Vulnerability detection method and device, vulnerability detection equipment and storage medium

Abstract

The invention relates to a vulnerability detection method and device, vulnerability detection equipment and a storage medium. Firstly, a structured data model of a to-be-detected item is obtained, the structured data model is structured representation data of a source code of the to-be-detected item so as to provide basic data for taint propagation analysis, then taint propagation analysis is carried out on multiple original paths in the structured data model, and the taint propagation analysis result is obtained. The method comprises the steps of obtaining multiple candidate paths with taint sources and rule functions simultaneously from multiple original paths, then performing natural language processing on the multiple candidate paths, generating structured texts corresponding to the multiple candidate paths respectively, and enabling a vulnerability detection model to directly analyze the structured texts. And determining vulnerability detection data respectively corresponding to the plurality of candidate paths. In this way, the candidate paths are determined through taint propagation analysis, semantic analysis and logical reasoning operation are executed through the vulnerability detection model, and vulnerability detection data are determined. And the comprehensiveness and accuracy of vulnerability detection are improved.

Description

Technical Field

[0001] This disclosure relates to the field of computer security technology, and in particular to a vulnerability detection method, apparatus, vulnerability detection device, and storage medium. Background Technology

[0002] Server-Side Request Forgery (SSRF) is a high-risk vulnerability that attackers can exploit to trick server applications into making unauthorized requests to internal networks (such as intranet services or cloud platform metadata services) or arbitrary external addresses that they cannot directly access, leading to information leakage or attacks on the server application.

[0003] To improve the security of server applications, related technologies employ taint propagation analysis to identify multiple paths containing taint sources and rule functions, marking these paths as risky paths for vulnerability detection. However, this vulnerability detection method suffers from high false positive and high false negative rates and requires improvement. Summary of the Invention

[0004] To address the aforementioned technical problems, this disclosure provides a vulnerability detection method, apparatus, vulnerability detection device, and storage medium.

[0005] Firstly, this disclosure provides a vulnerability detection method applied to a vulnerability detection device, the method comprising: Obtain the structured data model of the project to be tested, wherein the structured data model is the structured representation data of the source code of the project to be tested; An taint propagation analysis is performed on multiple original paths in the structured data model to obtain multiple candidate paths that simultaneously contain taint sources and rule functions. Natural language processing is performed on each of the multiple candidate paths to generate structured text corresponding to each candidate path. The structured text is input into a preset vulnerability detection model for vulnerability semantic analysis and logical reasoning to generate vulnerability detection data corresponding to the multiple candidate paths.

[0006] Secondly, this disclosure provides a vulnerability detection device configured in a vulnerability detection equipment, the device comprising: The first acquisition module is used to acquire the structured data model of the item to be inspected, wherein the structured data model is the structured representation data of the source code of the item to be inspected; The second acquisition module is used to perform taint propagation analysis on multiple original paths in the structured data model, and to acquire multiple candidate paths that simultaneously contain taint sources and rule functions from the multiple original paths; The first generation module is used to perform natural language processing on the multiple candidate paths respectively to generate structured text corresponding to the multiple candidate paths respectively; The first determining module is used to input the structured text into a preset vulnerability detection model for vulnerability semantic analysis and logical reasoning, and generate vulnerability detection data corresponding to the multiple candidate paths respectively.

[0007] Thirdly, this disclosure also provides a vulnerability detection device, which includes: One or more processors; Storage device for storing one or more programs. When one or more programs are executed by one or more processors, the one or more processors implement the methods provided in the first aspect.

[0008] Fourthly, embodiments of this disclosure also provide a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the method provided in the first aspect.

[0009] The technical solution provided in this disclosure has the following advantages compared with the prior art: This disclosure discloses a vulnerability detection method, apparatus, device, and storage medium. First, a structured data model of the project to be detected is acquired. This structured data model is a structured representation of the project's source code, providing foundational data for taint propagation analysis. Then, taint propagation analysis is performed on multiple original paths in the structured data model to identify multiple candidate paths that simultaneously contain taint sources and rule functions. Next, natural language processing is applied to each candidate path to generate structured text corresponding to each path, which is then directly analyzed by the vulnerability detection model to determine the vulnerability detection data corresponding to each path. In this way, taint propagation analysis is used to obtain all candidate paths that may pose vulnerability risks. Then, the semantic analysis and logical reasoning capabilities of the vulnerability detection model are used to perform deep semantic analysis and logical reasoning on each candidate path, thereby determining the final vulnerability detection result for the project. Therefore, the comprehensiveness and accuracy of vulnerability detection are improved. Attached Figure Description

[0010] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0011] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0012] Figure 1 A flowchart illustrating a vulnerability detection method provided in an embodiment of this disclosure; Figure 2 A flowchart illustrating another vulnerability detection method provided in this embodiment of the disclosure; Figure 3 A flowchart illustrating yet another vulnerability detection method provided in this disclosure embodiment; Figure 4 A flowchart illustrating another vulnerability detection method provided in this disclosure embodiment; Figure 5 A logical schematic diagram of a vulnerability detection method provided in an embodiment of this disclosure; Figure 6 This is a schematic diagram of the structure of a vulnerability detection device provided in an embodiment of the present disclosure; Figure 7 This is a schematic diagram of the structure of a vulnerability detection device provided in an embodiment of this disclosure. Detailed Implementation

[0013] To better understand the above-mentioned objectives, features, and advantages of this disclosure, the solutions disclosed herein will be further described below. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0014] Numerous specific details are set forth in the following description in order to provide a full understanding of this disclosure, but this disclosure may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some, and not all, of the embodiments of this disclosure.

