Code detection method and device based on multi-dimensional model, equipment and storage medium

Abstract

The invention belongs to the technical field of computer network security, and particularly discloses a code detection method and device based on a multi-dimensional model, equipment and a storage medium. According to the method, the target program slice is generated according to the vulnerability concern; model input parameters are generated according to the target program slices, and new function codes are generated based on the multiple code large models; calculating text similarity according to a plurality of text similarity algorithms, and calculating structural similarity according to a plurality of structural similarity algorithms; and performing vulnerability detection on the to-be-detected code based on the target machine learning model. Through the above mode, the advantages of deep mining of inherent semantic and structural information of codes by the code large models and efficient identification and classification of the machine learning model are fully utilized, the new function codes are generated based on the multiple code large models, and then vulnerability detection is performed based on the target machine learning model. Therefore, the code detection efficiency and accuracy can be effectively improved, and the method is suitable for scenes of various programming languages and vulnerability types.

Description

Technical Field

[0001] This application belongs to the field of computer network security technology, and more specifically, relates to code detection methods, devices, equipment and storage media based on multi-dimensional models. Background Technology

[0002] With the rapid development of information technology, the scale and complexity of software systems are constantly increasing, leading to a more serious problem of vulnerabilities in code. These vulnerabilities not only affect the quality and stability of software, but also pose a serious threat to user data security and privacy. Traditional code detection methods generally involve manual code review and security testing. Although these methods can detect vulnerabilities to some extent, they suffer from drawbacks such as low efficiency, susceptibility to omissions, and interference from human factors, making them unsuitable for the needs of modern software development.

[0003] In recent years, the rise of artificial intelligence technology has brought about a revolutionary change in code vulnerability detection. Deep learning technology, in particular, with its powerful feature extraction and classification capabilities, has provided a new solution for code detection. Deep learning models can automatically learn patterns from massive amounts of code, thereby accurately identifying potential vulnerabilities. However, when processing large-scale codebases, deep learning models typically consume significant computational resources and time, resulting in low efficiency in code detection. Furthermore, conventional deep learning models often focus only on the surface features of the code, ignoring its inherent semantic and structural information. This severely impacts the accuracy of detection results when facing complex and hidden vulnerabilities. Therefore, the above methods result in low efficiency and accuracy in code detection. Summary of the Invention

[0004] In view of the shortcomings of the prior art, the purpose of this application is to provide a code detection method, apparatus, device and storage medium based on a multi-dimensional model, which aims to solve the problem of low efficiency and accuracy of code detection in the prior art.

[0005] To achieve the above objectives, firstly, this application provides a code detection method based on a multi-dimensional model, comprising: Obtain the vulnerability concerns of the code to be detected, and generate a target program slice based on the vulnerability concerns; Based on the target program slice, model input parameters that meet the format requirements of multiple large code models are generated, and new function code is generated based on the model input parameters according to the multiple large code models. The text similarity between each of the new function codes and the code to be detected is calculated using multiple text similarity algorithms, and the structural similarity between each of the new function codes and the code to be detected is calculated using multiple structural similarity algorithms. Based on the target machine learning model, vulnerability detection is performed on the code to be detected according to the text similarity and the structural similarity.

[0006] In one embodiment, the step of obtaining vulnerability concerns of the code to be detected and generating a target program slice based on the vulnerability concerns includes: Obtain the code to be detected and remove the comments from the code; Obtain the user-defined variable names and function names in the code to be tested after the comments have been removed, and process the variable names and function names in a unified manner respectively; Extract the program dependency graph of the code to be detected after unified processing, and traverse the nodes in the program dependency graph; Extract target nodes from each of the nodes, and use the locations of the target nodes as vulnerability concerns in the code to be detected; Using the vulnerabilities mentioned above as the baseline, target program slices are generated by performing forward and backward slicing.

