Code vulnerability detection method

Abstract

The invention provides a code vulnerability detection method, which comprises the following steps of: preprocessing a source code to obtain a de-obfuscated source code and a dependency graph; according to the de-obfuscated source code and the dependency graph, establishing a syntax tree corresponding to the source code and carrying out taint analysis to obtain a plurality of static analysis vulnerabilities; analyzing the de-obfuscated source code and the syntax tree by adopting a symbolic execution strategy to obtain a plurality of dynamic analysis vulnerabilities; inputting the de-obfuscated source code and the dependency graph into a machine learning model to obtain a plurality of machine learning analysis vulnerabilities; inputting the static analysis vulnerability, the dynamic analysis vulnerability and the machine learning analysis vulnerability into a Bayesian decision network to determine occurrence probabilities corresponding to the static analysis vulnerability, the dynamic analysis vulnerability and the machine learning analysis vulnerability; and performing weighted summation on the occurrence probabilities corresponding to the static analysis vulnerabilities, the dynamic analysis vulnerabilities and the machine learning analysis vulnerabilities to determine the risk probability of each vulnerability. According to the invention, the front-end code can be intelligently analyzed.

Description

Technical Field

[0001] This invention relates to the field of code detection technology, and in particular to a method for detecting code vulnerabilities. Background Technology

[0002] With the rapid development of web applications, front-end security issues are becoming increasingly prominent. Traditional front-end security testing mainly relies on manual code review and basic static analysis tools. However, static analysis typically uses simple rule-matching scanning tools, primarily detecting obvious security issues and struggling to address increasingly complex security threats. To improve the ability to detect code vulnerabilities, a combination of static analysis and basic dynamic detection can be introduced. However, this approach only detects vulnerabilities based on the execution path of the code, failing to integrate the vulnerabilities detected by both methods or detect deep vulnerabilities within the code. Summary of the Invention

[0003] The code vulnerability detection method provided by this invention can integrate multiple code analysis techniques to perform intelligent analysis of front-end code.

[0004] This invention provides a code vulnerability detection method, the method comprising: The source code is preprocessed to obtain deobfuscated source code and a dependency graph corresponding to the source code; Based on the deobfuscated source code and the dependency graph, a syntax tree corresponding to the source code is built, and taint analysis is performed based on the syntax tree to obtain multiple static analysis vulnerabilities that are at risk. The deobfuscated source code and syntax tree are analyzed using a symbolic execution strategy to identify several dynamic analysis vulnerabilities that pose a risk. The deobfuscated source code and dependency graph are input into the machine learning model to obtain code segments that deviate from the cluster center in the deobfuscated code, thereby identifying multiple machine learning analysis vulnerabilities that may pose a risk. The static analysis vulnerability, dynamic analysis vulnerability, and machine learning analysis vulnerability are input into a Bayesian decision network to determine the occurrence probability of the static analysis vulnerability, dynamic analysis vulnerability, and machine learning analysis vulnerability. The probability of occurrence of the static analysis vulnerability, the dynamic analysis vulnerability, and the machine learning analysis vulnerability is weighted and summed to determine the risk probability of each vulnerability.

[0005] Optionally, the step of weighted summing of the occurrence probabilities of the static analysis vulnerability, the dynamic analysis vulnerability, and the machine learning analysis vulnerability to determine the risk probability of each vulnerability includes: The probability of each vulnerability occurring in static analysis, dynamic analysis, and machine learning analysis is summed according to preset weights to obtain the risk probability of each vulnerability.

[0006] Optionally, after determining the risk probability of each vulnerability by weighted summation of the occurrence probabilities corresponding to the static analysis vulnerability, dynamic analysis vulnerability, and machine learning analysis vulnerability, the method further includes: Vulnerabilities with a risk probability greater than a preset value are scored according to a preset vulnerability scoring system to obtain the risk rating of the corresponding vulnerability.

[0007] Optionally, the step of scoring vulnerabilities with a risk probability greater than a preset value according to a preset vulnerability scoring system to obtain a risk rating for the corresponding vulnerability includes: The risk rating of the vulnerability is obtained by weighting and summing the attack path complexity, data leakage risk, and code modification complexity.

[0008] Optionally, after scoring vulnerabilities with a risk probability greater than a preset value according to a preset vulnerability scoring system to obtain a risk rating for the corresponding vulnerability, the method further includes: The risk ratings of all vulnerabilities with a risk probability greater than a preset value are weighted and summed to obtain the total risk score corresponding to the source code.

[0009] Optionally, the step of weighted summing of the risk ratings of all vulnerabilities with a risk probability greater than a preset value to obtain the total risk score corresponding to the source code includes: The dependency depth weight and usage frequency of the vulnerability are determined based on the dependency graph. The risk rating, depth of dependency weight, and frequency of use of each vulnerability are multiplied together to obtain the risk level of a single vulnerability; The risk levels of all vulnerabilities are summed to obtain the total risk score corresponding to the source code.

[0010] Optionally, based on the deobfuscated source code and the dependency graph, a syntax tree corresponding to the source code is constructed, and taint analysis is performed based on the syntax tree to obtain multiple static analysis vulnerabilities with potential risks, including: Construct a syntax tree corresponding to the source code, and inject corresponding context information into each node of the syntax tree according to the dependency graph; Based on the context information in the syntax tree, tainted data is subjected to context tracking; When tainted data is not cleaned up by the time it reaches a dangerous convergence point, a static analysis vulnerability is identified in the propagation path of the tainted data.

[0011] Optionally, the analysis of the deobfuscated source code and syntax tree using a symbolic execution strategy to identify multiple dynamic analysis vulnerabilities that pose a risk includes: A lightweight sandbox is built using a file object model tree, key reference interfaces, a JavaScript interpreter, and simulated request and response. The deobfuscated source code and syntax tree are analyzed using a symbolic execution strategy within the lightweight sandbox to identify multiple dynamic analysis vulnerabilities that pose a risk.

[0012] Optionally, the analysis of the deobfuscated source code and syntax tree using a symbolic execution strategy to identify multiple dynamic analysis vulnerabilities that pose a risk includes: Construct a syntax tree corresponding to the source code, and inject corresponding context information into each node of the syntax tree according to the dependency graph; Based on the upper and lower information of each node, the path of symbol execution is solved; Symbolic execution is performed based on the execution path obtained from the solution, and it is determined whether there are dynamic analysis vulnerabilities in the path.

[0013] Optionally, the step of inputting the deobfuscated source code and dependency graph into the machine learning model to obtain code segments in the deobfuscated code that deviate from the cluster center, thereby identifying multiple machine learning analysis vulnerabilities that may pose a risk, includes: The deobfuscated source code and dependency graph are input into the encoding layer of the machine learning model, so that the encoding layer outputs code sequence encoding, control flow graph encoding, and position encoding. The code sequence encoding, control flow graph encoding, and position encoding are processed using a multi-head attention mechanism to obtain feature data corresponding to the source code; The feature data is input into the classification layer, and the deviation results between the feature vectors corresponding to multiple code segments and the cluster centers are determined to identify multiple machine learning analysis vulnerabilities that may be at risk.

[0014] In the technical solution provided by this invention, firstly, static analysis vulnerabilities, dynamic analysis vulnerabilities, and machine learning analysis vulnerabilities are identified. Then, the corresponding occurrence probabilities are determined through a Bayesian decision network. Finally, the occurrence probabilities of the static analysis vulnerabilities, dynamic analysis vulnerabilities, and machine learning analysis vulnerabilities are weighted and summed to determine the risk probability of each vulnerability. This risk probability represents the overall result of static analysis, dynamic analysis, and machine learning analysis. In other words, this risk probability represents the analysis results at multiple levels, effectively improving the accuracy and coverage of vulnerability detection. Attached Figure Description

[0015] Figure 1 This is a flowchart of a code vulnerability detection method according to an embodiment of the present invention. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] This invention provides a code vulnerability detection method, such as... Figure 1 As shown, the method includes: The source code is preprocessed to obtain deobfuscated source code and a dependency graph corresponding to the source code; In some embodiments, preprocessing of source code can be performed using a multi-mode deobfuscation engine. For example, it can integrate various deobfuscation algorithms such as JSFuck, AAEncode, and variable name obfuscation, automatically selecting the appropriate decoding strategy through feature detection. Furthermore, based on directed acyclic graph theory, it automatically analyzes the component dependencies of the project and identifies vulnerability propagation paths. After deobfuscation and dependency graph construction, the code representation of different frameworks can be unified, providing standardized input for subsequent analysis.

[0018] The deobfuscation algorithm is based on syntax tree reconstruction and pattern recognition theory. Specifically, deobfuscation processing mainly relies on three types of obfuscation techniques. The first is JSFuck obfuscation, which utilizes JavaScript's type conversion characteristics to construct code using only characters such as [], (), !, and +. This obfuscation technique primarily targets reverse engineering based on JavaScript's weak type conversion rules. Therefore, the detection method for this obfuscation technique mainly calculates the character frequency distribution, triggering decoding when a specific character set accounts for more than 90%, and restoring the original semantics by constructing a character mapping table and recursively parsing. The second is AAEncode obfuscation, which uses emoticons for code obfuscation. Therefore, this obfuscation technique can be identified by detecting the density of emoticons within a specific Unicode range, and the code can be restored by reverse conversion based on a predefined symbol-value mapping relationship. The third is variable name obfuscation, which randomizes identifier naming. For this type of obfuscation technique, meaningful variable names can be reconstructed through context analysis and type inference, and the scrambled program execution order can be identified and restored. By deobfuscating the source code, unnecessary deobfuscation operations on normal code can be avoided. Large projects can be parsed in blocks and obfuscated patterns can be cached to improve the efficiency of identifying repetitive patterns.

[0019] The dependency graph is built based on the Directed Acyclic Graph (DAG) theory to represent the dependencies between components in a front-end project. Specifically, there are two implementation methods: static dependency extraction and indirect dependency discovery. Static dependency extraction identifies direct dependencies by parsing import / require statements, dynamic dependencies by analyzing dynamic import patterns, and extracts CSS @imports and resource references. Indirect dependency discovery involves recursively traversing to build a complete dependency tree, identifying circular dependencies and potential dependency conflicts, and calculating dependency depth and impact. By constructing the dependency graph, the impact of a single component vulnerability on the entire project can be assessed, facilitating the development of security update plans based on dependency priorities and identifying the isolation boundaries of high-risk components.

[0020] Based on the deobfuscated source code and the dependency graph, a syntax tree corresponding to the source code is built, and taint analysis is performed based on the syntax tree to obtain multiple static analysis vulnerabilities that are at risk. In some embodiments, since the dependency graph represents the data flow graph and control flow graph in the code, while the syntax tree typically only represents the constituent units of the code and the nesting and dependency relationships between these units, context information of each node can be tracked by injecting information corresponding to the dependency graph into each node of the syntax tree. After constructing the syntax tree, taint analysis can be performed on it to identify potential static analysis vulnerabilities.

[0021] The deobfuscated source code and syntax tree are analyzed using a symbolic execution strategy to identify several dynamic analysis vulnerabilities that pose a risk. In some embodiments, symbolic execution can explore multiple execution paths of a program by using symbolic values ​​instead of specific values, and discover deep-seated logical vulnerabilities. In this step, the execution of the symbolic execution strategy based on the syntax tree can provide constraints on the path solving process through the context information of multiple nodes of the syntax tree, thereby accelerating the inspection efficiency of the symbolic execution strategy.

[0022] The deobfuscated source code and dependency graph are input into the machine learning model to obtain code segments that deviate from the cluster center in the deobfuscated code, thereby identifying multiple machine learning analysis vulnerabilities that may pose a risk. In some embodiments, inputting the dependent graph and deobfuscated source code into a trained machine learning model enables a deep understanding of the code semantics and execution logic, and the extraction of corresponding feature vectors. The machine learning model, having learned the pattern distribution of normal code, already possesses corresponding cluster centers. When the feature vector of a code segment deviates from the cluster center, vulnerabilities in that code segment can be detected.

[0023] The static analysis vulnerability, dynamic analysis vulnerability, and machine learning analysis vulnerability are input into a Bayesian decision network to determine the occurrence probability of the static analysis vulnerability, dynamic analysis vulnerability, and machine learning analysis vulnerability. In some embodiments, the aforementioned static analysis vulnerabilities, dynamic analysis vulnerabilities, and machine learning analysis vulnerabilities are all potential vulnerabilities, but the probability of such vulnerabilities occurring cannot be determined. Therefore, in this step, the aforementioned vulnerabilities are input into a Bayesian decision network, and the Bayesian decision network outputs the corresponding probability of occurrence.

[0024] The probability of occurrence of the static analysis vulnerability, the dynamic analysis vulnerability, and the machine learning analysis vulnerability is weighted and summed to determine the risk probability of each vulnerability.

[0025] In some embodiments, the risk probability refers to the weighted sum of the probabilities of each vulnerability occurring in static analysis, dynamic analysis, and machine learning analysis. The same vulnerability may exist in one, two, or all three sets of these vulnerabilities. By weighted summing the probabilities of occurrence for each type of vulnerability, the probability of its occurrence can be effectively measured. For example, when the same vulnerability exists simultaneously in static analysis, dynamic analysis, and machine learning analysis, the risk probability is usually high because the vulnerability is detected by all three detection methods.

[0026] In the technical solution provided by the embodiments of the present invention, firstly, static analysis vulnerabilities, dynamic analysis vulnerabilities, and machine learning analysis vulnerabilities are identified. Then, the corresponding occurrence probabilities are determined through a Bayesian decision network. Finally, the occurrence probabilities of the static analysis vulnerabilities, dynamic analysis vulnerabilities, and machine learning analysis vulnerabilities are weighted and summed to determine the risk probability of each vulnerability. This risk probability represents the overall result of static analysis, dynamic analysis, and machine learning analysis. That is, the risk probability represents the analysis results at multiple levels, effectively improving the accuracy and coverage of vulnerability detection.

[0027] As an optional implementation, the step of weighted summing of the occurrence probabilities of the static analysis vulnerability, the dynamic analysis vulnerability, and the machine learning analysis vulnerability to determine the risk probability of each vulnerability includes: The probability of each vulnerability occurring in static analysis, dynamic analysis, and machine learning analysis is summed according to preset weights to obtain the risk probability of each vulnerability.

[0028] In some embodiments, the weighted summation process can be performed according to, for example, the following formula: P(vulnerability | observational evidence) = α1·P(vulnerability | static analysis) + α2·P(vulnerability | dynamic analysis) + α3·P(vulnerability | deep learning); Wherein the weighting coefficients are: α1 = 0.4 (static analysis weight); α² = 0.3 (dynamic analysis weight); α3 = 0.3 (deep learning weights); The constraint is α1 + α2 + α3 = 1 The Bayesian decision network outputs the probability of occurrence for each vulnerability in static analysis, dynamic analysis, and machine learning analysis. When a vulnerability exists in all three types of vulnerabilities (i.e., at their intersection), the probability is calculated by weighting these three probabilities together. If a vulnerability does not exist in any of these three types, its probability in static analysis, dynamic analysis, or machine learning analysis is set to 0.

[0029] As an optional implementation, after weighted summing the occurrence probabilities of the static analysis vulnerability, dynamic analysis vulnerability, and machine learning analysis vulnerability to determine the risk probability of each vulnerability, the method further includes: Vulnerabilities with a risk probability greater than a preset value are scored according to a preset vulnerability scoring system to obtain the risk rating of the corresponding vulnerability.

[0030] In some embodiments, high-probability vulnerabilities are those that are likely to occur and thus have a higher probability of impacting the system. However, the severity of the vulnerability's impact on the system should still be assessed; therefore, a risk rating for the corresponding vulnerability is required.

[0031] As an optional implementation, the step of scoring vulnerabilities with a risk probability greater than a preset value according to a preset vulnerability scoring system to obtain a risk rating for the corresponding vulnerability includes: The risk rating of the vulnerability is obtained by weighting and summing the attack path complexity, data leakage risk, and code modification complexity.

[0032] In some embodiments, risk rating may be performed using a rating matrix such as the following:

[0033] Based on the aforementioned rating matrix, the risk rating of the corresponding vulnerability is obtained using the following formula: Final risk level = 0.6 × availability score + 0.3 × impact range score + 0.1 × repair cost score.

[0034] As an optional implementation, after scoring vulnerabilities with a risk probability greater than a preset value according to a preset vulnerability scoring system to obtain a risk rating for the corresponding vulnerability, the method further includes: The risk ratings of all vulnerabilities with a risk probability greater than a preset value are weighted and summed to obtain the total risk score corresponding to the source code.

[0035] In some embodiments, after determining the risk rating of each vulnerability, it is also necessary to confirm the risk of all source code. Therefore, in this step, the risk ratings of all vulnerabilities with a risk probability greater than a preset value are weighted and summed to obtain the final total risk score of the source code.

[0036] As an optional implementation, the step of weighted summing of the risk ratings of all vulnerabilities with a risk probability greater than a preset value to obtain the total risk score corresponding to the source code includes: The dependency depth weight and usage frequency of the vulnerability are determined based on the dependency graph. The risk rating, depth of dependency weight, and frequency of use of each vulnerability are multiplied together to obtain the risk level of a single vulnerability; The risk levels of all vulnerabilities are summed to obtain the total risk score corresponding to the source code.

[0037] In some embodiments, the weighted summation can be performed according to the following formula: Risk score = (Risk Rating) i × Depth-dependent weights i × Frequency of use i ) Where n is the total number of vulnerabilities and the risk rating i The risk rating of the i-th vulnerability depends on depth weighting. i The dependency depth weight for the i-th vulnerability is determined by the frequency. i Let be the frequency at which the i-th vulnerability is used.

[0038] As an optional implementation, based on the deobfuscated source code and the dependency graph, a syntax tree corresponding to the source code is constructed, and taint analysis is performed based on the syntax tree to obtain multiple static analysis vulnerabilities with potential risks, including: Construct a syntax tree corresponding to the source code, and inject corresponding context information into each node of the syntax tree according to the dependency graph; Based on the context information in the syntax tree, tainted data is subjected to context tracking; When tainted data is not cleaned up by the time it reaches a dangerous convergence point, a static analysis vulnerability is identified in the propagation path of the tainted data.

[0039] In some embodiments, the syntax tree has a unified syntax representation, that is, it has a general AST node type that is independent of the design framework and supports different syntaxes such as React JSX, Vue templates, and Angular components; the syntax tree has security semantic annotation, that is, security-related context information, including risk level, vulnerability type, data source, etc., is directly embedded in the AST node; the syntax tree also has adaptive taint analysis capability, that is, it dynamically adjusts the taint propagation rules according to the characteristics of the purification function of different frameworks.

[0040] The syntax tree can be constructed in the following manner: First, during the lexical analysis phase, based on the dependency graph, potential dangerous function calls are identified, user input-related variables and expressions are marked, and cross-domain requests and external resource references are identified; Subsequently, an AST node with security attributes is constructed, a risk level label is added to each node, and data flow relationships between nodes are established. Finally, type inference and variable scope analysis are used to identify potential code injection points and analyze the security impact of asynchronous operations.

[0041] For example, the nodes of a syntax tree can be arranged as follows: ASTNode { type: 'CallExpression', callee: 'innerHTML', arguments: [userInput], securityContext: { riskLevel: 'HIGH' vulnerabilityType: 'XSS', dataSource: 'USER_INPUT', sanitizationStatus: 'NONE' } } After constructing the syntax tree, based on information flow theory, security vulnerabilities are identified by tracing the propagation path of potentially malicious data within the program; this is known as taint analysis. Specifically, the taint analysis process can be performed as follows: First, identify tainted data sources, including: user input interfaces (forms, URL parameters, cookies, etc.), external API response data, and untrusted outputs from third-party libraries.

[0042] Subsequently, a pollution assessment is constructed based on the following formula: Pollution assessment (v) = (Path weight ