Code vulnerability reachability analysis method based on vulnerability database

Abstract

The application relates to the technical field of data analysis, in particular to a code vulnerability reachability analysis method based on a vulnerability database, which comprises the following steps: obtaining keywords in each vulnerability code segment in the vulnerability database and keywords of each node code extracted by a CPG (Code Property Graph) code attribute graph; extracting a node feature vector of each node in the CPG code attribute graph and a vulnerability feature vector of each vulnerability code segment, obtaining adjacency abnormality of each node and vulnerability triggerability, obtaining vulnerability confidence of each node in combination with a difference degree of vulnerability triggerability between different nodes in the CPG code attribute graph, and identifying vulnerability nodes in the CPG code attribute graph; and adopting a DFS (Depth-First Search) depth-first search algorithm to identify reachability of the vulnerability nodes in the CPG code attribute graph, so as to obtain a reachability analysis result of the code vulnerability. The application can improve the accuracy of code vulnerability reachability analysis.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data analysis, and particularly relates to a code vulnerability reachability analysis method based on a vulnerability database. BACKGROUND

[0002] Open source code has the advantages of low cost and convenient use, and is favored by software developers. However, with the large number of references to open source code in the software development process, the code defects existing in the open source code are inherited by the software development program, which affects the stability and reliability of the software system. Moreover, if the code vulnerability of the software system is exploited by a malicious attacker, it will lead to a series of unpredictable software security problems such as information leakage and system crash, so it is necessary to regularly identify and repair the vulnerabilities in the source code of the development software program to improve the stability and reliability of the software system.

[0003] In the prior art, a code property graph is constructed by a vulnerability database of software development and source code of a program to be detected, a vulnerability node in the code property graph of the program to be detected is identified by using node semantic matching, and a depth-first search algorithm is used to analyze the reachability of the vulnerability program in the source code, thereby effectively reducing false positives of code vulnerabilities and improving the accuracy of code vulnerability detection. However, due to the high complexity of the program source code, the prior art uses node semantic matching to identify the vulnerability node in the code property graph, which does not fully exploit the vulnerability features between different node contexts, which may cause errors or omissions in the identification of the vulnerability node in the code property graph, making it impossible to accurately analyze the reachability of the vulnerability program in the source code, thereby reducing the accuracy of code vulnerability detection. SUMMARY

[0004] To solve the above technical problems, the present application provides a code vulnerability reachability analysis method based on a vulnerability database to solve the existing problems.

[0005] The code vulnerability reachability analysis method based on a vulnerability database of the present application adopts the following technical solution:

[0006] One embodiment of the present application provides a code vulnerability reachability analysis method based on a vulnerability database, comprising the following steps:

[0007] A vulnerability database is constructed by keywords in each vulnerability code segment, and keywords of each node code are extracted from a CPG code property graph of the source code of the program to be detected;

[0008] The node feature vectors of the nodes in the CPG code attribute graph and the vulnerability feature vectors of the vulnerability code segments are extracted by using a word vector model, and the adjacency abnormality of each node is obtained by analyzing the correlation between the node feature vectors of the nodes in the CPG code attribute graph and the vulnerability feature vectors of the vulnerability code segments.

[0009] According to the adjacency abnormality of each node in the CPG code attribute graph, in combination with the correlation between the node feature vectors of each node and the vulnerability feature vectors of the vulnerability code segments, the vulnerability triggerability of each node is obtained, and in combination with the difference degree of the vulnerability triggerability between different nodes in the CPG code attribute graph, the vulnerability confidence of each node is obtained, which is used to identify the vulnerability nodes in the CPG code attribute graph.

[0010] The DFS (Depth-First Search) algorithm is used to identify the reachable paths of the vulnerability nodes in the CPG code attribute graph, so as to obtain the reachability analysis result of the code vulnerability.

[0011] Preferably, all the keywords of the code of each node in the CPG code attribute graph and all the keywords of each vulnerability code segment are respectively taken as the input of the Word2Vec word vector model, so as to obtain the node feature vectors of each node in the CPG code attribute graph and the vulnerability feature vectors of each vulnerability code segment.

