Sensitive data leakage detection method and device, electronic equipment and storage medium

Abstract

The invention provides a sensitive data leakage detection method, a sensitive data leakage detection device, electronic equipment and a computer readable storage medium, and belongs to the technical field of safety and artificial intelligence. The method comprises the following steps: acquiring a source code file, and determining a plurality of sensitive data nodes and leakage interface nodes in the source code file; determining the relevancy between the sensitive data node and the leaked interface node, and determining a candidate node pair according to the relevancy; in a pre-constructed abstract syntax tree of the source code file, searching a path connected with the candidate node pair, and determining a candidate leakage path according to path cost; constructing a multi-stream code attribute graph based on the candidate leakage paths; and executing message passing on the multi-stream code attribute graph to determine a risk assessment result of the leaked interface. According to the invention, sensitive data leakage can be effectively and accurately detected.

Description

Technical Field

[0001] This disclosure relates to the fields of security and artificial intelligence technology, and in particular to a sensitive data leakage detection method, a sensitive data leakage detection device, an electronic device, and a computer-readable storage medium. Background Technology

[0002] In the field of sensitive data leakage detection in source code, existing technologies generally adopt a combination of static analysis and semantic association, using methods such as rule scanning, program graph analysis (e.g., abstract syntax trees, control flow graphs), or deep learning to identify potential leakage paths for sensitive data (e.g., credentials, tokens). However, existing technologies have significant drawbacks: rule scanning is poorly adaptable to complex code structures, easily resulting in missed detections or false positives; program graph-based analysis, when dealing with long paths or cross-file dependencies, is prone to path truncation due to resource constraints, making it difficult to fully preserve the association between sensitive data and the leaked interface; deep learning methods are limited by sequence segmentation strategies, have limited ability to capture long-distance dependencies, and lack interpretable risk tracing evidence. These problems lead to insufficient accuracy and practicality in sensitive data leakage detection.

[0003] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0004] This disclosure provides a sensitive data leakage detection method, a sensitive data leakage detection device, an electronic device, and a computer-readable storage medium, thereby overcoming, to at least a certain extent, the problems of insufficient accuracy and practicality in sensitive data leakage detection in the prior art.

[0005] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0006] According to one aspect of this disclosure, a sensitive data leakage detection method is provided, comprising: acquiring a source code file and identifying multiple sensitive data nodes and leakage interface nodes in the source code file; determining the correlation between the sensitive data nodes and the leakage interface nodes, and determining candidate node pairs based on the correlation; searching for paths connecting the candidate node pairs in a pre-constructed abstract syntax tree of the source code file, and determining candidate leakage paths based on path costs; constructing a multi-stream code attribute graph based on the candidate leakage paths; and performing message passing on the multi-stream code attribute graph to determine the risk assessment result of the leakage interface.

[0007] In one exemplary embodiment of this disclosure, determining multiple sensitive data nodes and leaking interface nodes in the source code file includes: slicing the source code file to obtain multiple slice results; and parsing the syntax structure of each slice result to determine multiple sensitive data nodes and leaking interface nodes.

[0008] In one exemplary embodiment of this disclosure, the step of slicing the source code file to obtain multiple slice results includes: generating a locatable code index structure based on the source code file; and slicing the source code file based on the locatable code index structure and a preset slicing threshold.

[0009] In one exemplary embodiment of this disclosure, generating a locatable code index structure based on the source code file includes: scanning the source code file, recording the line identifier and byte offset of each line of data, and determining the function start line and end line to obtain a mapping table of line identifiers and file offsets, and a set of function boundaries; and generating the locatable code index structure based on the mapping table of line identifiers and file offsets, and the set of function boundaries.

[0010] In one exemplary embodiment of this disclosure, the step of slicing the source code file according to the locatable code index structure and a preset slicing threshold includes: slicing the code in the function boundary set into multiple code intervals according to the preset slicing threshold.

[0011] In one exemplary embodiment of this disclosure, the step of parsing the syntax structure of each slice result to determine multiple sensitive data nodes and leaking interface nodes includes: calling a deterministic finite state automaton to parse the syntax structure of each code segment, obtaining a tag corresponding to each code segment, so as to obtain a tag sequence of each code segment, and recording the mapping relationship between the tag and the line identifier; determining multiple sensitive data nodes and leaking interface nodes based on the tag sequence of each code segment.

[0012] In one exemplary embodiment of this disclosure, determining multiple sensitive data nodes and leaking interface nodes based on the tag sequence of each code segment includes: generating an abstract syntax subtree corresponding to each code segment based on the tag sequence of each code segment; and traversing the abstract syntax subtree corresponding to each code segment to determine the sensitive data nodes and leaking interface nodes.

[0013] In one exemplary embodiment of this disclosure, the step of traversing the abstract syntax subtrees corresponding to each of the code intervals to determine sensitive data nodes and leaking interface nodes includes: traversing the abstract syntax subtrees corresponding to each of the code intervals, determining the sensitive data nodes using preset regular expression matching rules, and determining the leaking interface nodes using a preset interface set.

[0014] In an exemplary embodiment of this disclosure, determining the relevance between the sensitive data node and the leaking interface node, and determining candidate node pairs based on the relevance, includes: concatenating the marker sequences of each code segment to obtain the full file symbol sequence of the source code file; determining the semantic vector of each symbol in the full file symbol sequence; determining the mixed vector of each symbol based on the semantic vector corresponding to each symbol, the syntax type corresponding to each symbol, the line information corresponding to each symbol, and the node category corresponding to each symbol; calculating the relevance between any two symbols based on the mixed vector of any two symbols; and selecting sensitive data nodes and leaking interface nodes whose relevance meets preset conditions as candidate node pairs.

[0015] In one exemplary embodiment of this disclosure, the step of calculating the correlation between any two symbols based on the mixture vector of any two symbols includes: processing the mixture vector of each symbol through multi-scale convolution to obtain feature vectors at different scales; and calculating the correlation between any two symbols based on the feature vectors of any two symbols at different scales.

[0016] In one exemplary embodiment of this disclosure, the step of selecting sensitive data nodes and leaked interface nodes whose relevance meets a preset condition as candidate node pairs includes: selecting symbol pairs whose relevance meets a preset condition from among the symbol pairs composed of sensitive data nodes and leaked interface nodes as candidate node pairs.

[0017] In one exemplary embodiment of this disclosure, before searching for cost paths connecting the candidate node pairs in the pre-built abstract syntax tree of the source code file, the method further includes: extracting line information corresponding to the sensitive data node and the leaking interface node from the candidate node pairs; calling the pre-built mapping index between the line information and the abstract syntax tree nodes, and locating the sensitive data node and the leaking interface node in the abstract syntax tree based on the line information through binary search; and recording the line identifier, column identifier, and file offset of the located sensitive data node and leaking interface node in the source code file.

[0018] In one exemplary embodiment of this disclosure, the step of searching for cost paths connecting the candidate node pairs in the pre-constructed abstract syntax tree of the source code file to generate candidate leakage paths includes: determining the function bodies of the sensitive data node and the leakage interface node; the function body is a complete logical unit in the code that starts with a function declaration and ends with a function terminator; if the sensitive data node and the leakage interface node belong to the same target function body, the path search scope is limited to the abstract syntax subtree corresponding to the target function body, and a search is performed to determine the candidate leakage path; if the sensitive data node and the leakage interface node do not belong to the same function body, or no valid path is found in the same function body, a cross-function path search process is used to search to determine the candidate leakage path.

[0019] In one exemplary embodiment of this disclosure, the step of limiting the path search scope to the abstract syntax subtree corresponding to the target function body and performing the search to determine candidate leakage paths includes:

[0020] In the abstract syntax subtree corresponding to the objective function body, a weighted depth-first search is performed based on minimizing the cost function that includes control flow penalties; the path with the minimum total cost is selected as the candidate leakage path.

[0021] In one exemplary embodiment of this disclosure, the step of using a cross-function path search process to determine candidate leakage paths includes: identifying the return node of a function call and the entry node of the called function; adding a virtual control flow edge between them, wherein the weight of the virtual control flow edge is between the weight of the real variable reference and the weight of cross-file import; and re-executing a weighted depth-first search based on the abstract syntax tree after adding the virtual edge, calculating the total cost of the path containing the virtual edge, so as to determine the candidate leakage paths.

[0022] In an exemplary embodiment of this disclosure, the step of constructing a multi-flow code attribute graph based on the candidate leakage path includes: determining a data flow adjacency matrix, a control flow adjacency matrix, a call flow adjacency matrix, and a relevance adjacency matrix based on the node sequence and inter-node associations contained in the candidate leakage path; merging the data flow adjacency matrix, control flow adjacency matrix, call flow adjacency matrix, and relevance adjacency matrix into a fourth-order adjacency tensor; and constructing the multi-flow code attribute graph based on the node range of the candidate leakage path and the association information of the fourth-order adjacency tensor.

[0023] In one exemplary embodiment of this disclosure, the step of constructing the multi-stream code attribute graph based on the node range of the candidate leakage path and the association information of the fourth-order adjacency tensor includes: taking the nodes in the candidate leakage path as the core, expanding and incorporating other nodes in the fourth-order adjacency tensor that have non-zero association with the core node, as the node set of the multi-stream code attribute graph; extracting the connection relationships of the nodes in the node set of the multi-stream code attribute graph from each adjacency matrix of the fourth-order adjacency tensor; extracting the association strength values ​​of each node pair in the node set from the relevance adjacency matrix of the fourth-order adjacency tensor, as the quantization weight of the corresponding connection relationship; assigning corresponding edge types to the extracted connection relationships, determining the relevance attribute of the edges according to the association strength values, and constructing the multi-stream code attribute graph in combination with the node set.

[0024] In an exemplary embodiment of this disclosure, after generating candidate leakage paths, the method further includes: extracting key features of the candidate leakage paths and converting the key features into a summary vector; adding the summary vector to the candidate leakage paths; and constructing the multi-stream code attribute graph based on the node range of the candidate leakage paths and the association information of the fourth-order adjacency tensor, which includes: constructing the multi-stream code attribute graph based on the node range of the candidate leakage paths, the association information of the fourth-order adjacency tensor, and the summary vector.

[0025] In one exemplary embodiment of this disclosure, the step of performing message passing on the multi-stream code attribute graph includes: determining sensitive data nodes as source nodes for message passing and leaking interface nodes as target nodes for message passing from the multi-stream code attribute graph; if performing single-round passing, starting from the source node, passing messages to the target node through intermediate nodes, accumulating all message values ​​received by the target node, and determining the passing result based on the single-round accumulated risk value; if performing multi-round iterative passing, based on the single-round accumulated risk value, iteratively passing messages according to a preset attenuation coefficient, updating the accumulated risk value of the target node in each round, and determining the passing result based on the final accumulated risk value.

[0026] In one exemplary embodiment of this disclosure, determining the risk assessment result of the leaking interface includes: comparing the transmission result with a preset risk reference value to determine the risk assessment result of the leaking interface.

[0027] In one exemplary embodiment of this disclosure, the method further includes: determining high-risk paths and generating corresponding analysis results based on the risk assessment results of the leaked interface and combining them with semantic confidence calculation.

