A method for detecting false positives of vulnerabilities and an electronic device

Abstract

The application discloses a false positive detection method and electronic equipment, and relates to the technical field of computers, wherein feature statistical information based on a sample data set is obtained from multiple data providers, a feature subset with distinguishing ability is determined, joint model training is performed based on a standard data set corresponding to the feature subset, and a false positive identification model is generated. The model can automatically learn the difference features of false positive and non-false positive code segments between different projects, and realize false positive identification and filtering across projects and versions. The technical problem of rule invalidation caused by dependence on context information such as specific code path or line number, code structure adjustment or version update is solved, the technical effects of false positive filtering automation, reduction of manual intervention and maintenance cost, improvement of code security analysis accuracy and overall efficiency are achieved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method and electronic device for detecting false positives of vulnerabilities. Background Technology

[0002] Currently, the industry commonly uses security scanning tools based on predefined rules to detect code vulnerabilities. While this method can uncover a large number of potential vulnerabilities, it also generates a significant number of false positives. These false positives require manual verification by developers or security experts, which not only consumes a lot of time and human resources but also seriously affects the efficiency and accuracy of code security analysis.

[0003] In related technologies, false alarm filtering files (such as whitelists) are usually maintained manually to handle false alarms. However, this method has obvious limitations: the filtering rules are heavily dependent on the context of a specific project (such as file paths, line numbers, etc.) and cannot adapt to new projects or code changes; when the code is refactored or the version is updated, the original filtering rules may become invalid due to position shift; as the project scales up, the maintenance cost of the filtering files increases sharply, and it cannot fundamentally solve the problem of low security audit efficiency. Summary of the Invention

[0004] This application provides a method and electronic device for detecting false positives of vulnerabilities, which at least solves the technical problems in related technologies where rules fail due to reliance on contextual information such as specific code paths or line numbers, code structure adjustments, or version updates. It achieves the technical effects of automating false positive filtering, reducing manual intervention and maintenance costs, and improving the accuracy and overall efficiency of code security analysis.

[0005] This application provides a method for detecting false positives of vulnerabilities, applied to a processor, comprising: receiving feature statistics information sent by multiple data providers, the feature statistics information being calculated based on multiple features in a sample dataset, the sample dataset including multiple falsely reported code snippets and multiple non-falsely reported code snippets; determining a feature subset from the features corresponding to the sample dataset based on the feature statistics information; receiving a standard dataset corresponding to the feature subset sent by multiple data providers; performing joint model training based on the standard dataset to obtain a false positive identification model, and sending the false positive identification model to each of the data providers for deployment on a detection terminal to identify false positives in code scanning results.

[0006] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for implementing the steps of the above-described method for detecting false positives of vulnerabilities when executing the computer program.

[0007] This application also provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the steps of any of the above-described methods for detecting false vulnerability reports.

[0008] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described methods for detecting false positives of vulnerabilities.

[0009] This application utilizes feature statistics from multiple data providers based on sample datasets to identify a subset of features with discriminative capabilities. A joint model is then trained using the corresponding standard datasets to generate a vulnerability false positive detection model. This model can automatically learn the differences between false positive and non-false positive code snippets across different projects, enabling cross-project and cross-version false positive identification and filtering. It solves the technical problems of rule failure caused by reliance on specific code paths or line numbers, code structure adjustments, or version updates, achieving automated false positive filtering, reduced manual intervention and maintenance costs, and improved accuracy and overall efficiency of code security analysis. Attached Figure Description

[0010] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 A flowchart illustrating a method for detecting false positives in vulnerabilities, provided as an embodiment of this application;

[0012] Figure 2 A system block diagram of a vulnerability false alarm detection method provided in this application embodiment;

[0013] Figure 3 A flowchart illustrating a feature subset selection method provided in this application embodiment;

[0014] Figure 4 A data transmission flow diagram for model training provided in this application embodiment;

[0015] Figure 5 A flowchart of another method for detecting false positives of vulnerabilities provided in an embodiment of this application. Detailed Implementation

[0016] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0017] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0018] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0019] The specific application environment architecture or specific hardware architecture on which the detection method for false vulnerability reports depends is described here.

[0020] The vulnerability false positive detection method of this application can be deployed in a distributed security detection system architecture, which typically includes three core hardware or computing units: a central training server, multiple data provider nodes, and detection terminals. The server can consist of a server cluster with high-performance computing capabilities, configured with multi-core CPUs (Central Processing Units) and GPUs (Graphics Processing Units) for performing large-scale sample feature analysis and joint model training. The server has an internal storage module for storing feature statistics, standard datasets, and the trained vulnerability false positive identification model, and communicates with each data provider through a secure network channel.

[0021] Data providers can be code scanning servers within different enterprises or project teams. These nodes are configured with local computing and storage resources to extract sample datasets (including false positive and true positive code snippets) and calculate feature statistics. Each node uploads the feature statistics and standard dataset to the central training server through a secure encrypted channel, enabling collaborative modeling of multi-source data without sharing specific source code content, thus balancing data privacy and security.