[0012] Preferably, the method for obtaining the adjacency abnormality of each node comprises the following steps:

[0013] In the formula, m represents the number of the node, and the adjacency abnormality of the mth node is represented by am. am is the adjacency abnormality of the mth node, is a range normalization function, is the number of the adjacent nodes in the adjacent node set of the mth node, is the similarity degree of the node feature vectors between the mth node and the ith node in the adjacent node set of the mth node, is the first sum value of the ith adjacent node in the adjacent node set of the mth node.

[0014] Preferably, the adjacency table of the CPG code attribute graph is constructed by using all the nodes in the CPG code attribute graph, and for each node, all the nodes connected to the node in the adjacency table are taken as the adjacent node set of the node.

[0015] Preferably, the cumulative sum of the similarity degrees between the node feature vectors of each adjacent node in the adjacent node set of each node and the vulnerability feature vectors of all the vulnerability code segments is taken as the first sum value of each adjacent node in the adjacent node set of each node.

[0016] Preferably, the method for obtaining the vulnerability triggerability of each node comprises the following steps: In the formula, m represents the number of the node, and the vulnerability triggerability of the mth node is represented by am. a vulnerability triggerability of the ith node, a cumulative sum of similarity degrees between a node feature vector of the ith node and vulnerability feature vectors of each vulnerability code segment, a neighborhood abnormality degree of the mth node.

[0017] Preferably, the method for obtaining the vulnerability confidence of each node is: ; in the formula, a vulnerability confidence of the mth node, an element mean in a value vector of the ith node, a vulnerability triggerability of the ith node, a constant for avoiding zero denominator, a range normalization function.

[0018] Preferably, each edge in the CPG code attribute graph is assigned with an edge to construct a directed graph of the CPG code attribute graph, and all edges connected with each node in the CPG code attribute graph form a value vector of the node.

[0019] Preferably, in the directed graph of the CPG code attribute graph, the edge of each edge is equal to an absolute difference value of the vulnerability triggerability between two nodes connected by each edge.

[0020] Preferably, the identification of the vulnerability node in the CPG code attribute graph further comprises:

[0021] Threshold segmentation is performed on the vulnerability confidence of the node in the CPG code attribute graph, and the node corresponding to the vulnerability confidence greater than or equal to the segmentation threshold is taken as the vulnerability node in the CPG code attribute graph.

[0022] The present application has at least the following beneficial effects:

[0023] The present application accurately measures the abnormality degree of the context code of each node in the CPG code attribute graph in the source code through the node feature vector of the node code and the vulnerability feature vector of the vulnerability code, which is beneficial to more accurately identify the vulnerability triggerability feature of the vulnerability node in the subsequent process, thereby more accurately detecting the vulnerability in the program source code to be detected;

[0024] Further, the present application measures the vulnerability triggerability feature of each node code in the CPG code attribute graph through the abnormality degree of the context code of the node in the source code and in combination with the correlation degree between the node feature vector and the vulnerability feature vector, which is beneficial to more efficiently identify the high-risk vulnerability in the subsequent process, thereby avoiding the adverse effects of the non-triggerability vulnerability on the vulnerability detection and repair;

[0025] The application fully exploits the vulnerability feature between different node contexts in the CPG code attribute graph, and accurately measures the credibility of the vulnerability of the node code in combination with the vulnerability triggerability of each node in the CPG code attribute graph and the value vector, avoids the problems of error and even omission in the identification of the vulnerability node in the code attribute graph, and thus more accurately analyzes the reachability of the vulnerability program in the source code and improves the accuracy of the code vulnerability detection. BRIEF DESCRIPTION OF DRAWINGS

[0026] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present application or the prior art, the drawings needed in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0027] Figure 1 The step flow chart of the code vulnerability reachability analysis method based on the vulnerability database provided by the present application. DETAILED DESCRIPTION

[0028] In order to further illustrate the technical means and effects adopted by the present application to achieve the predetermined invention purpose, the specific implementation, structure, features and effects of the code vulnerability reachability analysis method based on the vulnerability database according to the present application are described in detail as follows by combining with the drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. In addition, the specific features, structures or characteristics in one or more embodiments can be combined in any suitable form.

