Power software vulnerability automatic repairing method and device based on semantic enhancement and storage medium

Abstract

The application discloses a kind of based on semantic enhancement's electric power software vulnerability automatic repair method, device and storage medium, the method includes: obtaining the historical source code of target software;According to the abstract syntax tree of preprocessed source code;Based on abstract syntax tree, data flow analysis is carried out to preprocessed source code to construct data propagation chain;The weight score of key symbol is calculated to each function level code segment in preprocessed source code and it is injected as semantic enhancement information into the attention mechanism of model;Additional multilayer perception machine classifier is introduced in the output end of the encoder of model;Preprocessed source code and data propagation chain are input into encoder, and the output of encoder is respectively input into multilayer perception machine classifier and decoder;The decoder generates repair patch according to the output of encoder and multilayer perception machine classifier.The application reduces the computing overhead while ensuring the repair effect, realizes the efficient, accurate and automatic repair of electric power software system vulnerability.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of intelligent software security and code defect repair, and particularly relates to a power software vulnerability automatic repair method and device based on semantic enhancement, a terminal equipment and a computer readable storage medium. BACKGROUND

[0002] With the rapid development of informatization and digitization, software systems play a crucial role in various fields such as industrial control, financial services, power dispatching and management, and Internet applications. However, the increasing complexity of software systems leads to an increase in the number of vulnerabilities, posing serious challenges to system security and reliability. In the power field, power digital systems are critical infrastructure platforms that support power production, transmission, and dispatching. Their security directly affects the stable supply of energy and the normal operation of society. If vulnerabilities in such systems are not repaired in a timely manner, it may cause widespread power outages or abnormal operation of the power grid, resulting in serious economic losses and social impact.

[0003] Traditional software vulnerability repair methods mainly rely on manual patch writing or template-based repair methods, which are often inefficient and prone to omissions or errors, leading to rising repair and maintenance costs. In recent years, with the advent of deep learning and pre-trained code models, researchers have attempted to transform the vulnerability repair problem into a "code generation" task, thereby achieving automated repair. Existing automated vulnerability repair methods mostly treat source code as ordinary text sequences, ignoring structured information such as variable dependency relationships and logical constraints in programs. This processing method can capture some semantic features with the help of deep learning models, but due to the lack of in-depth modeling of program internal syntax and data flow, the generated patches often lack semantic rationality and are difficult to ensure logical consistency in actual operation. At the same time, mainstream pre-trained models rely on global attention mechanisms to process input code, which can obtain overall context information but lacks key local semantic attention to the vulnerability occurrence area, resulting in generated repair results that may be correct in syntax but have errors in variable scope, data dependency, or control logic.

[0004] Therefore, there is an urgent need for a new software vulnerability repair method that can reduce computational resource consumption while improving the model's ability to depict program structure and local semantics, thereby achieving efficient, accurate, and scalable software vulnerability automatic repair. SUMMARY

[0005] Therefore, the application provides a power software vulnerability automatic repair method and device based on semantic enhancement, a terminal equipment and a computer readable storage medium.

[0006] The first object of the application is to provide a power software vulnerability automatic repair method based on semantic enhancement.

[0007] The second object of the application is to provide a power software vulnerability automatic repair device based on semantic enhancement.

[0008] The third object of the application is to provide a terminal equipment.

[0009] The fourth object of the application is to provide a computer readable storage medium.

[0010] The first object of the application can be achieved by adopting the following technical scheme:

[0011] A power software vulnerability automatic repair method based on semantic enhancement, the method comprises:

[0012] Obtaining the historical source code of the target software, and preprocessing the source code;

[0013] Generating an abstract syntax tree according to the preprocessed source code; based on the abstract syntax tree, performing data flow analysis on the preprocessed source code, and constructing a data propagation chain by extracting the definition, transmission and use relationship of variables;

[0014] Calculating the weight score of a key symbol for each function-level code segment in the preprocessed source code; injecting the weight score as semantic enhancement information into the attention mechanism of a model; the model is an encoder-decoder structure;

[0015] Introducing a multilayer perceptron classifier at the output end of the encoder of the model; taking the probability distribution of the vulnerability category output by the multilayer perceptron classifier as the input of the decoder;

[0016] Inputting the preprocessed source code and the data propagation chain into the encoder in the model, and inputting the feature representation generated by the encoder into the multilayer perceptron classifier and the decoder respectively; the decoder generates a repair patch according to the feature representation and the probability distribution of the vulnerability category; in the process of generating the repair patch by the decoder, a beam search strategy is adopted, and consistency check is performed on the searched repair patch.