[0022] The detection terminal can be a development server, continuous integration system, or local development machine running code security scanning tools. The detection terminal is equipped with the vulnerability false positive identification model trained according to this application. After the code scanning tool outputs preliminary detection results, the detection terminal can call the model to identify and filter false positives, achieving real-time optimization and accuracy improvement of the scan results.

[0023] Through the above architecture design, the vulnerability false alarm detection method of this application can realize the joint training and rapid deployment of the model in a distributed, multi-source data environment, give full play to hardware computing resources and system synergy, and thus support the efficient and automated identification and filtering of security scan false alarms in multi-project, multi-platform environments.

[0024] like Figure 1 In a first aspect, embodiments of this application provide a method for detecting false positives of vulnerabilities, applied to a processor in a server, comprising: S11: receiving feature statistics information sent by multiple data providers, the feature statistics information being calculated based on multiple features in a sample dataset, the sample dataset including multiple false positive code snippets and multiple non-false positive code snippets.

[0025] like Figure 2 In this embodiment, feature statistics sent by multiple data providers are acquired and parsed. This process relies on the local sample dataset generation mechanism of each data provider. When performing security scans, each data provider records potential vulnerability information identified by the scanning tool in different code segments. Based on manual or system annotation, these code segments are distinguished into false positive and non-false positive code segments. To ensure data representativeness and balance, each data provider selects scan results from different language types, projects, and product versions during sample construction, ensuring that the number of false positive and non-false positive samples is roughly equal, making the subsequent extraction of feature statistics universal and adaptable.

[0026] After generating the sample dataset, each data provider performs structured modeling of the code based on an Abstract Syntax Tree (AST). By parsing the code, the control structure, function calls, and semantic hierarchy of the source code can be mapped into syntactic nodes and edges, thereby extracting multi-dimensional structural features. Specifically, the feature extraction process includes calculating the number of lines of code, cyclomatic complexity, node type distribution, number of loops, nesting depth, and the number of function or method calls, etc. These features reflect the logical complexity and structural characteristics of the code. Furthermore, the programming language type and the type of security scanning tool used are included as supplementary features to reflect the impact of different language syntax features and differences in scanning engines on false positive characteristics.

[0027] After feature extraction, each data provider performs preprocessing operations on the obtained features. Preprocessing includes deduplication of duplicate samples in the feature set to avoid statistical bias; and normalization of numerical features to ensure that feature values ​​of different dimensions are within a uniform scale range, facilitating subsequent feature analysis and model training. Some features are also discretized or encoded based on their distribution characteristics to transform discrete semantic information into a numerical form acceptable to the model. Through these processes, the data providers ultimately generate a structured and unified sample dataset, and calculate feature statistics based on this dataset.

[0028] In summary, this step, through the collaborative generation of feature statistics from multiple data providers, can reflect the structural differences and feature distributions of false positive and non-false positive samples in different project and language environments. This embodiment, through standardized feature construction and preprocessing mechanisms, ensures the comparability and consistency of the transmitted feature statistics, providing a reliable data foundation for determining feature subsets from sample features in subsequent steps.

[0029] S12: Determine a subset of features from the features corresponding to the sample dataset based on feature statistics.

[0030] In this embodiment, the processor determines a feature subset from multiple features corresponding to the sample dataset based on the aforementioned feature statistics. Since the feature statistics generated by different data providers contain a large number of dimensional code features, including structural features (such as loop depth, nesting depth, and call count) and semantic features (such as node type distribution, language type, and scanning tool type), some features are correlated or redundant. In this step, this embodiment analyzes and filters the feature statistics to identify feature dimensions that significantly distinguish between false positives and false negatives, thereby forming a feature subset to reduce the interference of redundant features on model training.

[0031] Specifically, this embodiment can calculate indicators such as information gain, variance, or mutual information based on the statistical distribution of each feature in the sample dataset to measure the correlation between the feature and the sample label (false positive or non-false positive). Features with low correlation or large differences between different data providers will be judged as low-contribution features and removed; while features with stable statistical characteristics and that can effectively reflect differences in false positive behavior will be retained in the feature subset. In addition, in the process of determining the feature subset, the statistical consistency of features from different data providers can also be considered. That is, when the distribution trend of the same feature is similar in multiple data sources, it indicates that the feature has universality across datasets and can be preferentially included in the feature subset.

[0032] Through the above screening and determination process, this embodiment achieves the transformation from a high-dimensional feature space to a concise feature subset. The screened feature subset can more accurately describe the structural and semantic differences between false positives and non-false positives, enabling subsequent modeling and training of the standard dataset to be based on a representative and stable feature foundation.

[0033] S13: Receive standard datasets corresponding to feature subsets sent by multiple data providers.

[0034] In this embodiment, standard datasets corresponding to feature subsets are received from multiple data providers. After filtering in step S12, the feature subsets have been determined to have feature dimensions with strong discriminative power between false positive and non-false positive samples. Based on this, each data provider selects and reconstructs the data set corresponding to these features from its local sample dataset to form the standard dataset. In this embodiment, the standard dataset can be understood as a sample set after unified feature constraints. This set is based on the feature subsets as dimensions to ensure that the data provided by different data providers maintains structural consistency, thereby facilitating subsequent joint training of the model.

[0035] Specifically, when constructing a standard dataset, each data provider extracts corresponding feature values ​​and annotation information from its local sample dataset based on the feature dimensions contained in the feature subset. During the extraction process, all parties use the same data format definition and encoding method, ensuring that standard datasets from different sources can be uniformly matched in data structure. For numerical features, each data provider maps data according to a unified normalization interval; for categorical or discrete features, all parties use a consistent label encoding method to ensure semantic consistency of the data. This embodiment may also include a consistency verification mechanism in this process, verifying whether the standard datasets generated by each data provider conform to the predetermined feature format and numerical range requirements by comparing sample distributions and statistics.

[0036] Through the above operations, this embodiment achieves a standardized data carrying process for feature subsets. Standard datasets generated by multiple data providers maintain uniformity in feature dimensions, format, and statistical properties, enabling subsequent joint model training to be conducted on a consistent data foundation.

[0037] S14: Train a joint model based on the standard dataset to obtain a vulnerability false alarm identification model, and send the vulnerability false alarm identification model to each data provider so that it can be deployed on the detection terminal to identify false alarms in the code scanning results.

[0038] In this embodiment, a joint model is trained based on a standard dataset to obtain a vulnerability false positive identification model. The standard datasets generated by the aforementioned data providers in the preceding steps all contain sample data with a uniform format and the same feature dimensions. This embodiment uses standard data from different data providers for joint modeling and training. Joint training can be achieved by aggregating parameters on a central training node or by sharing parameters through a distributed training framework. During training, this embodiment performs feature pattern recognition on false positive and non-false positive samples in the standard dataset, enabling the model to learn the differences between false positives and non-false positives in the feature space of multi-source data.

[0039] During the model training phase, this embodiment can employ a multilayer perceptron, tree model, or other statistical learning algorithms (such as logistic regression training) to assign feature weights and model classification decisions on the input feature vectors. During training, the model parameters are updated through repeated forward computation and error backpropagation, gradually converging to a stable state under sample distributions from multiple data providers. Since each standard dataset contains sample features from different languages, projects, and scanning environments, this embodiment uses joint training to enable the model to simultaneously adapt to multiple data distribution characteristics, thereby forming a holistic representation of vulnerability false alarm characteristics.

[0040] After training, this embodiment generates the final false positive detection model at the central training node and sends it to each data provider node for false positive identification of code scanning results on local detection terminals. Through this process, this embodiment decouples the training and application phases, allowing the model parameters to be updated uniformly in the joint training environment and then run independently on different terminals. The model's application on each detection terminal can judge the scanning results based on the same feature recognition logic, thereby maintaining the consistency and stability of the analysis results.

[0041] In one exemplary embodiment, determining a feature subset from the features corresponding to the sample dataset based on feature statistics includes: removing irrelevant and / or redundant features from the sample dataset based on feature statistics; and determining the feature subset based on the remaining features after removal.

[0042] In this embodiment, the process of determining a feature subset from the features corresponding to the sample dataset based on feature statistics includes two main stages: eliminating irrelevant and / or redundant features, and determining the final feature subset from the remaining features. First, based on the aforementioned feature statistics, this embodiment calculates the correlation between each feature in the sample dataset and the false positive and non-false positive categories to reflect the contribution of the features to the false positive determination. When certain features exhibit low correlation or high volatility across multiple data provider samples, these features are considered to have no significant correlation with the identification target and are eliminated at this stage. Simultaneously, this embodiment also identifies highly linear or non-linear dependencies between features through feature correlation analysis. For feature pairs exhibiting obvious redundant relationships, only one representative feature is retained to reduce feature dimensionality.

[0043] After removing invalid or redundant features, this embodiment further determines a feature subset based on the remaining feature set. This process can select feature dimensions that are statistically stable and have high discriminative power in a multi-data source environment, based on feature importance ranking or stability analysis results. To ensure that the selected features have consistent performance across different data providers, this embodiment can also use cross-validation or feature resampling to validate the candidate feature set, thereby filtering out features that perform abnormally or are unstable in some datasets. Through the above process, this embodiment finally obtains a feature subset that can centrally reflect the structural and semantic differences between false positives and non-false positives, providing a unified and reliable feature foundation for the construction of standard datasets and model training in subsequent steps.

[0044] In one exemplary embodiment, removing irrelevant features from a sample dataset based on feature statistics includes: calculating the degree of association between each feature and a category; the category includes false positive categories and non-false positive categories; comparing the degree of association with a preset threshold, and determining features with a degree of association less than or equal to the preset threshold as irrelevant features and removing them from the sample dataset.

[0045] In this embodiment, the process of removing irrelevant features from the sample dataset based on feature statistics includes calculating the correlation between each feature and the category, and performing a screening operation based on a preset threshold. First, after obtaining the sample dataset, this embodiment calculates the correlation between each feature and the sample category (i.e., false positive and non-false positive categories). The correlation can be measured using various statistical methods, such as information gain, mutual information, Pearson correlation coefficient, chi-square test, or point bilinear correlation coefficient, to reflect the discriminative ability of the feature in distinguishing different categories. This calculation process is based on the feature distribution and category labeling in the sample dataset, ensuring that each feature corresponds to a quantifiable correlation value, thereby establishing a mapping relationship between features and categories.

