An AI-based online JAR package execution intelligent recognition method and system

Abstract

This invention discloses an AI-based online intelligent identification method and system for JAR package execution, relating to the field of intelligent identification technology for compressed packages. The method includes: evaluating the overall similarity between the JAR package and historical JAR packages at the code business scenario level; analyzing the code similarity between the feature code of historical JAR packages and the feature code of this JAR package, and assessing the code vulnerability risk of the feature code; analyzing the impact of similar historical code in similar historical JAR packages on the vulnerability risk of the feature code; assessing the impact of vulnerable code on the vulnerability risk of the feature code in the JAR package; identifying the execution risk of the JAR package, obtaining execution risk data, and sending the execution risk data to the JAR package administrator through the platform. This achieves intelligent identification of JAR package execution risks and effectively improves the accuracy of execution risk identification.

Description

Technical Field

[0001] This invention relates to the field of intelligent recognition technology for compressed files, specifically an AI-based online intelligent recognition method and system for running JAR files. Background Technology

[0002] A JAR file is typically a collection of Java class files, related metadata, and resources into one file, which can be understood as a "container" for Java programs. However, in practice, JAR files may contain malicious code, viruses, Trojans, etc., posing security risks. Therefore, it is crucial to identify the operation of JAR files.

[0003] Traditional methods for identifying online JAR file execution only detect known threats, failing to promptly discover and identify unknown threats. Furthermore, most threat identification methods rely on rule-based pattern matching, judging illegal functions according to predefined rules. However, simply following fixed rules is prone to misjudgments, and the sheer number of rules can easily lead to thousands, making maintenance extremely difficult. Additionally, the identification process lacks effective utilization of historical JAR files, hindering accurate risk assessment of the code within JAR files based on actual business scenarios. Therefore, currently, there is a lack of an effective method for identifying currently running online JAR files. Summary of the Invention

[0004] The purpose of this invention is to provide an AI-based online JAR package execution intelligent recognition method and system to solve the problems raised in the prior art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: an AI-based online JAR package execution intelligent recognition method, the method comprising:

[0006] Step S1: Obtain business scenario data of JAR packages and historical JAR packages in the current period from the platform, evaluate the overall similarity between the JAR packages and historical JAR packages at the code business scenario level, and obtain the similar historical JAR packages of the JAR packages;

[0007] Step S2: Segment the code in the JAR package to obtain the characteristic code of the JAR package, analyze the code similarity between the characteristic code of historical JAR packages and the characteristic code of the JAR package to obtain similar historical code, obtain code vulnerability data in similar historical JAR packages, assess the code vulnerability risk of the characteristic code, and obtain the vulnerability code;

[0008] Step S3: Obtain historical codes with different characteristics of the vulnerability code, analyze the degree of similarity between the characteristic codes in different similar historical JAR packages, obtain a set of historical similar codes, and combine the vulnerability data in similar historical JAR packages to analyze the impact of historical codes with different characteristics on the vulnerability risk of the characteristic code. Then, collect the characteristic codes affected by different historical codes with different characteristics to obtain a set of characteristic affected codes.

[0009] Step S4: Obtain the feature impact code set of the vulnerability code, assess the vulnerability risk impact of the vulnerability code on the feature code in the JAR package, identify the runtime risk of the JAR package, obtain runtime risk data, and send the runtime risk data to the JAR package administrator through the platform.

[0010] Furthermore, step S1 includes:

[0011] Step S11: Obtain business scenario data of the JAR packages uploaded by the user on the platform during the current period, and obtain API interface data from the business scenario data;

[0012] Step S12: Obtain the interface paths of each API interface in the JAR file and the historical JAR files respectively;

[0013] Calculate the path distance similarity S(p,p´) between a certain API interface in a JAR package and another API interface in a historical JAR package;

[0014] Step S13: Obtain the fields of one API interface and another API interface, and aggregate them to obtain field sets A and A' respectively. Calculate the field similarity S(A,A') between one API interface in the JAR package and another API interface in the historical JAR package.

[0015] Step S14: Calculate the interface similarity R between one API interface and another API interface. s =w a ×S(A,A´)+w p ×S((p,p´), where w a w represents the similarity weight of interface paths p w represents the similarity weight of the interface fields. a and w p All are greater than zero, w a +w p =1;

[0016] When the interface similarity R s This represents the maximum interface similarity R between a specific API interface in a JAR file and all API interfaces in historical JAR files. sIf the similarity exceeds the preset threshold, then one API interface is determined to be similar to another API interface.

[0017] Step S15: Obtain the business process diagram of the JAR package generated by AI from the business scenario data of the JAR package, where the nodes in the business process diagram are API interfaces;

[0018] The business process diagram of the historical JAR package is obtained by summarizing the business scenario data of the historical JAR package. Based on the API interfaces in the historical JAR package that are identified as similar, the nodes identified as similar in the business process diagram of the JAR package and the historical JAR package are obtained.

[0019] In the business process diagram of the JAR package and historical JAR packages, the feature vectors of a node and another node that are determined to have similar interfaces are obtained. The cosine similarity between the two nodes is obtained, and the node graph similarity between the two nodes is obtained.

[0020] Get the average node graph similarity μ between several nodes that are judged to be similar in the business process graph of the JAR package and the historical JAR package, and calculate the business scenario similarity C between the JAR package and the historical JAR package;

[0021] If the business scenario similarity C is greater than the preset threshold, it is determined that the JAR package is similar to the historical JAR package at the business level, and the historical JAR package is recorded as a similar historical JAR package.