[0028] In one exemplary embodiment of this disclosure, the method further includes: performing semantic analysis on candidate leakage paths using a pre-trained neural network to infer semantic confidence.

[0029] In one exemplary embodiment of this disclosure, the method further includes: obtaining traceable evidence based on the identified high-risk path, and determining a disposal method based on the traceable evidence.

[0030] According to one aspect of this disclosure, a sensitive data leakage detection device is provided, comprising: a source code file acquisition module, configured to acquire a source code file and determine multiple sensitive data nodes and leakage interface nodes in the source code file; a candidate node pair determination module, configured to determine the correlation between the sensitive data nodes and the leakage interface nodes, and determine candidate node pairs based on the correlation; a candidate leakage path generation module, configured to search for cost paths connecting the candidate node pairs in a pre-constructed abstract syntax tree of the source code file to generate candidate leakage paths; a code attribute graph construction module, configured to construct a multi-stream code attribute graph based on the candidate leakage paths; and an interface risk assessment module, configured to perform message passing on the multi-stream code attribute graph to determine the risk assessment result of the leakage interface.

[0031] According to one aspect of this disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the method described in any of the preceding methods by executing the executable instructions.

[0032] According to one aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method described in any of the preceding claims.

[0033] The exemplary embodiments disclosed herein have the following beneficial effects:

[0034] Obtain the source code file and identify multiple sensitive data nodes and leaked interface nodes within it; determine the correlation between the sensitive data nodes and the leaked interface nodes, and identify candidate node pairs based on the correlation; search for paths connecting candidate node pairs in the pre-built abstract syntax tree of the source code file, and determine candidate leaked paths based on path costs; construct a multi-stream code attribute graph based on the candidate leaked paths; perform message passing on the multi-stream code attribute graph to determine the risk assessment results of the leaked interface. On the one hand, this exemplary embodiment filters candidate node pairs by calculating the correlation between sensitive data nodes and leaked interface nodes, determines candidate leaked paths by combining path costs, and then integrates multi-dimensional associations based on multi-stream code attribute graphs. This effectively avoids the one-sidedness of rule scanning and the path truncation problem of program graph analysis in the prior art, and can more accurately capture the propagation link of sensitive data, reducing missed detections and false alarms. On the other hand, the risk assessment results are determined through the message passing mechanism of multi-stream code attribute graphs. This not only uses the graph structure to preserve the complete context of sensitive data propagation and solves the problem of insufficient interpretability of deep learning methods, but also focuses on high-risk paths through path cost filtering and multi-stream fusion, optimizes resource consumption, avoids inefficiency caused by indiscriminate analysis, and makes the risk assessment results both reliable and traceable.

[0035] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0036] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0037] Figure 1 This schematically illustrates a flowchart of a sensitive data leakage detection method in this exemplary embodiment;

[0038] Figure 2 This schematic diagram illustrates the overall flow of a sensitive data leakage detection method in this exemplary embodiment.

[0039] Figure 3 This schematically illustrates a flowchart of another sensitive data leakage detection method in this exemplary embodiment;

[0040] Figure 4 This schematically illustrates a flowchart of abstract syntax tree path replication and summarization in this exemplary embodiment;

[0041] Figure 5This schematic diagram illustrates a structural block diagram of a sensitive data leakage detection device in this exemplary embodiment.

[0042] Figure 6 An electronic device for implementing the above method is illustrated in this exemplary embodiment. Detailed Implementation

[0043] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0044] Exemplary embodiments of this disclosure first provide a method for detecting sensitive data leakage.

[0045] The following is in conjunction with the appendix Figure 1 The exemplary embodiments will be further described as follows: Figure 1 As shown, the sensitive data leakage detection method may include the following steps S110 to S150:

[0046] Step S110: Obtain the source code file and identify multiple sensitive data nodes and leaked interface nodes in the source code file.

[0047] In this context, "source code file" refers to the computer program code file to be analyzed. It can be written in any programming language and may include various code units such as variable definitions, function calls, and control statements. "Sensitive data node" refers to a syntactic unit in the source code file that directly or indirectly involves sensitive data, such as variables, function parameters, or expressions. In this exemplary embodiment, a sensitive data node can be a credential literal anchor, which is a symbolic node identified by regular expressions as a sensitive constant such as a key or token, and can be used as the starting point of a data flow. "Leaking interface node" refers to a syntactic unit in the source code file that may output data to an external environment. In this exemplary embodiment, a leaking interface node can be an external interface call anchor, and a syntactic unit in the source code file that calls an external interface to output data; these interface calls may lead to data leakage.

[0048] This exemplary embodiment can first obtain the source code file and then parse it to identify multiple sensitive data nodes and leaky interface nodes. To improve processing efficiency and accuracy, the source code file can also be sliced ​​first, and each slice can be analyzed to identify sensitive data nodes and leaky interface nodes.

[0049] In an exemplary embodiment, the determination of multiple sensitive data nodes and leaking interface nodes in the source code file may include:

[0050] The source code file is sliced ​​to obtain multiple slice results;

[0051] For each slice result, a syntax structure is parsed to identify multiple sensitive data nodes and leaked interface nodes.

[0052] To improve data processing efficiency and accuracy, this exemplary embodiment first slices the source code file to obtain multiple slice results. For each slice result, its syntax structure is parsed to identify multiple sensitive data nodes and leaked interface nodes. Finally, the sensitive data nodes and leaked interface nodes corresponding to each slice result are integrated to obtain the sensitive data nodes and leaked interface nodes of the entire source code file.

[0053] In one exemplary embodiment, the above-described slicing process of the source code file to obtain multiple slice results may include:

[0054] Generate a locatable code index structure from the source code file;

[0055] The source code file is sliced ​​based on the locatable code index structure and the preset slicing threshold.

[0056] This exemplary embodiment can generate a locatable code index structure for a source code file, such as a line number index base table, and then slice the source code file according to the locatable code index structure and a preset slicing threshold. The preset slicing threshold refers to a reference threshold used for slicing the source code file, and its specific size can be customized according to actual needs; this disclosure does not impose specific limitations on it.

[0057] In one exemplary embodiment, the above-described generation of a locatable code index structure from the source code file may include:

[0058] Scan the source code file, record the line identifier and byte offset of each line of data, determine the start and end lines of functions, obtain a mapping table between line identifiers and file offsets, and a set of function boundaries;

[0059] A locatable code index structure is generated based on a mapping table between line identifiers and file offsets, as well as a set of function boundaries.

[0060] Here, line identifiers refer to data used to represent line information, such as line numbers. This exemplary embodiment can scan the source code file in a specific order, record the line identifier and byte offset of each line of data, determine the function start and end lines, obtain a mapping table between line identifiers and file offsets, and a set of function boundaries. Finally, based on the mapping table between line identifiers and file offsets, and the set of function boundaries, a locatable code index structure is constructed. For example, the entire source code file can be scanned sequentially from top to bottom, synchronously recording the line number l for each line of data. i With byte offset o i At the same time, the starting line f of the function is determined based on the pairing of keywords and curly braces. s With the end line f e At the end of the scan, a mapping table I between line numbers and file offsets, as well as a set of function boundaries, are obtained. Together, they form a baseline index that allows for the backtracking of any subsequent code snippet, i.e., a code index structure for locating the code.

[0061] In an exemplary embodiment, the above-described slicing of source code files based on a locatable code index structure and a preset slicing threshold may include:

[0062] Based on a preset slicing threshold, the code in the function boundary set is sliced ​​into multiple code intervals.

[0063] This exemplary embodiment can utilize a preset slicing threshold to slice code intervals within a function boundary set, for example, by... The function appears sequentially and the row numbers are accumulated downwards. When the accumulated value reaches the preset slice threshold L, the slice number is calculated. max When the value is 500, continue accumulating until the current function closes, then write to the segment boundary. This ultimately forms a set of segment intervals comprising multiple code intervals. In this exemplary embodiment, each code segment can be configured to fully cover several functions and maintain a length of approximately 400 to 550 lines, thus maintaining a fixed batch length while avoiding semantic cutoff.

[0064] In an exemplary embodiment, the above-described syntactic structure parsing for each slice result to identify multiple sensitive data nodes and leaking interface nodes may include:

[0065] The deterministic finite state automaton is invoked to parse the syntax structure of each code segment, obtain the corresponding label for each code segment, obtain the label sequence for each code segment, and record the mapping relationship between the label and the line identifier;

[0066] Based on the tag sequence of each code segment, multiple sensitive data nodes and leaked interface nodes were identified.

[0067] Here, a tag can refer to a structured representation of raw data, such as text or code. It can be the smallest unit obtained after breaking down the raw data. For example, the code "int a = 10;" can be broken down into tags ["int", "a", "=", "10", ";"]. Each tag corresponds to a keyword, variable name, operator, constant, or symbol in the code. The tags corresponding to a code interval can be the tags corresponding to the code included in the code interval. The tag sequence is the sequence of tags. The mapping relationship between tags and line identifiers can be, for example, the correspondence between each tag and its corresponding line number.

[0068] In this exemplary embodiment, for interval sets Each code segment A deterministic finite state automaton can be invoked to perform lexical analysis, resulting in a sequence T of tokens arranged in the order of appearance. k During the parsing process, the mapping relationship P between the marker and the line number is continuously written. k This ensures that all markers can be traced back to their original row-level positions, providing accurate coordinates for the relevance matrix.

[0069] In one exemplary embodiment, determining multiple sensitive data nodes and leaking interface nodes based on the tag sequence of each code segment may include:

[0070] Based on the tag sequence of each code segment, generate the abstract syntax subtree corresponding to each code segment;

[0071] Traverse the abstract syntax subtree corresponding to each code segment to identify sensitive data nodes and leaked interface nodes.

[0072] Here, the abstract syntax subtree refers to the local syntax tree structure generated for a single code segment, representing the syntactic relationships between tags in a hierarchical manner, such as the relationship between variable definition and assignment, or function call and parameter; it is a visual representation of the syntactic structure of the code segment. This exemplary embodiment can be based on the tag sequence T. k And with the help of the global symbol table Σ, it recursively descents within each code segment to generate the corresponding abstract syntax subtree. For nodes external to the subtree, reference pointers are only established in the global symbol table Σ without repeated expansion, stabilizing peak memory usage at the segment level while ensuring the syntactic structure remains intact. Then, sensitive data nodes and leaky interface nodes are identified by traversing the abstract syntax subtree corresponding to each code segment.

[0073] In an exemplary embodiment, the above-mentioned traversal of the abstract syntax subtree corresponding to each code segment to determine sensitive data nodes and leaked interface nodes may include:

[0074] Traverse the abstract syntax subtree corresponding to each code segment, use preset regular expression matching rules to determine sensitive data nodes, and use preset interface set to determine leaked interface nodes.

[0075] When traversing the abstract syntax subtree corresponding to each code segment, this exemplary embodiment can use different methods to determine sensitive data nodes and leaky interface nodes respectively.