[0046] After the calculation is completed, this embodiment compares the correlation degree of each feature with a preset threshold. This preset threshold can be dynamically set based on the empirical statistical results or feature importance distribution during the training phase, and is used to determine whether a feature has sufficient class discrimination ability. When the correlation degree of a certain feature is less than or equal to the preset threshold, it indicates that the feature has weak difference in the distribution of false positive and non-false positive samples and cannot provide effective discrimination information. Therefore, it is judged as an irrelevant feature and removed from the sample dataset.

[0047] Through this process, this embodiment realizes an automatic screening mechanism based on data statistical regularities, so that the subsequent determination of feature subsets depends only on the feature set that makes a significant contribution to class distinction, thereby maintaining the simplicity of the sample dataset structure and the effectiveness of the discriminative features.

[0048] In one exemplary embodiment, removing redundant features from a sample dataset based on feature statistics includes: sorting the candidate feature set corresponding to features with a correlation greater than a preset threshold in ascending or descending order according to the correlation degree; for any current feature in the candidate feature set, traversing each subsequent feature after the current feature; for each subsequent feature, calculating a first correlation between the current feature and the subsequent feature, a second correlation between the subsequent feature and the category, and calculating a third correlation between the set including the current feature and the category, and a fourth correlation between the set including the current feature and the subsequent feature and the category; determining whether the subsequent feature is a redundant feature of the current feature based on the first correlation, second correlation, third correlation, and fourth correlation; and removing all redundant features from the candidate feature set to obtain a feature subset.

[0049] In this embodiment, the process of removing redundant features from the sample dataset based on feature statistics involves further analyzing the remaining candidate feature set with high class correlation after irrelevant features have been removed, in order to eliminate redundant expressions and high correlations among features. First, this embodiment sorts the candidate feature set with a correlation degree greater than a preset threshold in ascending or descending order according to the degree of correlation. This sorting process determines the processing order among features, ensuring that features with high correlation are preferentially retained in subsequent screening.

[0050] Subsequently, for any current feature in the sorted candidate feature set, this embodiment iterates through each subsequent feature and calculates four types of correlation indices in turn. The first correlation indicates the degree of linear or non-linear correlation between the current feature and subsequent features, reflecting their similarity in the feature space. The second correlation indicates the degree of association between the subsequent feature and the category, used to determine the independent contribution of the subsequent feature in distinguishing categories. The third correlation indicates the correlation between the feature set containing the current feature and the category. The fourth correlation indicates the correlation between the joint feature set containing the current feature and subsequent features and the category. By comparing the third and fourth correlations, it can be observed whether the overall correlation between the feature set and the category changes significantly after adding subsequent features. After obtaining the above four types of correlation indices, this embodiment determines whether the subsequent feature is a redundant feature of the current feature based on their relative changes.

[0051] In one exemplary embodiment, determining whether a subsequent feature is a redundant feature of the current feature based on a first correlation, a second correlation, a third correlation, and a fourth correlation includes: if the first correlation is greater than the second correlation and the third correlation is greater than the fourth correlation, determining that the subsequent feature is a redundant feature of the current feature.

[0052] When the first correlation is greater than the second correlation, it indicates that the information expressed by the subsequent features is highly overlapping with that of the current features, while the independent contribution of the subsequent features to the category determination is low. At the same time, when the third correlation is greater than the fourth correlation, it indicates that after adding the subsequent features, the overall correlation between the feature set and the category has not increased significantly, indicating that the subsequent features do not provide new category discrimination information.

[0053] Based on the above conditions, this embodiment classifies subsequent features that satisfy the condition that the first relevance is greater than the second relevance and the third relevance is greater than the fourth relevance as redundant features of the current feature and removes them from the candidate feature set. Through this judgment mechanism, this embodiment can effectively eliminate features that repeat category judgment information, ensuring that the final feature subset retains key discriminative information while reducing dimensionality, thus avoiding feature overfitting and information duplication during model training. By sequentially traversing and judging, the final feature subset contains only features that are statistically independent and have effective class discrimination capabilities.

[0054] Specifically, assuming that by filtering features with a correlation greater than a threshold, a set of s features can be obtained. For sorted sets Each current feature in Let set Perform the following operation: Select from the sorted morning set For each subsequent feature, calculate the current feature. With subsequent features First correlation and set Third correlation with category ,gather Fourth correlation with category .

[0055] like ( (for the second correlation) and This indicates that the current feature With subsequent features The correlation is stronger, but it cannot improve the correlation between the entire subset and the class. Therefore, subsequent features These are redundant features and should be removed from set S. ;otherwise After the above process is completed, the final valid feature subset S is obtained.

[0056] like Figure 3 The data processing flow between each data provider and the processor is as follows: the data provider calculates feature statistics and sends them to the processor; the processor performs feature selection on the data and returns the feature numbers to the data provider; the data provider selects features based on the returned feature numbers to obtain the standard dataset.

[0057] In one exemplary embodiment, calculating the first correlation between the current feature and subsequent features, the second correlation between subsequent features and the category, and the third correlation between the set including the current feature and the category, and the fourth correlation between the set including the current feature and the category, includes: calculating the first correlation between the current feature and subsequent features and the second correlation between subsequent features and the category using the Pearson coefficient; and calculating the third correlation between the set including the current feature and the category, and the fourth correlation between the set including the current feature and the category using the set-class correlation parameter.