[0022] Furthermore, step S2 includes:

[0023] Step S21: Obtain the code data of the jar package, use AI technology to segment the code in the jar package, and obtain the characteristic code of each jar package;

[0024] Step S22: Obtain the feature codes from similar historical JAR packages, and analyze the degree of code similarity between a certain feature code in the JAR package and another feature code in similar historical JAR packages. The specific analysis process is as follows:

[0025] The cosine similarity of the bag-of-words feature vectors between the bag-of-words feature vectors of one feature code and another feature code is obtained to obtain the code-word similarity E between the two feature codes.

[0026] Step S23: Obtain the API interfaces called by a certain feature code in the jar package, and record them as the feature API interfaces of a certain feature code. Collect them to obtain the call interface set of a certain feature code.

[0027] Get the call frequency of each feature API interface in the call interface set of a certain feature code. When the call frequency of a certain feature API interface is greater than a preset frequency threshold, the preset frequency threshold is used as the call frequency of the feature API interface in another feature code.

[0028] Get the call interface set of another feature code, and get the similar feature API interface group between one feature code and another feature code;

[0029] Step S24: Calculate the feature interface call similarity F between a certain feature code and another feature code for a certain similar feature API interface group;

[0030] Step S25: Calculate the interface call similarity G between one feature code and another feature code;

[0031] Calculate the code similarity Y=η between one feature code and another feature code. G ×G+η E ×E, where η E and η F These are the word weight coefficient and the API call weight coefficient, respectively, η G >0, η F >0, η E +η F =1;

[0032] If the code similarity degree Y is the maximum value between a certain feature code and each other feature code in a similar historical JAR package, and the code similarity degree Y is greater than the preset code similarity threshold, then it is determined that the other feature code is similar to a certain feature code, and the other feature code is recorded as the approximate historical code of a certain feature code.

[0033] Step S26: Obtain the historical vulnerability codes that have been identified as vulnerabilities from the code vulnerability data. When another feature code is a vulnerability code in a similar historical JAR package, determine that a certain feature code in the JAR package has a vulnerability risk.

[0034] The probability value of a vulnerability risk is obtained by comparing the total number of times a certain feature code has a vulnerability risk with the total number of similar historical JAR packages in the JAR package. When the vulnerability risk value is greater than a preset risk probability threshold, it is determined that a certain feature code in the JAR package has a vulnerability risk, and the certain feature code is recorded as a vulnerability code.

[0035] Furthermore, step S3 includes:

[0036] Step S31: Obtain the approximate historical code of the vulnerable code in the jar package. When the approximate historical code is determined to have a vulnerability in a similar historical jar package, the approximate historical code is recorded as the feature approximate historical code.

[0037] Step S32: Analyze the degree of similarity between the characteristic codes of different similar historical JAR packages. The specific analysis process is as follows:

[0038] Obtain all similar historical JAR files of the JAR file. Select the k-th feature code from the α-th similar historical JAR file. Collect several feature codes from each similar historical JAR file that are determined to be similar to the k-th feature code, and combine them to obtain the historical similarity code set U of the k-th feature code. k Among them, the αth similar historical JAR package contains historical code with similar characteristics to the vulnerability code in the JAR package;

[0039] Step S33: Obtain the historical approximate code set U k The similar historical JAR packages corresponding to each element are marked;

[0040] Retrieve code vulnerability data from several similar historical JAR files that have been marked, and based on the code vulnerability data, obtain a set of similar historical code, U. k The total number of elements Q identified as having vulnerabilities k Similar code set U to history k The ratio of the total number of each element in Q ▽ k ;

[0041] Obtain historical approximate code set U k The total number H of elements identified as having vulnerabilities and those with similar historical code characteristics in several similar historical JAR packages that have been marked is calculated by dividing the total number of elements H by the total number of vulnerabilities Q. k The vulnerability impact value V is obtained. k ;

[0042] Get the preset threshold Q ▽ And V, when Q ▽ k ▽ And V k If >V, then it is determined that the feature-approximate historical code pairs with the historical approximate code set U are among the several marked similar historical JAR packages. k The vulnerability risk of the corresponding feature code has an impact; otherwise, no judgment is made.

[0043] Historical approximate code set U k ​Elements identified as having vulnerabilities are retrieved to obtain the characteristic affected code set of the vulnerable code in the JAR package;

[0044] The above steps denote the approximate historical code identified as vulnerable within the vulnerable code as the characteristic approximate code of the vulnerable code. This is because the approximate historical code and the vulnerable code are similar at both the code and business levels. This involves obtaining the degree of influence of the hypothetical vulnerable code in similar historical JAR packages on other characteristic codes. Specifically, this involves analyzing the impact of the characteristic approximate historical code in similar historical JAR packages on the vulnerability risk of the characteristic codes. By acquiring and aggregating the characteristic codes affected by the characteristic approximate historical code in similar historical JAR packages, a characteristic impact code set of the vulnerable code is obtained. Subsequently, based on this characteristic impact code set, it is only necessary to quickly determine whether different characteristic codes in the JAR package are affected by the vulnerable code, thereby greatly improving the accuracy of the code vulnerability risk assessment of the JAR package.

