Security defect clustering identification method based on graph attention network

Abstract

The invention discloses a security defect clustering identification method based on a graph attention network, and the method comprises the following steps: S1, obtaining a program file, and constructing an original graph structure; s2, performing semantic fusion on each node, encoding a multi-channel tensor, and generating a node state matrix; s3, constructing a graph attention network, executing multiple rounds of embedding, introducing a cross-channel attention score, and outputting a context fusion tensor; s4, introducing an aggregation sensing mechanism, executing channel compression and expansion based on a data dependence path, and outputting a reconstructed node feature sequence; s5, constructing a defect candidate cluster set, calculating a consistency score, and determining a high-confidence defect cluster; s6, executing dynamic threshold segmentation, and constructing a variable neighborhood boundary region; and S7, mapping the target clustering unit to a program file, and generating a security defect clustering recognition result. According to the method, the security defect nodes can be accurately clustered, and the identification precision, the boundary definition and the interpretability are improved.

Description

Technical Field

[0001] This invention relates to the field of software security detection and defect identification technology, and in particular to a security defect clustering identification method based on graph attention networks. Background Technology

[0002] As software systems continue to expand in scale and increase in complexity, the number of potential security flaws in programs is growing daily. Traditional methods relying on manual auditing and static rule matching are insufficient to cover complex defect logic and its variations, and are inefficient with a high false positive rate. In recent years, graph structure analysis methods have been gradually introduced into the field of code defect detection and analysis due to their advantages in processing structured information. Among them, abstract syntax trees, control flow graphs, and data flow graphs have become commonly used graph representation tools to reveal the internal structural relationships of programs.

[0003] In existing technologies, some studies attempt to model programs based on graph neural networks, achieving defect identification through information transfer and aggregation between nodes. However, these methods generally employ homogeneous graph structures, failing to adequately model the differences between various types of semantic edges, such as control dependencies, data dependencies, and call dependencies, resulting in insufficient defect feature representation capabilities. Furthermore, existing methods often rely on manually set feature dimensions or fixed structural templates, lacking modeling of the importance of node semantics, making it difficult to cope with complex defect distribution patterns in real-world scenarios.

[0004] Meanwhile, defect clustering, as an extension of defect identification, aims to group semantically similar defect nodes into consistent defect clusters to assist developers in locating systemic risks. However, traditional clustering methods are mostly based on static distance metrics, which cannot combine the contextual structure and feature coupling information in the program graph. This results in low clustering accuracy and difficulty in interpreting the position and boundaries of the clustering results in the original program.

[0005] More importantly, existing methods often ignore the channel differences and context aggregation mechanisms of node features during the embedding process when constructing defect clustering results. They lack dynamic segmentation strategies based on graph structure awareness, resulting in unclear cluster boundaries and difficulty in removing redundant nodes, ultimately affecting the accuracy and reliability of defect identification.

[0006] Therefore, how to provide a security defect clustering identification method based on graph attention networks is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0007] One objective of this invention is to propose a security defect clustering identification method based on graph attention networks. This invention fully utilizes graph structure modeling, cross-channel attention mechanism and density-driven clustering analysis technology, and describes in detail the entire process from program graph construction to defect cluster identification and visualization output. It has the advantages of strong structural expression ability, high defect identification accuracy and strong interpretability of clustering results.

[0008] A security vulnerability clustering identification method based on graph attention networks according to an embodiment of the present invention includes the following steps:

[0009] S1. Obtain the program file and construct the original graph structure consisting of a set of nodes and a set of edges of multiple types;

[0010] S2. Perform semantic fusion operation on each node, encode the control path features, data dependency path features and call path features into multi-channel tensors, and generate a node state matrix.

[0011] S3. Construct a graph attention network, input the node state matrix into the graph attention network, perform multiple rounds of embedding calculation, and introduce a cross-channel attention scoring mechanism in each round of embedding to output a context fusion tensor;

[0012] S4. Introduce an aggregation-aware mechanism into the context fusion tensor, perform channel compression and channel expansion based on the data dependency path between nodes, and output the reconstructed node feature sequence.

