Code vulnerability detection method

Abstract

The application relates to a code vulnerability detection method and relates to the technical field of computers.The method comprises the following steps: obtaining to-be-detected code; performing preprocessing on the to-be-detected code to obtain a normalized source code representation; constructing an abstract syntax tree based on the source code representation; constructing an intermediate representation based on the abstract syntax tree; wherein the intermediate representation comprises a core expression set, a target control flow graph and a target function call graph; constructing a target value dependency graph based on the target control flow graph and the target function call graph; performing constraint extraction based on the target value dependency graph and the target control flow graph to obtain a target constraint expression; and inputting the target constraint expression into a constraint solver to obtain a vulnerability detection result.The code vulnerability detection method can realize high-precision, low-false-alarm and strong-context-aware code vulnerability detection, and is more suitable for scenes with strict security requirements.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a code vulnerability detection method. BACKGROUND

[0002] In the process of software development and security maintenance, code vulnerability detection is an essential key link. Code vulnerability detection can identify potential security defects in the code through automation or manual methods, prevent attackers from exploiting these vulnerabilities for malicious operations, and thus avoid security incidents such as data leakage and system paralysis, and improve system stability and maintainability. Therefore, how to perform code vulnerability detection is a problem to be solved. SUMMARY

[0003] Therefore, it is necessary to provide a code vulnerability detection method capable of code vulnerability detection in view of the above technical problems.

[0004] The present application provides a code vulnerability detection method. The method comprises: obtaining to-be-detected code; preprocessing the to-be-detected code to obtain a normalized source code representation; constructing an abstract syntax tree based on the source code representation; constructing an intermediate representation based on the abstract syntax tree; wherein the intermediate representation comprises a core expression set, a target control flow graph and a target function call graph; constructing a target value dependency graph based on the target control flow graph and the target function call graph; performing constraint extraction based on the target value dependency graph and the target control flow graph to obtain a target constraint expression; inputting the target constraint expression into a constraint solver to obtain a vulnerability detection result.

[0005] The above code vulnerability detection method preprocesses the to-be-detected code to normalize the code format, and then converts it into an abstract syntax tree, which retains the syntax details while stripping the specific implementation details, and constructs an intermediate representation including a core expression set, a target control flow graph and a target function call graph based on the abstract syntax tree, to cover the static structure and dynamic behavior of the code and provide a comprehensive basis for subsequent analysis. The target value dependency graph is constructed by combining the target control flow graph and the target function call graph to accurately identify potential pollution points, and constraint extraction is further performed by combining the target control flow graph, so as to convert vulnerability detection into a constraint satisfaction problem. Finally, the constraint solver is used to perform constraint solving, and whether there is a solution that satisfies the vulnerability condition is judged through mathematical verification, so as to obtain the final vulnerability detection result. The code vulnerability detection method of the present application can realize high-precision, low-false-alarm and strong-context-aware code vulnerability detection, and is more suitable for scenarios with high security requirements.

[0006] In one of the embodiments, the step of preprocessing the code to be detected to obtain a normalized source code representation comprises: performing a compilation configuration analysis on the code to be detected to obtain language configuration information; extracting a minimum set of required header files based on the language configuration information and a trace compilation technique to obtain a header file minimum set; storing the header file minimum set locally through a persistent document object model and removing information irrelevant to code analysis verification to obtain storage data; performing header file deduplication analysis on the storage data and combining different header files according to inclusion relationships to obtain the source code representation.

[0007] In one of the embodiments, the step of constructing an intermediate representation based on the abstract syntax tree comprises: constructing a core expression set based on the abstract syntax tree; constructing a target control flow graph based on the abstract syntax tree and the core expression set; and constructing the target function call graph based on the abstract syntax tree and the target control flow graph.

[0008] In one of the embodiments, the step of constructing a core expression set based on the abstract syntax tree comprises: obtaining a queue of expression nodes to be processed based on expression nodes in the abstract syntax tree; degrading and normalizing expression nodes in the queue of expression nodes to be processed to obtain a candidate expression sequence; injecting metadata required for vulnerability analysis into the candidate expression sequence to obtain candidate core expressions; performing caching and deduplication on the candidate core expressions based on content hashing or structural equivalence to obtain unique core expression instances; and constructing the core expression set based on the unique core expression instances.

[0009] In one of the embodiments, the step of constructing a target control flow graph based on the abstract syntax tree and the core expression set comprises: identifying a control flow structure based on statement nodes in the abstract syntax tree to obtain a control flow skeleton; embedding the core expression set into basic blocks corresponding to the control flow skeleton in source code order to form a basic block list with operation sequences; constructing sequential edges, branch edges, and loop jump edges between the basic blocks based on the basic block list, and explicitly adding an exception control flow edge pointing to a corresponding exception handling block for an exception throwing point to obtain an initial control flow graph; performing reachability analysis on conditional branches in the initial control flow graph to prune unreachable paths, and injecting boundary and invariant information derived by interval analysis into loop nodes to obtain the target control flow graph.