[0045] Furthermore, step S4 includes:

[0046] Step S41: Obtain the characteristic affected code set of the vulnerable code in the JAR package, and evaluate the vulnerability impact of the vulnerable code on similar affected code. The specific evaluation process is as follows:

[0047] Get the average value Y of the code similarity between the i-th feature code in the JAR file and each element in the feature-affected code set. I μ When Y I μ If the value is greater than the code approximation threshold, then the vulnerable code is determined to have an impact on the vulnerability risk of the I-th feature code, and the I-th feature code is recorded as the vulnerable code.

[0048] Step S42: Identify the runtime risks of the JAR package and obtain runtime risk data. The specific identification process is as follows:

[0049] The system retrieves the vulnerability code and total number of vulnerability codes in the JAR file, and obtains the runtime risk level of the JAR file based on the preset runtime strategy data. The runtime risk level and vulnerability code of the JAR file are then combined to obtain runtime risk data, which is then sent to the administrator of the JAR file through the platform.

[0050] To better implement the above methods, an AI-based online JAR package execution intelligent identification system is proposed. The system includes a business overall similarity assessment module, a code vulnerability risk assessment module, a code impact analysis module, and an execution identification module.

[0051] The overall business similarity assessment module is used to assess the overall similarity between the JAR package and historical JAR packages at the code business scenario level, and to obtain the similar historical JAR packages of the JAR package.

[0052] The code vulnerability risk assessment module is used to obtain similar historical code from the characteristic code in the JAR package, assess the vulnerability risk of the characteristic code, and obtain the vulnerable code.

[0053] The code impact analysis module is used to analyze the degree of impact of similar historical code in similar historical JAR packages on the vulnerability risk of the feature code, and to collect the feature codes with different similar historical codes to obtain the feature impact code set.

[0054] The runtime identification module is used to identify runtime risks of JAR packages based on the characteristics affecting the code set, obtain runtime risk data, and send the runtime risk data to the JAR package administrators through the platform.

[0055] Furthermore, the overall business similarity assessment module includes an interface similarity determination unit and an overall business similarity assessment unit;

[0056] The interface similarity determination unit is used to determine the degree of similarity between a certain API interface in a JAR package and another API interface in a historical JAR package;

[0057] The overall business similarity assessment unit is used to obtain the nodes that are identified as similar in the business process diagram of the JAR package and the historical JAR package. It evaluates the overall similarity between the JAR package and the historical JAR package from the code business scenario level and obtains the similar historical JAR packages.

[0058] Furthermore, the code vulnerability risk assessment module includes a code approximation analysis unit and a code vulnerability risk assessment unit;

[0059] The code approximation analysis unit is used to acquire the characteristic code of a JAR package, analyze the degree of code similarity between the characteristic code of a historical JAR package and the characteristic code of the JAR package, and obtain the approximate historical code of the characteristic code in the JAR package.

[0060] The code vulnerability risk assessment unit is used to assess the code vulnerability risk of characteristic code based on code vulnerability data in similar historical JAR packages, and to obtain the vulnerable code in the JAR package.

[0061] Furthermore, the code impact analysis module includes an approximate code set acquisition unit and a code impact analysis unit;

[0062] The approximate code set acquisition unit is used to acquire historical code with different characteristics of the vulnerability code, analyze the degree of similarity between the characteristic codes in different similar historical JAR packages, and obtain the historical approximate code set.

[0063] The code impact analysis unit is used to analyze the impact of similar historical code in similar historical JAR packages on the vulnerability risk of the feature code based on the historical similar code set, and to obtain the feature impact code set.

[0064] Furthermore, the operation identification module includes an operation risk identification unit;

[0065] The runtime risk identification unit is used to assess the impact of the vulnerability code on the characteristic code in the JAR package based on the characteristics of the vulnerability code, identify the runtime risk of the JAR package, obtain runtime risk data, and send the runtime risk data.

[0066] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention achieves intelligent identification of online JAR package execution based on AI. By evaluating the overall similarity between the JAR package and historical JAR packages at the code business scenario level, it ensures that subsequent code approximation judgments will not be affected by scenario differences between the JAR package and historical JAR packages, thus preventing anomalies in the analysis of JAR package code vulnerabilities. It also allows the JAR package to accurately obtain the feature codes that may pose vulnerability risks in the current JAR package by analyzing the code vulnerability characteristics of similar feature codes in similar historical JAR packages. Furthermore, by approximating the impact of different features of the vulnerability code on the vulnerability risk of other feature codes in the corresponding similar historical JAR packages, it obtains the feature-affected code set of the vulnerability code. Subsequently, it is only necessary to analyze the approximation of the feature codes in the JAR package with the feature codes in the feature-affected code set to accurately determine whether the feature codes in the JAR package will pose vulnerability risks due to the vulnerability code. This achieves intelligent identification of the runtime risks of the JAR package during operation and effectively improves the accuracy of runtime risk identification. Attached Figure Description

[0067] Figure 1 This is a method logic diagram of an AI-based online JAR package execution intelligent recognition method according to the present invention;

[0068] Figure 2 This is a schematic diagram of a module of an AI-based online JAR package-based intelligent recognition system according to the present invention. Detailed Implementation

[0069] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0070] Example: Figures 1-2 As shown, this invention provides a technical solution: an AI-based online JAR package execution intelligent recognition method, the method comprising:

[0071] Step S1: Obtain business scenario data of JAR packages and historical JAR packages in the current period from the platform, evaluate the overall similarity between the JAR packages and historical JAR packages at the code business scenario level, and obtain the similar historical JAR packages of the JAR packages;

[0072] Furthermore, step S1 includes:

[0073] Step S11: Obtain business scenario data of the JAR packages uploaded by the user on the platform during the current period, and obtain API interface data from the business scenario data;

[0074] Step S12: Obtain the interface paths of each API interface in the JAR file and the historical JAR files respectively;

[0075] For example, after obtaining the interface paths of each API interface, it is necessary to normalize the interface paths of each API interface.

