Computer program vulnerability detection method based on graph neural network

Abstract

The invention discloses a computer program vulnerability detection method based on a graph neural network, and the method comprises the following steps: S1, analyzing a source code into a statement unit and a dependency relationship, and constructing a program graph structure; s2, performing word embedding coding on nodes in the graph to generate code feature vectors fusing semantics and structures; s3, executing graph information transmission through the graph neural network model, and extracting a graph feature vector; s4, constructing a vulnerability evaluation network, calculating vulnerability scores, and screening candidate nodes; s5, extracting a multi-scale adjacent graph, and generating a fusion feature vector; s6, label distribution is executed, whether the candidate nodes are vulnerability nodes or not is judged, and a detection result is output; and S7, updating the model and the network parameters according to the detection result and the error of the artificial label. The invention provides a program vulnerability detection method fusing a graph neural network and self-supervised learning. The method has the advantages of being high in structure expression ability, few in dependent labels and high in detection accuracy.

Description

Technical Field

[0001] This invention relates to the field of software vulnerability detection technology, and in particular to a computer program vulnerability detection method based on graph neural networks. Background Technology

[0002] In the development and maintenance of modern software systems, program vulnerabilities have become a key factor affecting system security and stability. Common vulnerability types include buffer overflows, null pointer dereferences, command injection, and privilege escalation. Once exploited by attackers, these vulnerabilities can lead to program crashes, data leaks, or even system compromise. To detect potential vulnerabilities early in the source code stage, researchers have proposed various vulnerability detection methods, mainly including rule-based static analysis methods and behavior-based dynamic detection methods.

[0003] Static analysis methods scan program source code using predefined rules, enabling the discovery of potential defects without executing the program. However, these methods heavily rely on manually written syntax rule templates, making it difficult to cover diverse programming patterns and limiting their accuracy when dealing with complex control and data flow structures. Dynamic detection methods, on the other hand, identify vulnerabilities by executing the program and analyzing its runtime behavior. While they have a high actual hit rate, they suffer from incomplete detection path coverage, high execution costs, and strong dependence on specific inputs, making it difficult to meet the efficient detection needs of large-scale software systems.

[0004] In recent years, graph neural networks have been widely used in program vulnerability detection tasks. By modeling source code as a graph structure composed of nodes and dependent edges, semantic and structural features are automatically extracted to identify potential defects. Although existing methods such as GCN and GAT have improved the detection effect to some extent, there are still problems such as insufficient node encoding, lack of supervision in information transmission, overly simple context modeling, and lack of self-supervision mechanism. As a result, the model is insufficient in terms of expressive power, anomaly recognition and generalization performance, which limits its detection accuracy and efficiency in practical applications.

[0005] Therefore, how to provide a computer program vulnerability detection method based on graph neural networks is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] One objective of this invention is to propose a computer program vulnerability detection method based on graph neural networks. This invention employs graph structure modeling, graph neural network feature transfer, self-supervised comparative learning, and multi-scale context analysis techniques, and describes in detail the complete detection process from source code parsing to vulnerability node determination. It has the advantages of strong semantic structure expression ability, low label dependency, and high detection accuracy.

[0007] A computer program vulnerability detection method based on graph neural networks according to an embodiment of the present invention includes the following steps:

[0008] S1. Collect the source code of the computer program, parse the source code into a set of statement units and a set of dependencies according to the preset syntax rules, and construct the program graph structure with statement units as nodes and dependencies as directed edges.

[0009] S2. Perform word embedding encoding on each node of the program graph structure, extract semantic features and structural features, and concatenate the two types of features into a code feature vector.

[0010] S3. Construct a graph neural network model, perform graph information transfer and feature aggregation operations on the program graph structure, and update the code feature vector as the graph feature vector;

[0011] S4. Construct a vulnerability assessment network, use a graph attention mechanism to weight the graph feature vectors and calculate the vulnerability score, and select nodes with vulnerability scores higher than a set threshold as candidate nodes.

[0012] S5. Extract the multi-scale adjacency graph of candidate nodes in the program graph structure according to the fixed template, construct the context vector based on the adjacency graph, and concatenate the context vector with the corresponding graph feature vector to generate the fused feature vector.

[0013] S6. Perform label assignment based on the fused feature vector and vulnerability score, determine whether the candidate node is a vulnerability node, and generate detection and evaluation results;

[0014] S7. Compare the detection and evaluation results with the manually labeled results to determine the error. Based on the comparison results, use the Adam optimizer to update the parameters of the graph neural network model and the vulnerability assessment network.