[0010] In one of the embodiments, the step of constructing the target function call graph based on the abstract syntax tree and the target control flow graph comprises: identifying direct and indirect function call relationships based on function definition and call nodes in the abstract syntax tree, and determining actual targets of each call in combination with the core expression to obtain a preliminary function call list; performing pointing analysis on indirect calls in the preliminary function call list, and determining call targets by using context-sensitive call resolution techniques in combination with type information to obtain an accurate function call list; identifying cross-function data dependency and control dependency relationships based on the accurate function call list and execution path information of the target control flow graph to obtain an enhanced function call graph; modeling library functions and system calls in the enhanced function call graph based on a preset function model, and adjusting model parameters according to the target control flow graph to obtain a complete function call graph; and performing call relationship optimization on the complete function call graph to obtain the target function call graph.

[0011] In one of the embodiments, the step of constructing the target value dependency graph based on the target control flow graph and the target function call graph comprises: obtaining core expression operation sequences of each basic block in the target control flow graph to obtain a basic block operation queue to be processed; analyzing each operation sequence in the basic block operation queue to be processed and establishing definition-use chains among variables to obtain a preliminary value dependency relationship set; obtaining a cross-function value dependency relationship set based on the preliminary value dependency relationship set and cross-function data dependency information of the target function call graph; calculating and marking guard conditions under which each dependency edge in the cross-function value dependency relationship set takes effect according to condition branch information in the target control flow graph to obtain an initial value dependency graph; and performing constant propagation, folding optimization and loop structure interval analysis on the initial value dependency graph to obtain the target value dependency graph.

[0012] In one of the embodiments, the step of extracting constraints based on the target value dependency graph and the target control flow graph to obtain a target constraint expression comprises: obtaining a semantic control context queue to be processed based on each value dependency edge and guard condition in the target value dependency graph in combination with corresponding basic blocks and execution path information in the target control flow graph; converting each context in the semantic control context queue to an initial constraint expression according to its core expression operation and guard condition to obtain a preliminary constraint expression set; performing constant propagation, interval analysis and loop structure refinement processing on the preliminary constraint expression set to obtain an optimized constraint expression set; and performing program slicing on the optimized constraint expression set to remove redundant variables and path conditions introduced by irrelevant statements and retain key value dependency information to obtain the target constraint expression.

[0013] In one of the embodiments, the step of inputting the target constraint expression into a constraint solver to obtain a vulnerability detection result comprises: inputting the target constraint expression into a constraint solver to obtain a constraint solving result; analyzing the constraint solving result to identify feasible paths that meet dangerous conditions to obtain a set of potential vulnerability paths; and mapping the set of potential vulnerability paths back to specific program locations in the target control flow graph and the target value dependence graph to obtain the vulnerability detection result.

[0014] In one of the embodiments, the method further comprises: outputting the target control flow graph, the target function call graph and the target value dependence graph through an application programming interface. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 An application environment of a code vulnerability detection method in one of the embodiments;

[0016] Figure 2 A flowchart of a code vulnerability detection method in one of the embodiments;

[0017] Figure 3 A flowchart of obtaining a source code representation in one of the embodiments;

[0018] Figure 4 A flowchart of constructing an intermediate representation in one of the embodiments;

[0019] Figure 5 An internal structure diagram of a computer device in one of the embodiments. DETAILED DESCRIPTION

[0020] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and should not be used to limit the present application.

[0021] The code vulnerability detection method provided by the embodiments of the present application can be applied in an application environment as shown in Figure 1 The terminal 102 communicates with the server 104 through a network. The data storage system can store data required to be processed by the server 104. The data storage system can be integrated on the server 104, or placed on a cloud or other network server. The terminal 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things device can be a smart speaker, a smart television, a smart air conditioner, a smart vehicle device, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The server 104 can be implemented by an independent server or a server cluster composed of multiple servers.

[0022] In one embodiment, such as Figure 2 As shown, a code vulnerability detection method is provided, which can be applied to... Figure 1 Taking terminal 102 as an example, the explanation includes the following steps:

[0023] Step S110: Obtain the code to be detected.

[0024] Specifically, when performing code vulnerability detection, terminal 102 first obtains the code to be detected. This code can be read from a version control system, file system, or user input, and can be written in various programming languages. The original semantic structure of the code (such as macro definitions) is preserved in the code.

[0025] Step S120: Preprocess the code to be detected to obtain a standardized source code representation.

[0026] Specifically, after obtaining the code to be detected, terminal 102 first preprocesses the code to obtain a standardized source code representation. Preprocessing is used to eliminate syntactic noise, standardize code format, and facilitate subsequent structured analysis. Preprocessing may include operations such as syntax cleaning, standardization, and dependency resolution.

[0027] Step S130: Construct an abstract syntax tree based on the source code representation.

[0028] Specifically, after receiving the source code representation, terminal 102 constructs an Abstract Syntax Tree (AST) based on it. An AST is a tree-like representation of source code used to represent the syntactic structure of a programming language. In an AST, each node represents a structural element of the code, such as a declaration, expression, or control flow. The AST extracts the structure of the code literally, ignoring unstructured parts such as spaces and comments, making the program's logical structure clearer and easier to analyze.

[0029] Step S140: Construct an intermediate representation based on the abstract syntax tree.

[0030] Specifically, after terminal 102 constructs the abstract syntax tree (API), it then builds an intermediate representation (IR) based on the API to transform the API into a more abstract form suitable for vulnerability analysis, reducing the complexity related to specific syntax. The constructed intermediate representation includes: a set of core expressions, a target control flow graph, and a target function call graph. During the construction of the intermediate representation, the corresponding graph structure is obtained by traversing the API and identifying the control flow structure and function calls.