[0076] Calculate the path distance similarity S(p,p´) between a certain API interface in a JAR package and another API interface in a historical JAR package;

[0077] For example, the specific formula for calculating the path distance similarity S(p,p´) is:

[0078] ,

[0079] Where p is the interface path of a certain API interface; p' is the interface path of another API interface; d(p,p') is the edit distance between p and p'; I(p) is the path length of p; I(p') is the path length of p';

[0080] For example, if p is / api / * / users / *, p' is / api / * / members / *, the edit distance between p and p' is 4, and the maximum path length is 16 characters of p', then S path (p,p´):

[0081] ,

[0082] Step S13: Obtain the fields of one API interface and another API interface, and aggregate them to obtain field sets A and A' respectively. Calculate the field similarity S(A,A') between one API interface in the JAR package and another API interface in the historical JAR package.

[0083] For example, the specific formula for calculating the field similarity S(A,A´) is:

[0084] ,

[0085] Where |A| is the total number of fields in field set A; |A'| is the total number of fields in field set A'; and B' is the total number of fields that are the same in A and A'.

[0086] Step S14: Calculate the interface similarity R between one API interface and another API interface. s =w a ×S(A,A´)+w p ×S((p,p´), where w a w represents the similarity weight of interface paths p w represents the similarity weight of the interface fields. a and w p All are greater than zero, w a +w p =1;

[0087] When the interface similarity R s This represents the maximum interface similarity R between a specific API interface in a JAR file and all API interfaces in historical JAR files. s If the similarity exceeds the preset threshold, then one API interface is determined to be similar to another API interface.

[0088] Step S15: Obtain the business process diagram of the JAR package generated by AI from the business scenario data of the JAR package, where the nodes in the business process diagram are API interfaces;

[0089] For example, the specific process of obtaining the business process diagram of the AI-generated JAR package from the business scenario data of the JAR package is as follows:

[0090] Converting a JAR file into Java source code by decompiling it;

[0091] The analysis of Java source code using AI technology is as follows:

[0092] Natural language is used to analyze comments, method names, and class names in Java source code to obtain the specific meaning of the business logic in the JAR package.

[0093] Understanding the calling relationships between methods in Java source code through the abstract syntax tree;

[0094] To identify the control flow and data flow in Java source code and obtain the key steps in the business process;

[0095] Based on the analysis results of Java source code using AI technology, graph generation tools such as Graphviz are used to generate business process diagrams for JAR packages.

[0096] For example, in a business process diagram, nodes represent API interfaces, and edges represent calls and data flows;

[0097] The business process diagram of the historical JAR package is obtained by summarizing the business scenario data of the historical JAR package. Based on the API interfaces in the historical JAR package that are identified as similar, the nodes identified as similar in the business process diagram of the JAR package and the historical JAR package are obtained.

[0098] In the business process diagram of the JAR package and historical JAR packages, the feature vectors of a node and another node that are determined to have similar interfaces are obtained. The cosine similarity between the two nodes is obtained, and the node graph similarity between the two nodes is obtained.

[0099] For example, the specific process of constructing the feature vector of a certain node is as follows:

[0100] Obtain the edge feature data of a certain node in the business process graph of the JAR package, and construct the feature vector of the certain node;

[0101] For example, edge feature data includes the number of edges of a certain node in the business process diagram, the direction of the edges, and the type of adjacent nodes, where the specific type is an operation such as creation or deletion;

[0102] Get the average node graph similarity μ between several nodes that are judged to be similar in the business process graph of the JAR package and the historical JAR package, and calculate the business scenario similarity C between the JAR package and the historical JAR package;

[0103] For example, the specific formula for calculating the business scenario similarity C is:

[0104] ,

[0105] Among them, Z sum Z represents the total number of nodes identified as similar in the business process diagrams of the JAR file and its predecessors. (max,sum) This represents the maximum total number of nodes in the business process diagram of the JAR file and its historical counterparts.

[0106] When the business scenario similarity C is greater than the preset threshold, it is determined that the JAR package and the historical JAR package are similar in general at the business level, and the historical JAR package is recorded as a similar historical JAR package.

[0107] Step S2: Segment the code in the JAR package to obtain the characteristic code of the JAR package, analyze the code similarity between the characteristic code of historical JAR packages and the characteristic code of the JAR package to obtain similar historical code, obtain code vulnerability data in similar historical JAR packages, assess the code vulnerability risk of the characteristic code, and obtain the vulnerability code;

[0108] Step S2 includes:

[0109] Step S21: Obtain the code data of the jar package, use AI technology to segment the code in the jar package, and obtain the characteristic code of each jar package;

[0110] For example, the specific process of obtaining each feature code in a JAR file is as follows:

[0111] The code of each method of each class is obtained from the code data. Based on the class and method corresponding to the code, AI technology is used to segment the code in the JAR package to obtain the characteristic code in the JAR package.