[0058] In this embodiment, the first and second correlations are calculated using the Pearson correlation coefficient. Specifically, the first correlation between the current feature and subsequent features is obtained by calculating their Pearson coefficient on the sample dataset, which quantifies the degree of linear dependence between the two features. The second correlation between subsequent features and the category is also calculated using the Pearson coefficient, which reflects the linear correlation between the subsequent features and the category, thereby measuring the independent contribution of the subsequent features in the category determination.

[0059] The Pearson correlation coefficient is calculated as follows: for variables X and Y, the symmetric uncertainty between them is: ;in The covariance of variables X and Y; and Let X and Y be the standard deviations of variables X and Y, respectively. Symmetric uncertainty. The value range is [-1, -1]. The larger the value, the stronger the positive correlation between X and Y. The variable can be the current feature, the subsequent feature, or the category.

[0060] Meanwhile, this embodiment calculates the third and fourth correlations using set and class correlation parameters. The third correlation refers to the overall correlation between the feature set including the current feature and the category. Its calculation takes the set feature vector and the category label as input and outputs the correlation index between the set features and the category. The fourth correlation refers to the correlation between the feature set including the current feature and subsequent features and the category. By comparing the third and fourth correlations, the degree of impact of adding subsequent features on the correlation between the overall set and the category can be determined, thus providing a basis for redundancy feature determination.

[0061] Among them, Subset Correlation (SC) measures the correlation between a subset of features and a class, that is: Where SC represents the correlation between the set and the class, and N represents the number of features. This represents the average correlation between all features and categories. SC represents the average correlation between features, where i and j are integers between 0 and N. The value of SC ranges from [0, 1], and the larger the value, the stronger the correlation between the feature set and the class.

[0062] Through the above calculations, this embodiment achieves a quantitative assessment of the relationships between features and between features and categories during the feature subset selection process. By combining the first, second, third, and fourth correlations, this embodiment can systematically identify redundant features and remove them from the candidate feature set, ultimately obtaining a simplified feature subset that reflects the difference between false positives and non-false positives.

[0063] In one exemplary embodiment, the feature statistics include the mean of each feature, the mean of the category, the dot product of each feature and the category, the dot product between features, and the number of samples in the sample dataset; the categories include false positive categories and non-false positive categories.

[0064] This embodiment uses Pearson coefficients and set-class correlation parameters to filter feature subsets. These calculations can be performed directly using the aforementioned statistical information without accessing or transmitting the original feature data.

[0065] Specifically, the Pearson coefficient is calculated based on the feature mean, the class mean, and the dot product between the feature and the class, while the set and class correlation parameters are calculated based on the dot product between features and the number of samples. These statistical information allow for the calculation of the first, second, third, and fourth correlations, thereby identifying redundant or irrelevant features and selecting feature subsets.

[0066] Therefore, when data providers supply information to the processor, they only need to provide these feature statistics. Since only the aforementioned intermediate statistics are transmitted during the calculation process, without involving the original feature data, this embodiment can avoid the risk of leakage of original code data in a collaborative environment with multiple data providers. As an intermediate calculation result, the feature statistics only reflect the statistical relationship between features and categories, without containing specific code content, enabling all parties to complete joint feature selection and model training preparation while maintaining data privacy.

[0067] Specifically, the execution of this process depends on the computational structure of the evaluation function, and the detailed reasoning process is as follows: ,in: ;in, ; .

[0068] in, Let i be the i-th value in variable X. Let be the i-th value in variable Y, n be the total number of samples in variable X or Y, and i be an integer from 1 to n. The mean of variable X, The mean of variable Y, The dot product of X and Y The dot product of X and X, The dot product of Y and Y.

[0069] Suppose there are m data providers, and each data provider provides the corresponding data. The value is sent to the server, where the Pearson correlation can be calculated using the following methods. .

[0070] in, ; ; .

[0071] This demonstrates that the process can perform feature selection without encrypting the data, thus preventing data leakage.

[0072] In one exemplary embodiment, after determining the feature subset based on the remaining features after elimination, the method further includes: feeding back the number corresponding to each feature in the feature subset to multiple data providers, so that the multiple data providers can send the standard dataset corresponding to the feature subset based on the number.

[0073] In this embodiment, after filtering the remaining features after removing irrelevant and redundant features, a feature subset is determined. The feature subset consists of the filtered key features, each with a unique identifier in the candidate feature set. This embodiment feeds back the identifiers corresponding to each feature in the feature subset to multiple data providers, enabling each data provider to clearly identify which features are included in the standard dataset corresponding to the feature subset.

[0074] After receiving the feature IDs, each data provider extracts the corresponding feature values ​​and category labels from its local sample dataset based on the IDs, constructing a standard dataset corresponding to the feature subset. Through this ID mapping mechanism, this embodiment ensures that the standard datasets from different data providers maintain consistency in feature dimensions and order, thereby providing a unified data foundation for subsequent joint model training, while avoiding the exposure of specific feature content during data transmission.

