Code summary extraction method and device, computer equipment

Abstract

The application relates to a code summary extraction method and device and a computer device. The method comprises the following steps: inputting a detected code into a pre-trained function feature extraction model to obtain feature information of an unknown library function which is not pre-defined in the detected code; inputting the feature information of the unknown library function into a pre-trained function summary generation model to generate a first summary of the unknown library function according to a pre-set summary representation format; the summary representation format is used for representing a plurality of attributes of the unknown library function; supplementary information related to the unknown library function is obtained by network mining on the unknown library function, and a second summary of the unknown library function is generated according to the pre-set summary representation format according to the supplementary information; and the first summary and the second summary are merged to obtain a target summary of the unknown library function. According to the method, the summary of the unknown library function in the software code can be accurately extracted.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software analysis, in particular to a code summary extraction method and device, and computer equipment. BACKGROUND

[0002] With the increasing complexity of software systems, software vulnerabilities pose an increasingly significant threat to information security, so efficient and accurate software vulnerability mining technology has become the key to ensuring software security.

[0003] Currently, static analysis of software code is often required in software vulnerability mining. However, traditional software code analysis technology is limited by the complexity and diversity of library functions in current massive code, and has many limitations in dealing with complex code logic and unknown library functions not defined in the code, making it difficult to accurately analyze the features of the undefined functions in the code, resulting in inaccurate extraction of summaries of unknown library functions, which can easily cause high code false positive and false negative rates, affecting the accuracy of software vulnerability identification and detection, and thus posing a potential threat to software security.

[0004] Therefore, the traditional technology has the problem of low accuracy of the extracted unknown library function summary in software code analysis and detection. SUMMARY

[0005] Therefore, it is necessary to provide a code summary extraction method, device, computer equipment, computer readable storage medium and computer program product capable of more accurately extracting unknown library function summaries in software code to solve the above technical problems.

[0006] In a first aspect, the present application provides a code summary extraction method, which comprises the following steps:

[0007] inputting the detected code into a pre-trained function feature extraction model to obtain feature information of an unknown library function in the detected code; the unknown library function is a function not previously defined in the detected code;

[0008] inputting the feature information of the unknown library function into a pre-trained function summary generation model, and generating a first summary of the unknown library function according to a pre-set summary representation format; the summary representation format is used to represent a plurality of attributes of the unknown library function;

[0009] obtaining supplementary information related to the unknown library function by network mining of the unknown library function, and generating a second summary of the unknown library function according to the supplementary information and the pre-set summary representation format;

[0010] merging the first summary and the second summary to obtain a target summary of the unknown library function.

[0011] In one of the embodiments, the inputting the to-be-detected code into the pre-trained function feature extraction model to obtain the feature information of the unknown library function in the to-be-detected code comprises:

[0012] The function name and the parameter name of the unknown library function in the to-be-detected code are analyzed by the pre-trained function feature extraction model to obtain the text feature of the unknown library function.

[0013] The calling point context information of the unknown library function in the to-be-detected code is analyzed by the pre-trained function feature extraction model to obtain the semantic feature of the unknown library function.

[0014] The feature information of the unknown library function is obtained according to the text feature and the semantic feature.

[0015] In one of the embodiments, the supplementary information related to the unknown library function comprises natural language description information, code usage example information and interface document information.

[0016] The supplementary information related to the unknown library function is obtained by network mining of the unknown library function, and the second abstract of the unknown library function is generated according to the supplementary information in accordance with a pre-set abstract representation format, which comprises:

[0017] The natural language description information related to the unknown library function is network-mined, and a natural language description abstract is obtained according to a pre-defined syntax tree processing rule.

[0018] The code usage example information related to the unknown library function is network-mined, and a code usage example abstract is obtained by extracting the behavior attribute of the unknown library function.

[0019] The interface document information related to the unknown library function is network-mined to obtain an interface document abstract.

[0020] The second abstract is obtained according to the natural language description abstract, the code usage example abstract and the interface document abstract.

[0021] In one of the embodiments, the network mining of the natural language description information related to the unknown library function to obtain a natural language description abstract according to a pre-defined syntax tree processing rule comprises:

[0022] The natural language description information related to the unknown library function is segmented to obtain a plurality of natural language sentences.

[0023] Each of the natural language statements is segmented into words, keywords of the natural language description information are extracted, and a syntax tree of the natural language description information is built;

[0024] According to predefined syntax tree processing rules, the syntax tree is analyzed to obtain the behavioral attributes of the keywords corresponding to the unknown library functions, and the target of the behavioral attributes; the syntax tree processing rules are used to characterize the mapping relationship between the keywords in the natural language description information and the behavioral attributes of the unknown library functions.

[0025] According to the pre-set summary representation format, the behavioral attributes and the target of action are converted into the natural language description summary.

[0026] In one embodiment, the method further includes:

[0027] Obtain the first confidence score corresponding to each attribute in the first summary; the first confidence score is obtained from the output of the function summary generation model;

[0028] Based on the second summary, obtain the second confidence level corresponding to each attribute in the second summary;

[0029] The first confidence score and the second confidence score are fused to obtain the target confidence score corresponding to each attribute in the target summary;

[0030] Based on the target confidence level and the target digest, vulnerability mining is performed on the detected code to detect vulnerabilities in the unknown library functions within the detected code.

[0031] In one embodiment, setting the second confidence level based on the second digest includes:

[0032] According to the preset sorting rules, the natural language description summary, code usage example summary, and interface document summary in the second summary mined by the network are sorted to obtain the sorting result of the supplementary information;

[0033] Based on the sorting results, a corresponding confidence level is set for each attribute in the natural language description summary, the code usage example summary, and the interface document summary to obtain the second confidence level.

[0034] In one embodiment, after the step of fusing the first confidence score and the second confidence score to obtain the target confidence score corresponding to each attribute in the target summary, the method further includes:

[0035] Obtain historical detection data of the unknown library function, and extract warning information from the historical detection data to characterize different defect types of the unknown library function;

[0036] inputting the warning information into a pre-trained confidence adjustment model, adjusting the target confidence, and obtaining an updated target confidence.

[0037] In a second aspect, the present application provides a code summary extraction device, which comprises:

[0038] a feature information extraction module configured to input a detected code into a pre-trained function feature extraction model to obtain feature information of an unknown library function in the detected code; the unknown library function is a function in the detected code that is not predefined;

[0039] a first summary generation module configured to input the feature information of the unknown library function into a pre-trained function summary generation model, and generate a first summary of the unknown library function according to a pre-set summary representation format; the summary representation format is used to represent a plurality of attributes of the unknown library function;

[0040] a second summary generation module configured to obtain supplementary information related to the unknown library function by network mining on the unknown library function, and generate a second summary of the unknown library function according to the pre-set summary representation format based on the supplementary information;

[0041] a target summary generation module configured to combine the first summary and the second summary to obtain a target summary of the unknown library function.