[0031] A core expression (CE) is a basic, low-level representation of a program expression (e.g., arithmetic operations, pointer operations, conditional judgments), focusing on the display of data information. A control flow graph (CFG) is a basic structure for control flow analysis (CFA), which records in detail each control flow instruction and structure in a function, which represents a basic block (e.g., assignment, conditional judgment) as a node and an execution path as an edge. A call graph (CG) is obtained through call graph analysis (CGA), which is used to analyze the function call relationship in the program in detail, including analyzing direct and indirect calls between functions, and implicit calls, such as implicit calls of constructors in C++.

[0032] In step S150, a target value dependence graph is constructed based on the target control flow graph and the target call graph.

[0033] Specifically, after the terminal 102 constructs the intermediate representation, the target value dependence graph is constructed according to the target control flow graph and the target call graph. The target value dependence graph is used to track the data dependence relationship between variables and identify potential data flow vulnerabilities (such as out-of-bound access, null pointer dereference). The value dependence graph (VDG) generates nodes representing variables or expressions, and edges representing dependence relationships.

[0034] In step S160, constraint extraction is performed based on the target value dependence graph and the target control flow graph to obtain a target constraint expression.

[0035] Specifically, after the terminal 102 constructs the target value dependence graph, constraint extraction is performed according to the target value dependence graph and the target control flow graph to extract conditional statements, assignment statements, and function calls from the target value dependence graph and the target control flow graph, and convert the constraints into symbolic expressions, thereby obtaining the target constraint expression.

[0036] In step S170, the target constraint expression is input into a constraint solver to obtain a vulnerability detection result.

[0037] Specifically, after the terminal 102 obtains the target constraint expression, the target constraint expression is input into the constraint solver, and whether there is a violation of the constraint is verified through the constraint solver, so as to determine whether the code to be detected has a vulnerability, and obtain the final vulnerability detection result. The vulnerability detection result can include the vulnerability location, type (such as buffer overflow, integer overflow), and trigger condition.

[0038] The code vulnerability detection method disclosed by the present application can realize high-precision, low-false-alarm and strong context-aware code vulnerability detection, and is more suitable for scenes with high security requirements.

[0039] In one embodiment, as shown in FIG. 1, the step S120 of preprocessing the code to be detected to obtain a normalized source code representation includes: Figure 3

[0040] Step S121: performing compilation configuration analysis on the code to be detected to obtain language configuration information.

[0041] Specifically, in the present embodiment, when preprocessing the code to be detected, first, the code to be detected is subjected to compilation configuration analysis to obtain language configuration information, so as to determine the compilation environment and language characteristics of the code, and provide a more accurate language environment for the abstract syntax tree analysis, thereby improving the accuracy of the analysis. When performing the compilation configuration analysis, part of the language configuration, including macro definitions and reserved words related to the tracking compilation configuration, can be extracted to ensure the accuracy of the syntax analysis. This configuration is suitable for C or C++ code, covers a variety of detector configurations such as gcc, vs08, arm_5.1.6, MinGW, etc., and also includes configurations of external libraries such as qt.

[0042] Step S122: extracting a minimum set of required header files based on the language configuration information and the tracking compilation technology to obtain a header file minimum set.

[0043] Specifically, in order to avoid the problems of incomplete compilation and introduction of irrelevant header files caused by default configuration, the present embodiment adopts the tracking compilation technology to track the header files actually referenced by the code during the compilation process, rather than simply including all header files, and determines which header files are actually required by using the language configuration information (such as macro definitions), so as to automatically extract a minimum set of required header files and take the minimum set as the header file minimum set. By reducing irrelevant or repetitive header files, the speed of parsing can be improved, and the quality of subsequent abstract syntax tree analysis can be ensured.​

[0044] Step S123: The minimal set of header files is stored locally using the persistent document object model, and information irrelevant to code analysis and verification is removed to obtain the stored data.

[0045] Specifically, after obtaining the minimal header file set, the header files in the minimal header file set are structured and stored using the Persistent Document Object Model (PDOM) to remove information irrelevant to code analysis and verification, thus obtaining the stored data. Using the PDOM model effectively manages the problem of duplicate header file parsing, improving efficiency when handling complex projects. In some embodiments, removing information irrelevant to code analysis and verification includes removing comments, blank lines, formatting information, debugging statements, etc. Storing the data ensures that subsequent analysis only processes critical code related to vulnerability detection, improving the accuracy and efficiency of the analysis.

[0046] Step S124: Perform header file deduplication parsing on the stored data, and combine different header files according to the inclusion relationship to obtain the source code representation.

[0047] Specifically, to address the issue of duplicate header file parsing in complex engineering scenarios, after obtaining the stored data, a header file deduplication process is performed to remove duplicate inclusions in header file inclusion relationships. Different header files are then combined according to these inclusion relationships to form a logically complete source code representation. These steps ensure detection accuracy while significantly improving parsing efficiency.

[0048] In one embodiment, such as Figure 4 As shown, step S140, the step of constructing an intermediate representation based on the abstract syntax tree, includes:

[0049] Step S141: Construct a core expression set based on the abstract syntax tree.

[0050] Specifically, in this embodiment, when constructing an intermediate representation based on the abstract syntax tree, the core expression set is first constructed by traversing the expression nodes (such as arithmetic operations, relational operations, logical operations, function calls, memory operations, type conversions, etc.) in the abstract syntax tree and filtering them.