[0013] S5. Construct a set of candidate defect clusters in the node feature sequence, use a density clustering method based on distance threshold to calculate the internal consistency score of each candidate cluster, and determine the candidate cluster with the highest score as the high-confidence defect cluster.

[0014] S6. Perform dynamic threshold segmentation on the high-confidence defect cluster, construct a variable neighborhood boundary region, extract redundant nodes within the boundary range, and remove nodes based on feature offset to form target clustering units.

[0015] S7. Map the target clustering units to the basic block structure in the program file, generate the security defect clustering identification results, and output the defect distribution map and cluster labels.

[0016] Optionally, the program file is parsed by a static analysis tool to generate an intermediate representation. The intermediate representation includes basic block numbers, jump instruction types, variable read / write information, and function call indexes. The basic block numbers are used to uniquely identify each control unit, the jump instruction types are used to construct control path edges, the variable read / write information is used to construct data dependency path edges, and the function call indexes are used to construct call path edges. All of the above information participates in the construction process of the multi-type edge set in the original graph structure.

[0017] Optionally, the multi-type edge set distribution is constructed by mapping control paths, data dependency paths, and call paths to represent the connection relationships between nodes under different path types, and together with the node set, constitutes the original graph structure with structural semantics.

[0018] Optionally, the control path is used to represent the execution jump relationship between basic blocks in the program, and connects control flow nodes according to jump instructions; the data dependency path is used to represent the read and write transmission relationship between variables in the program, and establishes data flow connection between nodes by analyzing the read and write order of variables in different nodes; the call path is used to represent the call relationship between functions, and constructs cross-function connection edges according to function call indexes.

[0019] Optionally, S3 specifically includes:

[0020] S31. Construct a graph attention network by inputting the node state matrix into the graph attention network. The state vector of each node contains multi-channel feature dimensions, and the state matrix composed of all nodes is used to represent the feature space of the graph structure.

[0021] S32. Perform multi-head attention embedding operation on the node state matrix. Calculate the association strength between neighboring nodes by constructing multiple independent attention heads, and then concatenate them after each set of calculations to obtain the fused feature vector between nodes.

[0022] S33. Based on the fusion feature vector, a cross-channel attention scoring mechanism is introduced to calculate the weight transfer relationship between channels, and the channel features of each node are reconstructed by weight to obtain the channel weighted representation of the node.

[0023] S34. Repeatedly perform multiple rounds of embedding computation and channel attention weighting operations to gradually optimize the channel weighted representation of nodes, and finally generate a fusion tensor containing all node context information to support structural recognition and semantic clustering of defect patterns.

[0024] Optionally, S4 specifically includes:

[0025] S41. Based on the data dependency paths between nodes in the graph structure, construct a path-aware matrix representing the path strength, wherein the path strength is used to quantify the degree of structural connectivity between nodes;

[0026] S42. Perform channel compression on the context fusion tensor using a path-aware matrix, and extract the compressed channel representation through an aggregation-aware mechanism to form a compressed tensor.

[0027] S43. In the expanded mapping structure of the compressed tensor input channel, perform feature dimension expansion and nonlinear transformation operations to obtain the reconstructed feature vector of the corresponding node.

[0028] S44. Arrange and combine the reconstructed feature vectors of all nodes to output the reconstructed node feature sequence.

[0029] Optionally, S5 specifically includes:

[0030] S51. Based on the reconstructed feature vectors of each node in the node feature sequence, the feature space is divided by a density clustering method based on a distance threshold to generate multiple candidate cluster sets. Each candidate cluster contains multiple nodes with similar structural features.

[0031] S52. Perform consistency evaluation on the nodes in each candidate cluster, use an exponential weighting function to measure the feature distance density between nodes in the cluster, and obtain the internal consistency score of the cluster by calculating the weighted similarity score between all pairs of nodes in the cluster.

[0032] S53. Compare the internal consistency scores of all candidate clusters, and select the cluster with the highest score as the high-confidence defect cluster for performing boundary segmentation operations.