[0015] The taint propagation analysis method used in related technologies can mark paths containing both taint sources and rule functions as risky paths with vulnerabilities. However, lacking an understanding of the business logic and semantic context of the source code, it is prone to false positives. For example, a network address, although originating from a user, should not be marked as a risky path after rigorous and effective security checks. However, the taint propagation analysis method might mark this as a risky path, clearly indicating a false positive problem.

[0016] Furthermore, taint propagation analysis methods in related technologies struggle to handle non-explicit data streams, leading to missed detections. For example, user input might be stored in a database or cache and then retrieved in another asynchronous task for use in network requests; or the network address construction logic might be extremely complex, exceeding the default tracing depth of static analysis.

[0017] To solve the above problems, the following will be combined with... Figures 1-5 The vulnerability detection method provided in this disclosure is described. In this disclosure, the vulnerability detection method can be executed by a vulnerability detection device. The vulnerability detection device can be an electronic device or server at any stage of the software development lifecycle.

[0018] In one example, in a code submission and build scenario, an electronic device or server with code development and build capabilities is used as a vulnerability detection device. This vulnerability detection device automatically performs security scans during the code submission and build process to identify vulnerabilities in the source code.

[0019] In one example, in a security audit scenario involving a large codebase, electronic devices or servers with security auditing capabilities are used as vulnerability detection devices. These devices are then used to conduct regular, in-depth security vulnerability audits of the large codebase to identify vulnerabilities in the source code.

[0020] In one example, in a code repository scanning scenario, an electronic device or server with code repository scanning capabilities is used as a vulnerability detection device. This vulnerability detection device is then used to perform security monitoring on existing and newly submitted code in the code repository in order to identify vulnerabilities in the source code.

[0021] In one example, in a third-party component review scenario, an electronic device or server with third-party component review capabilities is used as a vulnerability detection device. This vulnerability detection device is then used to check for vulnerabilities in open-source or commercial software components before they are introduced.

[0022] Figure 1 A flowchart illustrating a vulnerability detection method provided in an embodiment of this disclosure is shown.

[0023] like Figure 1 As shown, the vulnerability detection method may include the following steps.

[0024] S110. Obtain the structured data model of the item to be tested, wherein the structured data model is the structured representation data of the source code of the item to be tested.

[0025] In this embodiment, at any stage of the software development lifecycle, the vulnerability detection device acquires the source code of the project to be detected, performs structural analysis and dependency analysis on the source code, and determines the structured representation data of the source code as a structured data model.

[0026] Since a structured data model is a structured representation of source code, it can be understood as a queryable code database. Specifically, the vulnerability detection device generates a structured data model of the source code through a project preprocessing module.

[0027] Optionally, the specific form of the structured data model can be any one of the following: Abstract Syntax Tree (AST), Control Flow Graph (CFG), or Data Flow Graph (DFG).

[0028] S120. Perform taint propagation analysis on multiple original paths in the structured data model, and obtain multiple candidate paths that simultaneously contain taint sources and rule functions from the multiple original paths.

[0029] In this embodiment, the vulnerability detection device has a built-in static analysis engine (such as a CodeQL query engine) that performs global taint propagation analysis on the structured data model based on preset rules. Specifically, it searches for taint sources in the structured data model and uses the taint source as the starting point to search for the rule function on its path, so as to obtain multiple candidate paths where both taint sources and rule functions exist.

[0030] Here, taint sources can be understood as user-controllable input parameters. Rule functions can be understood as functions that initiate network requests.

[0031] Candidate paths refer to paths or branches in a structured data model that simultaneously contain taint sources and rule functions. Regardless of whether a cleanup function exists, such paths or branches can be considered as candidate paths.

[0032] S130. Perform natural language processing on the multiple candidate paths respectively to generate structured text corresponding to each candidate path.

[0033] Since candidate paths are a structured representation of data, vulnerability detection devices cannot directly perform semantic analysis on them. Therefore, it is necessary to perform natural language processing on multiple candidate paths to generate structured text, which will facilitate the vulnerability detection device to perform semantic analysis based on the structured text to determine the final vulnerability detection data.

[0034] Structured text refers to text expressed in natural language that can be directly semantically analyzed, thereby transforming the structured representation of candidate paths into a natural language description.

[0035] S140. Input structured text into the preset vulnerability detection model, perform vulnerability semantic analysis and logical reasoning, and generate vulnerability detection data corresponding to multiple candidate paths.

[0036] Considering that the taint propagation analysis process lacks the ability to understand business logic and semantic context, vulnerability detection equipment can input structured text into a preset vulnerability detection model. This model can then leverage its powerful code semantic understanding and logical reasoning capabilities to perform vulnerability semantic analysis on the structured text and determine the vulnerability detection data corresponding to multiple candidate paths.

[0037] The preset vulnerability detection model can be a neural network model capable of semantic understanding and logical reasoning of natural language.

[0038] Optionally, the preset vulnerability detection model can be a Large Language Model (LLM) or other models.

[0039] The vulnerability detection data includes vulnerability types in natural language and the confidence level of each vulnerability type.