[0017] Preferably, the data flow analysis on the preprocessed source code based on the abstract syntax tree, and the construction of the data propagation chain by extracting the definition, transmission and use relationship of variables, comprise:

[0018] Static dependency analysis is performed on the preprocessed source code to identify the definition, assignment, and usage relationships of variables within and across functions, and to establish variable dependency mappings.

[0019] The variable dependencies are constructed into directed dependency chains, forming a complete data propagation path;

[0020] Linearize the data propagation path by expanding the variable dependencies into an ordered path sequence according to the program execution order;

[0021] The variables, operators, and dependency edges in the preprocessed source code are transformed into continuous numerical vectors by symbol embedding.

[0022] The ordered path sequence is concatenated with the transformed continuous numerical vector; the concatenated sequence is the data propagation chain.

[0023] Preferably, the abstract syntax tree is generated using a parsing tool; the parsing tool is a code attribute graph parser or an abstract syntax tree generation tool.

[0024] Preferably, the calculation of the weight score of key symbols for each function-level code segment in the preprocessed source code includes:

[0025] The frequency of key symbols in the preprocessed source code within a single function or code snippet is statistically analyzed; key symbols include variable names, function call names, and operators.

[0026] The importance score of key symbols is calculated using the term frequency-inverse document frequency method based on the frequency of their occurrence.

[0027] The importance scores of key symbols are normalized; the normalized importance scores are the weight scores of key symbols.

[0028] Preferably, the multilayer perceptron classifier is a feedforward neural network, consisting of an input layer and an output layer; through linear transformation and nonlinear activation operations, the high-dimensional abstract features learned by the encoder are gradually mapped to a low-dimensional category space; then, by using the Softmax activation function, the output values ​​of the neurons are converted into probability distributions, corresponding to the probability distributions of predefined vulnerability categories.

[0029] Preferably, the consistency check includes syntactic and semantic consistency checks.

[0030] Preferably, the preprocessing of the source code includes:

[0031] First, perform a completeness check on the source code, including removing incomplete files that are missing, corrupted, or cannot be compiled correctly;

[0032] Then, remove redundant comments, blank lines, and invalid debugging information from the source code;

[0033] Finally, the source code is standardized, including character encoding format conversion, keyword normalization, and indentation format unification, to ensure the consistency of input data.

[0034] The second objective of this invention can be achieved by adopting the following technical solution:

[0035] An automatic repair device for power software vulnerabilities based on semantic enhancement, the device comprising:

[0036] The acquisition and preprocessing module is used to acquire the historical source code of the target software and preprocess the source code.

[0037] The first building module is used to generate an abstract syntax tree from the preprocessed source code; based on the abstract syntax tree, data flow analysis is performed on the preprocessed source code to construct a data propagation chain by extracting the definition, transmission and usage relationships of variables.

[0038] The computation module is used to calculate the weight score of key symbols for each function-level code segment in the preprocessed source code; the weight score is injected into the attention mechanism of the model as semantic enhancement information; the model is an encoder-decoder structure;

[0039] The second building block is used to introduce a multilayer perceptron classifier at the encoder output of the model; the probability distribution of the vulnerability categories output by the multilayer perceptron classifier is used as the input of the decoder.

[0040] The repair module is used to input the preprocessed source code and data propagation chain into the encoder in the model, and input the feature representation generated by the encoder into the multilayer perceptron classifier and decoder respectively; the decoder generates repair patches based on the feature representation and the probability distribution of vulnerability categories; during the process of the decoder generating repair patches, a beam search strategy is adopted, and the searched repair patches are verified for consistency.

[0041] The third objective of this invention can be achieved by adopting the following technical solution:

[0042] A terminal device includes a processor and a memory for storing a processor-executable program. When the processor executes the program stored in the memory, it implements the above-described automatic repair method for power software vulnerabilities based on semantic enhancement.

[0043] The fourth objective of this invention can be achieved by adopting the following technical solution:

[0044] A computer-readable storage medium storing a program that, when executed by a processor, implements the above-described method for automatically repairing power software vulnerabilities based on semantic enhancement.

