decoder, with the objective of minimizing the difference between the sample code attribute map and the sample decoded attribute map, includes: For each of the multiple nodes, determine the difference features of each node in the sample code attribute graph and the sample decoding attribute graph; The variance of the difference features is determined based on the difference features corresponding to the multiple nodes respectively; The model parameters of the encoder and decoder are adjusted by using the variance of the differential features as the model loss and minimizing the model loss.

4. The method according to any one of claims 1-3, characterized in that, The graph neural network includes: a graph attention block of at least one level, which is used to aggregate and update features of the node and its neighboring nodes based on a self-attention mechanism.

5. The method according to claim 4, characterized in that, The graph attention block is used to aggregate and update features of the node and its neighboring nodes in the following manner: Perform linear feature transformation on each of the multiple nodes to obtain the linear features corresponding to each of the multiple nodes; For each of the plurality of nodes, the linear features of each node and its corresponding neighboring nodes are concatenated to obtain the concatenated feature vector corresponding to each node; Feature mapping is performed on the concatenated vector corresponding to each node to obtain the score corresponding to each node, and the scores corresponding to the multiple nodes are normalized to obtain the attention coefficient corresponding to each node. By using the attention coefficients of the neighboring nodes of each node, the linear features of the neighboring nodes of each node are weighted and summed to obtain the aggregated features of each node.

6. The method according to claim 5, characterized in that, For the case where the graph attention block has multiple levels: the input data of the first-level graph attention block is the code attribute graph; the input data of non-first-level graph attention blocks are the aggregated features corresponding to the multiple nodes output by the previous level graph attention block; the aggregated features of each node output by the last level graph processing block are the embedding features of the corresponding nodes.

7. The method according to claim 1, characterized in that, The heterogeneous graph neural network is used to extract features from the encoded attribute map in the following manner: The encoded attribute map is convolved using at least one heterogeneous graph convolutional layer to obtain feature data corresponding to multiple nodes in the encoded attribute map. A nonlinear transformation is performed on the feature data corresponding to the multiple nodes to obtain nonlinear feature data corresponding to the multiple nodes. The nonlinear feature data corresponding to the plurality of nodes are pooled to obtain the pooled feature data corresponding to the plurality of nodes. The target feature data is obtained by performing fully connected processing on the pooled feature data corresponding to the multiple nodes respectively.

8. A vulnerability detection device, characterized in that, include: A conversion module is used to convert the code of the program under test into a code attribute graph; the code attribute graph includes multiple nodes, directed edges corresponding to each node, and attributes of each node and / or its corresponding directed edges; The first processing module is used to encode the code attribute map using a pre-trained graph neural network to generate an encoded attribute map; the encoded attribute map includes: the plurality of nodes and the embedding features corresponding to the plurality of nodes respectively; the embedding feature corresponding to each of the plurality of nodes is obtained by feature aggregation of the features of other nodes; The second processing module is used to extract features from the encoded attribute graph using a pre-trained heterogeneous graph neural network to obtain target feature data, and to determine the vulnerability detection result corresponding to the program code under test based on the target feature data.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by a processor, it implements the steps of the method according to any one of claims 1-7.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it performs the following steps: The code of the program under test is converted into a code attribute graph; the code attribute graph includes multiple nodes, directed edges corresponding to each node, and attributes of each node and / or its corresponding directed edges; The code attribute map is encoded using a pre-trained graph neural network to generate an encoded attribute map. The encoded attribute map includes multiple nodes and embedding features corresponding to each of the multiple nodes. The embedding features corresponding to each of the multiple nodes are obtained by feature aggregation of the features of other nodes. The encoded attribute graph is used to extract features using a pre-trained heterogeneous graph neural network to obtain target feature data, and the vulnerability detection result corresponding to the code under test is determined based on the target feature data.

Images