[0007] In one embodiment, the step of generating model input parameters that meet the format requirements of multiple large code models based on the target program slice, and generating new function code based on the model input parameters according to the multiple large code models, includes: Code segments are generated based on consecutive lines of code in the target program slice, and the positions of each code segment are obtained; The prefixes required for multiple large code models are determined based on the code from the start position of the entire function to the specified position, and the suffixes required for multiple large code models are determined based on the code from the specified position to the end position of the entire function. Based on the target parameter construction strategy, model input parameters that meet the format requirements of multiple large code models are independently constructed. Based on multiple large code models, fill-in code is generated independently according to the input parameters of the models; The padding code, the prefix, and the suffix are concatenated to obtain the new function code.

[0008] In one embodiment, the step of performing vulnerability detection on the code to be detected based on the target machine learning model according to the text similarity and the structural similarity includes: Multi-dimensional similarity features are generated based on the text similarity and structural similarity of each of the aforementioned texts; The multi-dimensional similarity features are input into the target machine learning model, and the classification results output by the target machine learning model are obtained. When the classification result is "no vulnerabilities," the code to be detected is determined to be vulnerability-free code. If the classification result indicates the existence of a vulnerability, the code to be detected is determined to be vulnerable code.

[0009] In one embodiment, before the step of generating new function code based on multiple code models and the model input parameters, the method further includes: Generate code datasets based on code collected from multiple large-scale source databases; The code dataset is preprocessed and then classified to obtain a standard dataset of vulnerability code and a standard dataset of patch code. Identify the differences between the vulnerability code standard dataset and the patch code standard dataset, and obtain the location of the differences; The model input training parameters are generated based on the location of the differences, and the training function code is generated based on the model input training parameters. Multiple initial large models are trained based on the training parameters and training function codes of each model to obtain multiple code-based large models.

[0010] In one embodiment, before the step of performing vulnerability detection on the code to be detected based on the target machine learning model according to the text similarity and the structural similarity, the method further includes: The text similarity between each training function code and the vulnerability code in the vulnerability code standard dataset, and the text similarity between each training function code and the patch code in the patch code standard dataset are calculated using multiple text similarity algorithms. The structural similarity between each training function code and the vulnerability code in the standard dataset of vulnerability code, and the structural similarity between each training function code and the patch code in the standard dataset of patch code are calculated using multiple structural similarity algorithms. The similarity between the text of each training function code and the vulnerability code in the vulnerability code standard dataset, the similarity between the text of each training function code and the patch code in the patch code standard dataset, the structural similarity between each training function code and the vulnerability code in the vulnerability code standard dataset, the structural similarity between each training function code and the patch code in the patch code standard dataset, and the training features of the code label generation model are used. Based on the training features of the model, multiple initial machine learning models are trained to obtain the target machine learning model.

[0011] Secondly, this application provides a code detection device based on a multi-dimensional model, comprising: The generation module is used to obtain the vulnerability concerns of the code to be detected and generate a target program slice based on the vulnerability concerns. The generation module is also used to generate model input parameters that meet the format requirements of multiple large code models based on the target program slice, and to generate new function code based on the model input parameters according to the multiple large code models; The calculation module is used to calculate the text similarity between each of the new function codes and the code to be detected according to multiple text similarity algorithms, and to calculate the structural similarity between each of the new function codes and the code to be detected according to multiple structural similarity algorithms. The detection module is used to perform vulnerability detection on the code to be detected based on the target machine learning model, according to the text similarity and the structural similarity.

[0012] Thirdly, this application provides an electronic device, comprising: at least one memory for storing a program; and at least one processor for executing the program stored in the memory, wherein when the program stored in the memory is executed, the processor is configured to execute the method described in the first aspect or any possible implementation thereof.

[0013] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when run on a processor, causes the processor to perform the method described in the first aspect or any possible implementation thereof.

[0014] Fifthly, this application provides a computer program product that, when run on a processor, causes the processor to perform the method described in the first aspect or any possible implementation thereof.

[0015] It is understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here.

[0016] Overall, the technical solutions conceived in this application have the following beneficial effects compared with the prior art: (1) Fully utilize the advantages of deep mining of the inherent semantic and structural information of code by large code models, and no longer only focus on the surface features of code such as syntax and lexical. It can demonstrate strong coping ability when facing different scenarios and complex situations. For example, when facing complex or hidden vulnerabilities, it can use deep learning models to learn the rules and patterns in the code, extract key features related to the vulnerabilities, generate new function code according to the model input parameters, and calculate the similarity according to traditional text similarity algorithms and code structure similarity algorithms respectively. In this way, it can comprehensively and accurately measure the degree of similarity between codes and provide accurate features for subsequent classification models.