[0076] Specifically, the process could begin by traversing the abstract syntax subtrees corresponding to each code segment, using preset regular expression matching rules to identify sensitive data nodes. Then, it could continue traversing the abstract syntax subtrees corresponding to each code segment, using a preset interface set to identify leaking interface nodes. The preset regular expression matching rules could be a pre-defined set of regular expressions used to match sensitive data nodes, such as a set of credential regular expressions. The preset interface set can refer to the set of interfaces used to hit leaked interface nodes, such as the leaked API whitelist W.

[0077] Taking the sensitive data node as the credential literal anchor point and the leaked interface node as the external interface call anchor point as an example, this can be illustrated by depth-first traversal of the abstract syntax subtree. Execute the set of credential regular expressions on each string literal node. The comparison is performed, and if a match is found, the anchor point α is recorded. c =(l n ,id n hash(v) n And import it into the voucher anchor set. By locating sensitive constants such as potential keys and tokens within the segment, source nodes are provided for taint propagation.

[0078] Continue traversing When the method call signature is in the leaked API whitelist W, the anchor point α is recorded. e =(l n ,id n ,sig n And write it into the interface anchor set ε k This separation of the roles of credential anchors and interface anchors allows for the construction of source-sink propagation paths during the convolution phase.

[0079] Finally, this exemplary embodiment may also include the tag sequence T k Mapping relationship between markers and line numbers P k Voucher Anchor Set With interface anchor set ε k Aggregation into structured records Write to intermediate file F in segment order mid The file serves as the sole input for subsequent Hyena-Code long sequence correlation mining, completing the code slicing and safety anchor labeling process.

[0080] Step S120: Determine the correlation between sensitive data nodes and leaked interface nodes, and determine candidate node pairs based on the correlation.

[0081] The relevance score reflects the degree of connection between sensitive data nodes and leaked interface nodes formed through code logic. The relevance score can be a value between 0 and 1; a higher relevance score indicates a higher probability of sensitive data being leaked through the interface. Candidate node pairs refer to combinations of sensitive data nodes and leaked interface nodes whose relevance scores meet certain conditions. These combinations are the focus of subsequent path searching. This exemplary embodiment can use combinations of sensitive data nodes and leaked interface nodes with a relevance score greater than a preset threshold as candidate node pairs.

[0082] In an exemplary embodiment, the process of determining the correlation between sensitive data nodes and leaked interface nodes, and determining candidate node pairs based on the correlation, may include:

[0083] The marker sequences of each code segment are concatenated to obtain the complete symbol sequence of the source code file;

[0084] Determine the semantic vector of each symbol in the entire file symbol sequence;

[0085] The mixture vector of each symbol is determined based on the semantic vector, syntax type, line information, and node category of each symbol.

[0086] Calculate the correlation between any two symbols based on the mixture vector of any two symbols;

[0087] Sensitive data nodes and leaked interface nodes that meet the preset relevance criteria are selected as candidate node pairs.

[0088] Here, the complete file symbol sequence refers to the complete symbol sequence of the source code file obtained by integrating the mark sequences of multiple code segments. In this exemplary embodiment, all mark sequences can be concatenated according to segment order to obtain the complete file symbol sequence O = (o1, o2, o3, o4, o5, o6, o7, o8, o9, o1, o1, o1, o2, o3, o1, o2, o3, o1, o2, o3, o3, o4, o5, o6, o7, o1, o2, o3 ... / ,…,o N For the i-th symbol o i Retrieve semantic vector e from the language vector table r Simultaneously, it records the source code line number λ(i) and the segment offset δ(i). The semantic vector carries word meaning information, and the line offset carries the traceable position, enabling any subsequent inference to be located at the source code line level.

[0089] Then, the semantic vector of each symbol in the entire file symbol sequence can be determined. For example, semantic vectorization can be performed on each symbol in the entire file symbol sequence to obtain a semantic vector. Further, based on the semantic vector, syntax type, line information, and node category of each symbol, a hybrid vector can be determined. For example, the semantic vector, syntax type, line information, and node category of each symbol can be fused using weighted calculation or preset methods to obtain a hybrid vector. The syntax type of a symbol refers to the category of a symbol in the code, such as keywords, variable names, and operators, according to the syntax rules, used to clarify the role of the symbol in the code structure. The line information can be the high-order bits of the line number, which can be a calculation method used to segment and identify line numbers in the code. The node category can be used to determine what type of anchor node a node is, such as a normal node, a sensitive data node, or a node that leaks interfaces.

[0090] Finally, the correlation between any two symbols is calculated by plotting the mixture vector of any two symbols. Sensitive data nodes and leaking interface nodes whose correlation satisfies a preset condition are selected as candidate node pairs. Selecting sensitive data nodes and leaking interface nodes whose correlation satisfies the preset condition as candidate node pairs can be done by selecting sensitive data nodes whose calculated correlation value is greater than a preset threshold, or by selecting a preset number of sensitive data nodes and leaking interface nodes whose correlation calculation results are ranked first as candidate node pairs.

[0091] For example, in this exemplary embodiment, any symbol o in the entire file symbol sequence can be targeted. r Determine the known syntax type κ(i) and the high-order bit of the line number. And the anchor category β(i) is used to retrieve the position vector from the syntax vector table, line number vector table, and anchor vector table, respectively, and form an initial mixed vector with the semantic vector:

[0092]

[0093] in, Let e ​​be the initial mixing vector for the i-th symbol; r M is the semantic vector of the i-th symbol; κ(i) Let κ(i) be the position vector of syntactic type κ(i); B is the position vector corresponding to the high-order bits of the row number; β(i) κ(i) is the position vector of anchor category β(i); κ(i) is the syntax type index of the i-th symbol; λ(i) is the source code line number of the i-th symbol; β(i) is the anchor tag (0-normal, 1-credential, 2-interface).

[0094] This exemplary embodiment allows the model to acquire a safety scenario-specific bias at zero time step by superimposing three types of prior vectors at once, thus avoiding the need to repeatedly learn explicit information during the training phase.

[0095] In an exemplary embodiment, calculating the correlation between any two symbols based on the mixture vector of any two symbols may include:

[0096] By processing the mixed vector of each symbol through multi-scale convolution, feature vectors at different scales are obtained;

[0097] Calculate the correlation between any two symbols based on their feature vectors at different scales.

[0098] This exemplary embodiment can process the mixed vectors of various symbols through multi-scale convolution to obtain feature vectors at different scales. For example, by using three layers of convolution, the results of each layer of convolution can be obtained. Then, based on the feature vectors of any two symbols at different scales, the correlation between any two symbols can be calculated. For example, the correlation between the mixed vectors corresponding to the two symbols under each convolution layer can be calculated separately. Finally, based on the calculation results of the entire multi-scale convolution, the correlation between any two symbols can be determined.

[0099] Specifically, multi-scale convolution can include short-span convolutional feature extraction layers, and segment-span convolutional feature extraction layers can be used to extract features from sequence h. (7) Using length w s A 5x5 one-dimensional Toeplitz convolution kernel performs the first scan and outputs h. (1) The convolution receptive field covers the typical length of the statement terminator, while extracting fine-grained structures such as assignment operations, local control flow, and variable lifetimes, laying a high-resolution foundation for long-range correlation calculation.

[0100] Multi-scale convolutions can also include stacks of gated convolutions with medium to long spans, in h (1) Continue stacking the span w m =64 and w l A Toeplitz convolutional layer with a resolution of 256 is used. The output of each layer is channel-filtered using a Sigmoid-gated function and then added to the residual features of the previous layer to obtain h. ( / ) with h (3) Medium-span convolutions can cover multiple complete functions at once, while long-span convolutions capture hundreds of rows of distance dependencies across segment boundaries. The residual structure suppresses gradient vanishing in ultra-long sequence scenarios.

[0101] Furthermore, a window with a radius of ρ = 128 can be set centered on the row number where the anchor point is located. When the convolution center symbol is o... j satisfy When the convolutional layer is active, all channels are enabled; otherwise, only 25% of the channels are retained.

[0102] This exemplary embodiment, through the aforementioned multi-scale convolutional structure, can maintain the complete feature representation capability for high-risk regions and actively reduce the amount of GPU memory and computation for low-risk regions, thereby achieving centralized allocation of resources in security-sensitive areas.

[0103] Based on the above multi-scale convolutional synthesis of three-layer hybrid vectors, the following formula can be used to process any pair of symbols (o i ,o j Calculate the relevance:

[0104]

[0105] Among them, R i,j The correlation score between the i-th and j-th symbols; W represents the i-th symbol in the p-th layer blending vector; X d is the trainable weight matrix of the p-th layer; X Let λ be the dimension of the p-th layer blending vector; λ(i) and λ(j) are the symbols o. i With o j Source code line number; γ X The line spacing threshold for the p-th layer (can be set to 8, 64, or 256 respectively); This is an indicator function for line spacing meeting the threshold.

[0106] The above formula strengthens long-distance dependencies through a scale-increasing bilinear mapping, while using a line spacing threshold to suppress local noise, thus highlighting the cross-segment constant-interface coupling numerically.

[0107] In an exemplary embodiment, the above-mentioned selection of sensitive data nodes and leaked interface nodes that meet preset relevance conditions as candidate node pairs may include:

[0108] Among the symbol pairs consisting of sensitive data nodes and leaked interface nodes, symbol pairs that meet the preset relevance conditions are selected as candidate node pairs.

[0109] This exemplary embodiment needs to determine symbol pairs consisting of sensitive data nodes and leaking interface nodes. Therefore, node filtering can be performed by node category, and hard pruning can be performed if necessary. For example, this exemplary embodiment can set a threshold after normalizing the matrix R by rows and columns, such as θ = 0.85, and perform hard pruning, then retain only the two end anchor points that satisfy β(i) = 1, β(j) = 2 and R i,jFor entries ≥θ, symbol pairs consisting of sensitive data nodes and leaky interface nodes have been filtered out. Then, based on relevance, symbol pairs meeting preset conditions can be identified as candidate node pairs. For example, the top K = 1024 constant-interface combinations can be selected in descending order of score, and the symbol index, row number range, and relevance value can be encapsulated into a set. For use in subsequent steps.

[0110] This exemplary embodiment completes cross-segment correlation mining, which can achieve convergence from hundreds of thousands of symbols to thousands of high-confidence risk pairs.

[0111] Step S130: In the pre-built abstract syntax tree of the source code file, search for paths that connect candidate node pairs and determine candidate leak paths based on path costs.

[0112] Here, an abstract syntax tree refers to a tree structure formed after parsing the source code file. Each node can correspond to a syntactic unit in the code, and the relationship between nodes can reflect the syntactic logic of the code. In this exemplary embodiment, an abstract syntax tree about the source code file can be pre-constructed using a tool, and then the abstract syntax tree can be used to search for paths connecting candidate node pairs.

[0113] Path cost can be used to measure the complexity of a path; the lower the cost, the more likely the path is to become an actual data leakage channel. Candidate leakage paths can be leakage paths obtained based on cost paths, such as a sequence of multiple nodes corresponding to the minimum cost path. A candidate leakage path refers to a path connecting candidate node pairs selected based on path cost; it can be one or multiple. For example, in this exemplary embodiment, the path with the lowest cost, or a path with a cost less than a preset threshold, can be selected as a candidate leakage path.