[0051] Step S142: Construct the target control flow graph based on the abstract syntax tree and the core expression set.

[0052] Specifically, after the core expression set is constructed, a target control flow graph is constructed by the abstract syntax tree and the core expression set to convert the abstract syntax tree into a graph structure representing a program execution path, and to explicitly control the flow dependence between basic blocks. The core expression set is used to provide conditional expressions and assignment statements for the target control flow graph.

[0053] In step S143, a target function call graph is constructed based on the abstract syntax tree and the target control flow graph.

[0054] Specifically, after the target control flow graph is constructed, the target function call graph is constructed by combining the abstract syntax tree. The abstract syntax tree is used to provide nodes of the target function call graph, and the target control flow graph is used to provide a context of function calls.

[0055] In one embodiment, in step S141, the step of constructing the core expression set based on the abstract syntax tree includes: obtaining a queue of expression nodes to be processed based on expression nodes in the abstract syntax tree; degrading and normalizing the expression nodes in the queue of expression nodes to be processed to obtain a candidate sequence of expressions; injecting metadata required for vulnerability analysis into the candidate sequence of expressions to obtain candidate core expressions; judging the candidate core expressions based on content hash or structural equivalence to cache and remove duplicates, to obtain unique core expression instances; and constructing the core expression set based on the unique core expression instances.

[0056] Specifically, in the embodiment, when constructing the core expression set, first, expression nodes (such as assignment expressions, conditional expressions, function call expressions, etc.) in the abstract syntax tree are traversed, and the nodes are organized into a to-be-processed queue, so as to obtain a to-be-processed expression node queue. Then, the expression nodes in the to-be-processed expression node queue are degraded and normalized, and the expression nodes are converted into a bottom-layer operation sequence containing richer semantics, so as to obtain an expression candidate sequence. For example, a complex AST node (i++) in a high-level language is degraded and normalized into a bottom-layer operation sequence containing richer semantics (such as: “read the value of variable i”, “perform addition”, “write the new value back to variable i”, etc.). After obtaining the expression candidate sequence, metadata required for vulnerability analysis is injected into the expression candidate sequence, for example, a “taint” state indicating whether the data comes from untrusted input, so as to obtain a candidate core expression with metadata. Then, based on content hash or structural equivalence, the candidate core expression is cached and deduplicated, and the same expression in the program (for example, a+b appearing in different code paths) is only created into a unique CE instance and reused, so as to obtain a unique core expression instance, so as to ensure that repeated expressions and variables are reused in the analysis process and unnecessary computing overhead is reduced. Finally, all unique core expression instances are combined into a core expression set as a basic semantic unit of program analysis, and a basis is provided for subsequent construction of a target control flow graph and a target value dependence graph.

[0057] In one embodiment, in step S142, the step of constructing the target control flow graph based on the abstract syntax tree and the core expression set includes: identifying control flow structures based on statement nodes in the abstract syntax tree to obtain a control flow skeleton; embedding the core expression set into basic blocks corresponding to the control flow skeleton in the source code order to form a basic block list with operation sequences; based on the basic block list, constructing sequential edges, branch edges and loop jump edges between the basic blocks, and explicitly adding an exception control flow edge pointing to a corresponding exception handling block at an exception throwing point to obtain an initial control flow graph; performing reachability analysis on conditional branches in the initial control flow graph to prune unreachable paths, and injecting boundary and invariant information deduced by interval analysis in the loop nodes to obtain the target control flow graph.

[0058] Specifically, in the embodiment, when constructing the target control flow graph, first, the statement nodes (such as if, while, for, return, etc.) in the abstract syntax tree are traversed to identify the control flow structures (including conditional branches, loops, and exception handling), so as to obtain the control flow skeleton. Then, the core expression set is embedded into the basic block corresponding to the control flow skeleton in the source code order to form a basic block list with operation sequences. Each basic block contains an operation sequence, which reflects the actual operation logic in the basic block and provides an operation basis for constructing the control flow graph. Then, according to the basic block list, the sequential edges (representing the continuous execution of basic blocks), branch edges (representing the jump after conditional judgment), and loop jump edges (representing the jump of loop structures) between the basic blocks are constructed, and the exception control flow edges pointing to the corresponding exception handling block are explicitly added to the exception throwing points (such as throw, raise), to ensure that the exception handling path is completely represented, forming an initial control flow graph containing all possible execution paths. Finally, the initial control flow graph is subjected to reachability analysis by calling a lightweight symbolic execution or an SMT solver on the conditional branches to determine which conditional branch paths are actually reachable, and the unreachable paths are pruned to simplify the control flow graph. And the boundary and invariant information (such as the range of loop times and variable values) derived by interval analysis is injected into the loop nodes, so that the control flow graph more accurately reflects the program execution behavior, and thus an optimized target control flow graph is obtained.

[0059] In the embodiment, when constructing the target control flow graph, the try-catch-finally exception handling structure is explicitly identified, and when analyzing the try block, an exception control flow edge is constructed from each operation node that may throw an exception to the corresponding catch block entrance, ensuring that the implicit control jump path caused by the exception is accurately modeled. When encountering if-else conditional branches, the branch conditions are extracted as logical constraints, and a lightweight symbolic execution engine or an SMT solver is called for satisfiability checking. For branches that are never true under the current path, the CFG is directly pruned during construction, thereby avoiding invalid analysis on unreachable code paths and significantly reducing false positives. Additional elements such as loop nodes and exception handling nodes are introduced into the CFG to more comprehensively represent the control flow of the program. For example, interval analysis and other techniques are used to pre-derive the execution boundaries and invariants of loops, and these information are stored as attributes in the loop nodes, providing key data for detecting buffer overflow and other vulnerabilities.

[0060] In one embodiment, in step S143, the step of constructing the target function call graph based on the abstract syntax tree and the target control flow graph comprises: identifying direct and indirect function call relationships based on function definition and call nodes in the abstract syntax tree, and determining the actual target of each call in combination with the core expression to obtain a preliminary function call list; performing a pointing analysis on indirect calls in the preliminary function call list, and using a context-sensitive call resolution technique in combination with type information to determine the call target to obtain an accurate function call list; identifying cross-function data dependency and control dependency relationships based on the accurate function call list and execution path information of the target control flow graph to obtain an enhanced function call graph; modeling library functions and system calls in the enhanced function call graph based on a preset function model, and adjusting model parameters according to the target control flow graph to obtain a complete function call graph; and performing call relationship optimization on the complete function call graph to obtain the target function call graph.

[0061] Specifically, in constructing the target function call graph, the embodiment first traverses function definition and call nodes in the abstract syntax tree, identifies direct function call relationships and indirect function call relationships, and determines the actual target of a call using metadata (such as type information of a function pointer) contained in the core expression, thereby obtaining a preliminary function call relationship list, which is taken as a preliminary function call list. Then, the embodiment performs a pointing analysis on indirect calls (such as function pointer calls) in the preliminary function call list to determine the actual pointing of the function pointer, and uses a context-sensitive call resolution technique in combination with type information to accurately determine the call target, thereby obtaining a more accurate function call relationship list, which is taken as an accurate function call list. Then, the embodiment analyzes data dependency (such as parameter passing, return value, global variable) and control dependency (such as function return affecting the control flow of a call point) between function calls by combining execution path information provided by the target control flow graph, and adds these dependency relationships to the function call graph to form an enhanced function call graph, which is taken as an enhanced function call graph. Then, the embodiment models library functions and system calls in the enhanced function call graph using a preset function model database (such as modeling of library functions such as strcpy and malloc), and adjusts model parameters according to execution path information in the target control flow graph to ensure that the behavior of the library function is accurately represented in the call graph, thereby forming a complete function call graph, which is taken as a complete function call graph. Finally, the embodiment performs optimization processing on the complete function call graph, such as processing of expansion restrictions of recursive calls and synthesis edges of asynchronous calls, to eliminate redundant call relationships and simplify the structure of the call graph, and finally obtains the target function call graph used for subsequent construction of a target value dependency graph.

[0062] In the embodiment of the present application, when constructing the function call graph, algorithms such as Rapid Type Analysis (RTA), Class Hierarchy Analysis (CHA) and the like are adopted, and the construction process of the function call graph is optimized through on-demand or incremental algorithms, that is, only when analysis is needed, a specific function pointer or indirect call is parsed, rather than constructing a full graph in advance, and by iteratively discovering and adding reachable functions, complete analysis of the class hierarchy is avoided, especially when large and complex software systems are processed. Recursive calls are processed: recursive calls (i.e. loops in the graph) are explicitly detected and marked, and when data flow analysis is performed, rather than expanding the recursive path infinitely, the net effect of the recursive function (such as modification of input parameters, pollution state of return value) is summarized through calculation of a function summary, or it is expanded to a preset limited depth, thereby avoiding falling into a dead loop during analysis, and the influence of recursion can be accurately evaluated. Library function calls are processed: for library functions and system calls that are invisible to the source code, an extensible function model database is introduced for modeling. The model (preset function model) accurately describes the behavior of each library function, including the data flow of its parameters (which are input sources and which are output sinks), side effects (such as file operations, memory allocation) and potential risks (such as buffer overflow risk of strcpy). During analysis, the call graph uses these models to replace actual calls, so that the analysis can "penetrate" the library function, and end-to-end data flow tracking is achieved. Asynchronous and callback mechanisms are processed: for event-driven and asynchronous programming models, the construction algorithm of the call graph will specially identify callback function registration and event listener patterns, and when such patterns are identified, "inferred edges" or "synthetic edges" will be created in the call graph to connect the event trigger point (or callback execution point) with the corresponding callback function, which makes the control flow path generated by asynchronous execution and callback, which is not obvious in the source code, explicit, so that vulnerabilities in these complex scenarios can be analyzed.

[0063] In one embodiment, in step S150, the step of constructing the target value dependence graph based on the target control flow graph and the target function call graph comprises: obtaining the core expression operation sequence of each basic block in the target control flow graph to obtain a basic block operation queue to be processed; analyzing each operation sequence in the basic block operation queue to be processed and establishing the definition-use chain among variables to obtain a preliminary value dependence relationship set; obtaining a cross-function value dependence relationship set based on the preliminary value dependence relationship set and the cross-function data dependence information of the target function call graph; calculating and marking the guard condition of each dependence edge in the cross-function value dependence relationship set according to the conditional branch information in the target control flow graph to obtain an initial value dependence graph; and performing constant propagation, folding optimization and loop structure interval analysis on the initial value dependence graph to obtain the target value dependence graph.

[0064] Specifically, in the construction of the target value dependence graph, first, each basic block in the target control flow graph is traversed to obtain its core expression operation sequence, which represents the specific operation performed in the basic block and provides basic data for subsequent value dependence analysis. The extracted core expression operation sequence is taken as the basic block operation queue to be processed. Then, each operation sequence in the basic block operation queue to be processed is analyzed. By analyzing the operation sequence in the basic block, the definition point (such as the assignment operation) and the use point (such as the variable participating in the calculation) of the variable are identified to form the definition-use relationship among variables, thereby establishing the definition-use chain to constitute the preliminary value dependence relationship set. Then, the preliminary value dependence relationship set and the cross-function data dependence information (such as function parameter passing, return value and global variable access) of the target function call graph are combined to extend the value dependence relationship to the cross-function range to form a cross-function value dependence relationship set containing inter-function data flow. Then, for each dependence edge in the cross-function value dependence relationship set, the guard condition of its validity is calculated and marked according to the conditional branch information in the target control flow graph to obtain an initial value dependence graph. For example, if the dependence relationship is only valid when the condition x>0 is true, x>0 is marked as the guard condition. By marking the guard condition, the value dependence relationship is accurately associated with the program execution path to form the initial value dependence graph. Finally, constant propagation (replacing the variable with a known value with a constant), folding optimization (simplifying the expression) and loop structure interval analysis (analyzing the value range of the variable in the loop to provide accurate range information for the dependence relationship in the loop) are performed on the initial value dependence graph to obtain the target value dependence graph.

[0065] The embodiments of the present application can include three stages when constructing the target value dependency graph. The first stage includes non-guarded value dependency analysis, aiming to establish the relationship between the definition and use of variables, which can be derived from variable assignment and reference within a function, or more complex aliasing relationships, which can span multiple functions. In order to handle this situation, the present application introduces global variable analysis and cross-function Mod-Effect analysis in this stage. In the second stage, based on the preliminary constructed value dependency graph, the present application analyzes branch statements and control flow, calculates and labels the guard conditions for each edge in the graph. This stage is based on the high-precision target control flow graph generated in the previous step, and by analyzing the post-dominator tree, the control dependency relationship between program points is derived, thereby constructing a control dependency graph for handling guard conditions of cross-function control flow. In the third stage, the present application further refines the value dependency graph, adds constant propagation and folding, and further simplifies the newly appeared dependency relationship, especially for the analysis of loop structures.

[0066] In some embodiments, the present application also includes object domain analysis, interval analysis, program slicing and other techniques. These techniques not only provide support for generating constraint expressions for value dependency analysis, but also perform refinement processing. Through specific demand-driven constraint expression solving and information collection, the present application can effectively detect potential vulnerabilities. Object domain analysis can calculate the definition and use relationship in the entire program by uniformly analyzing the control flow graph of all functions. This analysis result is presented in the form of a region graph, which can intuitively show the definition-use relationship of each statement in the program. The region graph is a bipartite graph, where one type of node represents a statement in the program, and the other type of node represents an abstract memory region, such as an object field, a global variable or a heap allocation block. There are two types of directed edges in the graph: edges from "statement nodes" to "region nodes" indicate that the statement defines (writes) the memory region; edges from "region nodes" to "statement nodes" indicate that the statement uses (reads) the memory region. Through this structure, the region graph intuitively and accurately shows how data flows between statements through different memory regions in the entire program. This analysis process can cover multiple steps such as constructing hypergraphs (CFG, CG, VDG), object-sensitive analysis, reachability analysis and definition-use relationship analysis, and can construct a comprehensive and accurate program analysis framework. Interval analysis can help determine the value range of variables in the program, effectively detecting buffer overflow, integer overflow and other situations. Program slicing retains key value dependency information by removing irrelevant statements, thereby improving detection efficiency and accuracy.

[0067] In one embodiment, in step S160, the step of performing constraint extraction based on the target value dependence graph and the target control flow graph to obtain the target constraint expression includes: obtaining a semantic-control context queue to be processed based on each value dependence edge and guard condition in the target value dependence graph, and in combination with the corresponding basic block and execution path information in the target control flow graph; converting each context in the semantic-control context queue into an initial constraint expression according to its core expression operation and guard condition to obtain a preliminary constraint expression set; performing constant propagation, interval analysis, and loop structure refinement processing on the preliminary constraint expression set to obtain an optimized constraint expression set; and performing program slicing clipping on the optimized constraint expression set to remove redundant variables and path conditions introduced by irrelevant statements and retain key value dependence information to obtain the target constraint expression.