[0017] (2) When training the target machine learning model, the complex features of code vulnerabilities can be mined from different angles. A majority voting strategy is adopted, and the final classification result is obtained by combining the prediction results of multiple machine learning models. This can effectively reduce the errors that may be generated by a single machine learning model, improve the classification performance of the target machine learning model, and ultimately train a target machine learning model with efficient identification and classification advantages, thereby effectively improving the efficiency of code detection. In addition, the target machine learning model and the large code model in this application can be flexibly adjusted and optimized according to different needs to be applicable to different programming languages ​​and vulnerability types. It has strong versatility, keeps up with the pace of technological development, and continuously safeguards software security.

[0018] In summary, the process involves identifying vulnerability concerns in the code to be detected and generating target program slices based on these concerns. Model input parameters that meet the format requirements of multiple large code models are then generated based on these target program slices. New function code is generated based on these large code models and the model input parameters. The text similarity between each new function code and the code to be detected is calculated using multiple text similarity algorithms, and the structural similarity between each new function code and the code to be detected is also calculated using multiple structural similarity algorithms. Finally, vulnerability detection is performed on the code to be detected based on the target machine learning model, using both the text and structural similarities. This approach fully leverages the advantages of large code models in deeply mining the inherent semantic and structural information of the code, and the efficient identification and classification capabilities of machine learning models. By generating new function code based on multiple large code models and then performing vulnerability detection based on the target machine learning model, the efficiency and accuracy of code detection can be effectively improved, and the method is applicable to various programming languages ​​and vulnerability types. Attached Figure Description

[0019] Figure 1 This is one of the flowcharts illustrating the code detection method based on a multi-dimensional model provided in the embodiments of this application; Figure 2 This is the second flowchart of the code detection method based on a multi-dimensional model provided in the embodiments of this application; Figure 3 This is a schematic diagram of the module structure of the code detection device based on a multi-dimensional model provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0021] In this article, the term "and / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The symbol " / " in this article indicates that the related objects are in an "or" relationship; for example, A / B means A or B.

[0022] The terms "first" and "second," etc., used in the specification and claims herein are used to distinguish different objects, not to describe a specific order of objects. For example, "first response message" and "second response message," etc., are used to distinguish different response messages, not to describe a specific order of response messages.

[0023] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0024] Based on this, embodiments of this application provide a code detection method based on a multi-dimensional model, referring to... Figure 1 , Figure 1 This is one of the flowcharts illustrating the code detection method based on a multi-dimensional model provided in this application. In this embodiment, the code detection method based on a multi-dimensional model includes steps S10 to S30: Step S10: Obtain the vulnerability concerns of the code to be detected, and generate a target program slice based on the vulnerability concerns.

[0025] It should be noted that vulnerability concerns refer to locations in the program dependency graph corresponding to the code under test that may lead to security vulnerabilities. These vulnerabilities include, but are not limited to, the locations of pointers, arrays, expression operations, and sensitive API functions. Target program slices refer to program slices generated through forward and backward slicing, which preserve the same semantic logic as the original code at the baseline point.

[0026] Further, step S10 includes: obtaining the code to be detected and removing comments from the code; obtaining user-defined variable names and function names in the code after removing comments, and uniformly processing the variable names and function names respectively; extracting the program dependency graph of the uniformly processed code and traversing the nodes in the program dependency graph; extracting target nodes from each node, and using the occurrence position of the target node as the vulnerability concern of the code to be detected; and generating target program slices by performing forward and backward slicing based on the vulnerability concern.

[0027] It should be understood that in order to effectively improve the accuracy and efficiency of traversing nodes, it is necessary to remove comments from the code to be tested and to uniformly process variable names and function names. The purpose of removing comments is to remove comment information from the code to be tested, and the purpose of uniformly processing variable names and function names is to eliminate the interference of naming diversity in the code to be tested on subsequent analysis.