[0040] Understandably, since the taint propagation analysis process obtains global candidate paths, and through natural language processing on multiple candidate paths, it can obtain the global structured text of the project to be detected, providing comprehensive data for the vulnerability detection model to perform semantic analysis and logical reasoning, thereby accurately and comprehensively detecting vulnerabilities and improving the comprehensiveness and accuracy of vulnerability detection.

[0041] A vulnerability detection method according to an embodiment of this disclosure first obtains a structured data model of the project to be detected. This structured data model is a structured representation of the source code of the project to be detected, providing foundational data for taint propagation analysis. Then, taint propagation analysis is performed on multiple original paths in the structured data model to obtain multiple candidate paths that simultaneously contain taint sources and rule functions. Next, natural language processing is performed on each candidate path to generate structured text corresponding to each candidate path, which is then directly analyzed by the vulnerability detection model to determine the vulnerability detection data corresponding to each candidate path. In this way, taint propagation analysis is used to obtain all candidate paths that may have vulnerability risks. Then, the semantic analysis and logical reasoning capabilities of the vulnerability detection model are used to perform deep semantic analysis and logical reasoning on each candidate path, thereby determining the final vulnerability detection result for the project. Therefore, the comprehensiveness and accuracy of vulnerability detection are improved.

[0042] In another embodiment of this application, the implementation method of S110 will be explained in detail.

[0043] Figure 2 A flowchart illustrating another vulnerability detection method provided in an embodiment of this disclosure is shown.

[0044] like Figure 2 As shown, the vulnerability detection method may include the following steps.

[0045] S210. Perform structural analysis on the source code of the project to be tested to obtain the code structure information of the project to be tested.

[0046] The code structure information can be understood as a structured syntax tree. In other words, the structure analysis process is equivalent to parsing the source code into a structured syntax tree.

[0047] In some embodiments, the specific implementation method of S210 includes, but is not limited to, the following methods: performing lexical analysis on the source code of the project to be detected to generate syntactic constituent units of the source code; performing syntactic analysis on the syntactic constituent units of the source code to generate code structure information of the project to be detected.

[0048] In this context, the grammatical constituent units can be understood as a linear sequence of basic grammatical units, such as a token sequence.

[0049] In this way, by performing lexical analysis and syntax analysis on the source code in sequence, the source code can be parsed into a structured syntax tree.

[0050] S220. Perform dependency analysis on the code structure information of the project to be tested to obtain the structured data model of the project to be tested.

[0051] The structured data model is a structured representation of the source code of the project under test. In other words, the dependency analysis process is equivalent to transforming fragmented code structure information into a complete program view, thus obtaining the structured data model.

[0052] In some embodiments, the specific implementation method of S220 includes, but is not limited to, the following methods: obtaining external dependency information of code structure information; combining the code structure information and external dependency information accordingly to generate a structured data model of the project to be detected.

[0053] External dependency information can include the location and version of third-party libraries, frameworks, and system modules. Specifically, by incorporating external dependency information into the analysis, the code structure information and external dependency information are further combined to generate a structured data model of the project under test.

[0054] In this way, by performing dependency analysis on the code structure information of the project to be tested, data flow tracing across files and modules can be achieved.

[0055] S230. Perform taint propagation analysis on multiple original paths in the structured data model, and obtain multiple candidate paths that simultaneously contain taint sources and rule functions from the multiple original paths.

[0056] S240. Perform natural language processing on the multiple candidate paths respectively to generate structured text corresponding to each candidate path.

[0057] S250. Input structured text into the preset vulnerability detection model, perform vulnerability semantic analysis and logical reasoning, and generate vulnerability detection data corresponding to multiple candidate paths.

[0058] The specific implementation methods of S230~S250 can be found in the description of the above embodiments, and will not be repeated here.

[0059] In another embodiment of this application, the implementation method of S120 will be explained in detail.

[0060] Figure 3 A flowchart illustrating another vulnerability detection method provided in this disclosure is shown.

[0061] like Figure 3 As shown, the vulnerability detection method may include the following steps.

[0062] S310. Obtain the structured data model of the item to be tested, wherein the structured data model is the structured representation data of the source code of the item to be tested.

[0063] The structured data model contains the path structure for each original path.

[0064] S320. Traverse the multiple original paths respectively, and obtain the multiple paths to be analyzed from the multiple original paths that contain taint sources.

[0065] In this embodiment, the vulnerability detection device can obtain a pre-built taint source rule base, which is compatible with multiple programming languages. It can also obtain code that exists in the taint source rule base from multiple original paths as taint sources and use the original paths containing taint sources as paths to be analyzed.

[0066] S330. Starting from the taint sources of the path to be analyzed, based on the path structure of the path to be analyzed, obtain multiple paths to be analyzed that have regular functions, as multiple candidate paths.

[0067] In this embodiment, the vulnerability detection device can obtain a pre-built rule function library, and starting from the taint source of the path to be analyzed, traverse according to the path structure of the path to be analyzed, obtain the code existing in the rule function library as rule functions, and take the path to be analyzed containing tainted functions as candidate paths.

[0068] In some embodiments, the specific implementation method of S330 includes, but is not limited to, the following method: starting from the taint source of the path to be analyzed, traversing according to the path structure of the path to be analyzed, and detecting whether there is a cleanup function on the path to be analyzed; if there is a cleanup function on the path to be analyzed, skip executing the cleanup function and continue to search for a rule function in the path to be analyzed; and take multiple paths to be analyzed that have a rule function as multiple candidate paths.