[0114] In one exemplary embodiment, before searching for cost paths connecting candidate node pairs in the pre-built abstract syntax tree of the source code file, the above-described sensitive data leakage detection method may further include:

[0115] Extract the row information corresponding to the sensitive data node and the leaked interface node from the candidate node pairs;

[0116] The pre-built mapping index between line information and abstract syntax tree nodes is invoked, and sensitive data nodes and leaked interface nodes are located in the abstract syntax tree through binary search based on the line information.

[0117] Record the line identifier, column identifier, and file offset of the located sensitive data nodes and leaked interface nodes in the source code file.

[0118] The line information can be, for example, a line number or line sequence identifier. Before determining the cost path, this exemplary embodiment can first perform the above steps to record the line identifier, column identifier, and file offset of the sensitive data node and the leaking interface node in the source code file of the located candidate node pair. Specifically, this can be done, for example, by extracting a set encapsulated based on symbol index, line number range, and relevance value. Read line number pairs one by one (l c ,l e ), where 'c' indicates sensitive data nodes, such as credential literal anchors, and 'e' indicates leaked interface nodes, such as leaked interface call anchors. This exemplary embodiment can invoke a pre-built line number → AST (Abstract Syntax Tree) node sparse index to access the pre-built abstract syntax tree of the source code file. Perform a binary search to locate the leaf node v of the voucher literal. c Calling leaf node v with dangerous interface e Since the index is bucketed in 1000-row granularity, this is possible when N≈10 d The time complexity of retrieval on a large set of nodes remains unchanged. The location results not only determine the coordinates for subsequent link searches, but also write the row number, column number, and file offset into a temporary table to ensure that the source code can be traced back to the character-level position at any time.

[0119] In one exemplary embodiment, the process of searching for cost paths connecting candidate node pairs in the pre-built abstract syntax tree of the source code file to generate candidate leakage paths may include:

[0120] Identify the function bodies of sensitive data nodes and leaked interface nodes; a function body is a complete logical unit in the code that starts with a function declaration and ends with a function terminator.

[0121] If the sensitive data node and the leaked interface node belong to the same target function body, then the path search scope is limited to the abstract syntax subtree corresponding to the target function body to perform the search and determine the candidate leak path;

[0122] If the sensitive data node and the leaked interface node do not belong to the same function body, or if no valid path is found within the same function body, a cross-function path search process is used to search for candidate leaked paths.

[0123] This exemplary embodiment first determines the function bodies of the sensitive data node and the leaking interface node. Based on whether their function bodies belong to the same target function body, it determines the corresponding search method and generates candidate leaking paths using different approaches. The target function body can be the innermost function body. If the sensitive data node and the leaking interface node belong to the same target function body, the path search scope can be limited to the abstract syntax subtree corresponding to the target function body to determine candidate leaking paths. If the sensitive data node and the leaking interface node do not belong to the same function body, or if no valid path is found within the same function body (e.g., the function bodies of the sensitive data node and the leaking interface node are different), or if no candidate leaking path is found in the aforementioned case of the same target function body, then a cross-function path search process is used to determine candidate leaking paths.

[0124] In an exemplary embodiment, limiting the path search scope to the abstract syntax subtree corresponding to the target function body to determine candidate leak paths may include:

[0125] In the abstract syntax subtree corresponding to the objective function body, a weighted depth-first search is performed based on minimizing the cost function that includes control flow penalties;

[0126] The path with the lowest total cost is selected as the candidate leakage path.

[0127] In this exemplary embodiment, if in the already located node pair (v c ,v e Within the function body φ, determine whether the two belong to the same innermost function body φ. If they belong to the same function, perform a weighted depth-first search in the abstract syntax subtree of φ, aiming to minimize the cost function including control flow penalties.

[0128]

[0129] Where Π represents a node chain, i.e., a path; ω represents the total cost of the link, i.e., the path cost; k,kj1 For true grammatical edge weights; ξ k,kj1 The value is 1 if the edge crosses a branch, and 0 otherwise.

[0130] Edge weight ω k,kj1 The difference in syntax level between corresponding nodes, and the branch penalty ξ. k,kj1 Prioritize paths within the same basic block. This strategy ensures semantic connectivity of paths and minimizes their length, avoiding the introduction of meaningless jumps.

[0131] In one exemplary embodiment, the above-described cross-function path search process for determining candidate leakage paths may include:

[0132] Identify the return node of a function call and the entry node of the called function, and add a virtual control flow edge between them. The weight of the virtual control flow edge is between the weight of the real variable reference and the weight of cross-file import.

[0133] Based on the abstract syntax tree with added virtual edges, a weighted depth-first search is re-executed to calculate the total cost of the path containing virtual edges in order to determine candidate leaky paths.

[0134] If v c With v e If no solution is found in the same function body or the previous sub-step, then identify the call return node r and the called function entry node s, and introduce a virtual control flow edge between them. The edge weights are set as follows Located between real variable references (weight 1) and cross-file imports (weight 0.1), it allows paths to cross function boundaries while avoiding virtual jumps suppressing real dependencies.

[0135] Re-execute the cost function Minimize the search until a new logically closed link Π is obtained. * For call chains with more than five recursive levels, the upper limit of iteration depth is set to five levels to prevent path explosion.

[0136] Determine Π using the methods described above. * After that, you can put Π * The nodes in the path are output as path segments Ω = (m1, ..., m) in the order they appear. s Each node records the following fields: AST type, source code line number, column number, function signature, and whether it is a virtual edge endpoint. Both the real syntax edges connected to the node and the constructed virtual edges retain independent identifiers, thus forming a complete candidate leakage path containing the original control semantics.

[0137] The total cost of synchronous writing to the link during the replication process It provides a quantitative basis for priority ranking.

[0138] In one exemplary embodiment, after generating candidate leakage paths, the sensitive data leakage detection method may further include:

[0139] Extract key features from candidate leakage paths and convert these key features into summary vectors;

[0140] Add the summary vector to the candidate leak paths.

[0141] In this exemplary embodiment, in order to quickly capture the global risk profile of the path in the subsequent graph convolution stage, a security digest vector can also be calculated. Specifically, three types of security features can be compressed into a fixed-length digest vector: constant content hash h (32-dimensional, the first 32 bytes of SHA-256 are taken and normalized to [0,1]); control flow branch label b (64-dimensional, each bit corresponds to one if / else branch path); and call stack depth scalar d (in layers).

[0142] The summary vector is generated by mapping the data together in the following way:

[0143] s = W h h‖W b b‖σ(d) (4)

[0144] Where s is a 128-dimensional summary vector; W h W is a 32×32 mapping matrix. b is a 64×95 mapping matrix; σ(d) is the 31-dimensional depth vector after Sigmoid compression; ‖ is the column concatenation operation.

[0145] This vector retains key elements such as the voucher itself, control flow direction, and call depth, while also having controllable dimensions, making it suitable for direct consumption by neural networks.

[0146] Then, the summary vector s can be written to both the first node m1 and the last node m1 of the path using the key summary-vec. s The extended fields. This exemplary embodiment enables subsequent multi-flow graph convolutions to obtain path-level summary information in the first round of neighbor aggregation, without the need for step-by-step accumulation along the entire path, reducing the number of propagation layers and improving the explicitness of high-risk paths.

[0147] Encapsulate all path segments Ω and their corresponding summary vectors s into a JSONLines format file. A single record contains the following fields: link node sequence, edge type array, and total cost. The summary vector and the source file line number range are written to disk in read-only mode and used as input for the enhanced multi-stream code attribute graph construction in step S4. The candidate leak path concatenation and summary embedding process is completed, ensuring both structural accuracy and semantic compression in subsequent steps.

[0148] Step S140: Construct a multi-stream code attribute graph based on candidate leakage paths.

[0149] A multi-flow code attribute graph is a graph structure that integrates information from data flow, control flow, call flow, and relevance flow. It can be used to comprehensively represent the propagation relationships of sensitive data. Nodes in a multi-flow code attribute graph can include sensitive data nodes and leak interface nodes in candidate leakage paths, as well as nodes associated with these nodes, such as credential literal anchors, leaked interface call anchors, and related intermediate variable nodes, constant nodes, and method nodes. Edges between nodes in a multi-flow code attribute graph can represent various relationships between nodes, such as transitive relationships, execution order relationships, or call relationships. Node attributes can include information related to the node, such as node type, cost, association strength, or sensitive information.

[0150] After determining the candidate leakage path, this exemplary embodiment can first determine the multiple nodes in the path based on the candidate leakage path, then add edges and attributes to the nodes, and label the node attributes, etc., and finally construct a multi-flow code attribute graph.

[0151] In one exemplary embodiment, constructing a multi-stream code attribute graph based on candidate leakage paths may include:

[0152] Based on the node sequence and inter-node associations contained in the candidate leakage path, the data flow adjacency matrix, control flow adjacency matrix, call flow adjacency matrix, and relevance adjacency matrix are determined.

[0153] The data flow adjacency matrix, control flow adjacency matrix, call flow adjacency matrix, and relevance adjacency matrix are merged into a fourth-order adjacency tensor.

[0154] Based on the node range of candidate leakage paths and the association information of the fourth-order adjacency tensor, a multi-flow code attribute graph is constructed.

[0155] Among them, the node sequence refers to the sequence of all nodes in the candidate leakage path, and the node association refers to the data used to reflect the association relationship between nodes. It can include the relationship type between nodes, such as data transmission relationship, control dependency relationship, function call relationship between nodes, and can also include the association strength, etc.

[0156] The data flow adjacency matrix can be used to record data transmission relationships between nodes, the control flow adjacency matrix can be used to record control dependencies between nodes, the call flow adjacency matrix can be used to record function call relationships, and the relevance adjacency matrix can be used to record the degree of association between nodes. This exemplary embodiment determines the data flow adjacency matrix, control flow adjacency matrix, call flow adjacency matrix, and relevance adjacency matrix based on the node sequence and associations between nodes in the candidate leakage path. Then, these matrices are merged into a fourth-order adjacency tensor, which is a high-dimensional data structure integrating the four types of adjacency matrices. Finally, a multi-flow code attribute graph can be constructed based on the node range of the candidate leakage path and the association information of the fourth-order adjacency tensor. Among them, the node range of the candidate leakage path can be the set of all nodes directly related to the path. It can include the core nodes of the path itself, or the surrounding nodes that have a direct impact on the path or are directly related to the path. The multi-flow code attribute graph refers to a graph structure with nodes as vertices and the association information in the fourth-order adjacency tensor as edge attributes. The edge attributes can include different flow types, such as data flow, control flow or call flow, which can intuitively present multi-dimensional association relationships.

[0157] In this exemplary embodiment, the basic node mapping and physical coordinates can be set first.

[0158] Specifically, it could be traversing the abstract syntax tree. Each statement-level node u in the graph is assigned a unique graph node identifier ν(u).