[0033] Optionally, S6 specifically includes:

[0034] S61. Using all nodes in the high-confidence defect cluster as input, calculate the difference vector between each node and the mean vector of all nodes, and use the mean vector as the cluster center reference.

[0035] S62. Using the Euclidean distance in the feature space as a metric, calculate the feature offset of each node relative to the cluster center, and construct a set of offset vectors that reflect the degree of feature deviation.

[0036] S63. By setting a dynamic threshold based on the mean and standard deviation of the offset vector set, the effective boundary region in the cluster is divided, a variable neighborhood boundary region is constructed, and the target node set within the boundary range is selected.

[0037] S64. All nodes that do not meet the threshold requirements are identified as redundant nodes and removed from the candidate clusters. The remaining nodes constitute the final target clustering unit.

[0038] Optionally, the construction process of the variable neighborhood boundary region specifically includes:

[0039] Based on the reconstructed feature vectors and Euclidean distances of all nodes in the high-confidence defect cluster, the feature offset of each node relative to the feature centroid within the cluster is calculated, forming a complete set of offset vectors.

[0040] The numerical distribution characteristics of the statistical offset vector set are analyzed, and the mean and standard deviation information are extracted. Two dynamic adjustment factors are defined and applied to the mean and standard deviation respectively. The adaptive threshold of the current cluster is then calculated.

[0041] Based on the adaptive threshold, the feature offset of each node is filtered and judged, and all nodes whose feature offset is less than or equal to the threshold are marked as nodes within the boundary.

[0042] All nodes that meet the conditions are set up to form an initial boundary region. The local adjacency density of the nodes in the initial boundary region is analyzed. The number of direct neighbors of each node is queried through the adjacency matrix, and all nodes with excessive isolation in the neighborhood boundary region are excluded.

[0043] The set of nodes filtered by feature offset and corrected by local adjacency density is defined as the variable neighborhood boundary region.

[0044] Optionally, S7 specifically includes:

[0045] S71. Match the node indices of all nodes in the target clustering unit with the node identifiers in the original graph structure, accurately locate the target nodes to the corresponding positions in the program file using the index mapping function, and construct the location mapping set.

[0046] S72. Based on the constructed location mapping set, construct and output the defect distribution map and cluster labels. The defect distribution map is used to represent the connection relationship between nodes in the target cluster unit in the original graph structure, and to characterize the spatial association pattern of defect nodes in the form of a graph structure.

[0047] The beneficial effects of this invention are:

[0048] First, by constructing a multi-type side graph structure that integrates control paths, data dependency paths, and call paths, this invention significantly improves the structural expression capability of program semantic information, accurately depicts the complex dependency relationships between security defect nodes, and provides a rich structural foundation for subsequent clustering identification.

[0049] Secondly, this invention introduces a multi-round graph attention embedding and cross-channel scoring mechanism, which realizes information weighting and context fusion between channels during feature extraction, effectively enhancing the feature representation capability of defective nodes. At the same time, it combines the aggregation perception mechanism to perform channel compression and expansion, further optimizing the semantic aggregation effect between nodes.

[0050] Finally, this invention constructs a defect clustering analysis method driven by adjacency density and feature offset. It utilizes a dynamic threshold segmentation strategy to remove redundant nodes and combines program structure mapping to generate defect distribution maps and cluster labels, which significantly improves the accuracy of cluster identification, the clarity of boundaries, and the interpretability of results. Attached Figure Description

[0051] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0052] Figure 1 This is a flowchart of a security defect clustering identification method based on graph attention networks proposed in this invention;

[0053] Figure 2 This is a flowchart of the original graph construction and semantic fusion process for a security defect clustering identification method based on graph attention network proposed in this invention.

[0054] Figure 3 This is a flowchart of graph attention network computation and context fusion for a security defect clustering identification method based on graph attention network proposed in this invention;

[0055] Figure 4 This is a flowchart illustrating the defect clustering and identification output of a security defect clustering and identification method based on graph attention networks proposed in this invention. Detailed Implementation

[0056] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0057] refer to Figure 1-4 A security vulnerability clustering identification method based on graph attention networks includes the following steps:

[0058] S1. Obtain the program file and construct the original graph structure consisting of a set of nodes and a set of edges of multiple types;

[0059] S2. Perform semantic fusion operation on each node, encode the control path features, data dependency path features and call path features into multi-channel tensors, and generate a node state matrix.