[0069] The cleansing function is the logic code that validates or filters user input; in other words, the cleansing function can be used to eliminate risks associated with user input.

[0070] Optionally, the purification function may include, but is not limited to, whitelist verification rules, protocol restriction rules, address filtering rules, and security encapsulation rules.

[0071] Understandably, considering that purification functions may exist along the paths in a structured data model, executing these functions could filter out some paths. To identify all potential paths from taint sources to rule functions, during the traversal of taint sources along the path to be analyzed, if a purification function is identified, its execution can be skipped (i.e., the purification function is disabled), and the search for rule functions continues along the path to be analyzed. This allows for the acquisition of candidate paths that simultaneously contain both taint sources and rule functions.

[0072] In this way, when performing taint propagation analysis on paths in a structured data model, disabling the sanitization function can identify all potential paths from the taint source to the rule function, avoiding the loss of some meaningful paths due to the enabling of the sanitization function.

[0073] S340. Perform natural language processing on the multiple candidate paths respectively to generate structured text corresponding to each candidate path.

[0074] S350. Input structured text into the preset vulnerability detection model, perform vulnerability semantic analysis and logical reasoning, and generate vulnerability detection data corresponding to multiple candidate paths.

[0075] The specific implementation methods of S340~S350 can be found in the description of the above embodiments, and will not be repeated here.

[0076] In another embodiment of this application, the implementation method of S130 will be explained in detail.

[0077] In some embodiments, the specific implementation method of S130 includes, but is not limited to, the following methods: S1301, performing structured parsing on the path structures corresponding to the multiple candidate paths respectively, and obtaining structured parsing data corresponding to the multiple candidate paths respectively; S1302, performing natural language generation processing on the structured parsing data corresponding to the multiple candidate paths respectively, and generating structured text corresponding to the multiple candidate paths respectively.

[0078] In essence, structured parsed data is a structured intermediate representation.

[0079] Specifically, vulnerability detection equipment uses automated prompt word engineering to perform program analysis on the path structure corresponding to multiple candidate paths, thereby obtaining structured parsing data. Then, the structured representation of the parsed data is converted into a natural language representation, thus obtaining structured text.

[0080] To make the vulnerability detection process applicable to specific business scenarios, before executing S130, the business background code corresponding to multiple candidate paths can be obtained first. The specific implementation method of S130 is as follows: perform natural language processing on multiple candidate paths and the business background code corresponding to multiple candidate paths to generate structured text corresponding to multiple candidate paths.

[0081] The business background code can be understood as the business semantic context of the candidate path.

[0082] Optionally, the business background code may include the background code for the tainted source and the background code for the rule function. For example, the business background code may include the interface name of the tainted source, the class name of the tainted source, the source of the parameters of the tainted source, the dangerous call function of the rule function, the complete call chain of the candidate path, and the suggestion information.

[0083] Specifically, after obtaining the business background code corresponding to multiple candidate paths, the vulnerability detection device uses automated prompt word engineering to perform program analysis on the path structure of multiple candidate paths and their corresponding business background code, obtaining structured parsing data of the path structure and structured parsing data of the business background code. Then, the structured expression of the structured parsing data is converted into a natural language expression, thereby obtaining structured text.

[0084] In this way, by performing structured analysis and natural language generation on the path structure of candidate paths and their corresponding business background code, structured text suitable for specific business scenarios and easy to perform semantic analysis can be obtained.

[0085] In another embodiment of this application, the implementation method of S140 will be explained in detail.

[0086] Figure 4 A flowchart illustrating another vulnerability detection method provided in an embodiment of this disclosure is shown.

[0087] like Figure 4 As shown, the vulnerability detection method may include the following steps.

[0088] S410. Obtain the structured data model of the item to be tested, wherein the structured data model is the structured representation data of the source code of the item to be tested.

[0089] S420. Perform taint propagation analysis on multiple original paths in the structured data model, and obtain multiple candidate paths that simultaneously contain taint sources and rule functions from the multiple original paths.

[0090] S430. Perform natural language processing on the multiple candidate paths respectively to generate structured text corresponding to each candidate path.

[0091] The specific implementation methods of S410~S430 can be found in the description of the above embodiments, and will not be repeated here.

[0092] S440, A semantic understanding network based on a vulnerability detection model performs semantic understanding on structured text to obtain semantic understanding information of the structured text.

[0093] In this embodiment, the vulnerability detection device utilizes a semantic understanding network to perform semantic role processing on structured text in order to achieve semantic understanding and obtain semantic understanding information of the structured text.

[0094] S450, a pattern recognition network based on a vulnerability detection model, performs vulnerability pattern matching on semantic understanding information to obtain vulnerability type and vulnerability type confidence.

[0095] In this embodiment, the vulnerability detection device utilizes a pattern recognition network and performs vulnerability pattern matching on semantically understood information based on the vulnerability pattern matching principle of co-occurrence statistics, and outputs the vulnerability type and the confidence level of the vulnerability type.

[0096] S460, a contextual reasoning network based on a vulnerability detection model, performs factual simulation and reasoning on vulnerability types and their confidence levels to obtain vulnerability detection data corresponding to multiple candidate paths.

[0097] In this embodiment, the vulnerability detection device utilizes a contextual reasoning network, based on counterfactual simulation and multi-hop reasoning principles, to perform factual simulation and reasoning on vulnerability types and their confidence levels, and to perform uncertainty modeling based on the simulation and reasoning results, thereby obtaining vulnerability detection data in natural language form.