[0159] Line number λ w , column number κ w With byte offset δ w Concatenate into ternary coordinates (λ) w ,κ w ,δ w ), and write it into the index table. Based on this coordinate system, any subsequent row- and column-based searches and backtracking can be performed within this framework. Completed within the required complexity, meeting the real-time graphing requirements of files with over 30,000 lines.

[0160] Then, the data flow adjacency matrix, control flow adjacency matrix, call flow adjacency matrix, and relevance adjacency matrix can be determined separately.

[0161] This exemplary embodiment proposes a data flow operator to address the variable definition-usage relationship. Explicitly modeling the propagation characteristics of short-range high-weighting and long-range low-weighting:

[0162]

[0163] in, For the elements of the data stream adjacency matrix; d x The definition node for variable x; u j For the j-th node using variable x; Δ ij For |λ j -λ i | represents the difference in node row numbers; var(i) is the variable identifier corresponding to node i.

[0164] To address path explosion caused by deep nesting, this exemplary embodiment proposes a control flow operator with joint direction-depth modulation.

[0165]

[0166] in, For elements of the control flow adjacency matrix; τ ij Θ is the edge direction factor; a true branch takes +1, a false branch takes -1, and a sequential edge takes +0.5. ij The nesting depth of the basic blocks between node i and node j.

[0167] The signs of true and false branches are stored to ensure that subsequent convolutions can distinguish the execution direction in one jump; the inverse of the nesting depth weakens the contribution of deep edges and reduces the noise interference of deeply nested branches on model training.

[0168] Considering the frequent scenario where credential constants are encapsulated in large parameter packages and leaked at shallow interfaces, this exemplary embodiment proposes a call stream operator.

[0169]

[0170] in, To call the elements of the adjacency matrix of the stream; call i To call the expression node; f j χ is the entry node of the called function. ij for Where p i p represents the actual number of parameters at the call point. max The maximum number of actual parameters in the entire file; Γ ij call for the invocation point i To entrance f j Static call depth.

[0171] This operator significantly amplifies the high-risk leakage pattern of large parameter packs + shallow depth in terms of weights, making the possible exit points of credentials easier to be identified by subsequent convolutions in the graph structure.

[0172] To determine the symbol-level correlation R as described above i,jMapping to values ​​in the same domain as the first three types of edges, this exemplary embodiment proposes a Sigmoid normalization operator.

[0173]

[0174] in, These are the elements of the relevance adjacency matrix; R i,j σ is the original relevance score of the i–j pairs of symbols; σ(·) is the Sigmoid function; k is the steepness coefficient, which is 8 here; θ is the truncation threshold, which can be set to 0.85 here.

[0175] The saturation region of Sigmoid will R i,j Strongly correlated edges with ≥θ are raised to (0.9,1), while weakly correlated edges are compressed to near zero, achieving consistency with the first three types of edge weight domains and avoiding the problem of inconsistent dimensions caused by traditional linear mapping.

[0176] Finally, this exemplary embodiment uses the data flow adjacency matrix A (1) Control flow adjacency matrix A ( / ) Call the adjacency matrix A (3) With relevance adjacency matrix A (4) Merging results in the formation of a fourth-order adjacency tensor:

[0177]

[0178] in, As a multi-flow adjacency tensor, subsequent convolutional layers use the flow direction as the explicit channel.

[0179] In an exemplary embodiment, if the aforementioned step of generating a summary vector has been performed, constructing a multi-stream code attribute graph based on the node range of the candidate leak paths and the association information of the fourth-order adjacency tensor may include:

[0180] A multi-stream code attribute graph is constructed based on the node range of candidate leakage paths, the association information of the fourth-order adjacency tensor, and the summary vector.

[0181] This exemplary embodiment can use line number λ w With the summary vector s w Bind to the node attribute table to achieve triple alignment of structure, position and security semantics.

[0182] In an exemplary embodiment, the construction of the multi-stream code attribute graph based on the node range of candidate leakage paths and the association information of the fourth-order adjacency tensor may include:

[0183] Taking the nodes in the candidate leakage path as the core, we expand and include other nodes in the fourth-order adjacency tensor that have non-zero association with the core node, as the node set of the multi-flow code attribute graph;

[0184] Extract the connection relationships of nodes within the node set of the multi-stream code attribute graph from each adjacency matrix of the fourth-order adjacency tensor;

[0185] The correlation strength values ​​of each node pair within the node set are extracted from the correlation adjacency matrix of the fourth-order adjacency tensor and used as the quantization weights of the corresponding connection relationships.

[0186] The extracted connections are assigned corresponding edge types, and the relevance attribute of the edges is determined based on the association strength value. A multi-flow code attribute graph is then constructed by combining the node set.

[0187] After determining the candidate leakage path, this exemplary embodiment can use the node in the candidate leakage path as the core to find other related nodes, such as other nodes in the fourth-order adjacency tensor that have non-zero association with the core node, as the node set of the multi-flow code attribute graph. The other nodes with non-zero association can be nodes with related relationships, such as nodes with data flow relationships, control flow relationships, or call flow relationships. The node set can be the node range of the candidate leakage path, such as including the core node and related nodes, which can be the vertex set of the multi-flow code attribute graph.

[0188] Extract the connection relationships of nodes within the node set of the multi-flow code attribute graph from the adjacency matrices of the fourth-order adjacency tensor. For example, extract data transfer relationships from the data flow adjacency matrix, control jump relationships from the control flow adjacency matrix, and function call relationships from the call flow adjacency matrix.

[0189] Then, the correlation strength values ​​of each node pair within the node set can be extracted from the correlation adjacency matrix of the fourth-order adjacency tensor, serving as the quantization weights for the corresponding connection relationships. The correlation strength values ​​can be quantized values ​​reflecting the tightness of the association between nodes.

[0190] Finally, the extracted connections are assigned corresponding edge types, such as data flow edges, control flow edges, and call flow edges. The relevance attribute of the edges is determined based on the association strength value. This relevance attribute can be used to reflect the importance of the edge or to quantify the tightness of the connection relationship represented by the edge. A multi-flow code attribute graph is constructed by combining the node set. That is, the nodes for constructing the multi-flow code attribute graph can be determined based on the node set, the edge types between nodes can be determined based on the connection relationship, and the relevance of the edges can be determined based on the association strength value, thereby constructing a complete multi-flow code attribute graph.

[0191] In this exemplary embodiment, a disjoint-set data structure can be used to analyze the graph. Connectivity checks are performed to remove isolated subgraphs containing only single nodes or only call flows. Finally, the node table, edge tensors, and coordinate indices are written using Protocol Buffers, with the file set to read-only and used as the sole input for the S5 multi-flow graph convolutional propagation stage. The enhanced multi-flow code property graph is now complete. Its innovative weight design and dimensionality unification for its four operators provide higher signal-to-noise ratios and faster convergence speeds for subsequent neural propagation.

[0192] Step S150: Message passing is performed on the multi-stream code property graph to determine the risk assessment results of the leaked interface.

[0193] In this context, message passing refers to the process of propagating and summing the initial risk values ​​of sensitive data nodes along the edges to the leaking interface nodes in the multi-stream code attribute graph, simulating the propagation of risk. The risk assessment result can refer to the aggregated risk result finally received by the leaking interface node, used to determine the degree of leakage risk of that interface. The risk assessment result can be specific evaluation information, such as high risk, medium risk, or low risk; it can also be an evaluation value, for example, a score greater than 8 indicates high risk, an evaluation of 5-8 indicates medium risk, and an evaluation less than 5 indicates low risk; it can also be the risk probability value of the leaking interface, etc. This exemplary embodiment can calculate the risk assessment result for each leaking interface node in the multi-stream code attribute graph.

[0194] In one exemplary embodiment, performing message passing on a multi-stream code property graph as described above may include:

[0195] Sensitive data nodes are identified from the multi-stream code attribute graph as source nodes for message passing, and leaked interface nodes are identified as target nodes for message passing.

[0196] If a single-round transmission is performed, the message is transmitted from the source node through intermediate nodes to the target node. All message values ​​received by the target node are accumulated, and the transmission result is determined based on the accumulated risk value of the single round.

[0197] If multiple rounds of iterative transmission are performed, the message is transmitted iteratively based on the cumulative risk value of a single round and according to a preset decay coefficient. The cumulative risk value of the target node is updated in each round, and the transmission result is determined based on the final cumulative risk value.

[0198] In this embodiment, the source node can be the starting node of message transmission, and the target node is the ending node of message transmission along the path. In this exemplary embodiment, the source node is a sensitive data node, such as a credential literal anchor, and the target node is a leakage interface node, such as an external leakage interface anchor. The message can be any data used for risk signal transmission between nodes. The message value can be the output data of a four-stream separable message calculation, referring to the quantized value result of the four types of stream messages. In this exemplary embodiment, the message value can be the multi-stream separable message operator Ψ. MFThe generated data consists of four types of streaming messages. The cumulative risk value refers to the state vector formed by a node during message transmission after gating fusion and residual iteration; it is a comprehensive accumulation of message values ​​from multiple rounds. The transmission result refers to the staged or final output generated after message values ​​are transmitted and fused; it is a holistic description of the risk transmission process. The transmission result may include the leakage probability of the leaking interface node, which can be used to represent the result of risk quantification.

[0199] For example, this exemplary embodiment can first read the multi-stream code attribute graph and initialize the node vectors. (from the summary vector s) i With position embedding p i (Concatenated) is written to display memory; the node set is traversed, and the taint flag η of the voucher literal node is marked. i Set to 1 to identify the information aggregate flag ζ of the potentially dangerous leaking interface node. i Set it to 1, and set all others to 0, to establish a clear start and end point for propagation.

[0200] Based on adjacency tensor Multistream separable message operator Ψ MF Four independent message channels are computed in parallel during a single forward pass, while retaining source tags to avoid semantic confusion:

[0201]

[0202] in, The message received by node i from the f-th type of stream; For the element of the f-th class adjacency matrix,

[0203] Including weights; W · Let f be the trainable linear transformation matrix of the f-th class of streams; Let be the state vector of neighbor node j in round t.

[0204] Unlike related technologies that mix and sum different types of edges before transformation, which can easily lead to noise in the control flow and call flow masking the credential data stream signal, this exemplary embodiment can first split the data stream by flow, then transform it, and finally achieve semantic isolation and information fidelity through subsequent gating fusion.

[0205] For a relevance stream f=4, it can be multiplied by a factor derived from Sigmoid normalization. It can directly achieve high-resolution amplification and low-resolution suppression, without the need for additional formulas, and can be used with Ψ. MF Connectivity is crucial to ensure that cross-segment misleading information is mitigated at its source.

[0206] The four messages and the node's historical state are input into the gating unit, and weighted superposition is performed through the learnable gating vector to generate candidate new states. Then, the source node bias is injected in the form of residuals to ensure that the risk signal has a new source input in each round and avoid dilution.

[0207] In each propagation round, adaptive risk diffusion Ω is utilized. RD Simultaneous completion of four-stream fusion, gated filtration, and contaminant injection:

[0208]

[0209] in, For the next state of node i; g i The gated vector is... α · η is the learnable importance coefficient of the f-th type of flow; τ is the fixed taint injection intensity; η i For identifying pollution sources; e s is the dedicated source bias vector; ⊙ represents element-wise multiplication.