[0042] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above code summary extraction method when executing the computer program.

[0043] In a fourth aspect, the present application further provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the steps of the above method.

[0044] In a fifth aspect, the present application further provides a computer program product comprising a computer program, wherein the computer program is executed by a processor to implement the steps of the above method.

[0045] The code abstract extraction method, device, computer device, readable storage medium and computer program product extract the behavior pattern information of the unknown library function accurately, provide important input information for generating the first abstract of the unknown library function, then input the feature information of the unknown library function into the pre-trained function abstract generation model, and can generate the first abstract reflecting the behavior pattern of the unknown library function according to the pre-set abstract representation format, which provides an important component for generating the target abstract of the unknown library function, further, the network mining is performed on the unknown library function to obtain the supplementary information related to the unknown library function, which can provide rich network supplementary resources for generating the second abstract of the unknown library function, improve the accuracy of the unknown library function analysis, and the second abstract generated according to the supplementary information further improves the accuracy of the unknown library function abstract, and the first abstract and the second abstract are merged to obtain the accurate and reliable target abstract of the unknown library function, which realizes the accurate extraction of the unknown library function abstract in the software code, and can provide reliable detection basis for software vulnerability mining, so as to improve the accuracy of software vulnerability identification and detection, reduce the false positive rate and the false negative rate of the code vulnerability, and solve the problem of low accuracy of the unknown library function abstract extracted by the traditional technology in the software code analysis and detection. BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the description of the embodiments of the present application or the related art will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other related drawings can be obtained without creative labor on the basis of these drawings.

[0047] Figure 1 An application environment diagram of a code abstract extraction method in an embodiment;

[0048] Figure 2 A flowchart of a code abstract extraction in an embodiment;

[0049] Figure 3 A flowchart of a code abstract extraction in an embodiment;

[0050] Figure 4 A structural block diagram of a code abstract extraction device in an embodiment;

[0051] Figure 5 An internal structure diagram of a computer device in an embodiment. DETAILED DESCRIPTION

[0052] In order to make the purposes, technical solutions and advantages of the present application clearer, further detailed description will be made to the present application in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0053] The code summary extraction method provided by the embodiments of the present application can be applied in an application environment as shown in Figure 1 The terminal 102 communicates with the server 104 through a network. The data storage system can store data required to be processed by the server 104. The data storage system can be integrated on the server 104, or placed on a cloud or other network server. The server 104 can input the detected code into a pre-trained function feature extraction model to obtain feature information of an unknown library function in the detected code; the server 104 can input the feature information of the unknown library function into a pre-trained function summary generation model to generate a first summary of the unknown library function according to a pre-set summary representation format; the server 104 can obtain supplementary information related to the unknown library function by network mining on the unknown library function, and generate a second summary of the unknown library function according to the pre-set summary representation format according to the supplementary information; and the server 104 can merge the first summary and the second summary to obtain a target summary of the unknown library function. The terminal 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers and the like. The server 104 can be a stand-alone physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0054] In an exemplary embodiment, as shown in Figure 2 A code summary extraction method is provided, and the present embodiment takes the server 104 in Figure 1 as an example. The method includes the following steps S202 to S208. Wherein:

[0055] Step S202, input the detected code into a pre-trained function feature extraction model to obtain feature information of an unknown library function in the detected code.

[0056] The unknown library function is a function that is not pre-defined in the detected code, including but not limited to: third-party library functions without source code, system library functions, dynamic link library functions, standard library functions and other functions not pre-defined in the current code analysis environment. It can be understood that since the unknown library function is not pre-defined in the detected code, the unknown library function does not have an accurate and reliable summary.

[0057] The known library function can refer to a function with a reliable high-quality summary, for example, a C Standard Library function corresponding to the summary can be established through manual analysis or authoritative API documentation.

[0058] Therefore, the function feature extraction model can be trained using the known library function. By performing static analysis and API analysis on the known library function, a summary of the known library function is established. Then, a natural language processing method is used to establish a word segmentation tool for the known library function in combination with manually labeled data. Thus, in a large-scale benchmark project in the early stage, in combination with the static analysis result and the word segmentation result, feature information of the known library function is generated, and the function feature extraction model is trained using the feature information of the known library function.

[0059] In actual application, the server 104 can input the detected code into the pre-trained function feature extraction model to obtain feature information of the unknown library function in the detected code by taking text (e.g., function name, parameter name) or semantics (e.g., call point context information) of the unknown library function in the detected code as a feature and performing static analysis or word segmentation on the unknown library function by the pre-trained function feature extraction model.

[0060] In step S204, the feature information of the unknown library function is input into the pre-trained function summary generation model, and a first summary of the unknown library function is generated according to a pre-set summary representation format.

[0061] The summary representation format can be used to represent a plurality of attributes of the unknown library function, such as variable attribute, behavior attribute, type attribute, operation attribute, and constraint attribute. The attributes can reflect the behavior pattern of the function, and thus the first summary can also be referred to as a behavior pattern summary.

[0062] Similarly, the function summary generation model can also be trained using the known library function. The feature information of the known library function and the summary are taken as input features and output targets of the training set to train the function summary generation model, so that the pre-trained function summary generation model is used to generate the summary of the unknown library function. It should be noted that, in order to represent the credibility of the generated behavior pattern summary, the function summary generation model can also give a confidence degree of the generated summary corresponding to each attribute.

[0063] In a specific implementation, the server 104 can input the feature information of the unknown library function into the pre-trained function summary generation model, perform static analysis and word segmentation on the behavior pattern of the unknown library function by the function summary generation model, and generate a first summary of the unknown library function according to a pre-set summary representation format, so as to obtain the behavior pattern summary of the unknown library function.

[0064] In step S206, the supplementary information related to the unknown library function is obtained by network mining on the unknown library function, and a second abstract of the unknown library function is generated according to the supplementary information and a pre-set abstract representation format.

[0065] In actual application, in order to improve the accuracy of the abstract of the unknown library function, the relevant clue information about the unknown library function needs to be obtained from outside, and the network mining is an effective means to supplement the behavior pattern abstract of the unknown library function. Therefore, the server 104 can obtain the supplementary information related to the unknown library function by network mining on the unknown library function in combination with a series of ranked web pages searched by a search engine, and generate a second abstract of the unknown library function, i.e., a network mining abstract of the unknown library function, according to the supplementary information and a pre-set abstract representation format.

[0066] It should be noted that, similarly, in order to represent the credibility of the generated network mining abstract, the confidence of each attribute corresponding to the abstract mined by the network mining can also be set.

[0067] In step S208, the first abstract and the second abstract are merged to obtain a target abstract of the unknown library function.

[0068] In specific implementation, the server 104 can merge the first abstract and the second abstract by taking the union set of each attribute in the behavior pattern abstract and the network mining abstract of the unknown library function, or by means of a conflict arbitration mechanism in static analysis, to obtain a target abstract of the unknown library function.

[0069] The above code summary extraction method can accurately extract the behavior pattern information of the unknown library function by inputting the detected code into the pre-trained function feature extraction model to obtain the feature information of the unknown library function in the detected code, thereby providing important input information for generating the first summary of the unknown library function; then the feature information of the unknown library function is input into the pre-trained function summary generation model, and the first summary reflecting the behavior pattern of the unknown library function can be generated according to the pre-set summary representation format, thereby providing an important component for generating the target summary of the unknown library function; further, the network mining is performed on the unknown library function to obtain the supplementary information related to the unknown library function, which can provide rich network supplementary resources for generating the second summary of the unknown library function, thereby improving the accuracy of the unknown library function analysis, and the second summary generated according to the supplementary information further improves the accuracy of the unknown library function summary; and the first summary and the second summary are merged to obtain the accurate and reliable target summary of the unknown library function, thereby realizing accurate extraction of the unknown library function summary in the software code, so as to provide reliable detection basis for software vulnerability mining, thereby improving the accuracy of software vulnerability identification and detection, reducing the false positive rate and the false negative rate of the code vulnerability, and solving the problem of low accuracy of the unknown library function summary extracted by the traditional technology in the software code analysis and detection.

[0070] For the function caller, the library function often has the following behaviors: 1) reading parameters and external inputs; 2) producing outputs through parameters and return values, wherein the output path of the parameters includes writing parameters through a reference or writing a pointed location through an address; 3) producing global or system-wide effects, such as opening / closing files, locking / unlocking, etc. Meanwhile, the calling of the library function also needs to satisfy the following two constraints: 1) type constraint, including the correspondence between the argument type and the parameter type, and the correspondence between the return value declaration type and the return value usage type; 2) constraint on input values, such as requiring that the parameter of the pointer type is not a null pointer.

[0071] Based on this, in one possible implementation, the pre-set summary representation format can include variable attribute (Var), behavior attribute (Act), type attribute (Type), operation attribute (Eff) and constraint attribute (Cons), that is, the summary of the library function can be abstractly represented as a five-tuple: <Var, Act, Eff, Type, Cons>. It can be understood that the summary representation format can be used for representing the summary of the unknown library function, and can also be used for representing the summary of the known library function. Among them:

[0072] The variable attribute (Var) can represent the variables defined or used in all input / output behaviors of the function. The variable attribute includes all parameters, return values and external inputs (each external input can be regarded as a variable) of the function.

[0073] The behavior attribute (Act) can represent a sequence of behaviors generated by the function. The behavior attribute can be represented as an extended definition-use relationship, including but not limited to a normal definition-use relationship, a read-type definition-use relationship, an offset-type definition-use relationship, and the like. By representing the behavior attribute of the function using the extended definition-use relationship, the accuracy of code analysis can be improved while maintaining the efficiency of software code analysis.

[0074] The type attribute (Type) can represent type information declared by the function. The representation and derivation of the type can be similar to the information on the function type declaration in the C / C++ language. The type information includes the return value type, the formal parameter type, and the variable argument information at the function declaration.

[0075] The operation attribute (Eff) can represent a set of global or system-level operations generated by the function call, such as memory allocation / deallocation, process creation / destruction, locking / unlocking, and opening / closing of resources (files, sockets, or pipes). The accuracy of identifying the global or system-level operations of the function often affects the accuracy of important detectors such as memory leaks and resource leaks, so the library function summary needs to accurately record the operation attribute of the function.

[0076] The constraint attribute (Cons) represents the constraints of the function, including preconditions and postconditions. The precondition refers to the constraints that need to be satisfied for the successful invocation of the function, and the postcondition refers to the constraints on the return value and control flow after the function call. The purpose of recording the function constraint information in the function summary is to improve the accuracy of code analysis and detection, for example, the preconditions can eliminate false negatives of software vulnerabilities in code detection, and the postconditions can eliminate false positives of software vulnerabilities in code detection.

[0077] The technical solution of the embodiment abstractly represents the summary as a five-tuple form of variable attribute, behavior attribute, type attribute, operation attribute, and constraint attribute, clearly defines the summary representation format, and provides a clear and explicit representation benchmark for subsequent generation of behavior pattern summaries and network mining summaries of unknown library functions.

[0078] In an exemplary embodiment, the detected code is input into a pre-trained function feature extraction model to obtain feature information of an unknown library function in the detected code, including: analyzing the function name and parameter name of the unknown library function in the detected code through the pre-trained function feature extraction model to obtain text features of the unknown library function; analyzing the call point context information of the unknown library function in the detected code through the pre-trained function feature extraction model to obtain semantic features of the unknown library function; and obtaining the feature information of the unknown library function according to the text features and the semantic features.

[0079] Generally, the characteristics of the unknown library function can be divided into text characteristics and semantic characteristics.

[0080] The text characteristics are also the naming characteristics (Name) of the function, which can include the function name (FunName) and the parameter name (ParaName). The naming characteristics are the more obvious and intuitive characteristics of the function. Generally, library functions need to comply with certain naming rules, and the function name and the parameter name (or formal parameter name) respectively express the function behavior and the parameter role, and functions with similar names have similar functions. In version iteration, new library functions are often created by adding prefixes and suffixes to the function name, and specific properties are added to the original function.

[0081] The inventors of the present application found through analysis of the GNU C Library (glibc for short, which is a C language runtime library in a free software collective project) that the function names of most library functions can be decomposed into the following pattern: (Pre)*(Obj)?Act(Post)*, where Pre represents the function name prefix, Obj represents the operation object, Act represents the operation action, and Post represents the function name suffix.

[0082] The semantic characteristics (Call) can include all the calling point context information of the function. Each calling point context information can include actual parameter information (Para) and return value information (Ret). The information of each parameter (Para) and return value (Ret) is composed of type (Type) and interval (Inter) information. The interval of the parameter represents the interval range that the parameter can take, and the interval of the return value represents the interval range that the return value uses. If the return value is not used, the return value information is empty. The parameter and return value type and interval information have a great relevance to the function behavior, such as a non-zero pointer type parameter is likely to have a dereferencing behavior in the function.

[0083] In actual application, the server 104 can analyze the function name (FunName), the function name prefix (Pre), the operation object (Obj), the operation action (Act), and the function name suffix (Post) of the unknown library function in the detected code through the pre-trained function characteristic extraction model to extract the function name (FunName) and the parameter name (ParaName) of the unknown library function, thereby obtaining the text characteristics (Name) of the unknown library function. The server 104 can analyze the calling point context information (including the actual parameter information (Para) and the return value information (Ret)) of the unknown library function in the detected code through the pre-trained function characteristic extraction model to obtain the semantic characteristics (Call) of the unknown library function. Then, the server 104 can obtain the characteristic information of the unknown library function according to the text characteristics (Name) and the semantic characteristics (Call).

[0084] Exemplarily, the feature information can be represented in the following form:

[0085] Fun := <Name, {Call+}>

[0086] Name := <FunName, ParaName>

[0087] FunName := <Pre*, Obj?, Act, Post*>

[0088] Call := <Para*, Ret?>

[0089] Para := <Type, Inter?>

[0090] Ret := <Type, Inter?>

[0091] The technical solution of the embodiment extracts the function name and parameter name of the unknown library function in the detected code by using the pre-trained function feature extraction model, thereby obtaining the most intuitive text features in the unknown library function; analyzes the call point context information of the unknown library function in the detected code by using the pre-trained function feature extraction model, thereby obtaining the semantic features of the unknown library function calling behavior, and accurately extracts the key features of the unknown library function in terms of text and semantics; and obtains feature information that can accurately reflect the behavior pattern of the unknown library function according to the text features and semantic features, improves the accuracy of code static analysis, and thereby provides an important basis for generating a behavior pattern summary of the unknown library function.

[0092] The above behavior pattern summary can effectively analyze the library function not found in the detected code provided by the user, but there are the following limitations in analyzing only the user code: first, the use of the library function is simple, which makes it difficult to mine effective summaries of the library function; second, even if the behavior pattern is sufficient to mine summaries, the mining accuracy of the summaries is difficult to be completely accurate.

[0093] Therefore, it is necessary to obtain clues about the unknown library function summary from the outside, and network mining becomes an effective means to supplement the behavior pattern summary mining. When mining the library function summary, a series of ranked web pages searched by a search engine can be combined, and then the mined web pages are analyzed. The present inventors have found that, exemplarily, the web pages related to summary mining, i.e., the supplementary information related to the unknown library function, can include natural language description information, code usage example information, and interface document information.

[0094] The natural language description information is a natural language description. The inventors of the present application find that a large number of library function usage methods are described in natural language in network resources such as forums and question-and-answer websites, and these information provides relatively rich resources for abstract mining.

[0095] The code usage example information is a natural language description. The form of natural language is variable, which leads to a high complexity of analyzing the natural language of the library function. The processing of the natural language only according to rules will inevitably reduce the recall rate of the abstract analysis. To ensure the accuracy of the abstract analysis and the precision of the abstract extraction, the inventors of the present application find that a considerable part of the discussion on the library function in network resources such as forums and question-and-answer websites also uses code snippets.

[0096] The interface document information is an API (Application Programming Interface) description language. The inventors of the present application observe that some library functions cannot be directly obtained in the user code, but their definitions are described in the official API document. The standardization degree of the official API description language is between the natural language and the program language. By using the standardized natural language and combining the code elements, the function, the precondition, the postcondition, the parameter, the return value and the like are described, which can make the abstract mining more accurate and comprehensive, and therefore should have a higher priority.

[0097] Therefore, in one possible implementation, by performing network mining on the unknown library function to obtain the supplementary information related to the unknown library function, and according to the supplementary information, generating a second abstract of the unknown library function according to a pre-set abstract representation format, including: performing network mining on the natural language description information related to the unknown library function, and obtaining a natural language description abstract according to a pre-defined syntax tree processing rule; performing network mining on the code usage example information related to the unknown library function, and extracting the behavior attribute of the unknown library function to obtain a code usage example abstract; performing network mining on the interface document information related to the unknown library function to obtain an interface document abstract; and obtaining the second abstract according to the natural language description abstract, the code usage example abstract and the interface document abstract.

[0098] In a specific implementation, for the natural language description information of the unknown library function, the server 104 can perform network mining on the natural language description information related to the unknown library function, obtain the natural language description summary (which can be referred to as a natural language summary) of the unknown library function according to a pre-defined syntax tree processing rule (i.e., a rule-based summary description analysis); for the code usage example information of the unknown library function, the server 104 can perform network mining on the code usage example information related to the unknown library function, analyze incomplete code fragments in network resources, extract the behavior attribute (behavior pattern) of the unknown library function, and obtain a code usage example summary; for the interface document information (API document) of the unknown library function, the server 104 can perform network mining on the interface document information related to the unknown library function, and obtain an interface document summary through a natural language analysis manner; and then, the second summary is obtained according to the natural language description summary, the code usage example summary, and the interface document summary.

[0099] The technical scheme of the embodiment supplements the code amount and information source of each attribute of the unknown library function by performing network mining on the natural language description information, the code usage example information, and the interface document information related to the unknown library function, provides an important analysis basis for accurately extracting the unknown library function summary, and further improves the accuracy of the unknown library function summary.

[0100] In one possible implementation, the network mining is performed on the natural language description information related to the unknown library function, and the natural language description summary is obtained according to a pre-defined syntax tree processing rule, including: segmenting the natural language description information related to the unknown library function to obtain a plurality of natural language sentences; performing word segmentation on each natural language sentence to extract keywords of the natural language description information, and establishing a syntax tree of the natural language description information; analyzing the syntax tree according to the pre-defined syntax tree processing rule to obtain the behavior attribute of the unknown library function corresponding to the keywords and the action target of the behavior attribute; and converting the behavior attribute and the action target into the natural language description summary according to a pre-set summary representation format.

[0101] The syntax tree processing rule can be used to represent the mapping relationship between the keywords in the natural language description information and the behavior attribute of the unknown library function. For example, before the summary network mining, a plurality of keywords (for example, “define / def” or “return / return”) in the natural language description information are defined in advance, and the mapping relationship between the keywords and the key behavior attribute (for example, parameter definition or function return value) of the unknown library function is defined, thereby forming the processing rule between the unknown library function summary and the keywords. In order to ensure the accuracy of the natural language analysis of the unknown library function, the processing of the sentences other than the syntax tree processing rule can be ignored.