[0015] Optionally, the statement unit represents the smallest executable syntactic structure unit with a syntax type identifier and a source code line number index, the dependency relationship represents the control dependency relationship and data dependency relationship between statement units, and the fixed template represents a graph structure composed of adjacent nodes of a preset order centered on the candidate node.

[0016] Optionally, S2 specifically includes:

[0017] S21. Perform word embedding encoding on each statement unit in the program graph structure, identify the identifiers, keywords and operators in the statement and map them into a fixed-dimensional semantic feature vector;

[0018] S22. Extract the structural feature information of each node based on the edge extraction of the program graph structure, and construct a structural feature vector containing the number of incoming edges, the number of outgoing edges, and the dependency type identifier of the node.

[0019] S23. Concatenate the semantic feature vector and the structural feature vector along the dimensional direction to form the code feature vector, and construct the code feature set.

[0020] Optionally, S3 specifically includes:

[0021] S31. Construct a graph neural network model, taking the program graph structure and code feature set as input, perform graph information transmission operation on each graph node, group the code feature vectors corresponding to adjacent nodes according to edge direction and edge type, and then perform averaging operation to generate the aggregate representation of the node, wherein the edge type represents control dependency or data dependency.

[0022] S32. Perform linear transformation and ReLU activation on the aggregate representation, and add it to the corresponding code feature vector by element position to generate an update vector;

[0023] S33. Combine the update vectors of all nodes into a new set of code features and repeat the graph information transfer operation.

[0024] S34. After each round of graph information transmission operation, self-supervised contrastive learning is performed using the SimSiam method based on the update vectors of all nodes in the current round. A contrastive loss function is constructed, and the graph neural network model parameters are optimized through backpropagation.

[0025] S35. After completing the preset number of graph information transmission operations, the code feature set formed in the last round is used as the graph feature vector set.

[0026] Optionally, the self-supervised contrastive learning process specifically includes:

[0027] After completing the graph information transmission in the current round using a graph neural network, all update vectors are obtained. For each update vector, dimension sampling is performed according to a preset occlusion ratio. The dimensions that need to be set to zero are determined by a pseudo-random number generator, and the values ​​of the corresponding dimensions are set to zero to construct an occlusion feature set.

[0028] Perform an order perturbation operation on the update vector to rearrange the dimensional order of the feature vectors without changing the edge connection relationship in the program graph structure, forming a perturbation feature set;

[0029] Based on the SimSiam method, a coding network with two layers of linear transformation and layer normalization structure is constructed. Feature mapping is performed on the occlusion feature set and the perturbation feature set respectively, and the corresponding coding vectors are extracted to form the occlusion coding set and the perturbation coding set.

[0030] Extract the pairs of encoding vectors that are the same for corresponding nodes from the two encoding sets, perform element-wise difference calculation on each pair of encoding vectors, square the difference by position and average them to generate the mean squared error loss value for a single node.

[0031] The mean squared loss values ​​of all nodes are averaged to obtain the contrastive loss value, and a contrastive loss function is constructed with the goal of minimizing this loss value.

[0032] Backpropagation is performed based on the contrastive loss function, and the Adam optimizer is used to update some parameters in the encoding network to complete the self-supervised contrastive learning process.

[0033] Optionally, S4 specifically includes:

[0034] S41. Construct a vulnerability assessment network. For each node in the program graph structure, extract the graph feature vectors of the current node and its neighboring nodes and perform a concatenation operation.

[0035] S42. Based on the graph attention mechanism, extract the graph feature vectors corresponding to the two nodes connected by each edge in the program graph structure, perform affine transformation and ReLU function activation operations, calculate the similarity coefficient between the two vectors as the attention coefficient of the edge, perform scaling and layer normalization operations on all attention coefficients, and generate an attention weight set.

[0036] S43. Extract the mean, variance, and extreme values ​​from the attention weight set as statistical features, construct auxiliary vectors according to a preset arrangement order, and linearly combine them with the graph feature vector of the current node according to the element position to generate a score representation vector.

[0037] S44. Perform a multiplication operation between the score representation vector and the preset weight vector according to the element position, compare the operation result with the set cutoff value, retain the operation result greater than the set cutoff value and calculate the average value to obtain the vulnerability score of the current node.

[0038] S45. Compare the vulnerability score with the set threshold, and filter the nodes with scores higher than the threshold to form a candidate node set.

[0039] Optionally, S5 specifically includes:

[0040] S51. Using candidate nodes as the central node, determine the extraction range according to a fixed template, extract nodes with first-order, second-order, and third-order dependency connections to the central node from the program graph structure, and construct a multi-scale adjacency graph. The dependency connection is a control dependency relationship or a data dependency relationship.