[0028] Understandably, after extracting the program dependency graph of the code to be detected after unified processing, and traversing the nodes in the program dependency graph, target nodes are extracted from each node. These target nodes include, but are not limited to, pointers, arrays, expression operations, and sensitive API functions. At this point, the location where the target node appears can be called the vulnerability concern of the code to be detected. The vulnerability concern is used as the reference point, and the target program slice is generated by performing forward slicing and backward slicing respectively from the reference point.

[0029] Step S20: Generate model input parameters that meet the format requirements of multiple large code models based on the target program slice, and generate new function code based on the model input parameters according to the multiple large code models.

[0030] As can be understood, model input parameters refer to the parameters input into multiple large code models to generate new function code. For different large code models, model input parameters that meet their format requirements will be generated independently. These model input parameters can be represented as prompts. k (k=1, 2, ..., n), where k represents the index, and the new function code refers to the code used to detect whether there are vulnerabilities in the code to be detected.

[0031] Furthermore, prior to the step of generating new function code based on multiple large code models and the model input parameters, the method further includes: generating a code dataset based on code collected from multiple large-scale source databases; preprocessing the code dataset and classifying the preprocessed code dataset to obtain a vulnerability code standard dataset and a patch code standard dataset; determining the differences between the vulnerability code standard dataset and the patch code standard dataset and obtaining the positions of the differences; generating model input training parameters based on the positions of the differences and generating training function code based on the model input training parameters; and training multiple initial large models based on each of the model input training parameters and each of the training function codes to obtain multiple large code models.

[0032] It should be noted that the code dataset refers to a collection of code gathered from multiple large-scale source databases. These large-scale source databases include, but are not limited to, major open-source code repositories, security vulnerability databases, and code software libraries. To ensure the diversity and comprehensiveness of the code dataset, these large-scale source databases cover various programming languages ​​and frameworks. To facilitate the initial large model's understanding of the code's structure and logic, the code dataset undergoes preprocessing after acquisition. This preprocessing includes, but is not limited to, decommenting and standardization. Standardization includes, but is not limited to, formatting and normalization, to ensure code consistency and comparability. Then, the preprocessed code dataset is categorized into a vulnerability code standard dataset and a patch code standard dataset.

[0033] Understandably, for different initial large models, model input training parameters that conform to each initial large model will be generated. The model input training parameters prompt for that initial large model are... 训练 It can be represented as: prefix 训练 + <fill 训练 >+suf-fix 训练 ,in, <fill 训练 > indicates the location of the code to be filled, prefix 训练 The suffix represents the prefix required for the initial large model. 训练 This indicates the suffix required for the initial large model. The difference section refers to the code portion where there are differences between the vulnerability code in the vulnerability code standard dataset and the corresponding patch code in the patch code standard dataset. In this case, the prefix required for the initial large model is the position from the start of the entire function to the position of the difference section. 训练 The suffix required for the larger code model is the position from the location of the difference to the end of the entire function. 训练Different initial large-scale models possess unique advantages in their respective domains. For example, the CodeT5 model has unique advantages in the field of embedded system development. Under different initial large-scale models, multiple training function codes with different characteristics can be generated, thereby more comprehensively covering various potential vulnerability scenarios and effectively reducing the bias and limitations of any single model. Combining multiple models helps to integrate their strengths and improve the quality of the generated training function code. These large-scale code models include, but are not limited to, deep learning models based on natural language processing techniques, CodeShell large-scale code models, and CodeLama large-scale code models.

[0034] Step S30: Calculate the text similarity between each of the new function codes and the code to be detected using multiple text similarity algorithms, and calculate the structural similarity between each of the new function codes and the code to be detected using multiple structural similarity algorithms.