[0060] S3. Construct a graph attention network, input the node state matrix into the graph attention network, perform multiple rounds of embedding calculation, and introduce a cross-channel attention scoring mechanism in each round of embedding to output a context fusion tensor;

[0061] S4. Introduce an aggregation-aware mechanism into the context fusion tensor, perform channel compression and channel expansion based on the data dependency path between nodes, and output the reconstructed node feature sequence.

[0062] S5. Construct a set of candidate defect clusters in the node feature sequence, use a density clustering method based on distance threshold to calculate the internal consistency score of each candidate cluster, and determine the candidate cluster with the highest score as the high-confidence defect cluster.

[0063] S6. Perform dynamic threshold segmentation on the high-confidence defect cluster, construct a variable neighborhood boundary region, extract redundant nodes within the boundary range, and remove nodes based on feature offset to form target clustering units.

[0064] S7. Map the target clustering units to the basic block structure in the program file, generate the security defect clustering identification results, and output the defect distribution map and cluster labels.

[0065] This invention achieves a complete process from program structure modeling to defect cluster identification and graph output by constructing the original graph structure, integrating multiple types of semantic edges, introducing graph attention mechanism and clustering analysis strategy, and has the beneficial effects of rich structural expression, high identification accuracy and high degree of process automation.

[0066] In this embodiment, the program file is parsed by a static analysis tool to generate an intermediate representation. The intermediate representation includes basic block numbers, jump instruction types, variable read / write information, and function call indexes. The basic block numbers are used to uniquely identify each control unit, the jump instruction types are used to construct control path edges, the variable read / write information is used to construct data dependency path edges, and the function call indexes are used to construct call path edges. All of the above information participates in the construction process of the multi-type edge set in the original graph structure.

[0067] This invention parses program files into an intermediate representation with control flow, data flow, and call information, enabling the construction of multi-type edges to have a clear data source and a parsable structure, thereby enhancing the versatility and adaptability of graph modeling.

[0068] In this embodiment, the multi-type edge set distribution is constructed by mapping control paths, data dependency paths, and call paths to represent the connection relationships between nodes under different path types, and together with the node set, it constitutes the original graph structure with structural semantics.

[0069] This invention constructs multi-type edge sets by controlling paths, data dependency paths, and calling paths, thereby improving the semantic completeness and structural expressive power of graph structures and helping to accurately characterize the structural dependencies between defects.

[0070] In this embodiment, the control path is used to represent the execution jump relationship between basic blocks in the program, and the control flow nodes are connected according to the jump instructions; the data dependency path is used to represent the read and write transfer relationship between variables in the program, and the data flow connection between nodes is established by analyzing the read and write order of variables in different nodes; the call path is used to represent the call relationship between functions, and cross-function connection edges are constructed according to the function call index.

[0071] This invention integrates control paths, data dependency paths, and call paths as multiple types of edges into the graph structure, clearly distinguishing different semantic dependencies and significantly improving the structural distinguishability of interactive information between nodes.

[0072] In this embodiment, S3 specifically includes:

[0073] S31. Construct a graph attention network and process the node state matrix. In the input graph attention network, where Indicates the first The state vectors of n nodes, with a total number of nodes. ;

[0074] S32, in the In round embedding computation, a multi-head attention embedding operation is performed, and for each attention head... Calculate the attention weights between neighboring nodes The fused feature vector is obtained using the following formula:

[0075] ;

[0076] in, Indicates the first Layer The fused feature vector of each node, For the first The set of first-order neighbors of each node For the first Layer The weight matrix of each attention head. Indicates the first Layer The fused feature vector of each node, This represents the activation function. This indicates a splicing operation. For the number of heads;

[0077] S33. In each round of embedding computation, a cross-channel attention scoring mechanism is introduced, assuming the channel scoring matrix is... Then for the first The channel-weighted representation of each node is as follows:

[0078] ;

[0079] in, Indicates the first The node at the th The first layer The characteristic values ​​of each channel, Indicates the first From the first layer Passage to the Channel attention shift score;

[0080] S34, Repeat execution After round embedding and scoring processes, the context fusion tensor is obtained:

[0081] ;

[0082] in, Indicates the first Layer The context fusion tensor of each node.