[0102] In actual application, for the natural language description information of the unknown library function, the server 104 can segment the natural language description information related to the unknown library function to obtain a plurality of natural language sentences; perform word segmentation on each natural language sentence, extract keywords of the natural language description information, and establish a syntax tree of the natural language description information, thereby establishing an abstract syntax tree; according to a pre-defined syntax tree processing rule, based on the mapping relationship corresponding to the unknown library function, analyze the syntax tree of each natural language sentence, combine the subject, predicate, object and other structures of the abstract keywords, extract the behavior attribute (key behavior) of the unknown library function corresponding to the keywords, and the action target of the behavior attribute; according to a pre-set abstract representation format, convert the behavior attribute and the action target into a natural language description abstract.

[0103] The technical scheme of the embodiment, by segmenting the natural language description information related to the unknown library function, and performing word segmentation on each natural language sentence, thereby reducing the analysis and processing scale of the mined natural language information; further, by extracting the keywords of the natural language description information, analyzing the syntax tree of the natural language description information, obtaining the behavior attribute of the unknown library function corresponding to the keywords, and the action target of the behavior attribute, thereby corresponding to each attribute in the pre-set abstract representation format, so as to generate a natural language description abstract, providing an important source for the second abstract of network mining.

[0104] In traditional static analysis, the false positive rate and the false negative rate of software vulnerabilities are the main quality measurement standards. In order to guarantee the quality of static analysis, the interpretability and reliability of the generated unknown library function abstract should be reflected, and the value of the confidence degree should guarantee the correctness of the final alarm information, therefore, the code abstract extraction method of the present application also needs to generate the confidence degree of the unknown library function abstract.

[0105] In an exemplary embodiment, the code abstract extraction method provided by the present application further comprises: obtaining a first confidence degree corresponding to each attribute in the first abstract; obtaining a second confidence degree corresponding to each attribute in the second abstract according to the second abstract; fusing the first confidence degree and the second confidence degree to obtain a target confidence degree corresponding to each attribute in the target abstract; based on the target confidence degree and the target abstract, performing vulnerability mining on the detected code to detect vulnerabilities of the unknown library function in the detected code.

[0106] In a specific implementation, the server 104 can obtain the first confidence degree corresponding to each attribute in the first summary by generating the first summary by the function summary generation model and the confidence degree corresponding to each attribute in the first summary, and set the confidence degree of the natural language description summary, the code usage example summary and the interface document summary in the second summary mined by the network according to the second summary to obtain the second confidence degree corresponding to each attribute in the second summary, fuse the first confidence degree and the second confidence degree, and obtain the target confidence degree corresponding to each attribute in the target summary by the confidence degree fusion manner not limited in the present application, such as weighted average, Bayesian synthesis and the like, and mine the vulnerabilities in the detected code based on the target confidence degree and the target summary to detect the vulnerabilities of the unknown library function in the detected code.

[0107] The technical scheme of the embodiment can obtain the first confidence degree corresponding to each attribute in the first summary and the second confidence degree corresponding to each attribute in the second summary, fuse the first confidence degree and the second confidence degree, and obtain the target confidence degree corresponding to each attribute in the target summary, so as to reflect the comprehensive confidence degree of the extracted summary of the unknown library function, and then mine the vulnerabilities in the detected code based on the target confidence degree and the target summary, provide clearer analysis basis and decision weight for subsequent software vulnerability mining, enhance the interpretability of the detection result, and detect the vulnerabilities of the unknown library function in the detected code, thereby improving the accuracy of software vulnerability mining.

[0108] In an exemplary embodiment, setting the second confidence degree according to the second summary includes: sorting the natural language description summary, the code usage example summary and the interface document summary in the second summary mined by the network according to a preset sorting rule to obtain a sorting result of the supplementary information, and setting the corresponding confidence degree of each attribute in the natural language description summary, the code usage example summary and the interface document summary according to the sorting result to obtain the second confidence degree.

[0109] In actual application, the server 104 can sort the natural language description summary, the code usage example summary and the interface document summary in the second summary according to a preset sorting rule to obtain a sorting result of the supplementary information, and then set the confidence degree of different summaries according to the sorting result, for the natural language description information, the code usage example information and the interface document information of the unknown library function mined by the network.

[0110] For example, the ranking rules can be set as follows: 1) API document (interface document information) > summary description natural language > code usage example; 2) webpage ranked in front > webpage ranked in back; 3) high frequency summary > low frequency summary. The mapping relationship between the ranking result and the confidence is constructed according to the pre-set ranking rules, so that the confidence of different summaries is set according to the ranking result.

[0111] For example, the interface document summary from the API document: confidence baseline 0.9; natural language summary from the top 1-3 webpages: confidence 0.7; natural language summary from the top 4-10 webpages: confidence 0.5; summary from the code example: confidence 0.4; if a summary appears in 5 webpages: +0.1 frequency bonus; if a summary appears only once: -0.2 sparsity penalty.

[0112] It should be noted that the ranking rules of the network mining summary (the second summary) and the corresponding confidence can be adjusted according to the above examples according to actual application conditions, and the present application does not limit this.

[0113] The technical scheme of the embodiment sorts the natural language description summary, the code usage example summary and the interface document summary in the second summary, and sets corresponding confidences for each attribute in the natural language description summary, the code usage example summary and the interface document summary according to the ranking result, thereby realizing the confidence based on the network mining summary, providing an important supplement to the confidence based on the behavior pattern summary, and ensuring the explanation and reliability of the generated unknown library function summary.

[0114] In order to guarantee the quality of static analysis, it is required that the value of the confidence of the unknown library function summary should guarantee the correctness of the final alarm information. Although the confidence based on the summary can be calculated, it still needs to be further optimized. Since the historical detection data can evaluate the established unknown library function summary, the present application designs a feedback adaptive method based on historical detection data to intelligently improve the accuracy of the summary confidence, thereby improving the analysis accuracy.

[0115] In one possible implementation, after the step of fusing the first confidence and the second confidence to obtain the target confidence corresponding to each attribute in the target summary, the method further includes: obtaining historical detection data of the unknown library function, and obtaining warning information for representing different defect types of the unknown library function from the historical detection data; inputting the warning information into a pre-trained confidence adjustment model to adjust the target confidence and obtain an updated target confidence.

[0116] The warning information (also referred to as alarm information) is used to represent different defect types of the unknown library function. For example, the warning information can provide the following information: (1) warning position: the accurate position of the warning information in the source code, including the file name, function name, line number, etc. that generates the warning; (2) warning type: array access out of bounds, null pointer dereference, etc.; and (3) unknown library function information that causes the error alarm.