[0098] In this way, by sequentially performing semantic understanding, vulnerability pattern matching, fact simulation, and reasoning on structured text through the vulnerability detection model, the vulnerability type and corresponding confidence level in the natural language form of the candidate path are determined and used as vulnerability detection data. This achieves the combination of the deep semantic understanding and logical reasoning capabilities of the vulnerability detection model, thereby improving the accuracy of vulnerability detection.

[0099] In another embodiment of this application, after executing S140, operations such as risk rating, report generation, and feedback optimization can also be performed.

[0100] In one embodiment, after executing S140, the method further includes: S1, obtaining a target path corresponding to the same vulnerability type from multiple candidate paths contained in the vulnerability detection data, and determining multiple confidence levels corresponding to the target path; S2, performing a danger level analysis on the target path based on the multiple confidence levels corresponding to the target path, and obtaining the target danger level of the target path.

[0101] Considering that multiple candidate paths may correspond to the same vulnerability type, in order to provide users with concise vulnerability detection results, the vulnerability detection device can use multiple candidate paths corresponding to the same vulnerability type as target paths, and use the confidence of these candidate paths as the confidence of the target path. Then, it can combine the multiple confidence levels corresponding to the target path to analyze the risk level and obtain the target risk level of the target path.

[0102] The specific implementation methods of S2 include, but are not limited to, the following: obtaining the maximum confidence score from multiple confidence scores corresponding to the target path as the target confidence score of the target path; or, performing a weighted summation of multiple confidence scores corresponding to the target path to obtain the target confidence score of the target path; and obtaining the hazard level corresponding to the target confidence score from different hazard levels based on the correspondence between different confidence scores and different hazard levels as the target hazard level of the target path.

[0103] In this way, by using a confidence-weighted method or selecting the maximum confidence method, the target confidence level of the same vulnerability type can be obtained. Then, by combining the correspondence between different confidence levels and different risk levels, risk rating can be performed to determine the final risk level of the target path.

[0104] In one embodiment, after executing S140, the method further includes: generating a vulnerability analysis report for the project to be detected based on the vulnerability detection data corresponding to the multiple candidate paths respectively; wherein the vulnerability analysis report includes one or more of the following information: vulnerability type, vulnerability risk level, vulnerability location, vulnerability data flow information, vulnerability analysis reason information, vulnerability remediation suggestions, and vulnerability attack examples for the project to be analyzed.

[0105] Understandably, since vulnerability detection data is in natural language format, vulnerability analysis reports can be structured text in natural language or visual data in the form of data flow diagrams. Vulnerability detection devices can then present vulnerability analysis reports to users in either visual or structured text format, making it easier for users to understand and maintain their code.

[0106] In one embodiment, after generating a vulnerability analysis report for the project to be detected, the method further includes: displaying the vulnerability analysis report; receiving user feedback on the vulnerability analysis report; and updating the vulnerability detection process based on the feedback.

[0107] Understandably, after the vulnerability detection device displays the vulnerability analysis report, it can receive user feedback on the report and update the taint propagation analysis process, vulnerability semantic analysis, and logical reasoning based on this feedback, so as to continuously optimize the vulnerability detection method.

[0108] In another embodiment of this application, the overall logic of the vulnerability detection method is explained.

[0109] Figure 5 A logical schematic diagram of a vulnerability detection method provided in an embodiment of this disclosure is shown.

[0110] like Figure 5 As shown, the vulnerability detection method may include the following steps.

[0111] S510, Perform project preprocessing operations.

[0112] The specific implementation methods of S510 include, but are not limited to, the following: performing structural analysis on the source code of the project to be tested to obtain the code structure information of the project to be tested; performing dependency analysis on the code structure information of the project to be tested to obtain the structured data model of the project to be tested.

[0113] S520, Perform static analysis.

[0114] The specific implementation methods of S520 include, but are not limited to, the following: performing taint propagation analysis on multiple original paths in the structured data model, and obtaining multiple candidate paths from the multiple original paths that simultaneously contain taint sources and rule functions.

[0115] S530, Perform the prompt word engineering processing operation.

[0116] One implementation method of S530 includes, but is not limited to, the following: performing natural language processing on multiple candidate paths to generate structured text corresponding to each candidate path.

[0117] Another implementation method of S530 includes, but is not limited to, the following: obtaining the business background code corresponding to each of the multiple candidate paths; performing natural language processing on the multiple candidate paths and the business background code corresponding to each of the multiple candidate paths to generate structured text corresponding to each of the multiple candidate paths.

[0118] S540, Perform semantic analysis operation.

[0119] The specific implementation methods of S540 include, but are not limited to, the following: using a preset vulnerability detection model, performing vulnerability semantic analysis and logical reasoning on structured text to determine the vulnerability detection data corresponding to multiple candidate paths.

[0120] S550, Perform hybrid decision processing.

[0121] The specific implementation method of S550 includes, but is not limited to, the following methods: from multiple candidate paths contained in the vulnerability detection data, obtain the target path corresponding to the same vulnerability type, and determine multiple confidence levels corresponding to the target path; based on the multiple confidence levels corresponding to the target path, perform a risk level analysis on the target path to obtain the target risk level of the target path.

[0122] S560, Execution Report and Remediation.

[0123] The specific implementation methods of S560 include, but are not limited to, the following: generating a vulnerability analysis report for the project to be detected based on the vulnerability detection data corresponding to multiple candidate paths.

