A cross-version vulnerability identification system based on a deep graph neural network

Abstract

The application discloses a kind of cross-version vulnerability identification systems based on depth map neural network, comprising: multi-version code metadata acquisition module, for collecting multiple versions of software source code and parsing generation multi-version code metadata set;Multi-version code graph generation module, for constructing multi-version code graph set;Characteristic representation matrix generation module, for generating the characteristic representation matrix of multi-version code graph;Depth map neural network modeling module, for using GLEM model, obtains the embedding matrix of each node;Potential vulnerability node identification module, for identifying the potential vulnerability node set across version;Result output module, for outputting cross-version vulnerability identification result and generating detection report.The application adopts depth map neural network and cross-version modeling method, realizes multi-version vulnerability automatic identification, with the advantages of strong intelligence, high adaptability, detection precision.

Description

Technical Field

[0001] This invention relates to the field of software security detection, and in particular to a cross-version vulnerability identification system based on deep graph neural networks. Background Technology

[0002] Existing vulnerability detection methods mainly include rule-based static analysis, feature-based machine learning methods, and deep learning-driven automated detection tools. These methods can achieve certain results in single versions or limited changes to software code. However, in actual engineering, software code often undergoes multiple version updates, refactoring, and fixes, resulting in significant changes in code structure, dependencies, and implementation details. Existing technologies mostly focus on a single version as the analysis object or rely on specific static syntax and simple structural features, making it difficult to cope with semantic variations, structural evolution, and vulnerability tag migration across version code nodes.

[0003] Meanwhile, in recent years, deep graph neural networks have demonstrated powerful capabilities in program analysis and code structure modeling. Some studies have attempted to introduce graph neural networks into code representation and vulnerability detection tasks. However, these technical solutions generally fail to achieve unified modeling of multiple versions of code and accurate alignment of cross-version nodes. They also lack dynamic modeling mechanisms for code change frequency, patch evolution, and active structural regions. The use of label information in version migration and evolution is also relatively limited. Summary of the Invention

[0004] One objective of this invention is to propose a cross-version vulnerability identification system based on deep graph neural networks. This invention uses deep graph neural networks and cross-version modeling methods to achieve automatic identification of vulnerabilities in multiple versions, and has the advantages of strong intelligence, high adaptability and accurate detection.

[0005] A cross-version vulnerability identification system based on a deep graph neural network according to an embodiment of the present invention includes:

[0006] The multi-version code metadata collection module is used to collect multiple versions of software source code and parse them to generate multi-version code metadata datasets;

[0007] The multi-version code graph generation module is used to construct a multi-version code graph set based on a multi-version code meta dataset;

[0008] The feature representation matrix generation module is used to standardize and encode the node attributes and edge attributes in the multi-version code graph set, and generate the feature representation matrix of the multi-version code graph;

[0009] The deep graph neural network modeling module is used to input the feature representation matrix of multiple versions of the code graph into the GLEM model. The EM algorithm is used to alternately optimize the generative label propagation module and the discriminative graph neural network module to obtain the embedding matrix of each node.

[0010] The potential vulnerability node identification module is used to identify a set of potential vulnerability nodes across versions based on the node embedding matrix and node label probability distribution output by the GLEM model, through node similarity analysis and label probability screening.

[0011] The results output module is used to output cross-version vulnerability identification results and generate detection reports.

[0012] Optionally, modules can be integrated using the following methods:

[0013] Collect multiple versions of software source code, perform syntax parsing on each version of the software source code, extract functions, classes, files, modules, call relationships, dependency relationships and reference relationships, and construct a multi-version code meta dataset;

[0014] Based on a multi-version code metadata dataset, the source code of each version of the software is converted into a code graph, forming a multi-version code graph set;

[0015] The node attributes, edge attributes, and global attributes in the multi-version code graph set are standardized and encoded to generate a feature representation matrix of the multi-version code graph.

[0016] The feature representation matrix of the multi-version code graph is input into the GLEM model. The generative label propagation module and the discriminative graph neural network module are alternately optimized through the EM algorithm. In the E-step, the generative model is used to infer the label probability distribution of unlabeled nodes. In the M-step, the discriminative graph neural network is used to optimize the parameters of all nodes, and finally the embedding matrix of each node is obtained.

[0017] Based on the embedding matrix and node label probability distribution output by the GLEM model, the similarity of code nodes between different versions is calculated to identify potential vulnerability nodes.

[0018] Output cross-version vulnerability identification results and generate vulnerability detection reports.

[0019] Optionally, the construction of the multi-version code meta-dataset includes the following specific steps:

[0020] For the software to be tested, multiple different versions of the software source code were collected, numbered sequentially according to version order, and saved as a multi-version source code dataset.

[0021] For each version of the software source code, perform lexical and syntactic analysis to extract function names, function parameters, return types, function body content, and inter-function call information, and construct the function set for each version;

[0022] Extract class names, class attributes, class methods, class inheritance relationships, and class composition relationships from the source code of each version of the software to construct a class set for each version;

[0023] Extract file names, file inclusion relationships, and file reference relationships from the source code of each version to construct a file set for each version;

[0024] Extract module division information, function and class member distribution within modules, and reference and interaction relationships between modules from the source code of each version, and construct the module set for each version;

[0025] For each version, a function call relationship table is created to mark the function call chain;

[0026] Establish a dependency table between classes and mark the inheritance and composition chains of classes;

[0027] Establish a table showing the include and reference relationships between files, and mark the associated paths between files;

[0028] Establish a table showing the interactions and references between modules, and mark the dependency chains between modules;

[0029] The function sets, class sets, file sets, module sets, and their respective relationship information extracted from each version are uniformly archived and encoded, and organized into a version code meta dataset;

[0030] All versions of the code meta dataset are aggregated to form a multi-version code meta dataset.

[0031] Optionally, the generation of the multi-version code graph set includes the following specific steps:

[0032] For each version in the multi-version code metadata set, process the software source code of the version and perform structured definition of nodes and edges based on the extracted functions, classes, files, modules, call relationships, dependency relationships and reference relationships;

[0033] For each version of the software source code, a node set is constructed, which includes function nodes, class nodes, file nodes and module nodes. Each node contains node type, node name, structure, number of lines of code, number of methods and number of attributes, and all node attributes are uniformly organized into a node attribute set.

[0034] For each version of the software source code, an edge set is constructed, which includes call relationship edges, dependency relationship edges, and reference relationship edges. Each edge is labeled with a start node and an end node. All edges include edge type, edge direction, and relationship strength. All edge attributes are uniformly organized into an edge attribute set.

[0035] The code graph for this version is generated by structuring the set of nodes, the set of node attributes, the set of edges, and the set of edge attributes. The code graph consists of the set of nodes, the set of edges, the set of node attributes, and the set of edge attributes.

[0036] All versions of the code diagrams are stored in version order to form a multi-version code diagram collection.

[0037] Optionally, the generation of the feature representation matrix of the multi-version code graph includes the following specific steps:

[0038] For each code graph in the multi-version code graph set, obtain the node set, node attribute set, edge set, and edge attribute set of the code graph. All nodes and edges are assigned unique identifiers.

[0039] For each node in the node set, based on the node type, node name, structure, number of lines of code, number of methods, and number of attributes, one-hot encoding, hash encoding, and normalization are used to concatenate all attributes in the order of the node's unique number to form a node feature vector. All node feature vectors are arranged in the order of the node set to form a node feature matrix.

[0040] For each edge in the edge set, based on the edge type, edge direction and relation strength, one-hot encoding, hash encoding and normalization are used to concatenate all attributes in the order of the edge's unique number to form an edge feature vector. All edge feature vectors are arranged in the order of the edge set to form an edge feature matrix.

[0041] Based on the node set and edge set, a node adjacency matrix is ​​constructed, which describes the connection relationship between each node in the node set;

[0042] Use the node feature matrix as the feature representation vector of the version code graph;

[0043] The feature representation vectors of all versions of the code graph are arranged in version order to generate a feature representation matrix for the multi-version code graph.

[0044] Optionally, obtaining the embedding matrix of each node includes the following specific steps:

[0045] The feature representation matrix of the multi-version code graph is input into the GLEM model. The GLEM model introduces a cross-version node semantic alignment and label migration mechanism, as well as dynamic edge weight adjustment and version evolution information injection on the basis of the original GLEM model.

[0046] For different versions of the code graph, the semantic similarity of cross-version nodes is calculated based on the feature representation vector, and a cross-version node alignment probability distribution matrix is ​​generated;

[0047] Set a label confidence threshold. For node pairs whose node alignment probability is higher than the label confidence threshold, migrate the node labels from the source version to the target version and update the label probability distribution of unlabeled nodes.

[0048] For each edge in the multi-version code graph, the edge weight is dynamically set according to the frequency of structural changes, patch number, and change timestamp, and the adjacency matrix is ​​adjusted accordingly.

[0049] In step E, the generative label propagation module is used, and the parameters of the discriminative graph neural network module are fixed. Label propagation is performed using a dynamic weighted adjacency matrix and the current label distribution.

[0050] In step M, the node label probability distribution is fixed, and the node feature matrix and the node label probability distribution matrix are concatenated along the feature dimension to form the node input feature matrix.

[0051] Using the node input feature matrix and the dynamically weighted adjacency matrix as input, a multi-layer graph neural network embedding is performed. The initial value of the node embedding matrix is ​​the node input feature matrix.

[0052] The node label probability distribution matrix output by the joint label propagation module and the node embedding matrix output by the discriminative graph neural network module are used to optimize the comprehensive loss.

[0053] Repeat the E-step and M-step until the label probability distribution and node embedding converge or the maximum number of iterations is reached, and output the embedding matrix of each version of the code graph.

[0054] Optionally, the identification of potential vulnerable nodes includes the following specific steps:

[0055] Collect the embedding matrix in the code graph of each version of the GLEM model output, and organize the embedding vector information of all nodes in each version.

[0056] For all nodes in different versions of the code graph, a unified node similarity calculation method is used to compare the similarity of the embedding vectors between nodes of different versions and obtain the similarity judgment results between nodes of different versions.

[0057] Node pairs with a similarity higher than a set threshold are identified as cross-version high similarity node pairs and these node pairs are included in the potential vulnerability node candidate set.

[0058] For each node in the potential vulnerability node candidate set, the label probability distribution of each node is analyzed in conjunction with the node label probability distribution of its respective version. A label probability threshold is set, and all nodes with label probabilities higher than the label probability threshold are selected as the final potential vulnerability node set.

[0059] The beneficial effects of this invention are:

[0060] This invention improves the accuracy and automation of vulnerability detection in multi-version software during continuous evolution by constructing a cross-version vulnerability identification system based on deep graph neural networks. The system can uniformly parse and model the multi-dimensional structure of source code from multiple versions of software. It adopts feature standardization and encoding methods to ensure consistent expression of nodes, edges, and global features across different versions. Based on the GLEM model, it organically combines generative label propagation with discriminative graph neural networks, making full use of a small amount of known label data and a large number of unlabeled nodes to improve label propagation and feature learning capabilities in complex version evolution scenarios. By introducing cross-version node semantic alignment and label migration mechanisms, the system can intelligently identify similar nodes after changes in code structure, dependencies, and implementation methods, achieving automatic expansion and variant tracking of vulnerability labels, dynamic edge weight adjustment, and injection of version evolution information. This enables the model to focus on areas with frequent structural changes or key revisions, effectively compensating for the lack of adaptability of traditional static feature methods during evolution.

[0061] This invention can automatically output accurate cross-version vulnerability identification results for large-scale, multi-version software systems, and generate a detection report that includes vulnerability type, code location, evolution path and variant association. Compared with existing single-version detection and static feature-driven methods, this invention not only achieves breakthroughs in detection comprehensiveness and generalization ability, but also improves the intelligent support capability for vulnerability propagation and variant tracing throughout the software lifecycle. Attached Figure Description

[0062] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0063] Figure 1 This is a schematic diagram of the overall structure of a cross-version vulnerability identification system based on a deep graph neural network proposed in this invention.

[0064] Figure 2 This is a schematic diagram of the GLEM model of a cross-version vulnerability identification system based on a deep graph neural network proposed in this invention. Detailed Implementation

[0065] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0066] refer to Figure 1-2 A cross-version vulnerability identification system based on deep graph neural networks includes:

[0067] The multi-version code metadata collection module is used to collect multiple versions of software source code and parse them to generate multi-version code metadata datasets;

[0068] The multi-version code graph generation module is used to construct a multi-version code graph set based on a multi-version code meta dataset;

[0069] The feature representation matrix generation module is used to standardize and encode the node attributes and edge attributes in the multi-version code graph set, and generate the feature representation matrix of the multi-version code graph;

[0070] The deep graph neural network modeling module is used to input the feature representation matrix of multiple versions of the code graph into the GLEM model. The EM algorithm is used to alternately optimize the generative label propagation module and the discriminative graph neural network module to obtain the embedding matrix of each node.

[0071] The potential vulnerability node identification module is used to identify a set of potential vulnerability nodes across versions based on the node embedding matrix and node label probability distribution output by the GLEM model, through node similarity analysis and label probability screening.

[0072] The results output module is used to output cross-version vulnerability identification results and generate detection reports.

[0073] This invention integrates multi-version code metadata collection, multi-version code graph generation, feature representation matrix generation, deep graph neural network modeling, potential vulnerability node identification, and result output into modular systems, constructing a cross-version vulnerability identification system with a clear process and unified structure. The modules work synergistically to achieve structured analysis and graph modeling of large-scale software source code from multiple versions, solving the problem that traditional methods can only analyze a single version or lack cross-version alignment capabilities. This lays a solid technical foundation for subsequent high-precision, automated vulnerability detection based on deep learning, and enhances the overall intelligence and engineering adaptability of the system.

[0074] In this embodiment, the modules are interconnected using the following method:

[0075] Collect multiple versions of software source code, perform syntax parsing on each version of the software source code, extract functions, classes, files, modules, call relationships, dependency relationships and reference relationships, and construct a multi-version code meta dataset;

[0076] Based on a multi-version code metadata dataset, the source code of each version of the software is converted into a code graph, forming a multi-version code graph set;

[0077] The node attributes, edge attributes, and global attributes in the multi-version code graph set are standardized and encoded to generate a feature representation matrix of the multi-version code graph.

[0078] The feature representation matrix of the multi-version code graph is input into the GLEM model. The generative label propagation module and the discriminative graph neural network module are alternately optimized through the EM algorithm. In the E-step, the generative model is used to infer the label probability distribution of unlabeled nodes. In the M-step, the discriminative graph neural network is used to optimize the parameters of all nodes, and finally the embedding matrix of each node is obtained.

[0079] The GLEM model includes a generative label propagation module and a discriminative graph neural network module, and the two modules are iteratively optimized alternately using the EM algorithm.

[0080] The generative label propagation module, based on graph structure and known node labels, automatically infers the label probability distribution of unlabeled nodes through probabilistic modeling.

[0081] The discriminative graph neural network module utilizes node features and label probability distribution to optimize node embedding and classification capabilities through a deep graph neural network.

[0082] Based on the embedding matrix and node label probability distribution output by the GLEM model, the similarity of code nodes between different versions is calculated to identify potential vulnerability nodes.

[0083] Output cross-version vulnerability identification results and generate a vulnerability detection report, which includes vulnerability type, code location, cross-version evolution path and variant association.

[0084] This invention achieves a tight closed-loop process between modules, from parsing and collecting multiple versions of source code to generating multiple versions of code graphs, representing features, deep learning modeling, and filtering vulnerability nodes. It ensures the consistency of cross-module data structures and key variables. Through standardized parsing and process design, it effectively eliminates data silos and process fragmentation, improves the efficiency of multi-version data processing and analysis, and ensures the traceability and scalability of the entire vulnerability detection process. Compared with the existing loose integration mode, it improves the stability and reusability of the system.

[0085] In this embodiment, the construction of the multi-version code meta dataset includes the following specific steps:

[0086] For the software to be tested, multiple different versions of the software source code were collected, numbered sequentially according to version order, and saved as a multi-version source code dataset.

[0087] For each version of the software source code, perform lexical and syntactic analysis to extract function names, function parameters, return types, function body content, and inter-function call information, and construct the function set for each version;

[0088] Extract class names, class attributes, class methods, class inheritance relationships, and class composition relationships from the source code of each version of the software to construct a class set for each version;

[0089] Extract file names, file inclusion relationships, and file reference relationships from the source code of each version to construct a file set for each version;

[0090] Extract module division information, function and class member distribution within modules, and reference and interaction relationships between modules from the source code of each version, and construct the module set for each version;

[0091] For each version, a function call relationship table is created to mark the function call chain;

[0092] Establish a dependency table between classes and mark the inheritance and composition chains of classes;

[0093] Establish a table showing the include and reference relationships between files, and mark the associated paths between files;

[0094] Establish a table showing the interactions and references between modules, and mark the dependency chains between modules;

[0095] The function sets, class sets, file sets, module sets, and their respective relationship information extracted from each version are uniformly archived and encoded, and organized into a version code meta dataset;

[0096] All versions of the code meta dataset are aggregated to form a multi-version code meta dataset.

[0097] In this embodiment, the generation of the multi-version code graph set includes the following specific steps:

[0098] For each version in the multi-version code metadata set, process the software source code of the version and perform structured definition of nodes and edges based on the extracted functions, classes, files, modules, call relationships, dependency relationships and reference relationships;

[0099] For each version of the software source code, a node set is constructed, which includes function nodes, class nodes, file nodes and module nodes. Each node contains node type, node name, structure, number of lines of code, number of methods and number of attributes, and all node attributes are uniformly organized into a node attribute set.

[0100] For each version of the software source code, an edge set is constructed, which includes call relationship edges, dependency relationship edges, and reference relationship edges. Each edge is labeled with a start node and an end node. All edges include edge type, edge direction, and relationship strength. All edge attributes are uniformly organized into an edge attribute set.

[0101] The code graph for this version is generated by structuring the set of nodes, the set of node attributes, the set of edges, and the set of edge attributes. The code graph consists of the set of nodes, the set of edges, the set of node attributes, and the set of edge attributes.

[0102] All versions of the code diagrams are stored in version order to form a multi-version code diagram collection.

[0103] In this embodiment, the generation of the feature representation matrix of the multi-version code graph includes the following specific steps:

[0104] For each code graph in the multi-version code graph set, obtain the node set, node attribute set, edge set, and edge attribute set of the code graph. All nodes and edges are assigned unique identifiers.

[0105] For each node in the node set, based on the node type, node name, structure, number of lines of code, number of methods, and number of attributes, one-hot encoding, hash encoding, and normalization are used to concatenate all attributes in the order of the node's unique number to form a node feature vector. All node feature vectors are arranged in the order of the node set to form a node feature matrix.

[0106] For each edge in the edge set, based on the edge type, edge direction and relation strength, one-hot encoding, hash encoding and normalization are used to concatenate all attributes in the order of the edge's unique number to form an edge feature vector. All edge feature vectors are arranged in the order of the edge set to form an edge feature matrix.

[0107] Based on the node set and edge set, a node adjacency matrix is ​​constructed, which describes the connection relationships between nodes in the node set:

[0108] ;

[0109] in, Indicates the first The node set in the code graph of version n The node and the first The connection relationship of each node. Indicates the first The node adjacency matrix of the code graph for each version;

[0110] Use the node feature matrix as the feature representation vector of the version code graph;

[0111] The feature representation vectors of all versions of the code graph are arranged in version order to generate a feature representation matrix for the multi-version code graph.

[0112] In this embodiment, obtaining the embedding matrix of each node includes the following specific steps:

[0113] The feature representation matrix of the multi-version code graph is input into the GLEM model. The GLEM model introduces a cross-version node semantic alignment and label migration mechanism, as well as dynamic edge weight adjustment and version evolution information injection on the basis of the original GLEM model.

[0114] The feature representation matrix is ​​composed of feature representation vectors;

[0115] For different versions of the code graph, the semantic similarity of cross-version nodes is calculated based on the feature representation vectors, and a cross-version node alignment probability distribution matrix is ​​generated:

[0116] ;

[0117] in, This represents the node alignment probability distribution matrix. Indicates the first Version code diagram The node and the first Version code diagram The alignment probability of each node. and They represent the first Version code diagram The node and the first Version code diagram The feature representation vector of each node. Indicates cosine similarity;

[0118] Set a label confidence threshold. For node pairs with a node alignment probability higher than the label confidence threshold, migrate the node labels from the source version to the target version and update the label probability distribution of unlabeled nodes.

[0119] ;

[0120] in, Indicates the target version number The label probability distribution of each node. Indicates the source version number The probability distribution of labels for each node;

[0121] For each edge in the multi-version code graph, the edge weight is dynamically set based on the frequency of structural changes, patch number, and change timestamp, and the adjacency matrix is ​​adjusted accordingly.

[0122] ;

[0123] in, Represents a dynamically weighted adjacency matrix. Indicates edge weight;

[0124] The method of dynamically setting edge weights based on structural change frequency, patch number, and change timestamp specifically includes: counting the number of times each edge changes in different versions to obtain the structural change frequency;

[0125] Extract the patch number associated with the most recent change to identify the latest revision information of the edge;

[0126] Obtain the timestamp of the latest change to the edge to reflect the evolution sequence of the edge;

[0127] The frequency of structural changes, patch numbers, and change timestamps are normalized and weighted by setting weight coefficients to obtain the dynamic weight of each edge. This allows the model to focus more on key areas that have undergone frequent structural changes or have been recently revised during version evolution, thereby improving the ability to identify cross-version vulnerability propagation paths and the overall detection accuracy.

[0128] In step E, a generative label propagation module is used, and the parameters of the discriminative graph neural network module are fixed. Label propagation is performed using a dynamically weighted adjacency matrix and the current label distribution.

[0129] ;

[0130] in, Indicates the first The node label probability distribution matrix after the next iteration No. The node label probability distribution matrix after the next iteration This represents the label propagation balance coefficient. Represents the true label matrix;

[0131] In step M, the node label probability distribution is fixed, and the node feature matrix and the node label probability distribution matrix are concatenated along the feature dimension to form the node input feature matrix.

[0132] Using the node input feature matrix and the dynamically weighted adjacency matrix as input, a multi-layer graph neural network embedding is performed. The initial value of the node embedding matrix is ​​the node input feature matrix:

[0133] ;

[0134] in, Indicates the first Version code diagram The node embedding matrix after the next iteration Indicates the first Version code diagram The node embedding matrix after the next iteration This represents the weighted adjacency matrix after adding self-loops. express The degree matrix, Indicates the first The learning weight parameters of the layer, Represents a non-linear activation function. Represents the identity matrix;

[0135] The combined loss is optimized using the node label probability distribution matrix output by the joint label propagation module and the node embedding matrix output by the discriminative graph neural network module.

[0136] ;

[0137] in, Indicates the overall loss. This represents the label propagation cross-entropy loss. Indicates structural retention loss. Indicates the loss balance coefficient;

[0138] The label propagation cross-entropy loss is:

[0139] ;

[0140] in, This represents a set of labeled nodes. Indicates the total number of categories. Indicates the first The first version of the code diagram The true label of the node in the th... Values ​​under the class Indicates the first The first version of the code diagram The node at the th The probability distribution of node labels under a class;

[0141] The structural retention loss is:

[0142] ;

[0143] in, Indicates the first The set of edges in the code graph of each version. Represents a node and nodes Cosine similarity between them Indicates the first The first version of the code diagram The embedding vector of each node. Indicates the first The first version of the code diagram The embedding vector of each node. The second norm of a vector;

[0144] Repeat the E-step and M-step until the label probability distribution and node embedding converge or the maximum number of iterations is reached, and output the embedding matrix of each version of the code graph.

[0145] This invention introduces cross-version node semantic alignment, label migration mechanism, and dynamic edge weight adjustment strategy in the generation of node embedding matrix. This enables the deep graph neural network model to dynamically focus on areas with frequent structural changes or key revisions during version evolution. Through high-confidence label migration and node alignment probability modeling, the accuracy and robustness of label propagation and node embedding learning are effectively improved. This provides a solid model foundation for subsequent high-precision cross-version vulnerability node identification and enhances the system's adaptability and detection capability to evolutionary variants.

[0146] In this embodiment, the identification of potential vulnerable nodes includes the following specific steps:

[0147] Collect the embedding matrix in the code graph of each version of the GLEM model output, and organize the embedding vector information of all nodes in each version.

[0148] For all nodes in different versions of the code graph, a unified node similarity calculation method is used to compare the similarity of the embedding vectors between nodes of different versions and obtain the similarity judgment results between nodes of different versions.

[0149] Node pairs with a similarity higher than a set threshold are identified as cross-version high similarity node pairs and these node pairs are included in the potential vulnerability node candidate set.

[0150] For each node in the potential vulnerability node candidate set, the label probability distribution of each node is analyzed in conjunction with the node label probability distribution of its respective version. A label probability threshold is set, and all nodes with label probabilities higher than the label probability threshold are selected as the final potential vulnerability node set.

[0151] Example 1:

[0152] In modern enterprise software development, frequent version updates, code refactoring, and security patching have become the norm. However, this has also brought about more prominent challenges in vulnerability detection. For example, a large financial software platform regularly expands and upgrades the functionality and architecture of its core modules, such as transaction management, user authentication, and back-end settlement, due to service diversification and changing business needs. In actual maintenance, traditional vulnerability detection methods can only perform static analysis or feature scanning on a single version of the software code, making it difficult to track potential vulnerabilities that manifest differently in different versions. In particular, some variant vulnerabilities resulting from code refactoring, dependency adjustments, and residual vulnerabilities after patching often cannot be accurately detected by existing detection tools, increasing system security risks and subsequent maintenance pressure.

[0153] To address the aforementioned issues, the platform maintenance team attempted to apply the cross-version vulnerability identification system based on deep graph neural networks proposed in this invention to multiple consecutive versions of the financial software platform. The system first automatically collects the source code of each historical version and performs detailed lexical and syntactic analysis on each version, extracting functions, classes, files, modules, and their call relationships, dependencies, and reference relationships. All structured data is uniformly encoded and archived to generate a cross-version code metadata dataset. Subsequently, the system automatically constructs a multi-version code graph set based on the metadata dataset of each version, standardizing, hashing, and normalizing the attributes of each node and edge to form a feature representation matrix of the multi-version code graph. In this process, the structure, call chain, dependency hierarchy, and module boundaries between nodes are fully preserved, enabling the accurate expression of structural evolutionary features.

[0154] During the model training phase, the platform team inputs the feature representation matrices of multiple versions of code graphs into the deep graph neural network modeling module. The generative label propagation module of the GLEM model and the discriminative graph neural network module are used for joint modeling, and the EM algorithm is introduced for alternating optimization. With the automatic inference of the system and the synergy of a small number of known labels, not only is semantic alignment and label transfer of cross-version nodes achieved, but also a dynamic edge weight adjustment mechanism is combined to enable the model to prioritize structural regions that have changed frequently or undergone key revisions during version evolution. Through similarity analysis of node embedding vectors and label probability screening, the system automatically identifies potential high-risk nodes between versions and includes these nodes in the vulnerability detection result set.

[0155] In practical applications, platform maintenance personnel can quickly locate the vulnerability type, code location, cross-version evolution path, and related variants based on the detection report output by the system. This shortens the cycle of manual investigation and repair, and improves the timeliness and comprehensiveness of security risk handling. As the system continues to operate and maintain, it continuously learns the distribution and variation patterns of security vulnerabilities in historical versions, and can gradually improve its ability to identify unknown vulnerability variants in new versions.

[0156] To verify the performance of the present invention in practice, it was compared with traditional methods.

[0157] Table 1. Performance Comparison of Cross-Version Vulnerability Identification System Based on Deep Graph Neural Networks and Traditional Methods

[0158]

[0159] In terms of detection accuracy, the system of this invention achieves an accuracy of 95.3%, significantly higher than static rule detection (82.1%), machine learning feature models (86.7%), and traditional single-version graph neural network detection (89.6%). This improvement is mainly due to the hybrid mechanism adopted in this invention, which combines unified modeling of multi-version code graphs with deep graph neural networks, generative label propagation, and discriminative learning. This mechanism can deeply explore the structural and semantic changes during version evolution, achieving more comprehensive vulnerability detection coverage.

[0160] In terms of false positive and false negative rates, the system of this invention achieves rates of only 4.1% and 7.8%, respectively, far superior to the 13.4% false positive and 27.2% false negative rates of static rule detection, as well as other traditional methods. This advantage demonstrates the high efficiency of the GLEM model in node feature learning and label probability propagation. The system can effectively identify code structure variations caused by refactoring, patching, and dependency adjustments, thereby reducing false positives and false negatives. While machine learning and traditional graph neural networks offer some improvement, their limited ability to fuse information from multiple versions still presents a high risk of false detection.

[0161] In terms of cross-version variant tracing capabilities, the system of this invention is rated as "high," while traditional static rules and single-version GNNs are rated as "low" or "medium." This indicates that the present invention has formed a significant technical barrier in terms of node semantic alignment, label migration, and analysis of structural active regions. It can realize automated source tracing and variant tracking of cross-version vulnerabilities, effectively making up for the shortcomings of existing methods in that they are difficult to associate multiple version vulnerability evolution chains.

[0162] Automation and analysis efficiency are also highlights of this invention's system. The system boasts a high degree of automation, significantly reducing manual intervention and improving detection efficiency. The average analysis time per version is 2.9 minutes, far lower than traditional static rule detection (14.8 minutes), machine learning feature models (9.3 minutes), and traditional single-version GNNs (6.7 minutes). This efficiency improvement is primarily attributed to automated process design, feature standardization, dynamic edge weight adjustment, and end-to-end transmission of node label probability distribution, effectively supporting rapid response in large-scale, multi-version software environments.

[0163] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A cross-version vulnerability identification system based on a deep graph neural network, characterized in that, include: The multi-version code metadata collection module is used to collect multiple versions of software source code and parse them to generate multi-version code metadata datasets; The multi-version code graph generation module is used to construct a multi-version code graph set based on a multi-version code meta dataset; The feature representation matrix generation module is used to standardize and encode the node attributes and edge attributes in the multi-version code graph set, and generate the feature representation matrix of the multi-version code graph; The deep graph neural network modeling module is used to input the feature representation matrix of multiple versions of the code graph into the GLEM model. The EM algorithm is used to alternately optimize the generative label propagation module and the discriminative graph neural network module to obtain the embedding matrix of each node. The potential vulnerability node identification module is used to identify a set of potential vulnerability nodes across versions based on the node embedding matrix and node label probability distribution output by the GLEM model, through node similarity analysis and label probability screening. The results output module is used to output cross-version vulnerability identification results and generate a detection report; Obtaining the embedding matrix of each node includes the following specific steps: The feature representation matrix of the multi-version code graph is input into the GLEM model. The GLEM model introduces a cross-version node semantic alignment and label migration mechanism, as well as dynamic edge weight adjustment and version evolution information injection on the basis of the original GLEM model. For different versions of the code graph, the semantic similarity of cross-version nodes is calculated based on the feature representation vector, and a cross-version node alignment probability distribution matrix is ​​generated; Set a label confidence threshold. For node pairs whose node alignment probability is higher than the label confidence threshold, migrate the node labels from the source version to the target version and update the label probability distribution of unlabeled nodes. For each edge in the multi-version code graph, the edge weight is dynamically set according to the frequency of structural changes, patch number, and change timestamp, and the adjacency matrix is ​​adjusted accordingly. In step E, a generative label propagation module is used, and the parameters of the discriminative graph neural network module are fixed. Label propagation is performed using a dynamically weighted adjacency matrix and the current label distribution. In step M, the node label probability distribution is fixed, and the node feature matrix and the node label probability distribution matrix are concatenated along the feature dimension to form the node input feature matrix. Using the node input feature matrix and the dynamically weighted adjacency matrix as input, a multi-layer graph neural network embedding is performed. The initial value of the node embedding matrix is ​​the node input feature matrix. The node label probability distribution matrix output by the joint label propagation module and the node embedding matrix output by the discriminative graph neural network module are used to optimize the comprehensive loss. Repeat the E-step and M-step until the label probability distribution and node embedding converge or the maximum number of iterations is reached, and output the embedding matrix of each version of the code graph.

2. The cross-version vulnerability identification system based on deep graph neural networks according to claim 1, characterized in that, The modules are connected in the following way: Collect multiple versions of software source code, perform syntax parsing on each version of the software source code, extract functions, classes, files, modules, call relationships, dependency relationships and reference relationships, and construct a multi-version code meta dataset; Based on a multi-version code metadata dataset, the source code of each version of the software is converted into a code graph, forming a multi-version code graph set; The node attributes, edge attributes, and global attributes in the multi-version code graph set are standardized and encoded to generate a feature representation matrix of the multi-version code graph. The feature representation matrix of the multi-version code graph is input into the GLEM model. The generative label propagation module and the discriminative graph neural network module are alternately optimized through the EM algorithm. In the E-step, the generative model is used to infer the label probability distribution of unlabeled nodes. In the M-step, the discriminative graph neural network is used to optimize the parameters of all nodes, and finally the embedding matrix of each node is obtained. Based on the embedding matrix and node label probability distribution output by the GLEM model, the similarity of code nodes between different versions is calculated to identify potential vulnerability nodes. Output cross-version vulnerability identification results and generate vulnerability detection reports.