[0068] Specifically, in constructing the target constraint expression, each value dependence edge and guard condition in the target value dependence graph is combined with the corresponding basic block and execution path information in the target control flow graph to construct a semantic-control context for each value dependence edge to obtain a queue to be processed, which is used as a semantic-control context queue to provide accurate context for subsequent constraint expression generation. Then, each context in the semantic-control context queue is combined into an initial logical constraint expression according to its core expression operation (such as variable assignment, arithmetic operation) and guard condition, and is used as a preliminary constraint expression set. Then, constant propagation (replacing variables with known values with constants), interval analysis (analyzing the value range of variables to provide accurate range information for constraints), and loop structure refinement (optimizing constraints in the loop structure to determine the boundary and invariant of variables in the loop) processing are performed on the preliminary constraint expression set to obtain an optimized constraint expression set. Finally, program slicing technology is used to perform program slicing clipping on the optimized constraint expression set to remove redundant variables and path conditions irrelevant to vulnerability judgment, and only retain key value dependence information related to vulnerability detection, thereby obtaining the final target constraint expression. For example, global variables or branch conditions irrelevant to vulnerabilities are removed to ensure that the final target constraint expression only contains logic directly related to vulnerability detection, so that the constraint solver can efficiently identify potential vulnerability paths.

[0069] In one embodiment, in step S170, the step of inputting the target constraint expression into the constraint solver to obtain the vulnerability detection result includes: inputting the target constraint expression into the constraint solver to obtain a constraint solving result; analyzing the constraint solving result to identify feasible paths that satisfy dangerous conditions to obtain a set of potential vulnerability paths; and mapping the set of potential vulnerability paths back to specific program locations in the target control flow graph and the target value dependence graph to obtain the vulnerability detection result.

[0070] Specifically, in the embodiment, when performing constraint solving, first, the target constraint expression is input into a constraint solver (such as an SMT solver Z3) to perform formal verification on the target constraint expression by the constraint solver to determine whether there is a variable assignment that satisfies all the constraint conditions. The constraint solving result represents whether there is a program execution path that satisfies the vulnerability condition, which is used to provide a basis for subsequent vulnerability analysis. Then, the constraint solving result is analyzed by analyzing the satisfying assignment returned by the constraint solver to identify the feasible paths that satisfy the dangerous conditions (such as buffer overflow, null pointer dereference, integer overflow, etc.), and a set of potential vulnerability paths is obtained. The paths in the set of potential vulnerability paths represent the possible vulnerability execution paths in the program. Finally, the set of potential vulnerability paths is mapped back to the specific program location in the target control flow graph and the target value dependency graph to obtain a structured vulnerability detection result. The target control flow graph can be used to locate the position of the vulnerability path in the program control flow, and the target value dependency graph can be used to locate the variables and expressions involved in the vulnerability path. The generated structured vulnerability detection result can include vulnerability type, code location (file name, line number), reproduction path, and risk level, etc. The vulnerability detection result is presented in a clear and operable form, which facilitates developers to quickly locate and repair vulnerabilities.

[0071] In one embodiment, the code vulnerability detection method further comprises: outputting the target control flow graph, the target function call graph, and the target value dependency graph through an application programming interface.

[0072] Specifically, in the embodiment, a standardized application programming interface (Application Programming Interface, API) is also provided for outputting the target control flow graph, the target function call graph, and the target value dependency graph, so that external systems can access and utilize these intermediate representations. For example, an AI (Artificial Intelligence)-based vulnerability mining system can be provided with efficient and structured input. The API has the ability to efficiently manage and operate CFG, CG, VDG, and other analysis graphs, so that the AI-based vulnerability mining system can perform in-depth code structure and behavior analysis based on these graphs. Through the structured data provided by the API, the AI-based vulnerability mining system can automatically identify common programming errors and potential security vulnerabilities, such as buffer overflow, race condition, or memory leak. In addition, the API also supports the AI-based vulnerability mining system to generate customized detection logic based on these analysis graphs, further improving the accuracy and efficiency of code analysis.

[0073] It should be understood that although the steps in the flowcharts involved in the embodiments described above are shown in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other orders. Moreover, at least some of the steps in the flowcharts involved in the embodiments described above can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be alternately or alternately executed with at least part of other steps or steps or stages in other steps.

[0074] In one embodiment, a computer device, which can be a terminal, has an internal structure diagram as shown in Figure 5 The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through the system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capability. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used for wired or wireless communication with external terminals, and wireless communication can be achieved through WIFI, mobile cellular network, NFC (near field communication) or other technologies. The computer program is executed by the processor to implement a code vulnerability detection method. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball or touchpad arranged on the shell of the computer device, or an external keyboard, touchpad or mouse, etc.

[0075] Those skilled in the art can understand that Figure 5 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0076] In one embodiment, a computer device is provided, comprising a memory and a processor, the memory storing a computer program, and the processor implementing the steps in the above method embodiments when executing the computer program.

[0077] In one embodiment, a computer readable storage medium is provided, storing a computer program, and the processor implementing the steps in the above method embodiments when executing the computer program.

[0078] A person of ordinary skill in the art can understand that all or part of the processes in the above method embodiments can be completed by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above method embodiments. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0079] The technical features of the above embodiments can be combined in any manner. To make the description concise, not all possible combinations of the technical features in the above embodiments are described, however, as long as the combinations of the technical features do not contradict, they should be considered within the scope of the present application.