[0083] This invention constructs a graph attention network and introduces a multi-round embedding and cross-channel attention scoring mechanism to achieve deep fusion of node features and channel-level weight adjustment, thereby enhancing the model's ability to perceive important semantic channels and focus on features.

[0084] In this embodiment, S4 specifically includes:

[0085] S41. Construct a path-aware matrix based on the data dependency paths between each pair of nodes in the graph structure. ,in Indicates from the first The node to the first The path strength of each node, with values ​​ranging from 1 to 2. The data dependency path is used to represent the read and write transmission relationship between variables in the program. The data flow connection between nodes is established by analyzing the read and write order of variables in different nodes.

[0086] S42, Path-Aware Matrix Perform channel compression on the context fusion tensor to generate a compressed tensor for the corresponding node. The calculation formula is as follows:

[0087] ;

[0088] in, Here is the channel compression weight matrix. This represents the activation function. For the first The compressed tensor of each node Indicates the first Layer The context fusion tensor of each node;

[0089] S43, to Perform a channel expansion operation to generate the reconstructed feature vector for the corresponding node. The calculation formula is as follows:

[0090] ;

[0091] in, Expand the weight matrix for each channel. For the reconstructed channel dimension, To expand the bias vector, For channel reconstruction activation function, Indicates the first Reconstructed feature vectors of each node;

[0092] S44. Construct a node feature sequence from the reconstructed feature vectors of all nodes. And output it.

[0093] This invention introduces an aggregation-aware mechanism during the context fusion process, performs channel compression and expansion operations based on data-dependent paths, improves the structural expressiveness and representation compactness of node feature sequences, and provides a better feature foundation for subsequent clustering.

[0094] In this embodiment, S5 specifically includes:

[0095] S51. Let the reconstructed node feature sequence be... A density-based clustering method based on distance thresholds is used to initially divide all nodes into clusters, forming a candidate cluster set. ,in Indicates the first There are candidate clusters, and the number of candidate clusters is . ;

[0096] S52, For any candidate cluster Calculate the internal consistency score The calculation formula is:

[0097] ;

[0098] in, Candidate clusters The number of nodes in These are the reconstructed feature vectors of two different nodes within the candidate cluster. Density attenuation factor, Represents Euclidean distance. This represents the natural exponential function with base e;

[0099] S53. Among all candidate clusters, select the candidate cluster with the highest consistency score. As a high-confidence defect cluster, used to perform boundary segmentation operations, denoted as:

[0100] ;

[0101] in, Candidate clusters for the function to reach its maximum value The value.

[0102] This invention utilizes a distance threshold-based density clustering method to construct candidate clusters and calculate consistency scores for node feature sequences, effectively achieving automatic screening of high-confidence defect clusters and improving the accuracy and reliability of defect clustering.

[0103] In this embodiment, S6 specifically includes:

[0104] S61. Let the high-confidence defect cluster be... ,in For the first The reconstructed feature vectors of n nodes, with a total number of nodes. The centroid vector is defined as:

[0105] ;

[0106] in, The average vector representing the characteristics of nodes within a cluster is used as a reference for cluster centers;

[0107] S62. Based on the Euclidean distance of each node relative to the centroid, calculate the feature offset of each node from the centroid within the cluster, and construct a set of offset vectors. :

[0108] ;

[0109] in, Indicates the first The feature offset of each node;

[0110] S63. Let the dynamic threshold be... According to the set of offset vectors Adaptive settings ,in and The dynamic weighting coefficients, mean and std represent the mean and standard deviation functions respectively, constructing a variable neighborhood boundary region. ;

[0111] S64. For variable neighborhood boundary regions Medium-to-high confidence defect clusters All nodes are removed, and the remaining nodes form the target clustering unit. .