[0210] This exemplary embodiment can simultaneously achieve adaptive flow importance, gated filtering, and constant amplification of the source signal, ensuring that the risk spreads steadily across segments within five rounds without being overwhelmed by information attenuation.

[0211] Additionally, it can be configured to centrally read all information sink nodes ζ when the iteration cycle T=5 ends. i =1 final state Input: Lightweight two-layer fully connected classification header; Output: Leakage probability q i The classification head parameters are trained offline with cross-entropy as the objective, forming an end-to-end differentiable process together with the operators.

[0212] Finally, {q i The corresponding start and end line number paths are encapsulated into a JSONLines file. Provided to the semantic review component, enabling structured output of detection results and integration with natural language reports. Multi-flow graph convolutional propagation and risk quantification are completed, improving the accuracy and interpretability of detecting leakage of ultra-long single-document credentials.

[0213] In one exemplary embodiment, the risk assessment results for determining the leaky interface described above include:

[0214] The transmitted results are compared with preset risk reference values ​​to determine the risk assessment results of the leaked interface.

[0215] Here, the risk reference value refers to reference data used to assess the risk of the transmission result. By comparing the transmission result with the preset risk reference value, the risk assessment result of the leaking interface can be determined based on the comparison result. For example, when the transmission result is greater than the risk reference value, the leaking interface can be determined to be at the risk assessment result corresponding to the risk reference value, such as high risk. In this exemplary embodiment, the preset risk reference value can include multiple values, such as a high-risk risk reference value, a low-risk risk reference value, etc. This exemplary embodiment can compare the transmission result with multiple preset risk reference values ​​to determine the risk assessment result corresponding to the risk reference value. For example, when it meets the medium-risk risk reference value, the risk assessment result is determined to be medium risk, etc.

[0216] Based on the above description, in this exemplary embodiment, a source code file is obtained, and multiple sensitive data nodes and leaked interface nodes are identified in the source code file; the correlation between the sensitive data nodes and the leaked interface nodes is determined, and candidate node pairs are determined based on the correlation; in the pre-built abstract syntax tree of the source code file, paths connecting the candidate node pairs are searched, and candidate leaked paths are determined based on the path costs; a multi-stream code attribute graph is constructed based on the candidate leaked paths; message passing is performed on the multi-stream code attribute graph to determine the risk assessment result of the leaked interface. On the one hand, this exemplary embodiment filters candidate node pairs by calculating the correlation between sensitive data nodes and leaked interface nodes, determines candidate leaked paths by combining path costs, and then integrates multi-dimensional associations based on multi-stream code attribute graphs. This effectively avoids the one-sidedness of rule scanning and the path truncation problem of program graph analysis in the prior art, and can more accurately capture the propagation link of sensitive data, reducing missed detections and false alarms. On the other hand, the risk assessment results are determined through the message passing mechanism of multi-stream code attribute graphs. This not only uses the graph structure to preserve the complete context of sensitive data propagation and solves the problem of insufficient interpretability of deep learning methods, but also focuses on high-risk paths through path cost filtering and multi-stream fusion, optimizes resource consumption, avoids inefficiency caused by indiscriminate analysis, and makes the risk assessment results both reliable and traceable.

[0217] In one exemplary embodiment, the above-described sensitive data leakage detection method may further include:

[0218] Based on the risk assessment results of the leaked interface, combined with semantic confidence calculation, high-risk paths are identified and corresponding analysis results are generated.

[0219] After determining the risk assessment result of the leaked interface, this exemplary embodiment can also calculate the result with the semantic confidence of the model inference to determine a more accurate high-dimensional path and generate corresponding analysis results. For example, the top 10% of the calculated results and non-third-party paths can be taken as high-risk paths.

[0220] In one exemplary embodiment, the above-described sensitive data leakage detection method may further include:

[0221] A pre-trained neural network is used to perform semantic analysis on candidate leakage paths to infer semantic confidence.

[0222] This exemplary embodiment can utilize a pre-trained neural network, such as Code-LLaMA-Lite, to perform semantic analysis on candidate leakage paths and determine semantic confidence.

[0223] The specific process may include setting the total number of candidate leakage paths output in the above steps to N, and obtaining an ordered sequence <Ω in descending order of leakage probability. (1) ,Ω ( / ) ,…,Ω (N) > Let rank(i) represent the path Ω i The ranking (starting from 1) makes φ i ∈{0,1} indicates whether the path is located in a third-party library (0 for no, 1 for yes):

[0224]

[0225] Among them, κ i =1 indicates that the item will be reserved for review; κ i =0 means to be directly removed.

[0226] Final Index Set to be Reviewed Ensure that resources are concentrated on the top 10% of core high-risk paths that originate from self-developed code.

[0227] For each Extract 60 bytes from the vicinity of the voucher literal to generate a constant fragment. By using cross-segment summary vectors to reverse-engineer the source code, and concatenating the first and last segments, a code summary is formed. Extract 80 bytes of context from the dangerous interface line to generate an API fragment. Rewrite the three paragraphs into natural language prompts. i Include line numbers.

[0228] The prompt will be π i Together with the unified question "Will this candidate leakage path lead to credential leakage?", the prompt word "promptφ" is formed. i Input the tweaked Code-LLaMA-Lite to get <answer i ,r i reason i >, where r i ∈[0,1] represents the model confidence level.

[0229] parsing r i It is a floating-point number, including reason.i Write to audit log To meet compliance traceability requirements.

[0230] Geometrically average the structural probability with the semantic confidence inferred by Code-LLaMA-Lite, for example, for each candidate leak path. Calculate the fusion score:

[0231]

[0232] Where, q i The structure propagation probability in step S5; r i For semantic confidence of large models.

[0233] Geometric mean can automatically converge toward the lower score side when there is a large difference between the two scores, thus suppressing false alarms.

[0234] Based on the comparison between the calculated ensemble average and a preset threshold, a high-dimensional path is determined. For example, if g i ≥0.75 and φ i =0, then path Ω is considered. i This is a genuine high-risk case; please note. Write into the final report If for g i Path saving <0.75<Ω i ,q i ,r i reason i This information is submitted to List W for reference during subsequent incremental scanning or manual review. Based on this, the semantic review and risk confirmation process for the large model is complete.

[0235] In one exemplary embodiment, the above-described sensitive data leakage detection method may further include:

[0236] Based on the identified high-risk routes, obtain traceable evidence and determine the appropriate course of action based on the traceable evidence.

[0237] In the confirmed high-risk route set ={Ω1,Ω / Based on this, this exemplary embodiment can automatically assemble three types of traceable evidence for each path:

[0238] First, extract the source code of the voucher constant definition line and the five lines before and after it, generate source code snippets, and retain the original line numbers and syntax highlighting.

[0239] Second, extract the smallest control-data-relevance connected subgraph covering the path from the multi-flow attribute graph, render it as a scalable SVG (Scalable Vector Graphics), and denote it as a flow graph, so as to intuitively display the cross-segment dependency relationship;

[0240] Third, capture dangerous API call lines and complete call stacks, along with input parameter summaries and return value flows, and compile them into a call stack.

[0241] The above three types of evidence, along with the fusion risk score g, i The line number chain and the reasoning of the large model are uniformly encapsulated as JSONLines (JavaScript Object Notation Lines, a JSON-based text format, with one JSON object per line), and stored separately as key source code fragments, flow graphs, and call stacks. The flow graph is synchronously output as interactive HTML (HyperTextMarkup Language), and nodes can jump to the corresponding source code line. After receiving the data, the auditing platform can locate the source code, expand the graph view, and the call stack with one click, helping technical personnel quickly reproduce the problem and implement fixes.

[0242] This exemplary embodiment, based on the above implementation method, can automatically locate credential literals and leaked interfaces, provide precise transmission paths, and simultaneously generate traceable evidence such as source code fragments, call stacks, and multi-flow subgraphs. For large repositories, an incremental scanning mode can be used to achieve continuous security verification without interruption during daily builds. The scanning time for a single file containing hundreds of thousands of lines of source code can be controlled to around ten seconds, and it can be seamlessly embedded into existing CI / CD (Continuous Integration / Continuous Deployment) pipelines or IDE (Integrated Development Environment) plugins without any additional hardware investment. On the other hand, it can be applied to security gateways before the launch of critical businesses containing a large number of sensitive configurations, such as core billing systems for operators, bank transaction platforms, and government clouds. It can also be deployed on hosting platforms such as GitLab and Gitea as a real-time push scanning service, further extending to compliance auditing scenarios for third-party component access and outsourced code delivery. On the other hand, this exemplary embodiment can reduce the risk of credential leakage by more than 90%, helping enterprises avoid losses and damage to brand reputation; automation replaces manual auditing, which can save more than 100 person-days of security review costs per project per year, shorten the launch cycle, and help enterprises improve their overall security rating, fostering new businesses of security testing services for external clients.

[0243] Figure 2 This diagram illustrates the overall flow of a sensitive data leakage detection method in this exemplary embodiment, which may specifically include the following steps:

[0244] Step S210: Input source code file;

[0245] Step S220: Use regular expressions to scan the source code file and locate the anchor point of the voucher literal;

[0246] Step S230: Identify leaked interface anchor points based on interface whitelist filtering;

[0247] Step S240: Propagate messages in the constructed multi-stream code attribute graph to generate static alarm information;

[0248] Step S250: Manual review, correct false alarms and / or omissions, and feed back the correction results to step S220.

[0249] Figure 3 A flowchart of another sensitive data leakage detection method in this exemplary embodiment is shown, which may specifically include the following steps:

[0250] Step S302: Load the source code file to be detected;

[0251] Step S304: Slice the source code file and mark security anchors. Scan the source code file line by line from top to bottom, build a line number offset base table, aggregate complete functions into segments, recursively descent to generate segment-level AST, and mark the voucher literal anchors and leaked interface anchors by matching regular expressions through DFS (Depth-First Search).

[0252] Step S306: Through Hyena-Code long sequence relevance mining, vector information such as semantic vectors and line number / syntax / anchor point priors are superimposed, multi-scale convolution processing, bilinear relevance and line spacing gating are used to determine candidate node pairs composed of high-confidence constants and interfaces.

[0253] Step S308: AST path replication and summarization, precise search by row number index, if the row number index accurately falls into the AST, shortest search of the same function path, cross-function virtual call edge expansion, output 128-dimensional summary of node sequence;

[0254] Step S310: Determine whether the anchor points of the candidate nodes are located in the same innermost function body;

[0255] If it is located in the innermost function body, then execute.

[0256] Step S312: Construct the multi-stream code attribute graph, perform log decay of the data stream, modulate the direction ± depth of the control stream, normalize the volume of the call stream parameters, align the correlation stream with Sigmoid, and merge to generate a fourth-order adjacency tensor.

[0257] If there is no innermost function body, then execute step S314, expand the virtual edge, and then execute step S312;

[0258] Step S316: Perform message propagation in the multi-stream code attribute graph and input the leakage probability of the interface node;

[0259] Step S318: Determine whether the leakage probability is higher than a preset threshold;

[0260] If the value is higher than the threshold, then proceed to step S320, which combines semantic verification and fusion scoring with the large language model LLM.