[0124] S570, Perform feedback optimization processing.

[0125] The specific implementation methods of S570 include, but are not limited to, the following: displaying vulnerability analysis reports; receiving user feedback on vulnerability analysis reports; and updating the vulnerability detection process based on the feedback.

[0126] This disclosure also provides a vulnerability detection device for implementing the above-described vulnerability detection method, which will be described below in conjunction with... Figure 6 This will be explained in more detail. In this embodiment of the disclosure, the vulnerability detection device can be executed by a vulnerability detection equipment. The vulnerability detection equipment can be an electronic device or server at various stages of the software development lifecycle.

[0127] Figure 6 A schematic diagram of the structure of a vulnerability detection device provided in an embodiment of this disclosure is shown.

[0128] like Figure 6 As shown, the vulnerability detection device 600 may include: The first acquisition module 610 is used to acquire the structured data model of the item to be inspected, wherein the structured data model is the structured representation data of the source code of the item to be inspected; The second acquisition module 620 is used to perform taint propagation analysis on multiple original paths in the structured data model, and to acquire multiple candidate paths that simultaneously contain taint sources and rule functions from the multiple original paths; The first generation module 630 is used to perform natural language processing on the multiple candidate paths respectively to generate structured text corresponding to the multiple candidate paths respectively; The first determining module 640 is used to input the structured text into a preset vulnerability detection model for vulnerability semantic analysis and logical reasoning, and generate vulnerability detection data corresponding to the multiple candidate paths respectively.

[0129] A vulnerability detection apparatus according to an embodiment of this disclosure first acquires a structured data model of the project to be detected. This structured data model is a structured representation of the source code of the project to be detected, providing foundational data for taint propagation analysis. Then, taint propagation analysis is performed on multiple original paths in the structured data model to obtain multiple candidate paths that simultaneously contain taint sources and rule functions. Next, natural language processing is performed on each candidate path to generate structured text corresponding to each candidate path, which is then directly analyzed by the vulnerability detection model to determine the vulnerability detection data corresponding to each candidate path. In this way, taint propagation analysis is used to obtain all candidate paths that may have vulnerability risks. Then, the semantic analysis and logical reasoning capabilities of the vulnerability detection model are used to perform deep semantic analysis and logical reasoning on each candidate path, thereby determining the final vulnerability detection result for the project. Therefore, the comprehensiveness and accuracy of vulnerability detection are improved.

[0130] In some embodiments of this disclosure, the first acquisition module 610 includes: The structural analysis unit is used to perform structural analysis on the source code of the project to be tested, and obtain the code structure information of the project to be tested. The dependency analysis unit is used to perform dependency analysis on the code structure information of the project to be tested, and to obtain the structured data model of the project to be tested.

[0131] In some embodiments of this disclosure, the structural analysis unit is specifically used for: Lexical analysis is performed on the source code of the item to be detected to generate syntactic constituent units of the source code; Syntactic analysis is performed on the syntactic constituent units of the source code to generate the code structure information of the item to be detected.

[0132] In some embodiments of this disclosure, the dependency analysis unit is specifically used for: Obtain the external dependency information of the code structure information; The code structure information and the external dependency information are combined accordingly to generate a structured data model of the project to be tested.

[0133] In some embodiments of this disclosure, the structured data model includes the path structure of each original path; the second acquisition module 620 includes: The traversal unit is used to traverse the multiple original paths respectively and obtain multiple paths to be analyzed from the multiple original paths that contain taint sources; The first acquisition unit is used to acquire multiple paths with regular functions based on the path structure of the path to be analyzed, starting from the taint source of the path to be analyzed, as the multiple candidate paths.

[0134] In some embodiments of this disclosure, the first acquisition unit is specifically used for: Starting from the taint source of the path to be analyzed, the path is traversed according to its structure to detect whether a cleanup function exists on the path to be analyzed. The cleanup function refers to the logic code that validates or filters user input. If the purification function exists on the path to be analyzed, then skip executing the purification function and continue searching for the rule function in the path to be analyzed; Multiple paths to be analyzed that contain the aforementioned rule function are selected as multiple candidate paths.

[0135] In some embodiments of this disclosure, the first generation module 630 includes: The structured parsing unit is used to perform structured parsing on the path structures corresponding to the multiple candidate paths respectively, and obtain the structured parsing data corresponding to the multiple candidate paths respectively. The natural language generation unit is used to perform natural language generation processing on the structured parsed data corresponding to the multiple candidate paths, and generate structured text corresponding to the multiple candidate paths.

[0136] In some embodiments of this disclosure, the device further includes: The third acquisition module is used to acquire the business background code corresponding to the multiple candidate paths respectively; The first generation module 630 is specifically used to perform natural language processing on the multiple candidate paths and the business background code corresponding to the multiple candidate paths respectively, and generate structured text corresponding to the multiple candidate paths respectively.

[0137] In some embodiments of this disclosure, the first determining module 540 includes: A semantic understanding unit is used to perform semantic understanding on the structured text based on the semantic understanding network of the vulnerability detection model, and obtain the semantic understanding information of the structured text. The vulnerability pattern matching unit is used to perform vulnerability pattern matching on the semantic understanding information based on the pattern recognition network of the vulnerability detection model to obtain the vulnerability type and the confidence level of the vulnerability type. The inference unit is used to perform factual simulation and inference on the vulnerability type and the confidence level of the vulnerability type based on the contextual inference network of the vulnerability detection model, so as to obtain vulnerability detection data corresponding to the multiple candidate paths respectively.