[0045] The present invention has the following advantages over the prior art:

[0046] This invention models the relationships between variable definition, transmission, and usage in source code by introducing a data propagation chain, effectively characterizing the program's structured dependency information. Simultaneously, it incorporates statistically based weight scores of key symbols into the attention mechanism of a deep learning model, enhancing the model's ability to focus on vulnerability-related local semantics. During the patch generation stage, a bundle search strategy supplemented by consistency checks ensures the reliability of the final output patch in terms of correctness and logic. Compared to existing methods, this invention not only improves the accuracy and applicability of vulnerability repair but also reduces dependence on computational resources, demonstrating strong engineering practical value and promising prospects for widespread application. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the structures shown in these drawings without creative effort.

[0048] Figure 1 The flowchart of the automatic repair method for power software vulnerabilities based on semantic enhancement provided in Embodiment 1 of the present invention is shown below.

[0049] Figure 2 This is a schematic diagram of the vulnerability repair framework provided in Embodiment 1 of the present invention;

[0050] Figure 3 This is a structural block diagram of the automatic repair device for power software vulnerabilities based on semantic enhancement according to Embodiment 2 of the present invention;

[0051] Figure 4 This is a structural block diagram of the terminal device according to Embodiment 3 of the present invention. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. It should be understood that the specific embodiments described are merely used to explain this application and are not intended to limit this application.

[0053] Example 1:

[0054] like Figure 1 As shown in the figure, the automatic repair method for power software vulnerabilities based on semantic enhancement provided in this embodiment mainly includes the following steps:

[0055] S101. Obtain the historical source code files of the target software project.

[0056] The system parses the log files and version control records of the target power software system, automatically collects historical source code files during system operation, and records metadata information such as version information, submission time, and modifiers.

[0057] In one embodiment, in order to train the model subsequently, the method further includes: extracting defect error information from the system operation log, locating the corresponding source code file path, marking these files as vulnerability files, and providing accurate defect sample data for the subsequent training and verification of the model.

[0058] S102. Preprocess the source code file.

[0059] To ensure the source code data has a high degree of integrity and standardization before being fed into the model, preprocessing mainly includes:

[0060] (1) Perform integrity checks on the collected source code files. This includes checking for missing or corrupted parts, as well as verifying the integrity of function call chains, dependent libraries, and code logic. Files that do not meet the basic integrity requirements should be removed to ensure the reliability of subsequent modeling data.

[0061] (2) Remove comments, blank lines, and debugging information, and unify indentation and encoding format. During the cleanup process, redundant explanatory statements, blank lines, and debugging print or log output statements in the source code are deleted. At the same time, source code from different sources is uniformly converted to a consistent indentation style and encoding format to reduce noise factors in training samples while maintaining the code logic structure.

[0062] (3) Standardize the source code, including character encoding format conversion, keyword standardization and indentation style unification. This not only standardizes the code written by different programming language versions or different developers, but also performs consistency correction on case-sensitive identifiers to avoid parsing deviations caused by differences in syntax style and ensure data consistency.

[0063] In one embodiment, the method further includes annotating the preprocessed source code, specifically as follows:

[0064] After preprocessing, explicit start and end markers are inserted into the vulnerable source code areas, along with vulnerability category information. Specifically, special symbol labels are added around vulnerable statements or functions to indicate the start and end positions of the vulnerability, while the category identifier of the vulnerability is attached to the label. This allows the model to more accurately focus on the context area related to the vulnerability during training and inference.

[0065] S103. Generate an abstract syntax tree based on the preprocessed source code file; perform data flow analysis on the processed source code based on the abstract syntax tree to construct a data propagation chain.

[0066] An abstract syntax tree is generated from the preprocessed source code file using a parsing tool, which can be a code property graph parser or an abstract syntax tree generator.

[0067] Data propagation chains are used to characterize the dependencies between variables in a program. To ensure that the constructed data propagation chains accurately reflect the logical dependencies between variables within the program, they mainly include:

[0068] (1) Perform static dependency analysis on the preprocessed source code to identify the definition, assignment and usage relationships of variables inside and across functions, and establish variable dependency mapping;

[0069] (2) Construct the variable dependency relationship into a directed dependency chain to form a complete data propagation path and intuitively depict the flow logic of variables in the program execution process;

[0070] (3) Linearize the generated data propagation path, expand the variable dependencies into an ordered path sequence according to the program execution order, and transform the variables, operators, and dependency edges into continuous numerical vectors through symbol embedding; then concatenate the ordered path sequence with the continuous numerical vector representation of the original source code to construct an input sequence suitable for the pre-trained model, which can be expressed as:

[0071] Input sequence: [[CLS], feature serialization, [SEP], source code numeric vector, [EOS]] (1)

[0072] Where [CLS] indicates the beginning of the input sequence, [SEP] is used to separate the feature sequence and the source code numeric vector, and [EOS] indicates the end of the input sequence.