[0075] In one exemplary embodiment, receiving a standard dataset corresponding to a feature subset sent by multiple data providers includes: receiving an asymmetric encrypted dataset corresponding to the feature subset sent by multiple data providers; the generation process of the asymmetric encrypted dataset is as follows: each data provider encrypts the standard dataset corresponding to the feature subset based on the public key in the key pair to obtain the asymmetric encrypted dataset; the key pair is pre-sent to each data provider by a third-party trusted platform; joint model training is performed based on the standard dataset to obtain a vulnerability false positive identification model, and the vulnerability false positive identification model is sent to each data provider, including: joint model training is performed based on the asymmetric encrypted dataset to obtain a ciphertext vulnerability false positive identification model, and the ciphertext vulnerability false positive identification model is sent to each data provider.

[0076] In this embodiment, the process of receiving standard datasets corresponding to feature subsets sent by multiple data providers includes receiving encrypted data and jointly training a model. Specifically, each data provider encrypts its locally generated standard dataset corresponding to the feature subset based on the public key in a key pair pre-sent by a trusted third-party platform, resulting in an asymmetric encrypted dataset. The received asymmetric encrypted dataset remains ciphertext during transmission, ensuring that the original data is not leaked during cross-party transmission. It should be understood that since the standard datasets sent by multiple data providers use the same public key for encryption, the server can directly concatenate these data sets.

[0077] After receiving asymmetric encrypted datasets from various data providers, this embodiment trains a joint model based on these encrypted data. The joint training process models the relationship between features and categories in the encrypted state, generating a encrypted vulnerability false alarm identification model through encrypted computation methods. After training, this embodiment sends the obtained encrypted vulnerability false alarm identification model to each data provider, enabling each party to perform vulnerability false alarm identification locally based on the encrypted model without directly accessing the other parties' original standard datasets.

[0078] Through this mechanism, this embodiment achieves joint model training and distribution in a multi-data provider environment, while ensuring the privacy and security of the original standard data from all parties. The encrypted training and model distribution process ensures that feature data is not leaked throughout the entire training and application process, achieving secure data collaboration and model construction.

[0079] In one exemplary embodiment, receiving a standard dataset corresponding to a feature subset sent by multiple data providers includes: receiving a symmetric encrypted dataset corresponding to the feature subset sent by multiple data providers; the generation process of the symmetric encrypted dataset is as follows: each data provider encrypts an asymmetric encrypted dataset based on its own symmetric key to obtain a symmetric encrypted dataset; the symmetric key is determined through negotiation between each data provider and the processor; joint model training is performed based on the asymmetric encrypted dataset to obtain a ciphertext vulnerability false positive identification model, and the ciphertext vulnerability false positive identification model is sent to each data provider's ciphertext vulnerability false positive identification model, including: decrypting the symmetric encrypted dataset based on the key negotiated between each data provider and the processor to obtain an asymmetric encrypted dataset; joint model training is performed based on the asymmetric encrypted dataset to obtain a ciphertext vulnerability false positive identification model; ciphertext vulnerability false positive identification model is encrypted using the key negotiated with each data provider to obtain a secondary encrypted ciphertext vulnerability false positive identification model, and the secondary encrypted ciphertext vulnerability false positive identification model is sent to each data provider.

[0080] In this embodiment, the process of receiving standard datasets corresponding to feature subsets sent by multiple data providers includes performing double-layer encryption on the data. First, each data provider encrypts the original asymmetric encrypted dataset using its own symmetric key to generate a symmetric encrypted dataset. The symmetric key is determined through negotiation between each data provider and the processor, thereby ensuring that the data providers cannot view each other's data content during data transmission and storage, thus ensuring the security and privacy of the multi-party data.

[0081] Upon receiving the symmetric encrypted dataset, this embodiment uses the key negotiated by the data providers to decrypt the data and recover the original asymmetric encrypted dataset. Subsequently, this embodiment performs joint model training based on the asymmetric encrypted dataset. The training process completes the learning of model parameters without exposing the original feature data, thereby generating a ciphertext vulnerability false positive identification model. After training, the model remains in ciphertext state to avoid directly exposing sensitive information, while maintaining the consistency of the feature structure of the multi-source data from the joint training.

[0082] After model training is complete, this embodiment uses a key negotiated by the data providers to re-encrypt the generated ciphertext vulnerability false alarm identification model, forming a double-encrypted ciphertext vulnerability false alarm identification model. The processor sends this double-encrypted model back to each data provider, allowing each party to decrypt it locally using their own key and use the model for vulnerability false alarm identification without accessing the original or training data of other data providers. Through this process, this embodiment achieves multi-party secure data collaborative modeling, joint training, and model distribution, while ensuring the privacy and security of data and models throughout the entire process.

[0083] In one exemplary embodiment, after sending the double-encrypted ciphertext vulnerability false alarm identification model to each data provider, the method further includes: triggering each data provider to decrypt the double-encrypted ciphertext vulnerability false alarm identification model based on the key negotiated with each data provider to obtain the ciphertext vulnerability false alarm identification model, and then decrypting the ciphertext vulnerability false alarm identification model based on the private key in the key pair to obtain the plaintext vulnerability false alarm identification model.