[0029] Unless otherwise defined, such as the terms "comprise", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the circuit structure, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such article or device. Without more limitation, the element limited by the statement "including one" does not exclude the presence of another identical element in the article or device including the element. In addition, the term "and / or" used herein includes any and all combinations of one or more related listed items. All technical and scientific terms used herein have the same meaning as understood by those skilled in the art of the technology to which the present application belongs.

[0030] The specific scheme of the code vulnerability reachability analysis method based on the vulnerability database provided by the present application is specifically described below in combination with the drawings.

[0031] An embodiment of the present application provides a vulnerability database-based code vulnerability reachability analysis method, and specifically, refer to Figure 1 , which comprises the following steps:

[0032] Step 1: constructing a vulnerability database through keywords in each vulnerability code fragment, and extracting keywords of each node code through a CPG code property graph of a source code of a program to be detected.

[0033] In order to accurately analyze the reachability of vulnerability programs in the source code and improve the accuracy of code vulnerability detection, it is necessary to more accurately identify vulnerability nodes in the code property graph of the program to be detected. First, the present application extracts each vulnerability code fragment of a CVE vulnerability patch (Common Vulnerabilities & Exposures) in a software development process, and uses a regular expression matching algorithm to extract vulnerability keywords of different structure types in each vulnerability code fragment, the different structure types including function call type, variable name type, string operation type, pointer operation type and arithmetic expression type, a vulnerability database is constructed through the keywords in all vulnerability code fragments, the vulnerability database includes the keywords of the function call type, the variable name type, the string operation type, the pointer operation type and the arithmetic expression type in all vulnerability code fragments, the regular expression matching algorithm and the construction of the vulnerability database are known technologies, and the specific process will not be described again.

[0034] Meanwhile, the source code of the program to be detected is constructed into a CPG code property graph (Code Property Graph) by using a Joern tool, the CPG code property graph includes an AST abstract syntax tree (Abstract Syniax Tree) of the program to be detected, a CFG control flow graph (Control Flow Graph) and a DFG data flow graph (Data Flow Diagram), node codes of each node are extracted through the CPG code property graph, and all keywords of each node code in the CPG code property graph are extracted by using a regular expression matching algorithm, wherein the construction of the CPG code property graph is a known technology, and no redundant description is made.

[0035] Step 2: extracting node feature vectors of each node in the CPG code property graph and vulnerability feature vectors of each vulnerability code fragment by using a word vector model, and obtaining adjacency anomaly degrees of each node by analyzing the similarity between the node feature vectors of each node in the CPG code property graph and the vulnerability feature vectors of the vulnerability code fragments.

[0036] Generally, due to the high complexity of the program source code, the prior art adopts the node semantic matching method to identify the vulnerability nodes in the CPG code attribute graph, which does not fully mine the vulnerability features between the contexts of different nodes, thereby reducing the accuracy of the code vulnerability detection. Therefore, in order to avoid the identification errors or even omissions of the vulnerability nodes in the code attribute graph, it is necessary to fully mine the vulnerability features between the contexts of different nodes in the CPG code attribute graph.

[0037] In order to facilitate the subsequent accurate analysis of the vulnerability nodes in the CPG code attribute graph, all the keywords of the node codes in the CPG code attribute graph are taken as the input of the Word2Vec word vector model, and the node feature vectors of all the nodes in the CPG code attribute graph are obtained through the Word2Vec word vector model. At the same time, all the keywords of each vulnerability code segment in the vulnerability database are extracted, and all the keywords of each vulnerability code segment are taken as the input of the Word2Vec word vector model, and the vulnerability feature vectors of each vulnerability code segment are obtained through the Word2Vec word vector model, wherein the Word2Vec word vector model algorithm is a known technology, and the specific process will not be described here.