[0073] S104. Calculate the weight score of key symbols for each function-level code snippet in the preprocessed source code file, and inject it as semantic enhancement information into the model's attention mechanism.

[0074] This embodiment uses a pre-trained model (CodeT5+) based on an encoder-decoder structure to perform hierarchical semantic representation modeling on the preprocessed source code. The encoder is used to extract global features of the input code and its data propagation chain, and the decoder combines contextual information to generate a repair sequence, thereby capturing both global dependencies and local contextual semantics in the code.

[0075] This step, aimed at enhancing the model's attention to local vulnerability semantics during training and inference, mainly includes:

[0076] (1) Perform statistical analysis on key symbols in the preprocessed source code, including calculating the frequency of occurrence of variable names, function names and operators in a single function or code segment, and measuring their importance in combination with the distribution characteristics of the entire corpus.

[0077] (2) The importance score of key symbols is calculated using the term frequency-inverse document frequency method, and its mathematical form can be expressed as:

[0078] (2)

[0079] Among them, TF-IDF ( c i， C) Represents the symbol c i The weighted score in function C, freq( c i， C) Represents the symbol c i The number of times it appears in function C K Let N be the total number of symbols, and N be the total number of files in the corpus. DF ( c i ) indicates that it contains symbols c i Number of files.

[0080] (3) The calculated weight scores are further normalized by using the minimum-maximum normalization function to map the importance scores of different symbols to a fixed interval, thereby eliminating the dimensional differences caused by the original frequency distribution and making various symbols comparable on the same scale.

[0081] (4) The normalized weights are dynamically injected into the multi-head attention mechanism of the pre-trained model as external guiding information, so that it can explicitly focus on key symbols with high weights when calculating the attention distribution. Specifically, in the standard self-attention mechanism, the formula for calculating attention weights is:

[0082] (3)

[0083] Among them, Q i and K j These represent the query and key vectors, respectively. k This is the scaling factor. To incorporate external weight information, it is adjusted as follows:

[0084] (4)

[0085] Among them, w j This represents external weight information, which is the normalized weight score. This is a balancing parameter used to control the intensity of the influence of external guidance information on the attention distribution.

[0086] In this way, the attention mechanism can focus more intently on high-weight symbols related to vulnerabilities when performing context modeling, thereby enhancing the model's structural awareness and semantic discrimination capabilities.

[0087] This embodiment introduces a multi-head attention mechanism and external weight guidance information into the encoder-decoder structure, realizing local modeling of source code semantic features and enabling more accurate capture of vulnerability-related contextual dependencies.

[0088] S105. Construct a model-based vulnerability remediation framework; use the vulnerability remediation framework to perform feature abstraction on the preprocessed code and data propagation chain of the input, and generate remediation patches.

[0089] Further, step S105 includes:

[0090] (1) Construct a model-based vulnerability remediation framework.

[0091] An additional multilayer perceptron classifier (MLP classifier) ​​is introduced at the encoder output of the pre-trained model. (See [reference needed]). Figure 2 The multilayer perceptron classifier is used for vulnerability detection and classification. It is a feedforward neural network consisting of an input layer and an output layer. Through "linear transformation + nonlinear activation" operations, the high-dimensional abstract features learned by the encoder are gradually mapped to a low-dimensional category space. The Softmax activation function is used to convert the output values ​​of its neurons into a probability distribution, which directly corresponds to each predefined vulnerability category.

[0092] The encoder, as a shared feature extraction module, is responsible for a deep understanding of the input source code and its contextual information. Its attention mechanism is guided by the weights of key symbols. The feature representations generated by the encoder are fed in parallel to two independent downstream task modules: a multilayer perceptron classifier and a decoder. The decoder classifies the input feature representations and vulnerability categories to perform generative repair of the vulnerability code.

[0093] (2) Use the vulnerability repair framework to abstract the features of the preprocessed code and data propagation chain of the input and generate a repair patch.