[0035] It should be understood that text similarity algorithms refer to algorithms that calculate the text similarity between new function code and the code to be detected from a semantic dimension. These various text similarity algorithms include, but are not limited to, Levin-Stanby, Jaro similarity, Jaro-Winkler similarity, Jaccard similarity coefficient, and Dice similarity coefficient. Structural similarity algorithms refer to algorithms that calculate the structural similarity between new function code and the code to be detected from a structural dimension. These structural similarity algorithms include, but are not limited to, tree similarity algorithms based on abstract syntax trees and graph similarity algorithms based on control dependency graphs. Combining these similarity algorithms can more comprehensively measure the degree of similarity between codes, thereby improving the accuracy of code detection.

[0036] Step S40: Based on the target machine learning model, perform vulnerability detection on the code to be detected according to the text similarity and the structural similarity.

[0037] Understandably, a target machine learning model refers to a model used for vulnerability detection based on multi-dimensional similarity. After calculating text similarity and structural similarity respectively, vulnerability detection is performed on the code to be detected based on the target machine learning model.

[0038] Further, before step S40, the method includes: calculating the text similarity between each training function code and the vulnerability code in the vulnerability code standard dataset, and the text similarity between each training function code and the patch code in the patch code standard dataset, respectively, using multiple text similarity algorithms; calculating the structural similarity between each training function code and the vulnerability code in the vulnerability code standard dataset, and the structural similarity between each training function code and the patch code in the patch code standard dataset, respectively, using multiple structural similarity algorithms; based on the text similarity between each training function code and the vulnerability code in the vulnerability code standard dataset, the text similarity between each training function code and the patch code in the patch code standard dataset, the structural similarity between each training function code and the vulnerability code in the vulnerability code standard dataset, the structural similarity between each training function code and the patch code in the patch code standard dataset, and the code label generation model training features; and training multiple initial machine learning models based on the model training features to obtain the target machine learning model.

[0039] It should be noted that, in order to effectively improve the accuracy and robustness of the classification performed by the machine learning model, multiple machine learning models need to be used comprehensively during the training process to fully leverage their unique advantages. These models will repeatedly learn and adjust the similarity feature parameters and code labels during training, gradually mastering the key features that distinguish vulnerable code from patched code. Whether it's the potential risks in the vulnerable code or the remediation strategies in the patched code, the machine learning model can accurately capture and analyze them. The code label can be set as follows: a label of 1 is set for the portion of the training function code generated by the large code model that is similar to the vulnerable code; a label of 0 is set for the portion of the training function code generated by the large code model that is similar to the patched code. At this point, model training features can be generated based on multiple text similarities, multiple structural similarities, and code labels, and multiple initial machine learning models can be trained based on these features.

[0040] Further, step S40 includes: generating multi-dimensional similarity features based on each of the text similarities and each of the structural similarities; inputting the multi-dimensional similarity features into a target machine learning model and obtaining the classification result output by the target machine learning model; determining the code to be detected as vulnerability-free code when the classification result is no vulnerabilities; and determining the code to be detected as vulnerability code when the classification result is vulnerabilities.

[0041] It should be noted that after generating multi-dimensional similarity features, these features are used as input to the target machine learning model. The target machine learning model then outputs a classification result, which can be a label. A classification result indicating no vulnerabilities means the code to be detected is vulnerability-free and is therefore identified as vulnerability-free code. Conversely, a classification result indicating vulnerabilities exist means the code to be detected contains vulnerabilities and is therefore identified as vulnerable code. For users, this allows for timely remediation and handling of potential vulnerabilities in the code to be detected based on these results.

[0042] This embodiment acquires the vulnerability concerns of the code to be detected and generates target program slices based on these concerns. It then generates model input parameters that meet the format requirements of multiple large code models based on the target program slices, and generates new function code based on these large code models and the model input parameters. It calculates the text similarity between each new function code and the code to be detected using multiple text similarity algorithms, and calculates the structural similarity between each new function code and the code to be detected using multiple structural similarity algorithms. Finally, it performs vulnerability detection on the code to be detected based on the target machine learning model, using the text similarity and structural similarity. By fully utilizing the advantages of large code models in deeply mining the inherent semantic and structural information of the code, and the efficient identification and classification capabilities of machine learning models, this method effectively improves the efficiency and accuracy of code detection and is applicable to scenarios involving various programming languages ​​and vulnerability types. It generates new function code based on multiple large code models and then performs vulnerability detection based on the target machine learning model.