[0038] Further, the adjacency list of the CPG code attribute graph is constructed through all the nodes in the CPG code attribute graph, and the adjacent node set of each node in the CPG code attribute graph is extracted through the adjacency list. The adjacent node set is a set composed of all the nodes connected to the node, and the more the number of nodes in the adjacent node set, the more complex the context relationship of the node code representing the node in the source code. It should be noted that the construction of the adjacency list is a known technology, and the specific process will not be described here.

[0039] Further, for each node in the CPG code attribute graph, the cumulative sum of the similarity degree between the node feature vector of each adjacent node in the adjacent node set and the vulnerability feature vector of all the vulnerability code segments is calculated, which is denoted as the first sum value of each adjacent node in the adjacent node set. The similarity degree can be measured by cosine similarity or Jaccard similarity coefficient. In this embodiment, the Jaccard similarity coefficient is used to measure the similarity degree. The higher the similarity degree between the node feature vector of all the adjacent nodes of the node and the vulnerability feature vector, and the closer the context relationship between the node and its adjacent nodes, the more likely there is a high correlation between the context code of the node in the source code and the CVE vulnerability feature.

[0040] Therefore, based on the above analysis, the adjacent anomaly degree of each node in the CPG code attribute graph is calculated as follows:

[0041] ; in the formula, is the adjacent anomaly degree of the mth node. is a difference normalization function, is the number of adjacent nodes in the adjacent node set of the mth node, is the similarity degree of the node feature vector between the mth node and the i th node in the adjacent node set of the mth node, is the first sum of the i th adjacent node in the adjacent node set of the mth node.

[0042] Wherein, the adjacent anomaly degree reflects the abnormality degree of the context code of each node in the CPG code attribute graph in the source code, the larger the adjacent anomaly degree, the more likely the context code of the node in the source code has a higher correlation with the CVE vulnerability characteristics, so that the context code of the node in the source code appears a higher abnormality degree, and then the node is more likely to belong to the vulnerability node in the CPG code attribute graph.

[0043] Step 3: According to the adjacent anomaly degree of each node in the CPG code attribute graph, combined with the correlation between the node feature vector of each node and the vulnerability feature vector of the vulnerability code segment, the vulnerability triggerability of each node is obtained, and combined with the difference degree of the vulnerability triggerability between different nodes in the CPG code attribute graph, the vulnerability confidence of each node is obtained, which is used to identify the vulnerability node in the CPG code attribute graph.

[0044] Generally, the adjacent node path of each node in the CPG code attribute graph belongs to the directly reachable path of the node, if the abnormality degree of the context code of the node in the source code is higher, that is, the adjacent anomaly degree of the node is larger, and there is a high similarity between the node feature vector of the node and the vulnerability feature vector of the vulnerability code segment, which means that the node is more likely to belong to the vulnerability node in the CPG code attribute graph, and the vulnerability node is more likely to have a path that can trigger the vulnerability in the neighborhood range, which needs to be identified and repaired in time.

[0045] Therefore, based on the above analysis, the vulnerability triggerability of each node in the CPG code attribute graph is calculated:

[0046] ; In the formula, is the vulnerability triggerability of the i th node, is the cumulative sum of the similarity degree between the node feature vector of the i th node and the vulnerability feature vector of each vulnerability code segment.

[0047] Wherein, the vulnerability triggerability reflects the vulnerability triggerability characteristics of each node in the CPG code attribute graph, the larger the vulnerability triggerability, the more likely the node has a code vulnerability, and the adjacent node code of the node appears a higher anomaly, so the vulnerability node is more likely to have a path that can trigger the vulnerability in the neighborhood range, which needs to be identified and repaired in time.