[0041] S52. Perform order encoding on the graph feature vectors corresponding to all nodes in the multi-scale adjacency graph, add an order identifier to each vector to form a candidate vector set, wherein the order identifier represents the order between the node and the center node.

[0042] S53. The candidate vector set is sorted by the path entropy weighted structure sorting algorithm, and all sorted vectors are concatenated in turn to construct the context vector corresponding to the candidate node.

[0043] S54. Concatenate the context vector and the graph feature vectors corresponding to the candidate nodes according to the vector dimension to generate a fused feature vector.

[0044] Optionally, the sorting process of the candidate vector set specifically includes:

[0045] Enumerate all control dependency paths and data dependency paths between each candidate node and the central node in the candidate vector set, and construct a path set;

[0046] Calculate the path length of each path in the path set, and count the number of all paths starting from the candidate node and the number of node overlaps between paths. The path length represents the number of nodes in each path, and the number of node overlaps represents the number of intermediate nodes shared by multiple paths in the path set.

[0047] The path entropy value of each candidate node is calculated based on the length distribution, quantity statistics and overlap of the path set. The path entropy value represents the structural connection complexity and information uncertainty of the candidate node.

[0048] The path entropy value is used as the sorting weight, and the order of the order of the order of the order of the statement units in the source code is used as the sorting criterion to sort the candidate vector set.

[0049] Optionally, S6 specifically includes:

[0050] S61. Concatenate the fusion feature vector corresponding to each candidate node with the vulnerability score along the vector dimension to form a tag vector set;

[0051] S62. Input each label vector into the multilayer perceptron, and sequentially perform linear transformation, layer normalization and Sigmoid function mapping operations to output the corresponding label prediction value. The label prediction value represents the probability score of the candidate node being judged as a vulnerability node.

[0052] S63. Compare the predicted label value with the set label threshold. If it is higher than the label threshold, the candidate node is determined to be a vulnerability node; otherwise, it is determined to be a non-vulnerable node.

[0053] S64. Generate detection and evaluation results based on the candidate node vulnerability determination results, the line number and label prediction value of the corresponding statement unit in the source code.

[0054] Optionally, S7 specifically includes:

[0055] S71. Extract the predicted label values ​​of candidate nodes in the detection and evaluation results, compare them with the actual labels in the manual annotation results, and calculate the label loss of all candidate nodes.

[0056] S72. Perform mean squared error calculation on all label losses to generate loss values ​​representing the overall evaluation performance;

[0057] S73. The Adam optimizer is used to update the weight parameters of the graph neural network model and the vulnerability assessment network based on the loss value.

[0058] The beneficial effects of this invention are:

[0059] First, this invention proposes a computer program vulnerability detection method based on graph neural networks. Combining semantic feature extraction and structural feature encoding mechanisms, it constructs a program graph structure using control dependencies and data dependencies. Through graph information transfer operations and multi-round feature aggregation, it effectively improves the model's ability to understand and model potential dependency logic in the source code, providing a more accurate contextual representation for subsequent vulnerability identification.

[0060] Secondly, the SimSiam method is introduced during the training process to construct a self-supervised contrastive learning process. Multi-view feature samples are generated through occlusion and perturbation operations, and the model parameters are optimized using the contrastive loss function. This improves the quality of feature representation without the need for additional labels and enhances the model's adaptability to diverse code structures.

[0061] Finally, a vulnerability assessment method integrating path entropy ranking and graph attention mechanism is proposed. Context vectors and fused feature representations are constructed, and vulnerability node identification is completed in conjunction with multilayer perceptron and label allocation mechanism. The model is iteratively optimized based on error feedback, and finally, highly robust and high-precision automated vulnerability detection is achieved, effectively alleviating the problems of existing technologies that rely on manual rules and have low detection accuracy. Attached Figure Description

[0062] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0063] Figure 1 This is a flowchart of a computer program vulnerability detection method based on graph neural networks proposed in this invention;

[0064] Figure 2 This is a flowchart illustrating the graph feature generation and self-supervised comparative learning process of a computer program vulnerability detection method based on graph neural networks proposed in this invention.

[0065] Figure 3This is a flowchart illustrating the process from candidate nodes to vulnerability determination in a computer program vulnerability detection method based on graph neural networks proposed in this invention. Detailed Implementation

[0066] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0067] refer to Figure 1-3 A computer program vulnerability detection method based on graph neural networks includes the following steps:

[0068] S1. Collect the source code of the computer program, parse the source code into a set of statement units and a set of dependencies according to the preset syntax rules, and construct the program graph structure with statement units as nodes and dependencies as directed edges.