[0138] In some embodiments of this disclosure, the device further includes: The fourth acquisition module is used to acquire a target path corresponding to the same vulnerability type from the multiple candidate paths included in the vulnerability detection data, and determine multiple confidence levels corresponding to the target path; The hazard level analysis module is used to perform hazard level analysis on the target path based on multiple confidence levels corresponding to the target path, and obtain the target hazard level of the target path.

[0139] In some embodiments of this disclosure, the hazard level analysis module includes: The second acquisition unit is configured to acquire the maximum confidence score from multiple confidence scores corresponding to the target path, and use it as the target confidence score of the target path; or... The third acquisition unit is used to perform a weighted summation of multiple confidence scores corresponding to the target path to obtain the target confidence score of the target path; The fourth acquisition unit is used to acquire the danger level corresponding to the target confidence level from the different danger levels according to the correspondence between different confidence levels and different danger levels, and use it as the target danger level of the target path.

[0140] It should be noted that, Figure 6 The vulnerability detection device 600 shown can perform... Figures 1-5 The various steps in the method embodiment shown are implemented. Figures 1-5 The processes and effects in the method embodiments shown are not described in detail here.

[0141] Figure 7 A schematic diagram of the structure of a vulnerability detection device provided in an embodiment of this disclosure is shown.

[0142] like Figure 7 As shown, the vulnerability detection device may include a processor 701 and a memory 702 storing computer program instructions.

[0143] Specifically, the processor 701 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0144] Memory 702 may include a large-capacity storage for information or instructions. For example, and not limitingly, memory 702 may include a hard disk drive (HDD), a floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 702 may include removable or non-removable (or fixed) media. Where appropriate, memory 702 may be internal or external to the integrated gateway device. In a particular embodiment, memory 702 is a non-volatile solid-state memory. In a particular embodiment, memory 702 includes read-only memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (Electrically Programmable ROM, EPROM), an electrically erasable programmable PROM (EEPROM), an electrically alterable ROM (EAROM), or flash memory, or a combination of two or more of these.

[0145] The processor 701 acquires and executes computer program instructions stored in the memory 702 to perform the steps of the vulnerability detection method provided in the embodiments of this disclosure.

[0146] In one example, the vulnerability detection device may also include a transceiver 703 and a bus 704. For example, Figure 7 As shown, the processor 701, memory 702 and transceiver 703 are connected via bus 704 and communicate with each other.

[0147] Bus 704 includes hardware, software, or both. For example, and not limitingly, a bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industrial Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a MicroChannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or a combination of two or more of these. Where appropriate, bus 704 may include one or more buses. Although specific buses are described and illustrated in the embodiments of this application, this application considers any suitable bus or interconnection.

[0148] The following are embodiments of a computer-readable storage medium provided in this disclosure. This computer-readable storage medium belongs to the same inventive concept as the vulnerability detection methods in the above embodiments. For details not described in detail in the embodiments of the computer-readable storage medium, please refer to the embodiments of the above vulnerability detection methods.

[0149] This embodiment provides a storage medium containing computer-executable instructions. When executed by a computer processor, these instructions are used to perform a vulnerability detection method applied to a vulnerability detection device. The method includes: Obtain the structured data model of the project to be tested, wherein the structured data model is the structured representation data of the source code of the project to be tested; An taint propagation analysis is performed on multiple original paths in the structured data model to obtain multiple candidate paths that simultaneously contain taint sources and rule functions. Natural language processing is performed on each of the multiple candidate paths to generate structured text corresponding to each candidate path. The structured text is input into a preset vulnerability detection model for vulnerability semantic analysis and logical reasoning to generate vulnerability detection data corresponding to the multiple candidate paths.

[0150] Of course, the computer-executable instructions provided in the embodiments of this disclosure are not limited to the above-described method operations, but can also perform related operations in the vulnerability detection method provided in any embodiment of this disclosure.

[0151] Based on the above description of the implementation methods, those skilled in the art can clearly understand that this disclosure can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer cloud platform (which may be a personal computer, server, or network cloud platform, etc.) to execute the vulnerability detection methods provided in the various embodiments of this disclosure.

[0152] Note that the above description is merely a preferred embodiment and the technical principles employed in this disclosure. Those skilled in the art will understand that this disclosure is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of this disclosure. Therefore, although this disclosure has been described in detail through the above embodiments, it is not limited to the above embodiments. Many other equivalent embodiments may be included without departing from the concept of this disclosure, and the scope of this disclosure is determined by the scope of the appended claims.

Claims

1. A vulnerability detection method, characterized in that, Applied to vulnerability detection equipment, the method includes: Obtain the structured data model of the project to be tested, wherein the structured data model is the structured representation data of the source code of the project to be tested; An taint propagation analysis is performed on multiple original paths in the structured data model to obtain multiple candidate paths that simultaneously contain taint sources and rule functions. Natural language processing is performed on each of the multiple candidate paths to generate structured text corresponding to each candidate path. The structured text is input into a preset vulnerability detection model for vulnerability semantic analysis and logical reasoning to generate vulnerability detection data corresponding to the multiple candidate paths.

2. The method according to claim 1, characterized in that, The process of obtaining the structured data model of the item to be detected includes: Structural analysis is performed on the source code of the project to be tested to obtain the code structure information of the project to be tested. Dependency analysis is performed on the code structure information of the project to be tested to obtain the structured data model of the project to be tested.