[0112] For example, based on the classes and methods corresponding to the code, AI technology is used to segment the code in a JAR file to obtain various characteristic codes within the JAR file. The specific process is as follows:

[0113] Converting a JAR file into Java source code by decompiling it;

[0114] Transform the code in Java source code into a form that AI models can process;

[0115] Use clustering algorithms from machine learning to segment the code;

[0116] Step S22: Obtain the feature codes from similar historical JAR packages, and analyze the degree of code similarity between a certain feature code in the JAR package and another feature code in similar historical JAR packages. The specific analysis process is as follows:

[0117] The cosine similarity of the bag-of-words feature vectors between the bag-of-words feature vectors of one feature code and another feature code is obtained to obtain the code-word similarity E between the two feature codes.

[0118] For example, the specific process of obtaining the bag-of-words feature vector of a certain feature code is as follows:

[0119] The feature vector corresponding to a certain feature code is obtained by using a preset bag-of-words model to transform a certain feature code into a vector.

[0120] Step S23: Obtain the API interfaces called by a certain feature code in the jar package, and record them as the feature API interfaces of a certain feature code. Collect them to obtain the call interface set of a certain feature code.

[0121] Get the call frequency of each feature API interface in the call interface set of a certain feature code. When the call frequency of a certain feature API interface is greater than a preset frequency threshold, the preset frequency threshold is used as the call frequency of the feature API interface in another feature code.

[0122] Get the call interface set of another feature code, and get the similar feature API interface group between one feature code and another feature code;

[0123] For example, a similar feature API interface group for one feature code and another feature code contains a feature API interface group that is determined to be similar to one feature code and another feature code.

[0124] Step S24: Calculate the feature interface call similarity F between a certain feature code and another feature code for a certain similar feature API interface group;

[0125] For example, the specific formula for calculating the approximation degree F of the feature interface call is:

[0126] ,

[0127] Where, N sum The frequency of calls to the feature API interface group corresponding to a certain feature code within a certain similar feature API interface group; N´ sum R represents the call frequency of the feature API interface group corresponding to another feature code in a certain similar feature API interface group; R represents the interface similarity between feature API interface groups in a certain similar feature API interface group;

[0128] Step S25: Calculate the interface call similarity G between one feature code and another feature code;

[0129] For example, the specific formula for calculating the interface call approximation G is:

[0130] ,

[0131] Where, β sum β represents the total number of elements in the call interface set for a certain feature code; sum is the total number of elements in the API call set of another feature code; j is the total number of similar feature API interface groups between one feature code and another feature code; F iThe similarity of feature interface calls between the i-th similar feature API interface group in a certain feature code and another feature code;

[0132] Calculate the code similarity Y=η between one feature code and another feature code. G ×G+η E ×E, where η E and η F These are the word weight coefficient and the API call weight coefficient, respectively, η G >0, η F >0, η E +η F =1;

[0133] If the code similarity degree Y is the maximum value between a certain feature code and each other feature code in a similar historical JAR package, and the code similarity degree Y is greater than the preset code similarity threshold, then it is determined that the other feature code is similar to a certain feature code, and the other feature code is recorded as the approximate historical code of a certain feature code.

[0134] Step S26: Obtain the historical vulnerability codes that have been identified as vulnerabilities from the code vulnerability data. When another feature code is a vulnerability code in a similar historical JAR package, determine that a certain feature code in the JAR package has a vulnerability risk.

[0135] The probability value of a vulnerability risk is obtained by comparing the total number of times a certain feature code has a vulnerability risk with the total number of similar historical JAR packages in the JAR package. When the vulnerability risk value is greater than the preset risk probability threshold, it is determined that a certain feature code in the JAR package has a vulnerability risk, and the certain feature code is recorded as a vulnerability code.

[0136] Step S3 includes:

[0137] Step S31: Obtain the approximate historical code of the vulnerable code in the jar package. When the approximate historical code is determined to have a vulnerability in a similar historical jar package, the approximate historical code is recorded as the feature approximate historical code.

[0138] Step S32: Analyze the degree of similarity between the characteristic codes of different similar historical JAR packages. The specific analysis process is as follows:

[0139] Obtain all similar historical JAR files of the JAR file. Select the k-th feature code from the α-th similar historical JAR file. Collect several feature codes from each similar historical JAR file that are determined to be similar to the k-th feature code, and combine them to obtain the historical similarity code set U of the k-th feature code. kAmong them, the αth similar historical JAR package contains historical code with similar characteristics to the vulnerability code in the JAR package;

[0140] Step S33: Obtain the historical approximate code set U k The similar historical JAR packages corresponding to each element are marked;

[0141] Retrieve code vulnerability data from several similar historical JAR files that have been marked, and based on the code vulnerability data, obtain a set of similar historical code, U. k The total number of elements Q identified as having vulnerabilities k Similar code set U to history k The ratio of the total number of each element in Q ▽ k ;

[0142] Obtain historical approximate code set U k The total number H of elements identified as having vulnerabilities and those with similar historical code characteristics in several similar historical JAR packages that have been marked is calculated by dividing the total number of elements H by the total number of vulnerabilities Q. k The vulnerability impact value V is obtained. k ;

[0143] Get the preset threshold Q ▽ And V, when Q ▽ k ▽ And V k If >V, then it is determined that the feature-approximate historical code pairs with the historical approximate code set U are among the several marked similar historical JAR packages. k The vulnerability risk of the corresponding feature code has an impact; otherwise, no judgment is made.