[0069] S2. Perform word embedding encoding on each node of the program graph structure, extract semantic features and structural features, and concatenate the two types of features into a code feature vector.

[0070] S3. Construct a graph neural network model, perform graph information transfer and feature aggregation operations on the program graph structure, and update the code feature vector as the graph feature vector;

[0071] S4. Construct a vulnerability assessment network, use a graph attention mechanism to weight the graph feature vectors and calculate the vulnerability score, and select nodes with vulnerability scores higher than a set threshold as candidate nodes.

[0072] S5. Extract the multi-scale adjacency graph of candidate nodes in the program graph structure according to the fixed template, construct the context vector based on the adjacency graph, and concatenate the context vector with the corresponding graph feature vector to generate the fused feature vector.

[0073] S6. Perform label assignment based on the fused feature vector and vulnerability score, determine whether the candidate node is a vulnerability node, and generate detection and evaluation results;

[0074] S7. Compare the detection and evaluation results with the manually labeled results to determine the error. Based on the comparison results, use the Adam optimizer to update the parameters of the graph neural network model and the vulnerability assessment network.

[0075] In this embodiment, the statement unit represents the smallest executable syntax structure unit with a syntax type identifier and a source code line number index, the dependency relationship represents the control dependency relationship and data dependency relationship between statement units, and the fixed template represents a graph structure composed of adjacent nodes of a preset order centered on the candidate node.

[0076] In this embodiment, the syntax rules specifically include:

[0077] Lexical analysis rules that decompose source code into token sequences, the token sequences including keywords, operators, variable names, constants, and statement boundary characters;

[0078] Context-free syntax rules for constructing an abstract syntax tree, wherein the abstract syntax tree is used to represent the syntactic structure hierarchy of statement units;

[0079] A control flow parsing rule for identifying control dependencies in a program, wherein the control dependencies include conditional jumps, loop jumps, and branch judgment relationships;

[0080] Data flow parsing rules for identifying data dependencies in a program, wherein the data dependencies include variable definition and reference relationships, memory read and write order relationships, and parameter passing relationships between function calls;

[0081] A mapping rule is constructed based on the abstract syntax tree to create a unified set of dependency relationships. This mapping rule is used to map control dependencies and data dependencies as directed edges between statement units.

[0082] In this embodiment, S2 specifically includes:

[0083] S21. Perform word embedding encoding on each statement unit in the program graph structure, identify the identifiers, keywords and operators in the statement and map them into a fixed-dimensional semantic feature vector;

[0084] S22. Extract the structural feature information of each node based on the edge extraction of the program graph structure, and construct a structural feature vector containing the number of incoming edges, the number of outgoing edges, and the dependency type identifier of the node.

[0085] S23. Concatenate the semantic feature vector and the structural feature vector along the dimensional direction to form the code feature vector, and construct the code feature set.

[0086] In this embodiment, S3 specifically includes:

[0087] S31. Construct a graph neural network model, taking the program graph structure and code feature set as input, perform graph information transmission operation on each graph node, group the code feature vectors corresponding to adjacent nodes according to edge direction and edge type, and then perform averaging operation to generate the aggregate representation of the node, wherein the edge type represents control dependency or data dependency.

[0088] S32. Perform linear transformation and ReLU activation on the aggregate representation, and add it to the corresponding code feature vector by element position to generate an update vector;

[0089] S33. Combine the update vectors of all nodes into a new set of code features and repeat the graph information transfer operation.

[0090] S34. After each round of graph information transmission operation, self-supervised contrastive learning is performed using the SimSiam method based on the update vectors of all nodes in the current round. A contrastive loss function is constructed, and the graph neural network model parameters are optimized through backpropagation.

[0091] S35. After completing the preset number of graph information transmission operations, the code feature set formed in the last round is used as the graph feature vector set.

[0092] In this embodiment, the self-supervised contrastive learning process specifically includes:

[0093] After completing the graph information transmission in the current round using a graph neural network, all update vectors are obtained. For each update vector, dimension sampling is performed according to a preset occlusion ratio. The dimensions that need to be set to zero are determined by a pseudo-random number generator, and the values ​​of the corresponding dimensions are set to zero to construct an occlusion feature set.

[0094] Perform an order perturbation operation on the update vector to rearrange the dimensional order of the feature vectors without changing the edge connection relationship in the program graph structure, forming a perturbation feature set;

[0095] Based on the SimSiam method, a coding network with two layers of linear transformation and layer normalization structure is constructed. Feature mapping is performed on the occlusion feature set and the perturbation feature set respectively, and the corresponding coding vectors are extracted to form the occlusion coding set and the perturbation coding set.