[0112] This invention proposes a dynamic threshold segmentation strategy, which effectively eliminates redundant nodes and clarifies the boundaries of defect clusters by modeling feature offsets and constructing variable boundary regions, thereby improving the clarity and stability of defect localization.

[0113] In this embodiment, S7 specifically includes:

[0114] S71. Let the target clustering unit be... ,in The reserved number The feature vectors of n nodes, with a total number of nodes. By combining the index mapping function of the node identifiers in the original graph structure, the cluster node indexes are... Mapped to location labels in the program file Construct a set of location maps ;

[0115] S72, Based on the set of location labels Constructing a defect distribution map The defect distribution map is used to represent the connection relationships between nodes within the target cluster unit in the original graph structure, and to characterize the spatial association pattern of defect nodes in graph structure form, defined as:

[0116] ;

[0117] in, This is the adjacency matrix of the original graph structure. Indicates the first in the target cluster The node and the first Does the original graph structure exist between the nodes?

[0118] S73. Construct label vectors based on node feature distribution density. :

[0119] ;

[0120] in, For the first The classification weight vector of each cluster label. For the first Bias terms for each cluster label, This represents the number of cluster label categories. Indicates the first Cluster label number of each node.

[0121] This invention uses index mapping and label construction operations to accurately map clustering results back to the original program file. Combined with defect maps and label output, it constructs a complete closed-loop defect identification and feedback mechanism, which facilitates subsequent defect repair and management.

[0122] Example 1:

[0123] To verify the feasibility of this invention in practice, it was applied to an open-source software vulnerability analysis scenario. Static analysis and defect identification were performed on an actual source code file containing multiple function modules to simulate security vulnerabilities in a real software development environment. The accuracy and boundary identification capabilities of this method for defect clustering under complex dependency structures were evaluated.

[0124] In this application scenario, the selected target codebase consists of over 3200 functions, including multi-level nested structures, loop jump logic, global variable access, and cross-function call behavior. Traditional rule matching methods struggle to identify security vulnerabilities hidden due to the complex interweaving of control and data flows, such as uninitialized variable references, illegal pointer access, and function call stack out-of-bounds errors. Existing tools suffer from high false positives, scattered clustering, and unclear defect attribution when handling such semantically complex structures.

[0125] To address the aforementioned issues, this invention first utilizes static analysis techniques to parse the source code into a raw program graph containing control paths, data dependency paths, and function call paths. The graph contains 38,542 nodes and 174,653 edges. All nodes are encoded as multi-channel tensors with 64 channels, each corresponding to a semantic embedding dimension. After inputting the node state matrix into a graph attention network, four rounds of embedding are performed, each round containing six attention heads. In each round, a cross-channel attention scoring mechanism is introduced to dynamically adjust the aggregation weights of each semantic channel, enhancing the extraction capability of semantically dominant features.

[0126] After context fusion, a path-aware matrix is ​​constructed based on data dependency paths, and channel compression is performed to 32 dimensions before expansion to the original dimensions. The resulting node feature sequence serves as input for subsequent defect clustering. In the density clustering stage, a distance threshold of 0.42 is set, extracting 19 high-confidence candidate clusters. The defect cluster with the highest internal consistency score is selected for dynamic boundary identification. During dynamic threshold segmentation, the mean offset is 1.29, the standard deviation is 0.64, and the threshold is set to 1.89. 42 isolated nodes are removed, ultimately generating 17 target clustering units.

[0127] After mapping the target clustering units back to their original program locations, the system generates a defect distribution map and clustering labels, marking 188 key defect nodes covering a total of 26 functions. Compared with existing mainstream vulnerability detection tools, this invention demonstrates superiority in defect clustering accuracy, false positive rate control, and structural mapping integrity.

[0128] The following are comparative experimental data based on different methods, covering metrics such as accuracy, recall, boundary accuracy, and average cluster density.

[0129] Table 1. Evaluation of the comparative performance of different methods in the security defect clustering identification task.