[0117] In a specific implementation, the server 104 can obtain historical detection data of the unknown library function, and obtain, from the historical detection data, warning information used to represent different defect types of the unknown library function; input the warning information into the pre-trained confidence adjustment model, and perform self-adaptive adjustment on the target confidence through iterative feedback solving of the confidence adjustment model, to obtain an updated target confidence.

[0118] It should be noted that, since the alarm information of different defect types is different, when adjusting different confidences of the unknown library function summary, the application needs to consider the influence of the alarm information (warning information) of different defect types on the confidence of different properties of the library function summary, so as to find a suitable corresponding relationship between the warning information of different defect types of the unknown library function and the confidence.

[0119] According to the feedback of the warning information, the influence on the confidence of the unknown library function summary is as follows:

[0120] (1) Strengthening strategy: if the summary participates in the generation of correct warning information, that is, a certain property (such as "will write" or "cannot be empty") of a certain summary is used in code analysis and detection, and the warning information generated based on the summary is confirmed by the user as a real software vulnerability, then the confidence of the corresponding property of the summary is strengthened, and positive feedback is generated.

[0121] (2) Punishment strategy: if the summary participates in the generation of incorrect warning information, that is, a certain property of a certain summary is used in code analysis and detection, but the warning information generated based on the summary is confirmed by the user as a false alarm, then a penalty term is added to the confidence of the corresponding property of the summary, and negative feedback is generated.

[0122] (3) Ignoring strategy: if the summary does not participate in the generation of warning information, the original confidence of the summary is maintained and no correction is made.

[0123] For example, assume that a function from a third-party encryption library (library function with unknown source code, only header file available) is used in the code under test: void* secure_memcpy(void* dest, const void* src, size_t n). Since the definition of this function cannot be found in the code under test, it is an unknown library function. Through steps S202 and S204, the behavior pattern summary of this function (i.e., the first summary) is generated.

[0124] Function summary of secure_memcpy (five-tuple, the following simplified version is used as an example):

[0125] • Act behavior: "read n bytes from src, write to dest" (confidence: 0.8)

[0126] • Cons constraint: "dest and src cannot be null pointers" (confidence: 0.6)

[0127] Example Case 1: Summary participates in generating a

correct

[0128] Code under test:

[0129] void test() {

[0130] char buffer

[10] ;

[0131] secure_memcpy(buffer, "very long string", 20); / / Obviously out of bounds!

[0132] }

[0133] From the secure_memcpy summary, it can be known that the function wants to write 20 bytes to buffer, while from the above code it can be calculated that buffer has only 10 bytes of space, so the Act write attribute of the summary triggers an out-of-bounds warning. After user verification, it is indeed out of bounds! Therefore, this warning information is a correct warning (True). This indicates that the "Act behavior" attribute in the function summary has discovered a true bug in the code, indicating that this attribute is very reliable, so the enhanced strategy can be used to adjust the confidence of the Act attribute in the summary from 0.8 to 0.9.

[0134] Example Case 2: Summary participates in generating a

false

[0135] Another piece of code under test:

[0136] void test2() {

[0137] char *p = get_some_data();

[0138] secure_memcpy(p, "test", 4);

[0139] }

[0140] From the secure_memcpy summary, it can be known that the function is to read src and write dest, but the above code analysis cannot determine whether p is a null pointer, so the Cons non-empty constraint property of the summary triggers the warning of null pointer dereference risk, and the user verifies that p always has a value at runtime, so the warning information is false. It is shown that the "Cons constraint" property in the function summary leads to false positives, which shows that the property is too sensitive, so the punishment strategy can be used to adjust the confidence of the Cons property in the summary from 0.6 to 0.4.

[0141] Example case 3: summary not involved in warning (can be ignored)

[0142] Another piece of detected code:

[0143] void test3() {

[0144] / / No use of secure_memcpy function

[0145] printf("hello");

[0146] }

[0147] The secure_memcpy summary is not used in the analysis of the detected code, so the ignore strategy can be used, and the confidence of the summary remains unchanged.

[0148] From the above analysis, it can be known that the confidence adjustment model constructed in the present application is a learning model with known warning information as input and warning information correctness as target. After the learning task is established, an artificial neural network is constructed to solve it. Artificial neural network is a tool for approximating uncertain linear functions. However, the training of neural network is an iterative calculation, which consumes a lot of time for one static analysis, affecting the convergence speed of the commonly used feedback algorithm. Therefore, it is necessary to optimize the static analysis process according to the characteristics of iterative solution, and to convert the artificial experience driven confidence correction into an automatic strategy optimization process based on gradient descent or reinforcement learning, and to carry out special engineering optimization for the high iteration cost of static analysis. It is shown that the code summary confidence adjustment method based on historical detection data proposed in the present application is an iterative feedback adaptive algorithm, which can compress the time of model solving and analysis, and accelerate the convergence speed.

[0149] Exemplarily, the information required by the code summary confidence adjustment method based on historical detection data in the present application is shown in Table 1. Each of rows 2-6 represents an unknown library function, and each of columns 2-5 represents a defect report. Through user confirmation of the defect report and performance, “O” indicates that the function is analyzed, and “X” indicates that it is not analyzed. True represents that the result is correct, and False represents that the defect report is a false positive. Based on this information, an evaluation method for the detection effect of each unknown library function can be further designed, for example, the confidence of the corresponding summary attribute of the unknown library function analyzed by more correct reports should be higher. In addition, a more comprehensive evaluation method can be designed, for example, not limited to whether the library function is analyzed, but also the influence of the unknown library function on the defect type report can be comprehensively considered in terms of dependency graph, analysis frequency, code pattern, etc.

[0150] Table 1: Information table required by iterative feedback adaptive algorithm

[0151]

[0152] The technical solution of the present embodiment obtains warning information for representing different defect types of the unknown library function from the historical detection data of the unknown library function obtained; and inputs the warning information into a pre-trained confidence adjustment model to adaptively adjust the target confidence, thereby obtaining an updated target confidence. Thus, through iterative feedback solving of the confidence adjustment model, not only the time for model solving and analysis can be compressed, and the solving speed can be accelerated, but also the summary confidence can be optimized, the precision of the unknown library function summary confidence is improved, thereby improving the quality of the static analysis of the unknown library function, and providing an important reference for subsequent software vulnerability analysis.