[0096] Extract the pairs of encoding vectors that are the same for corresponding nodes from the two encoding sets, perform element-wise difference calculation on each pair of encoding vectors, square the difference by position and average them to generate the mean squared error loss value for a single node.

[0097] The mean squared loss values ​​of all nodes are averaged to obtain the contrastive loss value, and a contrastive loss function is constructed with the goal of minimizing this loss value.

[0098] Backpropagation is performed based on the contrastive loss function, and the Adam optimizer is used to update some parameters in the encoding network to complete the self-supervised contrastive learning process.

[0099] In this embodiment, S4 specifically includes:

[0100] S41. Construct a vulnerability assessment network. For each node in the program graph structure, extract the graph feature vectors of the current node and its neighboring nodes and perform a concatenation operation.

[0101] S42. Based on the graph attention mechanism, extract the graph feature vectors corresponding to the two nodes connected by each edge in the program graph structure, perform affine transformation and ReLU function activation operations, calculate the similarity coefficient between the two vectors as the attention coefficient of the edge, perform scaling and layer normalization operations on all attention coefficients, and generate an attention weight set.

[0102] S43. Extract the mean, variance, and extreme values ​​from the attention weight set as statistical features, construct auxiliary vectors according to a preset arrangement order, and linearly combine them with the graph feature vector of the current node according to the element position to generate a score representation vector.

[0103] S44. Perform a multiplication operation between the score representation vector and the preset weight vector according to the element position, compare the operation result with the set cutoff value, retain the operation result greater than the set cutoff value and calculate the average value to obtain the vulnerability score of the current node.

[0104] S45. Compare the vulnerability score with the set threshold, and filter the nodes with scores higher than the threshold to form a candidate node set.

[0105] In this embodiment, the linear combination process specifically includes:

[0106] Based on the graph feature vector corresponding to the current node, extract the values ​​of each dimension.

[0107] The statistical features at the corresponding positions in the auxiliary vector are used as weighting factors, and element-wise multiplication is performed on each dimension of the graph feature vector.

[0108] The multiplication result is added to the original value of the graph feature vector according to the element position to generate a linear combination of the score representation vector.

[0109] In this embodiment, S5 specifically includes:

[0110] S51. Using candidate nodes as the central node, determine the extraction range according to a fixed template, extract nodes with first-order, second-order, and third-order dependency connections to the central node from the program graph structure, and construct a multi-scale adjacency graph. The dependency connection is a control dependency relationship or a data dependency relationship.

[0111] S52. Perform order encoding on the graph feature vectors corresponding to all nodes in the multi-scale adjacency graph, add an order identifier to each vector to form a candidate vector set, wherein the order identifier represents the order between the node and the center node.

[0112] S53. The candidate vector set is sorted by the path entropy weighted structure sorting algorithm, and all sorted vectors are concatenated in turn to construct the context vector corresponding to the candidate node.

[0113] S54. Concatenate the context vector and the graph feature vectors corresponding to the candidate nodes according to the vector dimension to generate a fused feature vector.

[0114] In this embodiment, the sorting process of the candidate vector set specifically includes:

[0115] Enumerate all control dependency paths and data dependency paths between each candidate node and the central node in the candidate vector set, and construct a path set;

[0116] Calculate the path length of each path in the path set, and count the number of all paths starting from the candidate node and the number of node overlaps between paths. The path length represents the number of nodes in each path, and the number of node overlaps represents the number of intermediate nodes shared by multiple paths in the path set.

[0117] The path entropy value of each candidate node is calculated based on the length distribution, quantity statistics and overlap of the path set. The path entropy value represents the structural connection complexity and information uncertainty of the candidate node.

[0118] The path entropy value is used as the sorting weight, and the order of the order of the order of the order of the statement units in the source code is used as the sorting criterion to sort the candidate vector set.

[0119] In this embodiment, the calculation process of the path entropy value specifically includes:

[0120] The base score is obtained by multiplying the path length by the number of paths.

[0121] Divide the base score by the number of overlapping nodes and add one to get the complexity score of the corresponding path;

[0122] Summing all complexity scores and dividing each complexity score by the summation result yields the path proportion weight.

[0123] For each path, multiply the path percentage weight by the logarithmic result of that weight, and sum the results of all paths and take the opposite of the sum as the path entropy value.