[0094] The remediation process is a phased reasoning process. First, a multilayer perceptron classifier is used for rapid vulnerability detection and localization. Then, a decoder is activated to generate targeted patches. This design not only improves efficiency but also makes the remediation process more targeted.

[0095] Vulnerability Detection and Localization: The preprocessed source code and data propagation chain are fed into the model's encoder, whose output [CLS] feature vector is then passed to the MLP classifier. The MLP classifier outputs a probability distribution for a vulnerability category. If the category corresponding to the highest probability is "no vulnerability," the process terminates; otherwise, if a vulnerability is detected, the model records the predicted vulnerability type and passes this information, along with the complete context vector generated by the encoder, to the next stage.

[0096] Guided Patch Generation: After a vulnerability is confirmed, the model's decoder is activated. The decoder receives a complete vector representation rich in code context information generated by the encoder as initial input, thereby generating patch code highly relevant to that specific vulnerability type. The decoder generates a sequence of patches token by token in an autoregressive manner until the end-of-output symbol is reached.

[0097] To ensure that the final generated patch is both formally correct and logically consistent with the original program, a bundle search strategy is primarily employed during patch generation, combined with syntax verification and semantic consistency checks for filtering. Specifically, this includes:

[0098] (2-1) A beam search strategy is adopted during the decoding process. Multiple repair patch sequences are retained according to probability scores. Several possible paths are expanded at each decoding step, and the highest-scoring sequences are maintained in real time to avoid error accumulation caused by decoding a single path, thereby ensuring that the generated results have higher coverage and diversity. Compared with greedy search, beam search can retain multiple possible solution paths within a certain width, thereby improving the coverage and diversity of generated patches;

[0099] (2-2) Use a syntax parser and compilation tools to check the generated patch sequence one by one to ensure that it conforms to the syntax rules of the language and can be compiled or executed successfully;

[0100] (2-3) In the sequence of grammatically correct patch repairs, further semantic consistency analysis is performed, mainly including whether the variable scope is reasonable, whether the data dependencies are correct, and whether the propagation and control logic are consistent with the original program. Through this judgment step, it can be ensured that the finally selected patches are not only formally correct, but also logically consistent with the expected function.

[0101] This embodiment combines a bundle search strategy, syntax parsing, and semantic consistency determination mechanism to select a final repair solution that is both correct and reasonable from candidate patches, thereby effectively reducing the risk of introducing new defects due to improper repair.

[0102] In one embodiment, the method further includes training a model-based vulnerability remediation framework and then using the trained model-based vulnerability remediation framework to remediate the source code.

[0103] Training the model-based vulnerability remediation framework includes:

[0104] Based on the collected version control metadata, the fix commits for each tagged vulnerability file are traced. By parsing the commit, the specific content of the vulnerable code area in the pre-fix and post-fix versions is extracted. The pre-fix code and its generated data propagation chain together constitute the input of the training sample; the corresponding post-fix code snippet constitutes the expected output of the sample.

[0105] All selected and aligned vulnerability-fix pair samples are randomly divided into training, validation, and test sets in a preset ratio (8:1:1) according to standard machine learning practices. The training set is used for learning and optimizing model parameters; the validation set is used to monitor model performance, perform hyperparameter tuning, and prevent overfitting during training; and the test set is used to ultimately evaluate the model's fix effectiveness.

[0106] Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware, and the corresponding program can be stored in a computer-readable storage medium.

[0107] It should be noted that although the method operations of the above embodiments are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. On the contrary, the order of execution of the described steps may be changed. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0108] Example 2:

[0109] like Figure 3 As shown, this embodiment provides an automatic repair device for power software vulnerabilities based on semantic enhancement. The device includes an acquisition and preprocessing module 301, a first construction module 302, a calculation module 303, a second construction module 304, and a repair module 305, wherein:

[0110] The acquisition and preprocessing module 301 is used to acquire the historical source code of the target software and preprocess the source code;

[0111] The first construction module 302 is used to generate an abstract syntax tree based on the preprocessed source code; and to perform data flow analysis on the preprocessed source code based on the abstract syntax tree, and to construct a data propagation chain by extracting the definition, transmission and usage relationships of variables.

[0112] The calculation module 303 is used to calculate the weight score of key symbols for each function-level code segment in the preprocessed source code; and to inject the weight score as semantic enhancement information into the attention mechanism of the model; the model is an encoder-decoder structure.