[0043] In one specific implementation, this application provides steps for generating new function code. Please refer to... Figure 2 , Figure 2 This is the second flowchart illustrating the code detection method based on a multi-dimensional model provided in this application. Step S20 includes steps S201 to S205: Step S201: Generate code segments based on consecutive lines of code in the target program slice, and obtain the position of each code segment.

[0044] It should be noted that a code segment refers to a paragraph consisting of consecutive lines of code in a slice of the target program. The more lines of code there are, the wider the generated code segment will be.

[0045] Step S202: Determine the prefixes required for multiple large code models based on the code from the start position of the entire function to the specified position, and determine the suffixes required for multiple large code models based on the code from the specified position to the end position of the entire function.

[0046] It is understandable that after obtaining the positions of each code segment, the positions of the code segments can be used as the filling positions, the code from the start position of the entire function to the filling position can be used as the prefix required by multiple large code models, and the code from the filling position to the end position of the entire function can be used as the suffix required by the large code model.

[0047] Step S203: Based on the target parameter construction strategy, independently construct model input parameters that meet the format requirements of multiple large code models.

[0048] It should be understood that the target parameter construction strategy refers to the strategy of independently constructing model input parameters that meet the format requirements for different large code models. The format requirements for model input parameters differ for different large code models. To effectively improve the accuracy of constructing model input parameters, the target parameter construction strategy can be used to independently construct model input parameters that fit each large code model. These model input parameters that meet the format requirements of multiple large code models can be represented as prompts. 检测 .

[0049] Step S204: Based on multiple large code models, independently generate fill code according to the input parameters of the models.

[0050] Understandably, after constructing model input parameters that meet the format requirements, these model input parameters are used as input to their respective large code models, so that each large code model can independently generate fill code for each model input parameter.

[0051] Step S205: Concatenate the padding code, the prefix, and the suffix to obtain a new function code.

[0052] It should be understood that the new function code refers to the code used to detect whether there are vulnerabilities in the code to be detected. After independently generating the padding code using the large code model, the new function code can be obtained by concatenating the prefixes and suffixes required by the large code model. For example, the padding code is represented as follows: <fill 检测 The prefix required for the large code model is represented as prefix. 检测 The suffix required for the large code model is suffix. 检测 The new function code can then be represented as prefix. 检测 + <fill 检测 >+suf-fix 检测 .

[0053] This embodiment generates code segments based on consecutive lines of code in the target program slice and obtains the position of each code segment; it determines the prefixes required for multiple large code models based on the code from the start position of the entire function to the specified position, and determines the suffixes required for multiple large code models based on the code from the specified position to the end position of the entire function; it independently constructs model input parameters that meet the format requirements of multiple large code models based on the target parameter construction strategy; it independently generates filler code based on the model input parameters of multiple large code models; and it concatenates the filler code, the prefixes, and the suffixes to obtain new function code. Through the above method, after obtaining the position of each code segment, the prefixes required for multiple large code models are determined by combining the start position of the entire function and the suffixes required for multiple large code models by the end position of the entire function. Then, using the independently constructed model input parameters as the input of the large code models, the large code models independently generate high-quality filler code, and finally, the filler code, prefixes, and suffixes are concatenated to form new function code, thereby effectively improving the accuracy of generating new function code.

[0054] The code detection device based on a multi-dimensional model provided in this application is described below. The code detection device based on a multi-dimensional model described below corresponds to the code detection method based on a multi-dimensional model described above. Please refer to... Figure 3 , Figure 3 This is a schematic diagram of the module structure of the code detection device based on a multi-dimensional model provided in this application embodiment, including: The generation module T10 is used to obtain the vulnerability concerns of the code to be detected and generate a target program slice based on the vulnerability concerns.

[0055] The generation module T10 is also used to generate model input parameters that meet the format requirements of multiple large code models based on the target program slice, and to generate new function code based on the model input parameters according to the multiple large code models.