[0084] In this embodiment, after the processor sends the double-encrypted ciphertext vulnerability false positive identification model to each data provider, each data provider is triggered to first decrypt the double-encrypted ciphertext vulnerability false positive identification model using the symmetric key negotiated with the processor, recovering the single-layer encrypted ciphertext vulnerability false positive identification model generated by the processor. In this step, each data provider locally retrieves the symmetric key it has negotiated with the processor in advance and securely stored, and performs decryption operations on the received data according to the agreed symmetric decryption algorithm to obtain ciphertext model data protected only by asymmetric encryption. This decryption process is executed in the controlled environment of each data provider. After decryption, the metadata of the ciphertext model (such as model version number, model identifier, encryption parameters) can be verified to confirm that the decryption result is consistent with expectations and has not been tampered with.

[0085] After completing symmetric decryption and verifying the integrity of the ciphertext model, this embodiment requires each data provider to further decrypt the ciphertext vulnerability false alarm identification model using their private key based on their held asymmetric key, obtaining the plaintext vulnerability false alarm identification model. Specifically, each data provider uses the private key paired with the previously used public key to perform an asymmetric decryption operation, thereby removing the asymmetric protection applied during the generation by the third-party trusted platform or the initial encryption by the processor, and obtaining the plaintext parameters and structural information of the model. After decryption, each data provider can verify the model's digital signature or digest value locally to confirm the model's origin and integrity; provided the verification passes, this embodiment allows the plaintext model to be loaded into the local detection terminal to perform the false alarm identification task.

[0086] In this embodiment, the entire dual decryption process follows the principles of sequential triggering and multiple verifications: first, the secondary encryption layer is decrypted using the negotiated symmetric key, and then the remaining ciphertext layer is decrypted using the asymmetric private key. Integrity and version verification are performed at each decryption node to ensure the consistency and immutability of the model during transmission and decryption. Through this process, this embodiment ensures that the joint training results can be distributed and used locally while maintaining controlled authorization for the data provider's access to the model and end-to-end security.

[0087] like Figure 4 ① is the key pair sent by the trusted third-party platform to the data provider; ② is the feature statistics information provided by the data provider to the processor, and the corresponding number of the feature subset that the processor has already selected based on the feature statistics information to the data provider; ③ is the symmetric encrypted dataset corresponding to the standard dataset of the feature subset determined by the number provided by the data provider to the processor; ④ is the pre-trained ciphertext vulnerability false alarm identification model provided by the processor to the data provider based on the symmetric encrypted dataset.

[0088] like Figure 5 Secondly, this application provides a method for detecting false positives of vulnerabilities, applied to a detection terminal, including: S21: obtaining vulnerability information generated after scanning the target code by a security scanning tool.

[0089] The detection terminal invokes deployed scanning tools to perform static or dynamic analysis on the target code, identifying potential vulnerability locations and their related attributes, and generating vulnerability information data structures, including vulnerability type, code location, scope of impact, and call context. After this step, the vulnerability information becomes the raw input for subsequent feature extraction and false positive identification.

[0090] S22: Extract feature data from vulnerability information that corresponds to a predefined subset of features.

[0091] Based on the key feature numbers determined in the previous feature subset selection stage, corresponding code features, such as the number of lines of code, cyclomatic complexity, node type, number of loop layers, nesting depth, and number of calls, are extracted from the vulnerability information obtained from the scan, and a structured feature vector is formed to facilitate subsequent input into the model for calculation.

[0092] S23: Input the feature data into the vulnerability false alarm identification model to obtain the reasoning result of whether the vulnerability is a false alarm.

[0093] The detection terminal inputs the extracted feature data into the deployed vulnerability false alarm identification model. Based on the relationship between the features learned during training and the false alarm labels, the model performs inference calculations on the input features and outputs the probability or classification result of whether each vulnerability is a false alarm. At this stage, the model achieves automatic identification of scanned vulnerabilities without human intervention.

[0094] S24: If the reasoning result determines that the vulnerability is a false alarm, then the vulnerability determined to be a false alarm will be filtered out from the vulnerability report.

[0095] The detection terminal filters vulnerabilities identified as false positives based on the model's inference results. Specifically, when the model's output meets the false positive criteria, the vulnerability is marked or removed directly from the vulnerability report, thus generating the final vulnerability report after false positive identification and filtering. This step ensures the accuracy and usability of the vulnerability report, allowing subsequent security analysis and remediation work to be performed only on real vulnerabilities.

[0096] This embodiment enables real-time false alarm detection and automatic filtering of scan output, thereby reducing the workload of manual verification and maintaining the conciseness and usability of vulnerability reports.

[0097] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0098] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the above embodiments of the vulnerability false alarm detection method.

[0099] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above embodiments of the vulnerability false alarm detection method when running.

[0100] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0101] The embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described methods for detecting false vulnerability reports.

[0102] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described methods for detecting false vulnerability reports.

[0103] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0104] The foregoing has provided a detailed description of a method and electronic device for detecting false positives in vulnerabilities, as provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only intended to aid in understanding the method and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A method for detecting false positives of vulnerabilities, characterized in that, Applied to processors, including: Receive feature statistics information sent by multiple data providers. The feature statistics information is calculated based on multiple features in a sample dataset. The sample dataset includes multiple false alarm code snippets and multiple non-false alarm code snippets. Based on the feature statistics, a feature subset is determined from the features corresponding to the sample dataset; Receive standard datasets corresponding to the feature subsets sent by multiple data providers; A joint model is trained based on the standard dataset to obtain a vulnerability false alarm identification model, and the vulnerability false alarm identification model is sent to each of the data providers so that it can be deployed on the detection terminal to identify false alarms in the code scanning results. Receiving standard datasets corresponding to the feature subset sent by multiple data providers, including: Receive asymmetric encrypted datasets corresponding to the feature subset sent by multiple data providers; The asymmetric encrypted dataset is generated as follows: each data provider encrypts the standard dataset corresponding to the feature subset based on the public key in the key pair to obtain the asymmetric encrypted dataset; the key pair is sent in advance to each data provider by a trusted third-party platform. A joint model is trained based on the aforementioned standard dataset to obtain a vulnerability false alarm identification model, and the vulnerability false alarm identification model is sent to each of the aforementioned data providers, including: A joint model is trained based on the asymmetric encrypted dataset to obtain a ciphertext vulnerability false alarm identification model, and the ciphertext vulnerability false alarm identification model is sent to each of the data providers. Receiving standard datasets corresponding to the feature subset sent by multiple data providers, including: Receive symmetric encrypted datasets corresponding to the feature subset sent by multiple data providers; The process of generating the symmetric encrypted dataset is as follows: each data provider encrypts the asymmetric encrypted dataset based on its own symmetric key to obtain the symmetric encrypted dataset; the symmetric key is determined through negotiation between each data provider and the processor. A joint model is trained based on the aforementioned asymmetric encrypted dataset to obtain a ciphertext vulnerability false positive detection model, and this model is then sent to each of the aforementioned data providers, including: Based on the key negotiated between each data provider and the processor, the symmetric encrypted dataset is decrypted to obtain the asymmetric encrypted dataset. A joint model training was performed based on the aforementioned asymmetric encrypted dataset to obtain a ciphertext vulnerability false alarm identification model. The encrypted vulnerability false alarm identification model is encrypted using a key negotiated with each of the data providers to obtain a double-encrypted encrypted vulnerability false alarm identification model, and the double-encrypted encrypted vulnerability false alarm identification model is sent to each of the data providers.

2. The method for detecting false positives of vulnerabilities according to claim 1, characterized in that, Based on the aforementioned feature statistics, a subset of features is determined from the features corresponding to the sample dataset, including: Based on the feature statistics, irrelevant and / or redundant features are removed from the sample dataset; The feature subset is determined based on the remaining features after removal.

3. The method for detecting false positives of vulnerabilities according to claim 2, characterized in that, Removing irrelevant features from the sample dataset based on the aforementioned feature statistics includes: Calculate the degree of association between each feature and the category, where the category includes false positive categories and non-false positive categories; The correlation degree is compared with a preset threshold, and features whose correlation degree is less than or equal to the preset threshold are determined to be irrelevant features and removed from the sample dataset.

4. The method for detecting false positives of vulnerabilities according to claim 3, characterized in that, Based on the aforementioned feature statistics, redundant features are removed from the sample dataset, including: The candidate feature set corresponding to the correlation degree greater than the preset threshold is sorted in ascending or descending order according to the correlation degree. For any current feature in the candidate feature set, iterate through each subsequent feature after the current feature; For each of the subsequent features, a first correlation between the current feature and the subsequent feature, a second correlation between the subsequent feature and the category, a third correlation between the set including the current feature and the category, and a fourth correlation between the set including the current feature and the subsequent feature and the category are calculated. Based on the first correlation, the second correlation, the third correlation and the fourth correlation, it is determined whether the subsequent feature is a redundant feature of the current feature. The feature subset is obtained by removing all redundant features from the candidate feature set.

5. The method for detecting false positives of vulnerabilities according to claim 4, characterized in that, Determining whether the subsequent feature is a redundant feature of the current feature based on the first correlation, the second correlation, the third correlation, and the fourth correlation includes: If the first correlation is greater than the second correlation, and the third correlation is greater than the fourth correlation, the subsequent feature is determined to be a redundant feature of the current feature.

6. The method for detecting false positives of vulnerabilities according to claim 2, characterized in that, After determining the feature subset based on the remaining features after removal, the process further includes: The number corresponding to each feature in the feature subset is fed back to multiple data providers, so that the multiple data providers can send the standard dataset corresponding to the feature subset based on the number.

7. The method for detecting false positives of vulnerabilities according to any one of claims 1-6, characterized in that, After sending the false positive identification model for the ciphertext vulnerability of the secondary encryption to each of the data providers, the method further includes: Each of the aforementioned data providers is triggered to decrypt the ciphertext vulnerability false alarm identification model based on the key negotiated with each of the aforementioned data providers, thereby obtaining the ciphertext vulnerability false alarm identification model. Then, based on the private key in the key pair, the ciphertext vulnerability false alarm identification model is decrypted again to obtain the plaintext vulnerability false alarm identification model.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the method for detecting false positives of vulnerabilities as described in any one of claims 1 to 7 when executing the computer program.

Images