3. The method according to claim 2, characterized in that, The structural analysis of the source code of the project to be tested, to obtain the code structure information of the project to be tested, includes: Lexical analysis is performed on the source code of the item to be detected to generate syntactic constituent units of the source code; Syntactic analysis is performed on the syntactic constituent units of the source code to generate the code structure information of the item to be detected.

4. The method according to claim 2, characterized in that, The process of performing dependency analysis on the code structure information of the project to be tested to obtain a structured data model of the project to be tested includes: Obtain the external dependency information of the code structure information; The code structure information and the external dependency information are combined accordingly to generate a structured data model of the project to be tested.

5. The method according to claim 1, characterized in that, The structured data model contains the path structure for each original path; The step of performing taint propagation analysis on multiple original paths in the structured data model, and obtaining multiple candidate paths from the multiple original paths that simultaneously contain taint sources and rule functions, includes: The multiple original paths are traversed separately to obtain multiple paths containing taint sources for analysis. Starting from the taint sources of the path to be analyzed, and based on the path structure of the path to be analyzed, multiple paths with regular functions are obtained as multiple candidate paths.

6. The method according to claim 5, characterized in that, Starting from the taint sources of the path to be analyzed, and based on the path structure of the path to be analyzed, multiple paths with regular functions are obtained as multiple candidate paths, including: Starting from the taint source of the path to be analyzed, the path is traversed according to its structure to detect whether a cleanup function exists on the path to be analyzed. The cleanup function refers to the logic code that validates or filters user input. If the purification function exists on the path to be analyzed, then skip executing the purification function and continue searching for the rule function in the path to be analyzed; Multiple paths to be analyzed that contain the aforementioned rule function are selected as multiple candidate paths.

7. The method according to claim 1, characterized in that, The step of performing natural language processing on the multiple candidate paths to generate structured text corresponding to each candidate path includes: The path structures corresponding to the multiple candidate paths are subjected to structured parsing to obtain the structured parsing data corresponding to the multiple candidate paths. Natural language generation processing is performed on the structured parsed data corresponding to the multiple candidate paths to generate structured text corresponding to the multiple candidate paths.

8. The method according to claim 1, characterized in that, Before performing natural language processing on the multiple candidate paths to generate structured text corresponding to each of the multiple candidate paths, the method further includes: Obtain the business background code corresponding to each of the multiple candidate paths; The step of performing natural language processing on the multiple candidate paths to generate structured text corresponding to each candidate path includes: Natural language processing is performed on the multiple candidate paths and the business background code corresponding to each of the multiple candidate paths to generate structured text corresponding to each of the multiple candidate paths.

9. The method according to claim 1, characterized in that, The step of inputting the structured text into a preset vulnerability detection model for vulnerability semantic analysis and logical reasoning to generate vulnerability detection data corresponding to the multiple candidate paths includes: Based on the semantic understanding network of the vulnerability detection model, the structured text is semantically understood to obtain the semantic understanding information of the structured text; Based on the pattern recognition network of the vulnerability detection model, vulnerability pattern matching is performed on the semantic understanding information to obtain the vulnerability type and the confidence level of the vulnerability type; Based on the contextual reasoning network of the vulnerability detection model, factual simulation and reasoning are performed on the vulnerability type and the confidence level of the vulnerability type to obtain vulnerability detection data corresponding to the multiple candidate paths.

10. The method according to claim 1, characterized in that, Also includes: From the multiple candidate paths included in the vulnerability detection data, obtain the target path corresponding to the same vulnerability type, and determine multiple confidence levels corresponding to the target path; Based on multiple confidence levels corresponding to the target path, a hazard level analysis is performed on the target path to obtain the target hazard level of the target path.

11. The method according to claim 10, characterized in that, The step of performing a hazard level analysis on the target path based on multiple confidence levels corresponding to the target path to obtain the target hazard level of the target path includes: The highest confidence score is obtained from multiple confidence scores corresponding to the target path, and this highest confidence score is used as the target confidence score for the target path; or... The target confidence score of the target path is obtained by weighted summation of multiple confidence scores corresponding to the target path. Based on the correspondence between different confidence levels and different hazard levels, the hazard level corresponding to the target confidence level is obtained from the different hazard levels and used as the target hazard level of the target path.

12. A vulnerability detection device, characterized in that, Configured in a vulnerability detection device, the device includes: The first acquisition module is used to acquire the structured data model of the item to be inspected, wherein the structured data model is the structured representation data of the source code of the item to be inspected; The second acquisition module is used to perform taint propagation analysis on multiple original paths in the structured data model, and to acquire multiple candidate paths that simultaneously contain taint sources and rule functions from the multiple original paths; The first generation module is used to perform natural language processing on the multiple candidate paths respectively to generate structured text corresponding to the multiple candidate paths respectively; The first determining module is used to input the structured text into a preset vulnerability detection model for vulnerability semantic analysis and logical reasoning, and generate vulnerability detection data corresponding to the multiple candidate paths respectively.

13. A vulnerability detection device, characterized in that, include: processor; Memory, used to store executable instructions; The processor is configured to retrieve the executable instructions from the memory and execute the executable instructions to implement the method of any one of claims 1-11.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, The storage medium stores a computer program that, when executed by a processor, causes the processor to implement the method described in any one of claims 1-11.

Images