[0144] Historical approximate code set U k Elements identified as having vulnerabilities are retrieved to obtain the characteristic affected code set of the vulnerable code in the JAR package;

[0145] Step S4: Obtain the feature impact code set of the vulnerability code, assess the impact of the vulnerability code on the vulnerability risk of the feature code in the JAR package, identify the runtime risk of the JAR package, obtain runtime risk data, and send the runtime risk data to the JAR package administrator through the platform;

[0146] Step S4 includes:

[0147] Step S41: Obtain the characteristic affected code set of the vulnerable code in the JAR package, and evaluate the vulnerability impact of the vulnerable code on similar affected code. The specific evaluation process is as follows:

[0148] ​Get the average value Y of the code similarity between the i-th feature code in the JAR file and each element in the feature-affected code set. I μ When Y I μ If the value is greater than the code approximation threshold, then the vulnerable code is determined to have an impact on the vulnerability risk of the I-th feature code, and the I-th feature code is recorded as the vulnerable code.

[0149] Step S42: Identify the runtime risks of the JAR package and obtain runtime risk data. The specific identification process is as follows:

[0150] The system obtains the vulnerability code and total number of vulnerability codes in the JAR package, and obtains the runtime risk level of the JAR package based on the preset runtime strategy data. The runtime risk level and vulnerability code of the JAR package are aggregated to obtain runtime risk data, and the runtime risk data is sent to the administrator of the JAR package through the platform.

[0151] For example, based on preset runtime strategy data, the runtime risk level of the JAR package is specifically obtained as follows:

[0152] The operational strategy data includes the risk level relationship corresponding to different numbers of vulnerable codes in the JAR package;

[0153] For example, the specific operational strategy data is as follows: a total number of vulnerable codes greater than or equal to 8 is considered high-risk, 5 to 8 is considered medium-risk, and less than 5 is considered low-risk.

[0154] To better implement the above methods, an AI-based online JAR package execution intelligent identification system is proposed. The system includes a business overall similarity assessment module, a code vulnerability risk assessment module, a code impact analysis module, and an execution identification module.

[0155] The overall business similarity assessment module is used to assess the overall similarity between the JAR package and historical JAR packages at the code business scenario level, and to obtain the similar historical JAR packages of the JAR package.

[0156] The code vulnerability risk assessment module is used to obtain similar historical code from the characteristic code in the JAR package, assess the vulnerability risk of the characteristic code, and obtain the vulnerable code.

[0157] The code impact analysis module is used to analyze the degree of impact of similar historical code in similar historical JAR packages on the vulnerability risk of the feature code, and to collect the feature codes with different similar historical codes to obtain the feature impact code set.

[0158] The runtime identification module is used to identify runtime risks of JAR packages based on the characteristics affecting the code set, obtain runtime risk data, and send the runtime risk data to the JAR package administrators through the platform;

[0159] The overall business similarity assessment module includes an interface similarity determination unit and an overall business similarity assessment unit.

[0160] The interface similarity determination unit is used to determine the degree of similarity between a certain API interface in a JAR package and another API interface in a historical JAR package;

[0161] The overall business similarity assessment unit is used to obtain the nodes that are judged to be similar to one node and another node in the business process diagram of the JAR package and the historical JAR package. It evaluates the overall similarity between the JAR package and the historical JAR package from the code business scenario level and obtains the similar historical JAR packages.

[0162] The code vulnerability risk assessment module includes a code approximation analysis unit and a code vulnerability risk assessment unit.

[0163] The code approximation analysis unit is used to acquire the characteristic code of a JAR package, analyze the degree of code similarity between the characteristic code of a historical JAR package and the characteristic code of the JAR package, and obtain the approximate historical code of the characteristic code in the JAR package.

[0164] The code vulnerability risk assessment unit is used to assess the code vulnerability risk of characteristic code based on code vulnerability data in similar historical JAR packages, and to obtain the vulnerable code in the JAR package.

[0165] The code impact analysis module includes an approximate code set acquisition unit and a code impact analysis unit.

[0166] The approximate code set acquisition unit is used to acquire historical code with different characteristics of the vulnerability code, analyze the degree of similarity between the characteristic codes in different similar historical JAR packages, and obtain the historical approximate code set;

[0167] The code impact analysis unit is used to analyze the impact of similar historical code in similar historical JAR packages on the vulnerability risk of the feature code based on the historical similar code set, and to obtain the feature impact code set.

[0168] The operation identification module includes an operation risk identification unit;

[0169] The runtime risk identification unit is used to assess the impact of the vulnerability code on the characteristic code in the JAR package based on the characteristics of the vulnerability code, identify the runtime risk of the JAR package, obtain runtime risk data, and send the runtime risk data.