[0113] The second building module 304 is used to introduce a multilayer perceptron classifier at the encoder output of the model; the probability distribution of the vulnerability categories output by the multilayer perceptron classifier is used as the input of the decoder.

[0114] The repair module 305 is used to input the preprocessed source code and data propagation chain into the encoder in the model, and input the feature representation generated by the encoder into the multilayer perceptron classifier and decoder respectively; the decoder generates repair patches according to the feature representation and the probability distribution of vulnerability categories; during the process of the decoder generating repair patches, a beam search strategy is adopted, and the searched repair patches are verified for consistency.

[0115] The specific implementation of each module in this embodiment can be found in Embodiment 1 above, and will not be repeated here. It should be noted that the device provided in this embodiment is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure can be divided into different functional modules to complete all or part of the functions described above.

[0116] Example 3:

[0117] This embodiment provides a terminal device, which can be a computer, as can be referred to in [reference]. Figure 4The system is connected via a system bus 401 to a processor 402, a memory, an input device 403, a display 404, and a network interface 405. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium 406 and internal memory 407. The non-volatile storage medium 406 stores the operating system, computer programs, and a database. The internal memory 407 provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. When the processor 402 executes the computer programs stored in the memory, it implements the semantically enhanced automatic repair method for power software vulnerabilities in Embodiment 1, as follows:

[0118] Obtain the historical source code of the target software and preprocess the source code;

[0119] An abstract syntax tree is generated from the preprocessed source code; data flow analysis is performed on the preprocessed source code based on the abstract syntax tree, and a data propagation chain is constructed by extracting the definition, transmission and usage relationships of variables.

[0120] For each function-level code segment in the preprocessed source code, a weight score of the key symbol is calculated; the weight score is then injected into the attention mechanism of the model as semantic enhancement information; the model is an encoder-decoder structure.

[0121] An additional multilayer perceptron classifier is introduced at the encoder output of the model; the probability distribution of the vulnerability categories output by the multilayer perceptron classifier is used as the input of the decoder.

[0122] The preprocessed source code and data propagation chain are input into the encoder in the model. The feature representations generated by the encoder are input into the multilayer perceptron classifier and decoder, respectively. The decoder generates a patch based on the feature representations and the probability distribution of the vulnerability categories. During the process of generating the patch, a beam search strategy is used, and the consistency of the searched patch is verified.

[0123] Example 4:

[0124] This embodiment provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the semantically enhanced automatic repair method for power software vulnerabilities based on Embodiment 1 above, as follows:

[0125] Obtain the historical source code of the target software and preprocess the source code;

[0126] An abstract syntax tree is generated from the preprocessed source code; data flow analysis is performed on the preprocessed source code based on the abstract syntax tree, and a data propagation chain is constructed by extracting the definition, transmission and usage relationships of variables.

[0127] For each function-level code segment in the preprocessed source code, a weight score of the key symbol is calculated; the weight score is then injected into the attention mechanism of the model as semantic enhancement information; the model is an encoder-decoder structure.

[0128] An additional multilayer perceptron classifier is introduced at the encoder output of the model; the probability distribution of the vulnerability categories output by the multilayer perceptron classifier is used as the input of the decoder.

[0129] The preprocessed source code and data propagation chain are input into the encoder in the model. The feature representations generated by the encoder are input into the multilayer perceptron classifier and decoder, respectively. The decoder generates a patch based on the feature representations and the probability distribution of the vulnerability categories. During the process of generating the patch, a beam search strategy is used, and the consistency of the searched patch is verified.

[0130] It should be noted that the computer-readable storage medium in this embodiment can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0131] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope disclosed in the present invention, based on the technical solution and inventive concept of the present invention, shall fall within the scope of protection of the present invention.