[0048] In order to fully exploit the vulnerability features between the contexts of different nodes in the CPG code attribute graph, an edge is given to each edge in the CPG code attribute graph, and the edge size of each edge is equal to the absolute difference of the vulnerability triggerability between the two nodes connected by each edge. The smaller the absolute difference, the more similar the vulnerability features between the codes of the two nodes. A directed graph is constructed for the CPG code attribute graph, and the construction of the directed graph is a known technology, and the specific process will not be described again.

[0049] Further, the value vector of each node in the CPG code attribute graph is extracted through the directed graph of the CPG code attribute graph. The value vector of the node is a vector composed of all edges connected to the node. If the vulnerability triggerability feature of the node code is greater, the average level of all values in the value vector of the node is smaller, which means that the vulnerability features between the node and all adjacent nodes are closer, and the credibility of the vulnerability of the node code is higher.

[0050] Therefore, based on the above analysis, the vulnerability confidence of each node in the CPG code attribute graph is calculated:

[0051] In the formula, is the vulnerability confidence of the mth node, is the average of the elements in the value vector of the ith node, is the range normalization function, is a constant to avoid zero denominator, the value range is (0.01, 0.1), the influence on the calculation result is small and can be ignored. In this embodiment, the value is 0.05.

[0052] It can be understood that the vulnerability confidence reflects the credibility of the vulnerability of each node code in the CPG code attribute graph. The greater the vulnerability confidence, the more likely the node code has a code vulnerability, and the actual threat of the node to the system security is higher, which needs to be identified and repaired in time to avoid the exploitable code vulnerability being exploited by malicious attackers.

[0053] Further, in order to more accurately identify the vulnerability nodes in the CPG code attribute graph, in this embodiment, the vulnerability confidence of all nodes in the CPG code attribute graph is taken as the input of the maximum inter-class variance algorithm, and the segmentation threshold is obtained through the maximum inter-class variance algorithm. The node corresponding to the vulnerability confidence greater than or equal to the segmentation threshold is recorded as the vulnerability node in the CPG code attribute graph. The maximum inter-class variance algorithm is a known technology, and the specific process will not be described again.

[0054] Step 4: The DFS depth-first search algorithm is used to identify the reachable path of the vulnerability node in the CPG code attribute graph, and the reachability analysis result of the code vulnerability is obtained.

[0055] Further, the source code of the program to be detected is subjected to code vulnerability reachability analysis, each vulnerability node in the CPG code attribute graph is marked, and the marked CPG code attribute graph is taken as the input of the DFS depth-first search algorithm (DFS, Depth-First Search), the reachable path of each vulnerability node in the CPG code attribute graph of the source code of the program to be detected is identified by the DFS depth-first search algorithm, so as to obtain the reachability analysis result of the code vulnerability. The DFS depth-first search algorithm is a known technology, and the specific process is not described again.

[0056] If there is a reachable path for the vulnerability node in the CPG code attribute graph, it means that the vulnerability node is more likely to be exploited by a malicious attacker, thereby causing actual threat to the safety of the software system, and the vulnerability node with the reachable path needs to be repaired in priority, so as to improve the stability and reliability of the software system.

[0057] It can be understood that the reference to "one embodiment" or "some embodiments" and the like in the description of the present application means that the specific features, structures or characteristics described in connection with the embodiment are included in one or more embodiments of the present application. Therefore, if "in one embodiment", "in some embodiments", "in other some embodiments", "in further some embodiments" and the like appear in the description, it does not necessarily refer to the same embodiment, but means "one or more but not all embodiments", unless otherwise specifically emphasized. The terms "include", "contain", "have" and their variants mean "include but not limited to", unless otherwise specifically emphasized.

[0058] It should be noted that the above sequence of the embodiments of the present application is only for description, and does not represent the advantages and disadvantages of the embodiments. The above description is made for the specific embodiments of the present application. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-task processing and parallel processing are possible or advantageous. At the same time, the size of the serial number of each step in the embodiments does not mean the execution order, and the execution order of each process should be determined by its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments in the present application.