[0261] Step S322: Based on the fusion score, generate the evidence chain and report, including source code snippets, SVG flow graphs, call stacks, and JSON lines encapsulated for the auditing platform.

[0262] Step S324: Determine high-risk path output evidence and write the results into a document;

[0263] If the threshold is not exceeded, the convergence occurs directly, and step S322 is executed.

[0264] Figure 4 This embodiment illustrates a flowchart of abstract syntax tree path replication and summarization, which may specifically include the following steps:

[0265] Step S402: Read the high-confidence luminance-interface tuple;

[0266] Step S404: Call the row number → AST node sparse index to accurately locate the voucher literal anchor point and the leaked interface anchor point;

[0267] Step S406: If the credential literal anchor point and the leaked interface anchor point belong to the same function, then execute the same function body scenario step, with weighted depth-first search to minimize the total cost of the syntax path.

[0268] Step S408: If the credential literal anchor point and the leaked interface anchor point belong to different functions, then execute the cross-function scenario step, identify the call return node, determine the called entry point, insert virtual control rheometry, and set the weight, such as 0.5.

[0269] Step S410: Merge real or virtual edges, output node sequence and edge array to form candidate leaked path segments;

[0270] Step S412: Calculate a 128-dimensional security digest vector, including constant content hash (32-dimensional), control flow branch label (64-dimensional), and call stack depth (32-dimensional);

[0271] Step S414: Embed the summary vector into the first and last nodes of the path, with the key name summary-vec;

[0272] Step S416: Persist JSON Lines. Fields may include node sequence, edge array, total cost, summary vector, line number range, etc.

[0273] An exemplary embodiment of this disclosure also provides a sensitive data leakage detection apparatus. (Refer to...) Figure 5 The device 500 may include: a source code file acquisition module 510, used to acquire source code files and identify multiple sensitive data nodes and leaked interface nodes in the source code files; a candidate node pair determination module 520, used to determine the correlation between sensitive data nodes and leaked interface nodes, and determine candidate node pairs based on the correlation; a candidate leak path generation module 530, used to search for cost paths connecting candidate node pairs in a pre-built abstract syntax tree of the source code file to generate candidate leak paths; a code attribute graph construction module 540, used to construct a multi-flow code attribute graph based on the candidate leak paths; and an interface risk assessment module 550, used to perform message passing on the multi-flow code attribute graph to determine the risk assessment result of the leaked interface.

[0274] In one exemplary embodiment, the source code file acquisition module includes: a slicing processing unit for slicing the source code file to obtain multiple slicing results; and a node determination unit for parsing the syntax structure of each slicing result to determine multiple sensitive data nodes and leaked interface nodes.

[0275] In one exemplary embodiment, the slicing processing unit includes: an index generation subunit, configured to generate a locatable code index structure based on the source code file; and a slicing subunit, configured to slice the source code file based on the locatable code index structure and a preset slicing threshold.

[0276] In one exemplary embodiment, the index generation subunit includes: a file scanning subunit, configured to scan the source code file, record the line identifier and byte offset of each line of data, determine the function start line and end line, obtain a mapping table of line identifiers and file offsets, and a set of function boundaries; and an index generation subunit, configured to generate a locatable code index structure based on the mapping table of line identifiers and file offsets and the set of function boundaries.

[0277] In one exemplary embodiment, the slicing subunit is used to slice the code in the function boundary set into multiple code intervals according to a preset slicing threshold.

[0278] In an exemplary embodiment, the node determination unit includes: a syntax parsing subunit, configured to invoke a deterministic finite state automaton to parse the syntax structure of each code segment, obtain the tag corresponding to each code segment, obtain the tag sequence of each code segment, and record the mapping relationship between the tag and the line identifier; and a node determination subunit, configured to determine multiple sensitive data nodes and leaking interface nodes based on the tag sequence of each code segment.

[0279] In one exemplary embodiment, the node determining subunit is used to generate an abstract syntax subtree corresponding to each code segment based on the tag sequence of each code segment; and to traverse the abstract syntax subtree corresponding to each code segment to determine sensitive data nodes and leaking interface nodes.

[0280] In an exemplary embodiment, the node determination subunit includes: traversing the abstract syntax subtree corresponding to each code segment, determining sensitive data nodes using preset regular expression matching rules, and determining leaking interface nodes using a preset interface set.

[0281] In an exemplary embodiment, the candidate node pair determination module includes: a sequence determination unit, configured to concatenate the marker sequences of each code segment to obtain a full file symbol sequence of the source code file; a semantic vector determination unit, configured to determine the semantic vector of each symbol in the full file symbol sequence; a mixed vector determination unit, configured to determine the mixed vector of each symbol based on the semantic vector corresponding to each symbol, the syntax type corresponding to each symbol, the line information corresponding to each symbol, and the node category corresponding to each symbol; a relevance calculation unit, configured to calculate the relevance of any two symbols based on the mixed vector of any two symbols; and a candidate node pair determination unit, configured to select sensitive data nodes and leaked interface nodes whose relevance meets preset conditions as candidate node pairs.

[0282] In an exemplary embodiment, the correlation calculation unit includes: a feature vector determination subunit, used to process the mixed vector of each symbol through multi-scale convolution to obtain feature vectors at different scales; and a correlation calculation subunit, used to calculate the correlation between any two symbols based on the feature vectors of any two symbols at different scales.

[0283] In an exemplary embodiment, the candidate node pair determination unit is used to select symbol pairs whose relevance meets a preset condition from among the symbol pairs consisting of sensitive data nodes and leaking interface nodes as candidate node pairs.

[0284] In an exemplary embodiment, before searching for cost paths connecting candidate node pairs in the pre-built abstract syntax tree of the source code file, the sensitive data leakage detection device further includes: a line information extraction unit, used to extract line information corresponding to the sensitive data node and the leakage interface node from the candidate node pair; a node positioning unit, used to call the pre-built mapping index between line information and abstract syntax tree nodes, and locate the sensitive data node and the leakage interface node in the abstract syntax tree based on the line information through binary search; and an information recording unit, used to record the line identifier, column identifier, and file offset of the located sensitive data node and leakage interface node in the source code file.

[0285] In an exemplary embodiment, the candidate leakage path generation module includes: a function body determination unit, used to determine the function bodies of the sensitive data node and the leakage interface node; the function body is a complete logical unit in the code that starts with a function declaration and ends with a function terminator; a first search unit, used to limit the path search scope to the abstract syntax subtree corresponding to the target function body if the sensitive data node and the leakage interface node belong to the same target function body, and perform a search to determine the candidate leakage path; and a second search unit, used to perform a cross-function path search process to determine the candidate leakage path if the sensitive data node and the leakage interface node do not belong to the same function body, or if no valid path is found in the same function body.

[0286] In an exemplary embodiment, the first search unit is configured to perform a weighted depth-first search in the abstract syntax subtree corresponding to the objective function body, based on minimizing the cost function containing control flow penalties; and select the path with the minimum total cost as a candidate leakage path.

[0287] In an exemplary embodiment, the second search unit is used to identify the return node of a function call and the entry node of the called function, add a virtual control flow edge between them, and the weight of the virtual control flow edge is between the weight of the real variable reference and the weight of cross-file import; based on the abstract syntax tree after adding the virtual edge, the weighted depth-first search is re-executed to calculate the total cost of the path containing the virtual edge in order to determine the candidate leak path.

[0288] In one exemplary embodiment, the code attribute graph construction module includes: a matrix determination unit, configured to determine a data flow adjacency matrix, a control flow adjacency matrix, a call flow adjacency matrix, and a relevance adjacency matrix based on the node sequence and inter-node associations contained in the candidate leakage path; a tensor determination unit, configured to merge the data flow adjacency matrix, the control flow adjacency matrix, the call flow adjacency matrix, and the relevance adjacency matrix into a fourth-order adjacency tensor; and an attribute graph generation unit, configured to construct a multi-flow code attribute graph based on the node range of the candidate leakage path and the association information of the fourth-order adjacency tensor.

[0289] In an exemplary embodiment, the attribute graph generation unit includes: a node set determination subunit, used to expand and include other nodes in the fourth-order adjacency tensor that have non-zero association with the core node, taking the nodes in the candidate leakage path as the core, as the node set of the multi-stream code attribute graph; a connection relationship determination subunit, used to extract the connection relationships of the nodes in the node set of the multi-stream code attribute graph from each adjacency matrix of the fourth-order adjacency tensor; a weight determination subunit, used to extract the association strength values ​​of each pair of nodes in the node set from the relevance adjacency matrix of the fourth-order adjacency tensor, as the quantization weight of the corresponding connection relationship; and an attribute graph construction subunit, used to assign corresponding edge types to the extracted connection relationships, determine the relevance attribute of the edges according to the association strength values, and construct the multi-stream code attribute graph in combination with the node set.

[0290] In an exemplary embodiment, after generating candidate leakage paths, the sensitive data leakage detection device further includes: a digest vector generation unit, used to extract key features of the candidate leakage paths and convert the key features into digest vectors; add the digest vectors to the candidate leakage paths; and an attribute graph generation unit, used to construct a multi-stream code attribute graph based on the node range of the candidate leakage paths, the association information of the fourth-order adjacency tensor, and the digest vectors.

[0291] In an exemplary embodiment, the interface risk assessment module includes: a transmission coefficient calculation unit, configured to determine sensitive data nodes as source nodes for message transmission and leaked interface nodes as target nodes for message transmission from a multi-stream code attribute graph, and extract the relevance attributes and comprehensive weights of all edges in the graph to calculate the message transmission coefficient of each edge; a first transmission result calculation unit, configured to, if performing a single-round transmission, transmit messages from the source node through intermediate nodes to the target node, accumulate all message values ​​received by the target node, and determine the transmission result based on the single-round accumulated risk value; and a second transmission result calculation unit, configured to, if performing multi-round iterative transmission, iteratively transmit messages based on the single-round accumulated risk value and according to a preset attenuation coefficient, update the accumulated risk value of the target node in each round, and determine the transmission result based on the final accumulated risk value.

[0292] In one exemplary embodiment, the interface risk assessment module includes a reference value comparison unit, used to compare the transmission result with a preset risk reference value to determine the risk assessment result of the leaking interface.

[0293] In an exemplary embodiment, the sensitive data leakage detection device further includes a high-risk path determination unit, which determines high-risk paths and generates corresponding analysis results based on the risk assessment results of the leaked interface and in conjunction with semantic confidence calculation.

[0294] In one exemplary embodiment, the sensitive data leakage detection device further includes: a semantic analysis unit, used to perform semantic analysis on candidate leakage paths using a pre-trained neural network to infer semantic confidence.

[0295] In one exemplary embodiment, the sensitive data leakage detection device further includes: an evidence acquisition unit, configured to acquire traceable evidence based on a determined high-risk path, and determine a disposal method based on the traceable evidence.