Claims

1. A method for automatic repair of power software vulnerabilities based on semantic enhancement, characterized in that, The method comprises: acquiring historical source code of target software, and preprocessing the source code; generating an abstract syntax tree according to the preprocessed source code; performing data flow analysis on the preprocessed source code based on the abstract syntax tree; establishing variable dependency mapping according to the definition, assignment and use relationship of the identified variables within a function and between functions through static dependency analysis; constructing variable dependency relationship into a directed dependency edge to form a complete data propagation path; performing linearization processing on the data propagation path, and expanding the variable dependency relationship into an ordered path sequence according to the program execution order; converting the variables, operators and directed dependency edges in the preprocessed source code into continuous numerical vectors through symbolic embedding; splicing the ordered path sequence and the converted continuous numerical vectors; and the spliced sequence is a data propagation chain; calculating the weight score of a key symbol for each function-level code segment in the preprocessed source code; injecting the weight score as semantic enhancement information into the attention mechanism of the model; the model is an encoder-decoder structure; introducing a multilayer perceptron classifier at the output end of the encoder of the model; taking the probability distribution of the vulnerability category output by the multilayer perceptron classifier as the input of the decoder; inputting the preprocessed source code and the data propagation chain into the encoder in the model, and inputting the feature representation generated by the encoder into the multilayer perceptron classifier and the decoder respectively; the decoder generates a repair patch according to the feature representation and the probability distribution of the vulnerability category; in the process of generating the repair patch by the decoder, a beam search strategy is adopted, and consistency checking is performed on the searched repair patch.

2. The power software vulnerability automatic fixing method according to claim 1, wherein, The abstract syntax tree is generated by an analysis tool; the analysis tool is a code attribute graph parser or an abstract syntax tree generation tool.

3. The power software vulnerability automatic fixing method according to claim 1, wherein, The calculation of the weight score of a key symbol for each function-level code segment in the preprocessed source code comprises: counting the frequency of the key symbol in a single function or code segment; the key symbol includes a variable name, a function call name and an operator; calculating the importance score of the key symbol by using the term frequency-inverse document frequency method according to the frequency of the key symbol; normalizing the importance score of the key symbol; the normalized importance score is the weight score of the key symbol.

4. The power software vulnerability automatic fixing method according to claim 1, wherein, The multilayer perceptron classifier is a feedforward neural network composed of an input layer and an output layer; high-dimensional abstract features learned by the encoder are gradually mapped into a low-dimensional category space through linear transformation and nonlinear activation operation; then, the output value of the neuron is converted into a probability distribution by using a Softmax activation function, and the probability distribution corresponding to the pre-defined vulnerability category is obtained.

5. The method of any one of claims 1-4, wherein, The consistency checking includes syntax and semantic consistency checking.

6. The method of claim 1-4, wherein, The preprocessing of the source code comprises: firstly, performing integrity checking on the source code, including removing incomplete, damaged or damaged files that cannot be normally compiled; then, deleting redundant comments, blank lines and invalid debugging information in the source code; finally, performing uniformization processing on the source code, including character encoding format conversion, keyword normalization and indentation format unification, so as to ensure the consistency of the input data.

7. A device for automatic repair of power software vulnerabilities based on semantic enhancement, characterized by, The device comprises: an acquisition and preprocessing module configured to acquire historical source code of target software and pre-process the source code; a first construction module configured to generate an abstract syntax tree based on the pre-processed source code, perform data flow analysis on the pre-processed source code based on the abstract syntax tree, establish a variable dependency mapping according to the definition, assignment and use relationship of the identified variable within a function and between functions through static dependency analysis, construct a directed dependency edge from the variable dependency relationship to form a complete data propagation path, linearize the data propagation path, and expand the variable dependency relationship into an ordered path sequence according to the program execution order; the first construction module is further configured to convert the variable, operator and directed dependency edge in the pre-processed source code into a continuous numerical vector through a symbolic embedding method, splice the ordered path sequence and the converted continuous numerical vector, and obtain a data propagation chain after splicing; a calculation module configured to calculate a weight score of a key symbol for each function-level code segment in the pre-processed source code, and inject the weight score as semantic enhancement information into an attention mechanism of a model; a second construction module configured to additionally introduce a multilayer perceptron classifier at an output end of an encoder of the model, and take a probability distribution of a vulnerability category output by the multilayer perceptron classifier as an input of a decoder; a repair module configured to input the pre-processed source code and the data propagation chain into the encoder in the model, input feature representations generated by the encoder into the multilayer perceptron classifier and the decoder respectively, and generate a repair patch by the decoder according to the feature representations and the probability distribution of the vulnerability category; the repair module is further configured to adopt a beam search strategy in the process of generating the repair patch by the decoder, and perform consistency checking on the searched repair patch.

8. A terminal device comprising a processor and a memory for storing a processor-executable program, characterized in that The processor executes the program stored in the memory, and the power software vulnerability automatic repair method in any one of claims 1-6 is implemented.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor, and the power software vulnerability automatic repair method in any one of claims 1-6 is implemented.

Images