[0080] The above-described embodiments are merely illustrative of several embodiments of the present application, which are described in more detail and in a specific manner, but should not be construed as limiting the scope of the patent of the present application. It should be noted that, for those of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A code vulnerability detection method, characterized in that, The method includes: Obtain the code to be detected; The code to be detected is preprocessed to obtain a standardized source code representation; Construct an abstract syntax tree based on the source code representation; An intermediate representation is constructed based on the abstract syntax tree; wherein the intermediate representation includes: a core expression set, a target control flow graph, and a target function call graph; Construct a target value dependency graph based on the target control flow graph and the target function call graph; Constraint extraction is performed based on the target value dependency graph and the target control flow graph to obtain the target constraint expression, including: obtaining a semantic control context queue to be processed based on each value dependency edge and guard condition in the target value dependency graph, combined with the corresponding basic block and execution path information in the target control flow graph; transforming each context in the semantic control context queue into an initial constraint expression according to its core expression operation and guard condition to obtain a preliminary constraint expression set; performing constant propagation, interval analysis, and loop structure refinement on the preliminary constraint expression set to obtain an optimized constraint expression set; and performing program slicing and trimming on the optimized constraint expression set to remove redundant variables and path conditions introduced by irrelevant statements and retain key value dependency information to obtain the target constraint expression. The process of inputting the target constraint expression into a constraint solver to obtain vulnerability detection results includes: inputting the target constraint expression into a constraint solver to obtain constraint solution results; analyzing the constraint solution results to identify feasible paths that satisfy dangerous conditions, thereby obtaining a set of potential vulnerability paths; and mapping the set of potential vulnerability paths back to specific program locations in the target control flow graph and the target value dependency graph to obtain the vulnerability detection results.

2. The code vulnerability detection method according to claim 1, characterized in that, The step of preprocessing the code to be detected to obtain a normalized source code representation includes: The code to be tested is compiled and configured for analysis to obtain language configuration information; Based on the language configuration information and tracing compilation technology, the minimum set of required header files is extracted to obtain the minimum set of header files; The minimal set of header files is stored locally using the persistent document object model, and information irrelevant to code analysis and verification is removed to obtain the stored data. The stored data is parsed to remove duplicate header files, and different header files are combined according to the inclusion relationship to obtain the source code representation.

3. The code vulnerability detection method according to claim 2, characterized in that, The step of constructing an intermediate representation based on the abstract syntax tree includes: Construct a core expression set based on the abstract syntax tree; Construct a target control flow graph based on the abstract syntax tree and the core expression set; The target function call graph is constructed based on the abstract syntax tree and the target control flow graph.

4. The code vulnerability detection method according to claim 3, characterized in that, The step of constructing the core expression set based on the abstract syntax tree includes: Based on the expression nodes in the abstract syntax tree, a queue of expression nodes to be processed is obtained; The expression nodes in the queue of expression nodes to be processed are degraded and normalized to obtain a candidate sequence of expressions. Metadata required for vulnerability analysis is injected into the candidate expression sequence to obtain candidate core expressions; Based on content hashing or structural equivalence judgment, the candidate core expressions are cached and deduplicated to obtain unique core expression instances; The core expression set is formed by combining the unique core expression instances.

5. The code vulnerability detection method according to claim 3, characterized in that, The step of constructing the target control flow graph based on the abstract syntax tree and the core expression set includes: Based on the statement nodes in the abstract syntax tree, the control flow structure is identified to obtain the control flow skeleton; The core expression set is embedded into the basic blocks corresponding to the control flow skeleton in the order of the source code to form a list of basic blocks with operation sequences. Based on the list of basic blocks, sequential edges, branch edges, and loop jump edges between basic blocks are constructed, and exception control flow edges pointing to the corresponding exception handling blocks are explicitly added to exception throwing points to obtain the initial control flow graph. The conditional branches in the initial control flow graph are subjected to reachability analysis to prune unreachable paths, and boundary and invariant information derived from interval analysis is injected into the loop nodes to obtain the target control flow graph.

6. The code vulnerability detection method according to claim 3, characterized in that, The step of constructing the target function call graph based on the abstract syntax tree and the target control flow graph includes: Based on the function definitions and call nodes in the abstract syntax tree, direct and indirect function call relationships are identified, and the actual target of each call is determined by combining the core expression, resulting in a preliminary function call list; The indirect calls in the preliminary function call list are analyzed, and context-sensitive call resolution technology combined with type information is used to determine the call target and obtain the accurate function call list. Based on the precise function call list and the execution path information of the target control flow graph, cross-function data dependencies and control dependencies are identified to obtain an enhanced function call graph; The library functions and system calls in the enhanced function call graph are modeled based on the preset function model, and the model parameters are adjusted according to the target control flow graph to obtain the complete function call graph; The call relationships of the complete function call graph are optimized to obtain the target function call graph.

7. The code vulnerability detection method according to claim 3, characterized in that, The step of constructing the target value dependency graph based on the target control flow graph and the target function call graph includes: Obtain the core expression operation sequence of each basic block in the target control flow graph to obtain the basic block operation queue to be processed; Each operation sequence in the queue of basic block operations to be processed is analyzed and a definition and usage chain between variables is established to obtain a preliminary set of value dependencies. Based on the preliminary set of value dependencies and the cross-function data dependency information of the target function call graph, a set of cross-function value dependencies is obtained; For each dependency edge in the set of cross-function value dependencies, the guard conditions for its effectiveness are calculated and labeled according to the conditional branch information in the target control flow graph to obtain the initial value dependency graph; The initial value dependency graph is subjected to constant propagation, folding optimization, and cyclic structure interval analysis to obtain the target value dependency graph.

8. The code vulnerability detection method according to claim 1, characterized in that, The method further includes: The target control flow graph, the target function call graph, and the target value dependency graph are output through the application programming interface.

Images