[0059] The above examples are only used to illustrate the technical solutions of the present application, but not limit the same; although the present application has been described in detail with reference to the foregoing examples, those skilled in the art should understand that the technical solutions recorded in the foregoing examples can be modified, or some technical features can be replaced by equivalent ones; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A method for code vulnerability reachability analysis based on vulnerability database, characterized in that, The method comprises the following steps: A vulnerability database is constructed by keywords in each vulnerability code segment, and keywords of each node code are extracted from a CPG code property graph of a program source code to be detected; Node feature vectors of each node in the CPG code property graph and vulnerability feature vectors of each vulnerability code segment are extracted by using a word vector model, and the adjacency abnormality of each node is obtained by analyzing the correlation between the node feature vectors of each node in the CPG code property graph and the vulnerability feature vectors of the vulnerability code segments. According to the adjacency abnormality of each node in the CPG code property graph, in combination with the correlation between the node feature vectors of each node and the vulnerability feature vectors of the vulnerability code segments, the vulnerability triggerability of each node is obtained, and the vulnerability confidence of each node is obtained in combination with the difference degree of the vulnerability triggerability between different nodes in the CPG code property graph, which is used to identify the vulnerability nodes in the CPG code property graph; A DFS (depth first search) algorithm is used to identify the reachable paths of the vulnerability nodes in the CPG code property graph, and a reachability analysis result of the code vulnerability is obtained. The method for obtaining the adjacency abnormality of each node comprises the following steps: wherein, is the adjacent similarity of the mth node, is the range normalization function, is the number of adjacent nodes within the adjacent node set of the mth node, is the similarity of the node feature vector between the mth node and the i th node within the adjacent node set of the mth node, is the first sum of the i th adjacent node within the adjacent node set of the mth node; The vulnerability triggerability acquisition method of each node is: ; wherein, is the vulnerability triggerability of the ith node, is the cumulative sum of the similarity between the node feature vector of the ith node and the vulnerability feature vector of each vulnerability code segment, is the adjacent abnormality of the mth node; The method for obtaining the vulnerability confidence of each node is: ; wherein, is the vulnerability confidence of the mth node, is the mean of the elements in the weight vector of the ith node, is the vulnerability triggerability of the ith node, is a constant to avoid a zero denominator, is a range normalization function.

2. The vulnerability database based code vulnerability reachability analysis method of claim 1, wherein, All keywords of each node code in the CPG code property graph and all keywords of each vulnerability code segment are taken as inputs of a Word2Vec word vector model to obtain the node feature vectors of each node in the CPG code property graph and the vulnerability feature vectors of each vulnerability code segment.

3. The vulnerability database based code vulnerability reachability analysis method of claim 1, wherein, An adjacency list of the CPG code property graph is constructed by all nodes in the CPG code property graph, and for each node, all nodes connected to the node in the adjacency list form an adjacency node set of the node.

4. The vulnerability database based code vulnerability reachability analysis method of claim 1, wherein, The cumulative sum of the similarity degrees between the node feature vectors of each adjacency node in the adjacency node set of each node and the vulnerability feature vectors of all vulnerability code segments is calculated as a first sum value of each adjacency node in the adjacency node set of each node.

5. The vulnerability database based code vulnerability reachability analysis method of claim 1, wherein, An edge weight is assigned to each edge in the CPG code property graph to construct a weighted directed graph of the CPG code property graph, and the edge weights of all edges connected to each node in the CPG code property graph form a weight vector of the node.

6. The vulnerability database based code vulnerability reachability analysis method of claim 5, wherein, In the weighted directed graph of the CPG code property graph, the edge weight of each edge is equal to the absolute difference of the vulnerability triggerability between the two nodes connected by the edge.

7. The vulnerability database based code vulnerability reachability analysis method of claim 1, wherein, The identification of the vulnerability nodes in the CPG code property graph further comprises the following steps: The vulnerability confidence of each node in the CPG code property graph is threshold segmented, and the node corresponding to the vulnerability confidence greater than or equal to a segmentation threshold is taken as a vulnerability node in the CPG code property graph.

Images