[0153] In the present embodiment, as shown in Figure 3 The present application provides a code summary extraction method, and the core content of the technical framework of the method includes:

[0154] Library function summary model construction. Considering the complexity and common characteristics of library function behavior, a representation model of unknown library function summary, i.e., a summary representation format, is established in advance. The summary representation format includes variable attribute (Var), behavior attribute (Act), type attribute (Type), operation attribute (Eff), and constraint attribute (Cons), so that the operation of the unknown library function on parameters and return values, the system-level impact produced, and the constraints to be met can be accurately and concisely expressed.

[0155] Unknown library function summary generation. Based on the library function summary model, the behavior pattern-based summary analysis method and the network mining-based summary analysis method are comprehensively used. First, the text and semantic features of the unknown library function are extracted through the pre-trained function feature extraction model, and the feature information of the unknown library function is input into the pre-trained function summary generation model. According to the pre-set summary representation format, the behavior pattern summary (first summary) of the unknown library function is generated. Then, the network mining is performed on the unknown library function to mine the natural language description information, code usage example information and interface document information as the supplementary information related to the unknown library function. According to the supplementary information, the natural language description summary, the code usage example summary and the interface document summary are obtained according to the pre-set summary representation format, so as to generate the network mining summary (second summary) of the unknown library function. At the same time, the confidence of each attribute corresponding to the unknown library function summary can be obtained through machine learning and intelligent sorting, including the first confidence of each attribute in the first summary and the second confidence of each attribute in the second summary.

[0156] Unknown library function summary confidence optimization. After the first confidence and the second confidence are fused, the target confidence of the target summary is obtained. Due to the limitation of the amount of information obtained, it cannot be guaranteed that the summary and the confidence of the unknown library function obtained are accurate, so it is also necessary to use a feedback adaptive algorithm to optimize the confidence of each attribute in the summary. The target confidence is adjusted by reward and punishment through the alarm information in the historical monitoring data, so as to improve the precision and accuracy of the unknown library function summary.

[0157] It should be noted that the specific limitations of the above steps can be referred to the specific limitations of the code summary extraction method described above.

[0158] It should be understood that although each step in the flowchart involved in each embodiment as described above is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise stated herein, the execution of these steps has no strict sequence limitation, and these steps can be executed in other order. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be executed alternately or alternately with at least part of other steps or steps or stages in other steps. It can be understood that the steps in different embodiments can be freely combined as needed, and various non-contradictory schemes formed by combination are within the scope of protection of the present application.

[0159] Based on the same inventive concept, the embodiments of the present application also provide a code summary extraction device for implementing the code summary extraction method described above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more code summary extraction device embodiments provided below can refer to the limitations of the code summary extraction method described above, which will not be repeated here.

[0160] In one exemplary embodiment, as shown in FIG. 4, a code summary extraction device is provided, comprising:

[0161] The feature information extraction module 410 is configured to input the detected code into a pre-trained function feature extraction model to obtain feature information of an unknown library function in the detected code; the unknown library function is a function in the detected code that is not predefined in advance.

[0162] The first summary generation module 420 is configured to input the feature information of the unknown library function into a pre-trained function summary generation model, and generate a first summary of the unknown library function according to a pre-set summary representation format; the summary representation format is used to represent a plurality of attributes of the unknown library function.

[0163] The second summary generation module 430 is configured to obtain supplementary information related to the unknown library function by network mining on the unknown library function, and generate a second summary of the unknown library function according to the pre-set summary representation format based on the supplementary information.

[0164] The target summary generation module 440 is configured to merge the first summary and the second summary to obtain a target summary of the unknown library function.

[0165] In one embodiment, the feature information extraction module 410 is specifically configured to analyze the function name and the parameter name of the unknown library function in the detected code by the pre-trained function feature extraction model to obtain text features of the unknown library function; analyze the call point context information of the unknown library function in the detected code by the pre-trained function feature extraction model to obtain semantic features of the unknown library function; and obtain the feature information of the unknown library function according to the text features and the semantic features.

[0166] In one embodiment, the second summary generation module 430 is specifically configured to perform network mining on natural language description information related to the unknown library function to obtain a natural language description summary according to a pre-defined syntax tree processing rule; perform network mining on code usage example information related to the unknown library function to extract behavior attributes of the unknown library function to obtain a code usage example summary; perform network mining on interface document information related to the unknown library function to obtain an interface document summary; and obtain the second summary according to the natural language description summary, the code usage example summary, and the interface document summary.

[0167] In one of the embodiments, the second abstract generation module 430 is further configured to segment the natural language description information related to the unknown library function to obtain a plurality of natural language sentences, perform word segmentation on each natural language sentence, extract keywords of the natural language description information, and establish a syntax tree of the natural language description information; analyze the syntax tree according to a pre-defined syntax tree processing rule to obtain a behavior attribute of the unknown library function corresponding to the keywords and an action target of the behavior attribute; the syntax tree processing rule is used to represent a mapping relationship between the keywords in the natural language description information and the behavior attribute of the unknown library function; and convert the behavior attribute and the action target into a natural language description abstract according to a pre-set abstract representation format.

[0168] In one of the embodiments, the apparatus further includes an abstract confidence generation module 450 configured to obtain a first confidence corresponding to each attribute in the first abstract; the first confidence is obtained from the function abstract generation model; obtain a second confidence corresponding to each attribute in the second abstract according to the second abstract; fuse the first confidence and the second confidence to obtain a target confidence corresponding to each attribute in the target abstract; and based on the target confidence and the target abstract, perform vulnerability mining on the detected code to detect vulnerabilities of the unknown library function in the detected code.

[0169] In one of the embodiments, the abstract confidence generation module 450 is further configured to sort the natural language description abstract, the code usage example abstract, and the interface document abstract in the second abstract mined by the network according to a pre-set sorting rule to obtain a sorting result of the supplementary information; and according to the sorting result, set a corresponding confidence for each attribute in the natural language description abstract, the code usage example abstract, and the interface document abstract to obtain the second confidence.

[0170] In one of the embodiments, the apparatus further includes an abstract confidence adjustment module 460 configured to obtain historical detection data of the unknown library function, and from the historical detection data, obtain warning information used to represent different defect types of the unknown library function; input the warning information into a pre-trained confidence adjustment model to adjust the target confidence to obtain an updated target confidence.

[0171] Each module in the above code abstract extraction apparatus can be realized by software, hardware, and a combination thereof, in whole or in part. Each module can be embedded in or independent of a processor in a computer device in a hardware form, or can be stored in a memory in a computer device in a software form, so as to be called and executed by a processor to perform operations corresponding to each module.

[0172] In an example embodiment, a computer device, which can be a server, is provided, and an internal structure diagram of the computer device can be as shown in FIG. 5. The computer device includes a processor, a memory, an input / output interface (I / O), and a communication interface. The processor, the memory, and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store code summary extraction data. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to communicate with terminals outside through a network connection. The computer program is executed by the processor to implement a code summary extraction method.