[0124] In this embodiment, S6 specifically includes:

[0125] S61. Concatenate the fusion feature vector corresponding to each candidate node with the vulnerability score along the vector dimension to form a tag vector set;

[0126] S62. Input each label vector into the multilayer perceptron, and sequentially perform linear transformation, layer normalization and Sigmoid function mapping operations to output the corresponding label prediction value. The label prediction value represents the probability score of the candidate node being judged as a vulnerability node.

[0127] S63. Compare the predicted label value with the set label threshold. If it is higher than the label threshold, the candidate node is determined to be a vulnerability node; otherwise, it is determined to be a non-vulnerable node.

[0128] S64. Generate detection and evaluation results based on the candidate node vulnerability determination results, the line number and label prediction value of the corresponding statement unit in the source code.

[0129] In this embodiment, S7 specifically includes:

[0130] S71. Extract the predicted label values ​​of candidate nodes in the detection and evaluation results, compare them with the actual labels in the manual annotation results, and calculate the label loss of all candidate nodes.

[0131] S72. Perform mean squared error calculation on all label losses to generate loss values ​​representing the overall evaluation performance;

[0132] S73. The Adam optimizer is used to update the weight parameters of the graph neural network model and the vulnerability assessment network based on the loss value.

[0133] Example 1:

[0134] To verify the feasibility of this invention in practice, it was applied to a large dataset of industrial software source code collected in practice, and systematic experiments were conducted to evaluate its vulnerability detection capabilities and performance in a real environment.

[0135] The source code dataset used in the experiment covers multiple typical modules, involving various functional logics such as image processing, access control, string parsing, and network communication. It is characterized by deep function call hierarchies, complex dependencies, and diverse semantic structures. The test scope covers 45 subsystems, involving 1350 source code files with a total of over 650,000 lines. Based on manual annotation and vulnerability database verification, a total of 2287 real vulnerability nodes were identified, covering six vulnerability types: null pointer dereferences, array out-of-bounds access, privilege escalation, insecure function calls, and business logic defects.

[0136] In practical applications, the proposed program graph structure modeling method is first used to parse the source code into a graph structure with control and data dependencies. Then, word embedding encoding is performed on each statement unit, and structural feature vectors are constructed to generate a code feature set. Multi-round graph information transmission is performed based on a graph neural network model, and the SimSiam method is introduced after each round for self-supervised comparative learning. By constructing occlusion and perturbation feature pairs, highly stable graph representation vectors are extracted.

[0137] After feature extraction, a vulnerability scoring network is constructed using a graph attention mechanism. This network outputs a vulnerability score for each node in the program graph and extracts high-scoring nodes as candidate nodes. For each candidate node, a multi-scale adjacency graph is extracted centered on it. A path entropy sorting algorithm is used to construct the context vector, and the original graph features are fused to generate a fused feature vector.

[0138] The fused features and vulnerability scores are concatenated and input into a multilayer perceptron for label prediction, outputting the vulnerability probability of each candidate node. Finally, the prediction results are compared with manually labeled data, and the model parameters are optimized based on the error.

[0139] To comprehensively evaluate the performance of this invention, comparative experiments were designed with current mainstream methods, including traditional static scanning tools (Tool-A), convolutional neural network models (CNN-B), graph convolutional models (GCN-C), and graph attention mechanism models (GAT-D). The comparison metrics included accuracy, recall, F1 score, false positive rate, false negative rate, average processing time, number of effective recalled vulnerabilities, and model robustness metrics.

[0140] Table 1. Performance Comparison and Evaluation Results of the Invention Method and Existing Technologies in Vulnerability Detection Tasks

[0141] method Accuracy (%) Recall rate (%) F1 score (%) False alarm rate (%) Missed report rate (%) Average processing time (s) Number of effective vulnerability recalls Robustness score Tool-A 72.3 58.4 64.6 22.7 41.6 10.2 1337 0.51 CNN-B 80.1 70.3 74.8 15.6 29.7 12.7 1608 0.64 GCN-C 84.2 76.5 80.2 12.4 23.5 16.5 1749 0.71 GAT-D 87.5 81.3 84.3 10.1 18.7 18.3 1860 0.76 Method of the present invention 91.6 86.9 89.2 7.3 13.1 19.4 1983 0.84

[0142] Table 1 shows that this invention significantly outperforms the comparison methods in terms of accuracy, recall, and F1 score, with the lowest false positive and false negative rates, the highest number of effectively recalled vulnerability nodes, and the highest robustness score in multiple perturbation, structural pruning, and random occlusion experiments, demonstrating good stability and reliability. Especially in high-complexity control flow scenarios, this invention significantly improves the ability to identify potential vulnerability structures through context modeling and path entropy guidance strategies. The average processing time is slightly higher than the basic model, but within an acceptable range.