[0056] The calculation module T20 is used to calculate the text similarity between each of the new function codes and the code to be detected according to multiple text similarity algorithms, and to calculate the structural similarity between each of the new function codes and the code to be detected according to multiple structural similarity algorithms.

[0057] The detection module T30 is used to perform vulnerability detection on the code to be detected based on the target machine learning model, according to the text similarity and the structural similarity.

[0058] This embodiment acquires the vulnerability concerns of the code to be detected and generates target program slices based on these concerns. It then generates model input parameters that meet the format requirements of multiple large code models based on the target program slices, and generates new function code based on these large code models and the model input parameters. It calculates the text similarity between each new function code and the code to be detected using multiple text similarity algorithms, and calculates the structural similarity between each new function code and the code to be detected using multiple structural similarity algorithms. Finally, it performs vulnerability detection on the code to be detected based on the target machine learning model, using the text similarity and structural similarity. By fully utilizing the advantages of large code models in deeply mining the inherent semantic and structural information of the code, and the efficient identification and classification capabilities of machine learning models, this method effectively improves the efficiency and accuracy of code detection and is applicable to scenarios involving various programming languages ​​and vulnerability types. It generates new function code based on multiple large code models and then performs vulnerability detection based on the target machine learning model.

[0059] It is understood that the detailed functional implementation of each of the above modules can be found in the description of the aforementioned method embodiments, and will not be repeated here.

[0060] It should be understood that the above-described device is used to execute the methods in the above embodiments. The implementation principle and technical effect of the corresponding program modules in the device are similar to those described in the above methods. The working process of the device can be referred to the corresponding process in the above methods, and will not be repeated here.

[0061] Based on the methods in the above embodiments, this application provides an electronic device, please refer to... Figure 4 , Figure 4 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application.

[0062] It should be noted that the system may include: a processor 10, a communication interface (Co based on a multi-dimensional model code detection services interface) 20, a memory 30, and a communication bus 40. The processor 10, communication interface 20, and memory 30 communicate with each other via the communication bus 40. The processor 10 can call logical instructions stored in the memory 30 to execute the methods described in the above embodiments.

[0063] Furthermore, the logical instructions in the aforementioned memory 30 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0064] Based on the methods in the above embodiments, this application provides a computer-readable storage medium storing a computer program that, when run on a processor, causes the processor to execute the methods in the above embodiments.

[0065] Based on the methods in the above embodiments, this application provides a computer program product that, when run on a processor, causes the processor to execute the methods in the above embodiments.

[0066] It is understood that the processor in the embodiments of this application can be a central processing unit, or other general-purpose processors, digital signal processors, application-specific integrated circuits, field-programmable gate arrays, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A general-purpose processor can be a microprocessor or any conventional processor.

[0067] The method steps in this application embodiment can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in random access memory, flash memory, read-only memory, programmable read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only memory, registers, hard disks, portable hard disks, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor.

[0068] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application. Those skilled in the art will readily understand that the above descriptions are merely preferred embodiments of this application and are not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A code detection method based on a multi-dimensional model, characterized in that, include: Obtain the vulnerability concerns of the code to be detected, and generate a target program slice based on the vulnerability concerns; Based on the target program slice, model input parameters that meet the format requirements of multiple large code models are generated, and new function code is generated based on the model input parameters according to the multiple large code models. The text similarity between each of the new function codes and the code to be detected is calculated using multiple text similarity algorithms, and the structural similarity between each of the new function codes and the code to be detected is calculated using multiple structural similarity algorithms. Based on the target machine learning model, vulnerability detection is performed on the code to be detected according to the text similarity and the structural similarity.

2. The method as described in claim 1, characterized in that, The step of obtaining vulnerability concerns in the code to be detected and generating a target program slice based on the vulnerability concerns includes: Obtain the code to be detected and remove the comments from the code; Obtain the user-defined variable names and function names in the code to be tested after the comments have been removed, and process the variable names and function names in a unified manner respectively; Extract the program dependency graph of the code to be detected after unified processing, and traverse the nodes in the program dependency graph; Extract target nodes from each of the nodes, and use the locations of the target nodes as vulnerability concerns in the code to be detected; Using the vulnerabilities mentioned above as the baseline, target program slices are generated by performing forward and backward slicing.