[0130] Method Name Defect identification accuracy (%) Defect recall rate (%) Cluster boundary accuracy (%) Average false alarm rate (%) Number of clusters Average cluster density Explainability score ( / 10) The method of this invention (GAT + density clustering) 91.7 89.4 93.1 4.8 17 0.812 9.3 Method A (GNN+KMeans) 83.2 75.6 71.2 10.3 32 0.541 6.7 Method B (AST rule matching) 65.9 62.4 58.7 18.5 48 0.367 5.1 Method C (Static Analysis + Logical Derivation) 74.5 68.1 63.4 13.2 24 0.499 6.0

[0131] As shown in Table 1, this invention outperforms existing methods in several key metrics. Even in complex control structures and multi-layered calling scenarios, this invention can still stably output accurate boundaries and tight clustering results, and provide highly interpretable distribution maps, effectively supporting developers in defect analysis, source code auditing, and system hardening. This method demonstrates extremely high engineering adaptability and generalization performance, possessing strong promotional value.

[0132] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A security defect clustering identification method based on graph attention networks, characterized in that, Includes the following steps: S1. Obtain the program file and construct the original graph structure consisting of a set of nodes and a set of edges of multiple types; S2. Perform semantic fusion operation on each node in the original graph structure, encode the control path features, data dependency path features and call path features into multi-channel tensors, and generate a node state matrix. S3. Construct a graph attention network, input the node state matrix into the graph attention network, perform multiple rounds of embedding calculation, and introduce a cross-channel attention scoring mechanism in each round of embedding to output a context fusion tensor; S4. Introduce an aggregation-aware mechanism into the context fusion tensor, perform channel compression and channel expansion based on the data dependency path between nodes, and output the reconstructed node feature sequence. S5. Construct a set of candidate defect clusters in the node feature sequence, use a density clustering method based on distance threshold to calculate the internal consistency score of each candidate cluster, and determine the candidate cluster with the highest score as the high-confidence defect cluster. S6. Perform dynamic threshold segmentation on the high-confidence defect cluster, construct a variable neighborhood boundary region, extract redundant nodes within the boundary range, and remove nodes based on feature offset to form target clustering units. S7. Map the target clustering units to the program file to generate the security defect clustering identification results, and output the defect distribution map and cluster labels.

2. The security defect clustering identification method based on graph attention network according to claim 1, characterized in that, The program file is parsed by a static analysis tool to generate an intermediate representation. The intermediate representation includes basic block numbers, jump instruction types, variable read / write information, and function call indexes. The basic block numbers are used to uniquely identify each control unit. The jump instruction types are used to construct control path edges. The variable read / write information is used to construct data dependency path edges. The function call indexes are used to construct call path edges. All of the above information participates in the construction process of the multi-type edge set in the original graph structure.

3. The security defect clustering identification method based on graph attention network according to claim 1, characterized in that, The multi-type edge set distribution is constructed by mapping control paths, data dependency paths, and call paths, which is used to represent the connection relationship between nodes under different path types, and together with the node set, constitutes the original graph structure with structural semantics.

4. The security defect clustering identification method based on graph attention network according to claim 3, characterized in that, The control path is used to represent the execution jump relationship between basic blocks in the program, and connects control flow nodes according to jump instructions; the data dependency path is used to represent the read and write transmission relationship between variables in the program, and establishes data flow connection between nodes by analyzing the read and write order of variables in different nodes; the call path is used to represent the call relationship between functions, and constructs cross-function connection edges according to function call indexes.

5. The security defect clustering identification method based on graph attention network according to claim 1, characterized in that, S3 specifically includes: S31. Construct a graph attention network by inputting the node state matrix into the graph attention network. The state vector of each node contains multi-channel feature dimensions, and the state matrix composed of all nodes is used to represent the feature space of the graph structure. S32. Perform multi-head attention embedding operation on the node state matrix. Calculate the association strength between neighboring nodes by constructing multiple independent attention heads, and then concatenate them after each set of calculations to obtain the fused feature vector between nodes. S33. Based on the fusion feature vector, a cross-channel attention scoring mechanism is introduced to calculate the weight transfer relationship between channels, and the channel features of each node are reconstructed by weight to obtain the channel weighted representation of the node. S34. Repeatedly perform multiple rounds of embedding computation and channel attention weighting operations to gradually optimize the channel weighted representation of nodes, and finally generate a fusion tensor containing all node context information to support structural recognition and semantic clustering of defect patterns.