[0143] In summary, the method proposed in this invention can effectively identify various program vulnerabilities in practical applications, and has the advantages of high identification accuracy, strong robustness, and good structural adaptability, providing a practical and feasible technical path for automated vulnerability detection of large-scale software systems.

[0144] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for detecting computer program vulnerabilities based on graph neural networks, characterized in that, Includes the following steps: S1. Collect the source code of the computer program, parse the source code into a set of statement units and a set of dependencies according to the preset syntax rules, and construct the program graph structure with statement units as nodes and dependencies as directed edges. S2. Perform word embedding encoding on each node of the program graph structure, extract semantic features and structural features, and concatenate the two types of features into a code feature vector. S3. Construct a graph neural network model, perform graph information transfer and feature aggregation operations on the program graph structure, and update the code feature vector as the graph feature vector; S4. Construct a vulnerability assessment network, use a graph attention mechanism to weight the graph feature vectors and calculate the vulnerability score, and select nodes with vulnerability scores higher than a set threshold as candidate nodes. S5. Extract the multi-scale adjacency graph of candidate nodes in the program graph structure according to the fixed template, construct the context vector based on the adjacency graph, and concatenate the context vector with the corresponding graph feature vector to generate the fused feature vector. S6. Perform label assignment based on the fused feature vector and vulnerability score, determine whether the candidate node is a vulnerability node, and generate detection and evaluation results; S7. Compare the detection and evaluation results with the manually labeled results to determine the error. Based on the comparison results, use the Adam optimizer to update the parameters of the graph neural network model and the vulnerability assessment network.

2. The computer program vulnerability detection method based on graph neural networks according to claim 1, characterized in that, The statement unit represents the smallest executable syntactic structure unit with a syntax type identifier and a source code line number index. The dependency relationship represents the control dependency relationship and data dependency relationship between statement units. The fixed template represents a graph structure composed of adjacent nodes of a preset order centered on the candidate node.

3. The computer program vulnerability detection method based on graph neural networks according to claim 1, characterized in that, S2 specifically includes: S21. Perform word embedding encoding on each statement unit in the program graph structure, identify the identifiers, keywords and operators in the statement and map them into a fixed-dimensional semantic feature vector; S22. Extract the structural feature information of each node based on the edge extraction of the program graph structure, and construct a structural feature vector containing the number of incoming edges, the number of outgoing edges, and the dependency type identifier of the node. S23. Concatenate the semantic feature vector and the structural feature vector along the dimensional direction to form the code feature vector, and construct the code feature set.

4. The computer program vulnerability detection method based on graph neural networks according to claim 1, characterized in that, S3 specifically includes: S31. Construct a graph neural network model, taking the program graph structure and code feature set as input, perform graph information transmission operation on each graph node, group the code feature vectors corresponding to adjacent nodes according to edge direction and edge type, and then perform averaging operation to generate the aggregate representation of the node, wherein the edge type represents control dependency or data dependency. S32. Perform linear transformation and ReLU activation on the aggregate representation, and add it to the corresponding code feature vector by element position to generate an update vector; S33. Combine the update vectors of all nodes into a new set of code features and repeat the graph information transfer operation. S34. After each round of graph information transmission operation, self-supervised contrastive learning is performed using the SimSiam method based on the update vectors of all nodes in the current round. A contrastive loss function is constructed, and the graph neural network model parameters are optimized through backpropagation. S35. After completing the preset number of graph information transmission operations, the code feature set formed in the last round is used as the graph feature vector set.

5. The computer program vulnerability detection method based on graph neural networks according to claim 4, characterized in that, The self-supervised contrastive learning process specifically includes: After completing the graph information transmission in the current round using a graph neural network, all update vectors are obtained. For each update vector, dimension sampling is performed according to a preset occlusion ratio. The dimensions that need to be set to zero are determined by a pseudo-random number generator, and the values ​​of the corresponding dimensions are set to zero to construct an occlusion feature set. Perform an order perturbation operation on the update vector to rearrange the dimensional order of the feature vectors without changing the edge connection relationship in the program graph structure, forming a perturbation feature set; Based on the SimSiam method, a coding network with two layers of linear transformation and layer normalization structure is constructed. Feature mapping is performed on the occlusion feature set and the perturbation feature set respectively, and the corresponding coding vectors are extracted to form the occlusion coding set and the perturbation coding set. Extract the pairs of encoding vectors that are the same for corresponding nodes from the two encoding sets, perform element-wise difference calculation on each pair of encoding vectors, square the difference by position and average them to generate the mean squared error loss value for a single node. The mean squared loss values ​​of all nodes are averaged to obtain the contrastive loss value, and a contrastive loss function is constructed with the goal of minimizing this loss value. Backpropagation is performed based on the contrastive loss function, and the Adam optimizer is used to update some parameters in the encoding network to complete the self-supervised contrastive learning process.