3. The method as described in claim 1, characterized in that, The step of generating model input parameters that meet the format requirements of multiple large code models based on the target program slice, and generating new function code based on the model input parameters according to the multiple large code models, includes: Code segments are generated based on consecutive lines of code in the target program slice, and the positions of each code segment are obtained; The prefixes required for multiple large code models are determined based on the code from the start position of the entire function to the specified position, and the suffixes required for multiple large code models are determined based on the code from the specified position to the end position of the entire function. Based on the target parameter construction strategy, model input parameters that meet the format requirements of multiple large code models are independently constructed. Based on multiple large code models, fill-in code is generated independently according to the input parameters of the models; The padding code, the prefix, and the suffix are concatenated to obtain the new function code.

4. The method according to any one of claims 1 to 3, characterized in that, The step of performing vulnerability detection on the code to be detected based on the target machine learning model, according to the text similarity and structural similarity of each text, includes: Multi-dimensional similarity features are generated based on the text similarity and structural similarity of each of the aforementioned texts; The multi-dimensional similarity features are input into the target machine learning model, and the classification results output by the target machine learning model are obtained. When the classification result is "no vulnerabilities," the code to be detected is determined to be vulnerability-free code. If the classification result indicates the existence of a vulnerability, the code to be detected is determined to be vulnerable code.

5. The method as described in claim 1, characterized in that, Before the step of generating new function code based on multiple large code models and the input parameters of the models, the method further includes: Generate code datasets based on code collected from multiple large-scale source databases; The code dataset is preprocessed and then classified to obtain a standard dataset of vulnerability code and a standard dataset of patch code. Identify the differences between the vulnerability code standard dataset and the patch code standard dataset, and obtain the location of the differences; The model input training parameters are generated based on the location of the differences, and the training function code is generated based on the model input training parameters. Multiple initial large models are trained based on the training parameters and training function codes of each model to obtain multiple code-based large models.

6. The method as described in claim 1, characterized in that, Before the step of performing vulnerability detection on the code to be detected based on the target machine learning model according to the text similarity and the structural similarity, the method further includes: The text similarity between each training function code and the vulnerability code in the vulnerability code standard dataset, and the text similarity between each training function code and the patch code in the patch code standard dataset are calculated using multiple text similarity algorithms. The structural similarity between each training function code and the vulnerability code in the standard dataset of vulnerability code, and the structural similarity between each training function code and the patch code in the standard dataset of patch code are calculated using multiple structural similarity algorithms. The similarity between the text of each training function code and the vulnerability code in the vulnerability code standard dataset, the similarity between the text of each training function code and the patch code in the patch code standard dataset, the structural similarity between each training function code and the vulnerability code in the vulnerability code standard dataset, the structural similarity between each training function code and the patch code in the patch code standard dataset, and the training features of the code label generation model are used. Based on the training features of the model, multiple initial machine learning models are trained to obtain the target machine learning model.

7. A code detection device based on a multi-dimensional model, characterized in that, include: The generation module is used to obtain the vulnerability concerns of the code to be detected and generate a target program slice based on the vulnerability concerns. The generation module is also used to generate model input parameters that meet the format requirements of multiple large code models based on the target program slice, and to generate new function code based on the model input parameters according to the multiple large code models; The calculation module is used to calculate the text similarity between each of the new function codes and the code to be detected according to multiple text similarity algorithms, and to calculate the structural similarity between each of the new function codes and the code to be detected according to multiple structural similarity algorithms. The detection module is used to perform vulnerability detection on the code to be detected based on the target machine learning model, according to the text similarity and the structural similarity.

8. An electronic device, characterized in that, include: At least one memory for storing computer programs; At least one processor is configured to execute a program stored in the memory, wherein when the program stored in the memory is executed, the processor is configured to perform the method as described in any one of claims 1-6.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is run on the processor, it causes the processor to perform the method as described in any one of claims 1-6.

10. A computer program product, characterized in that, When the computer program product is run on a processor, the processor causes the processor to perform the method as described in any one of claims 1-6.

Images