6. The security defect clustering identification method based on graph attention network according to claim 1, characterized in that, S4 specifically includes: S41. Based on the data dependency paths between nodes in the graph structure, construct a path-aware matrix representing the path strength, wherein the path strength is used to quantify the degree of structural connectivity between nodes; S42. Perform channel compression on the context fusion tensor using a path-aware matrix, and extract the compressed channel representation through an aggregation-aware mechanism to form a compressed tensor. S43. In the expanded mapping structure of the compressed tensor input channel, perform feature dimension expansion and nonlinear transformation operations to obtain the reconstructed feature vector of the corresponding node. S44. Arrange and combine the reconstructed feature vectors of all nodes to output the reconstructed node feature sequence.

7. The security defect clustering identification method based on graph attention network according to claim 1, characterized in that, S5 specifically includes: S51. Based on the reconstructed feature vectors of each node in the node feature sequence, the feature space is divided by a density clustering method based on a distance threshold to generate multiple candidate cluster sets. Each candidate cluster contains multiple nodes with similar structural features. S52. Perform consistency evaluation on the nodes in each candidate cluster, use an exponential weighting function to measure the feature distance density between nodes in the cluster, and obtain the internal consistency score of the cluster by calculating the weighted similarity score between all pairs of nodes in the cluster. S53. Compare the internal consistency scores of all candidate clusters, and select the cluster with the highest score as the high-confidence defect cluster for performing boundary segmentation operations.

8. The security defect clustering identification method based on graph attention network according to claim 1, characterized in that, S6 specifically includes: S61. Using all nodes in the high-confidence defect cluster as input, calculate the difference vector between each node and the mean vector of all nodes, and use the mean vector as the cluster center reference. S62. Using the Euclidean distance in the feature space as a metric, calculate the feature offset of each node relative to the cluster center, and construct a set of offset vectors that reflect the degree of feature deviation. S63. By setting a dynamic threshold based on the mean and standard deviation of the offset vector set, the effective boundary region in the cluster is divided, a variable neighborhood boundary region is constructed, and the target node set within the boundary range is selected. S64. All nodes that do not meet the threshold requirements are identified as redundant nodes and removed from the candidate clusters. The remaining nodes constitute the final target clustering unit.

9. The security defect clustering identification method based on graph attention network according to claim 8, characterized in that, The construction process of the variable neighborhood boundary region specifically includes: Based on the reconstructed feature vectors and Euclidean distances of all nodes in the high-confidence defect cluster, the feature offset of each node relative to the feature centroid within the cluster is calculated, forming a complete set of offset vectors. The numerical distribution characteristics of the statistical offset vector set are analyzed, and the mean and standard deviation information are extracted. Two dynamic adjustment factors are defined and applied to the mean and standard deviation respectively. The adaptive threshold of the current cluster is then calculated. Based on the adaptive threshold, the feature offset of each node is filtered and judged, and all nodes whose feature offset is less than or equal to the threshold are marked as nodes within the boundary. All nodes that meet the conditions are set up to form an initial boundary region. The local adjacency density of the nodes in the initial boundary region is analyzed. The number of direct neighbors of each node is queried through the adjacency matrix, and all nodes with excessive isolation in the neighborhood boundary region are excluded. The set of nodes filtered by feature offset and corrected by local adjacency density is defined as the variable neighborhood boundary region.

10. The security defect clustering identification method based on graph attention network according to claim 1, characterized in that, Specifically, S7 includes: S71. Match the node indices of all nodes in the target clustering unit with the node identifiers in the original graph structure, accurately locate the target nodes to the corresponding positions in the program file using the index mapping function, and construct the location mapping set. S72. Based on the constructed location mapping set, construct and output the defect distribution map and cluster labels. The defect distribution map is used to represent the connection relationship between nodes in the target cluster unit in the original graph structure, and to characterize the spatial association pattern of defect nodes in the form of a graph structure.

Images