[0173] Those skilled in the art can understand that the structure shown in FIG. 5 is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. Specifically, the computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0174] In an example embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in each of the embodiments of the code summary extraction method when executing the computer program.

[0175] In an example embodiment, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program. The computer program is executed by a processor to implement the steps in each of the embodiments of the code summary extraction method.

[0176] In an example embodiment, a computer program product is provided, and the computer program product includes a computer program. The computer program is executed by a processor to implement the steps in each of the embodiments of the code summary extraction method.

[0177] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use, and processing of related data need to comply with relevant regulations.

[0178] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. The non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magneto resistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. The volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence processor, etc., without being limited thereto.

[0179] The technical features of the above embodiments can be combined arbitrarily. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combinations of the technical features do not exist contradictory, they should be considered as the scope of the present application.

[0180] The above-described embodiments are merely illustrative of several embodiments of the present application, and the description is relatively specific and detailed, but should not be understood as a limitation on the scope of the patent. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. A code digest extraction method, characterized in that, The method includes: The code to be detected is input into a pre-trained function feature extraction model to obtain feature information of unknown library functions in the code to be detected; the unknown library functions are functions in the code to be detected that are not predefined. The feature information of the unknown library function is input into a pre-trained function summary generation model, and a first summary of the unknown library function is generated according to a pre-set summary representation format; the summary representation format is used to represent multiple attributes of the unknown library function. By performing network mining on the unknown library functions, supplementary information related to the unknown library functions is obtained. Based on the supplementary information, a second summary of the unknown library functions is generated according to a pre-set summary representation format. The first summary and the second summary are merged to obtain the target summary of the unknown library function; Obtain the first confidence level corresponding to each attribute in the first summary; the first confidence level is obtained by the output of the function summary generation model; based on the second summary, obtain the second confidence level corresponding to each attribute in the second summary; fuse the first confidence level and the second confidence level to obtain the target confidence level corresponding to each attribute in the target summary; based on the target confidence level and the target summary, perform vulnerability mining on the detected code to detect the vulnerabilities of the unknown library functions in the detected code.

2. The method according to claim 1, characterized in that, The process of inputting the code to be detected into a pre-trained function feature extraction model to obtain feature information of unknown library functions in the code to be detected includes: The pre-trained function feature extraction model is used to analyze the function names and parameter names of the unknown library functions in the detected code to obtain the text features of the unknown library functions. The pre-trained function feature extraction model is used to analyze the context information of the call points of the unknown library functions in the detected code to obtain the semantic features of the unknown library functions. Based on the text features and the semantic features, the feature information of the unknown library function is obtained.

3. The method according to claim 1, characterized in that, The supplementary information related to the unknown library function includes natural language description information, code usage examples, and interface documentation information; The step of obtaining supplementary information related to the unknown library function through network mining, and generating a second summary of the unknown library function according to the supplementary information and a pre-set summary representation format, includes: The natural language description information related to the unknown library function is subjected to network mining, and a natural language description summary is obtained according to predefined syntax tree processing rules; The code related to the unknown library function is used for network mining with example information to extract the behavioral attributes of the unknown library function and obtain a code usage example summary. Web mining is performed on the interface documentation information related to the unknown library functions to obtain interface documentation summaries; The second summary is obtained based on the natural language description summary, the code usage example summary, and the interface documentation summary.

4. The method according to claim 3, characterized in that, The step of performing network mining on the natural language description information related to the unknown library function, and obtaining a natural language description summary according to predefined syntax tree processing rules, includes: The natural language description information related to the unknown library function is segmented to obtain multiple natural language statements; Each of the natural language statements is segmented into words, keywords of the natural language description information are extracted, and a syntax tree of the natural language description information is built; According to predefined syntax tree processing rules, the syntax tree is analyzed to obtain the behavioral attributes of the keywords corresponding to the unknown library functions, and the target of the behavioral attributes; the syntax tree processing rules are used to characterize the mapping relationship between the keywords in the natural language description information and the behavioral attributes of the unknown library functions. According to the pre-set summary representation format, the behavioral attributes and the target of action are converted into the natural language description summary.

5. The method according to claim 1, characterized in that, The step of setting the second confidence level based on the second digest includes: According to the preset sorting rules, the natural language description summary, code usage example summary, and interface document summary in the second summary mined by the network are sorted to obtain the sorting result of the supplementary information; Based on the sorting results, a corresponding confidence level is set for each attribute in the natural language description summary, the code usage example summary, and the interface document summary to obtain the second confidence level.

6. The method according to claim 1, characterized in that, After the step of fusing the first confidence score and the second confidence score to obtain the target confidence score corresponding to each attribute in the target summary, the method further includes: Obtain historical detection data of the unknown library function, and extract warning information from the historical detection data to characterize different defect types of the unknown library function; The warning information is input into a pre-trained confidence adjustment model to adjust the target confidence, resulting in an updated target confidence.

7. A code digest extraction device, characterized in that, The device includes: The feature information extraction module is used to input the code to be detected into a pre-trained function feature extraction model to obtain the feature information of unknown library functions in the code to be detected; the unknown library functions are functions in the code to be detected that are not predefined. The first summary generation module is used to input the feature information of the unknown library function into a pre-trained function summary generation model, and generate a first summary of the unknown library function according to a pre-set summary representation format; the summary representation format is used to represent multiple attributes of the unknown library function. The second summary generation module is used to obtain supplementary information related to the unknown library function by performing network mining on the unknown library function, and generate a second summary of the unknown library function according to the supplementary information and a pre-set summary representation format. The target summary generation module is used to merge the first summary and the second summary to obtain the target summary of the unknown library function; The summary confidence generation module is used to obtain the first confidence level corresponding to each attribute in the first summary; the first confidence level is obtained by the output of the function summary generation model; based on the second summary, the second confidence level corresponding to each attribute in the second summary is obtained; the first confidence level and the second confidence level are fused to obtain the target confidence level corresponding to each attribute in the target summary; based on the target confidence level and the target summary, vulnerability mining is performed on the detected code to detect the vulnerabilities of the unknown library functions in the detected code.

8. The apparatus according to claim 7, characterized in that, The summary confidence generation module is further configured to sort the natural language description summary, code usage example summary, and interface document summary in the second summary mined from the network according to a preset sorting rule, and obtain the sorting result of the supplementary information; based on the sorting result, set corresponding confidence scores for each attribute in the natural language description summary, the code usage example summary, and the interface document summary, and obtain the second confidence score.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images