3. The cross-version vulnerability identification system based on deep graph neural networks according to claim 2, characterized in that, The construction of the multi-version code meta dataset includes the following specific steps: For the software to be tested, multiple different versions of the software source code were collected, numbered sequentially according to version order, and saved as a multi-version source code dataset. For each version of the software source code, perform lexical and syntactic analysis to extract function names, function parameters, return types, function body content, and inter-function call information, and construct the function set for each version; Extract class names, class attributes, class methods, class inheritance relationships, and class composition relationships from the source code of each version of the software to construct a class set for each version; Extract file names, file inclusion relationships, and file reference relationships from the source code of each version to construct a file set for each version; Extract module division information, function and class member distribution within modules, and reference and interaction relationships between modules from the source code of each version, and construct the module set for each version; For each version, a function call relationship table is created to mark the function call chain; Establish a dependency table between classes and mark the inheritance and composition chains of classes; Establish a table showing the include and reference relationships between files, and mark the associated paths between files; Establish a table showing the interactions and references between modules, and mark the dependency chains between modules; The function sets, class sets, file sets, module sets, and their respective relationship information extracted from each version are uniformly archived and encoded, and organized into a version code meta dataset; All versions of the code meta dataset are aggregated to form a multi-version code meta dataset.

4. The cross-version vulnerability identification system based on a deep graph neural network according to claim 2, characterized in that, The generation of the multi-version code graph set includes the following specific steps: For each version in the multi-version code metadata set, process the software source code of the version and perform structured definition of nodes and edges based on the extracted functions, classes, files, modules, call relationships, dependency relationships and reference relationships; For each version of the software source code, a node set is constructed, which includes function nodes, class nodes, file nodes and module nodes. Each node contains node type, node name, structure, number of lines of code, number of methods and number of attributes, and all node attributes are uniformly organized into a node attribute set. For each version of the software source code, an edge set is constructed, which includes call relationship edges, dependency relationship edges, and reference relationship edges. Each edge is labeled with a start node and an end node. All edges include edge type, edge direction, and relationship strength. All edge attributes are uniformly organized into an edge attribute set. The code graph for this version is generated by structuring the set of nodes, the set of node attributes, the set of edges, and the set of edge attributes. The code graph consists of the set of nodes, the set of edges, the set of node attributes, and the set of edge attributes. All versions of the code diagrams are stored in version order to form a multi-version code diagram collection.

5. A cross-version vulnerability identification system based on a deep graph neural network according to claim 2, characterized in that, The generation of the feature representation matrix of the multi-version code graph includes the following specific steps: For each code graph in the multi-version code graph collection, obtain the node set, node attribute set, edge set, and edge attribute set of the code graph. All nodes and edges are assigned unique identifiers. For each node in the node set, based on the node type, node name, structure, number of lines of code, number of methods, and number of attributes, one-hot encoding, hash encoding, and normalization are used to concatenate all attributes in the order of the node's unique number to form a node feature vector. All node feature vectors are arranged in the order of the node set to form a node feature matrix. For each edge in the edge set, based on the edge type, edge direction and relation strength, one-hot encoding, hash encoding and normalization are used to concatenate all attributes in the order of the edge's unique number to form an edge feature vector. All edge feature vectors are arranged in the order of the edge set to form an edge feature matrix. Based on the node set and edge set, a node adjacency matrix is ​​constructed, which describes the connection relationship between each node in the node set; Use the node feature matrix as the feature representation vector of the version code graph; The feature representation vectors of all versions of the code graph are arranged in version order to generate a feature representation matrix for the multi-version code graph.

6. A cross-version vulnerability identification system based on a deep graph neural network according to claim 2, characterized in that, The identification of the potential vulnerable nodes includes the following specific steps: Collect the embedding matrix in the code graph of each version of the GLEM model output, and organize the embedding vector information of all nodes in each version. For all nodes in different versions of the code graph, a unified node similarity calculation method is used to compare the similarity of the embedding vectors between nodes of different versions and obtain the similarity judgment results between nodes of different versions. Node pairs with a similarity higher than a set threshold are identified as cross-version high similarity node pairs and these node pairs are included in the potential vulnerability node candidate set. For each node in the potential vulnerability node candidate set, the label probability distribution of each node is analyzed in conjunction with the node label probability distribution of its respective version. A label probability threshold is set, and all nodes with label probabilities higher than the label probability threshold are selected as the final potential vulnerability node set.

Images