[0296] The specific details of each module / unit in the above-mentioned device have been described in detail in the embodiments of the method section. For any undisclosed details, please refer to the embodiments of the method section, and therefore will not be repeated here.

[0297] An exemplary embodiment of this disclosure also provides an electronic device capable of implementing the above-described method.

[0298] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0299] The following reference Figure 6 To describe an electronic device 600 according to such an exemplary embodiment of the present disclosure. Figure 6 The electronic device 600 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0300] like Figure 6 As shown, the electronic device 600 is presented in the form of a general-purpose computing device. The components of the electronic device 600 may include, but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different system components (including storage unit 620 and processing unit 610), and a display unit 640.

[0301] The storage unit stores program code, which can be executed by the processing unit 610 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure. For example, the processing unit 610 can execute... Figure 1 , Figure 2 , Figure 3 or Figure 4 The steps shown are as follows.

[0302] Storage unit 620 may include readable media in the form of volatile storage units, such as random access memory (RAM) 621 and / or cache memory 622, and may further include read-only memory (ROM) 623.

[0303] Storage unit 620 may also include a program / utility 624 having a set (at least one) of program modules 625, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0304] Bus 630 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0305] Electronic device 600 can also communicate with one or more external devices 700 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 600, and / or with any device that enables electronic device 600 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 650. Furthermore, electronic device 600 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 660. As shown, network adapter 660 communicates with other modules of electronic device 600 via bus 630. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0306] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the method according to the exemplary embodiments of this disclosure.

[0307] Exemplary embodiments of this disclosure also provide a computer-readable storage medium having a program product stored thereon capable of implementing the methods described above in this specification. In some possible implementations, various aspects of this disclosure may also be implemented as a program product including program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure.

[0308] Exemplary embodiments of this disclosure also provide a program product for implementing the above-described method, which may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of this disclosure is not limited thereto. In this document, a readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0309] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0310] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0311] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0312] Program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing devices can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0313] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of this disclosure and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0314] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to exemplary embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0315] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

[0316] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is defined only by the appended claims.

Claims

1. A sensitive data leakage detection method, characterized in that, The method comprises the following steps: acquiring a source code file, and determining a plurality of sensitive data nodes and leakage interface nodes in the source code file; determining the relevance of the sensitive data nodes and the leakage interface nodes, and determining a candidate node pair according to the relevance; searching for a path connecting the candidate node pair in a pre-constructed abstract syntax tree of the source code file, and determining a candidate leakage path according to a path cost; constructing a multi-flow code attribute graph based on the candidate leakage path; performing message passing on the multi-flow code attribute graph to determine a risk assessment result of a leakage interface.

2. The method of claim 1, wherein, The step of determining a plurality of sensitive data nodes and leakage interface nodes in the source code file comprises the following steps: performing slicing processing on the source code file to obtain a plurality of slicing results; performing syntax structure analysis on each slicing result to determine a plurality of sensitive data nodes and leakage interface nodes.

3. The method of claim 2, wherein, The step of performing slicing processing on the source code file to obtain a plurality of slicing results comprises the following steps: generating a locatable code index structure according to the source code file; performing slicing processing on the source code file according to the locatable code index structure and a preset slicing threshold.

4. The method of claim 3, wherein, The step of generating a locatable code index structure according to the source code file comprises the following steps: scanning the source code file, recording the line identifier and byte offset of each line of data, and determining the function start line and end line to obtain a mapping table of line identifier and file offset and a function boundary set; generating the locatable code index structure according to the mapping table of line identifier and file offset and the function boundary set.

5. The method of claim 4, wherein, The step of performing slicing processing on the source code file according to the locatable code index structure and a preset slicing threshold comprises the following steps: according to the preset slicing threshold, slicing the code in the function boundary set into a plurality of code intervals.

6. The method of claim 5, wherein, The step of performing syntax structure analysis on each slicing result to determine a plurality of sensitive data nodes and leakage interface nodes comprises the following steps: calling a deterministic finite automaton to perform syntax structure analysis on each code interval to obtain the corresponding token of each code interval, to obtain the token sequence of each code interval, and recording the mapping relationship between the token and the line identifier; determining a plurality of sensitive data nodes and leakage interface nodes according to the token sequence of each code interval.

7. The method of claim 6, wherein, The step of determining a plurality of sensitive data nodes and leakage interface nodes according to the token sequence of each code interval comprises the following steps: generating the abstract syntax sub-tree corresponding to each code interval according to the token sequence of each code interval; traversing the abstract syntax sub-tree corresponding to each code interval to determine sensitive data nodes and leakage interface nodes.

8. The method of claim 7, wherein, The step of traversing the abstract syntax sub-tree corresponding to each code interval to determine sensitive data nodes and leakage interface nodes comprises the following steps: traversing the abstract syntax sub-tree corresponding to each code interval, and determining the sensitive data nodes by using a preset regular matching rule and determining the leakage interface nodes by using a preset interface set.

9. The method of claim 6, wherein, The step of determining the relevance of the sensitive data nodes and the leakage interface nodes, and determining a candidate node pair according to the relevance comprises the following steps: Splicing the token sequences of the code intervals to obtain a full-file symbol sequence of the source code file; Determining semantic vectors of the symbols in the full-file symbol sequence; Determining a hybrid vector of each symbol according to the semantic vector corresponding to the symbol, the syntax type corresponding to the symbol, the line information corresponding to the symbol, and the node category corresponding to the symbol; Calculating a correlation degree of any two symbols according to the hybrid vectors of the two symbols; Taking sensitive data nodes and leakage interface nodes whose correlation degrees satisfy a preset condition as candidate node pairs.

10. The method of claim 9, wherein, The method further includes: Extracting line information corresponding to the sensitive data nodes and the leakage interface nodes from the candidate node pairs; Calling a pre-constructed mapping index of line information and abstract syntax tree nodes, and locating the sensitive data nodes and the leakage interface nodes in the abstract syntax tree based on the line information through binary search; 11. The method of claim 9, wherein, Recording line identifiers, column identifiers, and file offsets of the located sensitive data nodes and leakage interface nodes in the source code file. The method further includes:

12. The method of claim 1, wherein, Determining function bodies in which the sensitive data nodes and the leakage interface nodes are located; the function body is a complete logical unit in code with a function declaration as a starting point and a function end symbol as an ending point; If the sensitive data nodes and the leakage interface nodes belong to a same target function body, limiting a path search range in an abstract syntax sub-tree corresponding to the target function body to search to determine a candidate leakage path; If the sensitive data nodes and the leakage interface nodes do not belong to a same function body or an effective path is not found in a same function body, searching by using a cross-function path search process to determine a candidate leakage path. The method further includes:

13. The method of claim 12, wherein, Performing weighted depth-first search in the abstract syntax sub-tree corresponding to the target function body according to a cost function that minimizes a control flow penalty; Taking a path with a minimum total cost as the candidate leakage path. The method further includes: ​ 14. The method of claim 13, wherein, ​ ​ ​ 15. The method of claim 14, wherein, ​ identifying a return node of a function call and an entry node of a called function, adding a virtual control flow edge between the two, the virtual control flow edge having a weight between a weight of a real variable reference and a weight of a cross-file import; re-performing a weighted depth-first search on the abstract syntax tree after adding the virtual edge, calculating a total cost of a path containing the virtual edge to determine a candidate leakage path.

16. The method of claim 1, wherein, constructing a multi-flow code property graph based on the candidate leakage path, including: determining a data flow adjacency matrix, a control flow adjacency matrix, a call flow adjacency matrix, and a relevance adjacency matrix based on a sequence of nodes and associations between nodes contained in the candidate leakage path; merging the data flow adjacency matrix, the control flow adjacency matrix, the call flow adjacency matrix, and the relevance adjacency matrix into a fourth-order adjacency tensor; constructing the multi-flow code property graph based on a node range of the candidate leakage path and association information of the fourth-order adjacency tensor.

17. The method of claim 16, wherein, constructing the multi-flow code property graph based on the node range of the candidate leakage path and the association information of the fourth-order adjacency tensor, including: extending, with a node in the candidate leakage path as a core, other nodes in the fourth-order adjacency tensor that have a non-zero association with the core node into a node set of the multi-flow code property graph; extracting connection relationships of nodes in the node set from each adjacency matrix of the fourth-order adjacency tensor; extracting association strength values of pairs of nodes in the node set from the relevance adjacency matrix of the fourth-order adjacency tensor as quantized weights of corresponding connection relationships; assigning corresponding edge types to the extracted connection relationships, and determining relevance properties of the edges according to the association strength values, to construct the multi-flow code property graph in combination with the node set.

18. The method of claim 17, wherein, After generating the candidate leakage path, the method further includes: extracting key features of the candidate leakage path, and converting the key features into an abstract vector; adding the abstract vector to the candidate leakage path; constructing the multi-flow code property graph based on the node range of the candidate leakage path, the association information of the fourth-order adjacency tensor, and the abstract vector. performing message passing on the multi-flow code property graph, including:

19. The method of claim 1, wherein, determining a sensitive data node as a source node of message passing and a leakage interface node as a target node of message passing from the multi-flow code property graph; if a single round of passing is performed, passing a message from the source node to the target node through intermediate nodes, accumulating all message values received by the target node, and determining a passing result according to a single round cumulative risk value; if a multi-round iterative passing is performed, iteratively passing a message according to a preset decay coefficient based on the single round cumulative risk value, updating a cumulative risk value of the target node in each round, and determining a passing result according to a final cumulative risk value. determining a risk assessment result of the leakage interface, including:

20. The method of claim 19, wherein, comparing the passing result with a preset risk reference value to determine the risk assessment result of the leakage interface. the method further includes:

21. The method of claim 1, wherein, ​ Based on the risk assessment result of the leakage interface, combined with semantic confidence calculation, a high-risk path is determined and corresponding analysis result is generated.

22. The method of claim 21, wherein, The method further comprises: A pre-trained neural network is used to perform semantic analysis on the candidate leakage path to infer the semantic confidence.

23. The method of claim 22, wherein, The method further comprises: Based on the determined high-risk path, traceable evidence is obtained, and a disposal method is determined according to the traceable evidence.

24. A sensitive data leakage detection apparatus, characterized by, Comprise: A source code file acquisition module is configured to acquire a source code file and determine a plurality of sensitive data nodes and leakage interface nodes in the source code file; A candidate node pair determination module is configured to determine the relevance of the sensitive data nodes and the leakage interface nodes, and determine a candidate node pair according to the relevance; A candidate leakage path generation module is configured to search for a cost path connecting the candidate node pair in a pre-constructed abstract syntax tree of the source code file to generate a candidate leakage path; A code attribute graph construction module is configured to construct a multi-flow code attribute graph based on the candidate leakage path; An interface risk assessment module is configured to perform message passing on the multi-flow code attribute graph to determine a risk assessment result of the leakage interface.

25. An electronic device, comprising: Comprise: A processor; And A memory for storing executable instructions of the processor; Wherein the processor is configured to execute the executable instructions to perform the method of any one of claims 1-23.

26. A computer readable storage medium comprising a computer program, characterized in that, The computer program is executed by the processor to implement the method of any one of claims 1-23.

Images