[0170] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. An AI-based online JAR package execution intelligent recognition method, characterized in that, The method includes: Step S1: Obtain business scenario data of JAR packages and historical JAR packages in the current period from the platform, evaluate the overall similarity between the JAR packages and historical JAR packages at the code business scenario level, and obtain the similar historical JAR packages of the JAR packages; Step S2: Segment the code in the JAR package to obtain the characteristic code of the JAR package, analyze the code similarity between the characteristic code of historical JAR packages and the characteristic code of the JAR package to obtain similar historical code, obtain code vulnerability data in similar historical JAR packages, assess the code vulnerability risk of the characteristic code, and obtain the vulnerability code; Step S3: Obtain historical codes with different characteristics of the vulnerability code, analyze the degree of similarity between the characteristic codes in different similar historical JAR packages, obtain a set of historical similar codes, and combine the vulnerability data in similar historical JAR packages to analyze the impact of historical codes with different characteristics on the vulnerability risk of the characteristic code. Then, collect the characteristic codes affected by different historical codes with different characteristics to obtain a set of characteristic affected codes. Step S4: Obtain the feature impact code set of the vulnerability code, assess the impact of the vulnerability code on the vulnerability risk of the feature code in the JAR package, identify the runtime risk of the JAR package, obtain runtime risk data, and send the runtime risk data to the JAR package administrator through the platform; Step S3 includes: Step S31: Obtain the approximate historical code of the vulnerable code in the jar package. When the approximate historical code is determined to have a vulnerability in a similar historical jar package, the approximate historical code is recorded as the feature approximate historical code. Step S32: Analyze the degree of similarity between the characteristic codes of different similar historical JAR packages. The specific analysis process is as follows: Obtain all similar historical JAR files of the JAR file. Select the k-th feature code from the α-th similar historical JAR file. Collect several feature codes from each similar historical JAR file that are determined to be similar to the k-th feature code, and combine them to obtain the historical similarity code set U of the k-th feature code. k Among them, the αth similar historical JAR package contains historical code with similar characteristics to the vulnerability code in the JAR package; Step S33: Obtain the historical approximate code set U k The similar historical JAR packages corresponding to each element are marked; Retrieve code vulnerability data from several similar historical JAR files that have been marked, and based on the code vulnerability data, obtain a set of similar historical code, U. k The total number of elements Q identified as having vulnerabilities k Similar code set U to history k The ratio of the total number of each element in Q ▽ k ; Obtain historical approximate code set U k The total number H of elements identified as having vulnerabilities and those with similar historical code characteristics in several similar historical JAR packages that have been marked is calculated by dividing the total number of elements H by the total number of vulnerabilities Q. k The vulnerability impact value V is obtained. k ; Get the preset threshold Q ▽ And V, when Q ▽ k ▽ And V k If >V, then it is determined that the feature-approximate historical code pairs with the historical approximate code set U are among the several marked similar historical JAR packages. k The vulnerability risk of the corresponding feature code has an impact; otherwise, no judgment is made.​ Historical approximate code set U k Elements identified as vulnerable are retrieved to obtain the characteristic affected code set of the vulnerable code in the JAR file.

2. The AI-based online JAR package execution intelligent recognition method according to claim 1, characterized in that, Step S1 includes: Step S11: Obtain business scenario data of the JAR packages uploaded by the user on the platform during the current period, and obtain API interface data from the business scenario data; Step S12: Obtain the interface paths of each API interface in the JAR file and the historical JAR files respectively; Calculate the path distance similarity S(p,p´) between a certain API interface in a JAR package and another API interface in a historical JAR package; Step S13: Obtain the fields of one API interface and another API interface, and aggregate them to obtain field sets A and A' respectively. Calculate the field similarity S(A,A') between one API interface in the JAR package and another API interface in the historical JAR package. Step S14: Calculate the interface similarity R between one API interface and another API interface. s =w a ×S(A,A´)+w p ×S((p,p´), where w a w represents the similarity weight of interface paths p w represents the similarity weight of the interface fields. a and w p All are greater than zero, w a +w p =1; When the interface similarity R s This represents the maximum interface similarity R between a specific API interface in a JAR file and all API interfaces in historical JAR files. s If the similarity exceeds the preset threshold, then one API interface is determined to be similar to another API interface. Step S15: Obtain the business process diagram of the JAR package generated by AI from the business scenario data of the JAR package, where the nodes in the business process diagram are API interfaces; The business process diagram of the historical JAR package is obtained by summarizing the business scenario data of the historical JAR package. Based on the API interfaces in the historical JAR package that are identified as similar, the nodes identified as similar in the business process diagram of the JAR package and the historical JAR package are obtained. In the business process diagram of the JAR package and historical JAR packages, the feature vectors of a node and another node that are determined to have similar interfaces are obtained. The cosine similarity between the two nodes is obtained, and the node graph similarity between the two nodes is obtained. Get the average node graph similarity μ between several nodes that are judged to be similar in the business process graph of the JAR package and the historical JAR package, and calculate the business scenario similarity C between the JAR package and the historical JAR package; If the business scenario similarity C is greater than the preset threshold, it is determined that the JAR package is similar to the historical JAR package at the business level, and the historical JAR package is recorded as a similar historical JAR package.

3. The AI-based online JAR package execution intelligent recognition method according to claim 2, characterized in that, Step S2 includes: Step S21: Obtain the code data of the jar package, use AI technology to segment the code in the jar package, and obtain the characteristic code of each jar package; Step S22: Obtain the feature codes from similar historical JAR packages, and analyze the degree of code similarity between a certain feature code in the JAR package and another feature code in similar historical JAR packages. The specific analysis process is as follows: The cosine similarity of the bag-of-words feature vectors between the bag-of-words feature vectors of one feature code and another feature code is obtained to obtain the code-word similarity E between the two feature codes. Step S23: Obtain the API interfaces called by a certain feature code in the jar package, and record them as the feature API interfaces of a certain feature code. Collect them to obtain the call interface set of a certain feature code. Get the call frequency of each feature API interface in the call interface set of a certain feature code. When the call frequency of a certain feature API interface is greater than a preset frequency threshold, the preset frequency threshold is used as the call frequency of the feature API interface in another feature code. Get the call interface set of another feature code, and get the similar feature API interface group between one feature code and another feature code; Step S24: Calculate the feature interface call similarity F between a certain feature code and another feature code for a certain similar feature API interface group; Step S25: Calculate the interface call similarity G between one feature code and another feature code; Calculate the code similarity Y=η between one feature code and another feature code. G ×G+η E ×E, where η E and η F These are the word weight coefficient and the API call weight coefficient, respectively, η G >0, η F >0, η E +η F =1; If the code similarity degree Y is the maximum value between a certain feature code and each other feature code in a similar historical JAR package, and the code similarity degree Y is greater than the preset code similarity threshold, then it is determined that the other feature code is similar to a certain feature code, and the other feature code is recorded as the approximate historical code of a certain feature code. Step S26: Obtain the historical vulnerability codes that have been identified as vulnerabilities from the code vulnerability data. When another feature code is a vulnerability code in a similar historical JAR package, determine that a certain feature code in the JAR package has a vulnerability risk. The probability value of a vulnerability risk is obtained by comparing the total number of times a certain feature code has a vulnerability risk with the total number of similar historical JAR packages in the JAR package. When the vulnerability risk value is greater than a preset risk probability threshold, it is determined that a certain feature code in the JAR package has a vulnerability risk, and the certain feature code is recorded as a vulnerability code.

4. The AI-based online JAR package execution intelligent recognition method according to claim 3, characterized in that, Step S4 includes: Step S41: Obtain the characteristic affected code set of the vulnerable code in the JAR package, and evaluate the vulnerability impact of the vulnerable code on similar affected code. The specific evaluation process is as follows: Get the average value Y of the code similarity between the i-th feature code in the JAR file and each element in the feature-affected code set. I μ When Y I μ If the value is greater than the code approximation threshold, then the vulnerable code is determined to have an impact on the vulnerability risk of the I-th feature code, and the I-th feature code is recorded as the vulnerable code. Step S42: Identify the runtime risks of the JAR package and obtain runtime risk data. The specific identification process is as follows: The system retrieves the vulnerability code and total number of vulnerability codes in the JAR file, and obtains the runtime risk level of the JAR file based on the preset runtime strategy data. The runtime risk level and vulnerability code of the JAR file are then combined to obtain runtime risk data, which is then sent to the administrator of the JAR file through the platform.

5. An AI-based online JAR package execution intelligent recognition system, used to execute the AI-based online JAR package execution intelligent recognition method according to any one of claims 1-4, characterized in that, The system includes a business-wide similarity assessment module, a code vulnerability risk assessment module, a code impact analysis module, and an operation identification module; The overall business similarity assessment module is used to assess the overall similarity between the JAR package and historical JAR packages at the code business scenario level, and obtain the similar historical JAR packages of the JAR package. The code vulnerability risk assessment module is used to obtain approximate historical code of the characteristic code in the jar package, assess the code vulnerability risk of the characteristic code, and obtain the vulnerable code. The code impact analysis module is used to analyze the degree of impact of similar historical code in similar historical JAR packages on the vulnerability risk of the feature code, and to collect the feature codes with different similar historical codes to obtain the feature impact code set. The runtime identification module is used to identify runtime risks of JAR packages based on the feature-affected code set, obtain runtime risk data, and send the runtime risk data to the JAR package administrators through the platform.

6. The AI-based online JAR package execution intelligent recognition system according to claim 5, characterized in that, The overall business similarity assessment module includes an interface similarity determination unit and an overall business similarity assessment unit; The interface similarity determination unit is used to determine the degree of similarity between a certain API interface in a JAR package and another API interface in a historical JAR package. The overall business similarity assessment unit is used to obtain a certain node and another node that are determined to be similar in the business process diagram of the JAR package and the historical JAR package, and to evaluate the overall similarity between the JAR package and the historical JAR package from the code business scenario level, so as to obtain the similar historical JAR package.

7. The AI-based online JAR package execution intelligent recognition system according to claim 5, characterized in that, The code vulnerability risk assessment module includes a code approximation analysis unit and a code vulnerability risk assessment unit; The code approximation analysis unit is used to acquire the feature code of the jar package, analyze the code similarity between the feature code of the historical jar package and the feature code of the jar package, and obtain the approximate historical code of the feature code in the jar package. The code vulnerability risk assessment unit is used to assess the code vulnerability risk of the feature code based on code vulnerability data in similar historical JAR packages, and obtain the vulnerable code in the JAR package.

8. The AI-based online JAR package execution intelligent recognition system according to claim 5, characterized in that, The code impact analysis module includes an approximate code set acquisition unit and a code impact analysis unit; The approximate code set acquisition unit is used to acquire historical code with different characteristics of the vulnerability code, analyze the degree of similarity between the characteristic codes in different similar historical JAR packages, and obtain a historical approximate code set. The code impact analysis unit is used to analyze the degree of impact of similar historical code in similar historical JAR packages on the vulnerability risk of the feature code based on the historical similar code set, and to obtain the feature impact code set.

9. The AI-based online JAR package execution intelligent recognition system according to claim 5, characterized in that, The operation identification module includes an operation risk identification unit; The runtime risk identification unit is used to assess the impact of the vulnerability code on the characteristic code in the JAR package based on the characteristic impact code set of the vulnerability code, identify the runtime risk of the JAR package, obtain runtime risk data, and send the runtime risk data.

Images