6. The computer program vulnerability detection method based on graph neural networks according to claim 1, characterized in that, S4 specifically includes: S41. Construct a vulnerability assessment network. For each node in the program graph structure, extract the graph feature vectors of the current node and its neighboring nodes and perform a concatenation operation. S42. Based on the graph attention mechanism, extract the graph feature vectors corresponding to the two nodes connected by each edge in the program graph structure, perform affine transformation and ReLU function activation operations, calculate the similarity coefficient between the two vectors as the attention coefficient of the edge, perform scaling and layer normalization operations on all attention coefficients, and generate an attention weight set. S43. Extract the mean, variance, and extreme values ​​from the attention weight set as statistical features, construct auxiliary vectors according to a preset arrangement order, and linearly combine them with the graph feature vector of the current node according to the element position to generate a score representation vector. S44. Perform a multiplication operation between the score representation vector and the preset weight vector according to the element position, compare the operation result with the set cutoff value, retain the operation result greater than the set cutoff value and calculate the average value to obtain the vulnerability score of the current node. S45. Compare the vulnerability score with the set threshold, and filter the nodes with scores higher than the threshold to form a candidate node set.

7. The computer program vulnerability detection method based on graph neural networks according to claim 1, characterized in that, S5 specifically includes: S51. Using candidate nodes as the central node, determine the extraction range according to a fixed template, extract nodes with first-order, second-order, and third-order dependency connections to the central node from the program graph structure, and construct a multi-scale adjacency graph. The dependency connection is a control dependency relationship or a data dependency relationship. S52. Perform order encoding on the graph feature vectors corresponding to all nodes in the multi-scale adjacency graph, add an order identifier to each vector to form a candidate vector set, wherein the order identifier represents the order between the node and the center node. S53. The candidate vector set is sorted by the path entropy weighted structure sorting algorithm, and all sorted vectors are concatenated in turn to construct the context vector corresponding to the candidate node. S54. Concatenate the context vector and the graph feature vectors corresponding to the candidate nodes according to the vector dimension to generate a fused feature vector.

8. The computer program vulnerability detection method based on graph neural networks according to claim 7, characterized in that, The sorting process of the candidate vector set specifically includes: Enumerate all control dependency paths and data dependency paths between each candidate node and the central node in the candidate vector set, and construct a path set; Calculate the path length of each path in the path set, and count the number of all paths starting from the candidate node and the number of node overlaps between paths. The path length represents the number of nodes in each path, and the number of node overlaps represents the number of intermediate nodes shared by multiple paths in the path set. The path entropy value of each candidate node is calculated based on the length distribution, quantity statistics and overlap of the path set. The path entropy value represents the structural connection complexity and information uncertainty of the candidate node. The path entropy value is used as the sorting weight, and the order of the order of the order of the order of the statement units in the source code is used as the sorting criterion to sort the candidate vector set.

9. The computer program vulnerability detection method based on graph neural networks according to claim 1, characterized in that, S6 specifically includes: S61. Concatenate the fusion feature vector corresponding to each candidate node with the vulnerability score along the vector dimension to form a tag vector set; S62. Input each label vector into the multilayer perceptron, and sequentially perform linear transformation, layer normalization and Sigmoid function mapping operations to output the corresponding label prediction value. The label prediction value represents the probability score of the candidate node being judged as a vulnerability node. S63. Compare the predicted label value with the set label threshold. If it is higher than the label threshold, the candidate node is determined to be a vulnerability node; otherwise, it is determined to be a non-vulnerable node. S64. Generate detection and evaluation results based on the candidate node vulnerability determination results, the line number and label prediction value of the corresponding statement unit in the source code.

10. The computer program vulnerability detection method based on graph neural networks according to claim 1, characterized in that, Specifically, S7 includes: S71. Extract the predicted label values ​​of candidate nodes in the detection and evaluation results, compare them with the actual labels in the manual annotation results, and calculate the label loss of all candidate nodes. S72. Perform mean squared error calculation on all label losses to generate loss values ​​representing the overall evaluation performance; S73. The Adam optimizer is used to update the weight parameters of the graph neural network model and the vulnerability assessment network based on the loss value.

Images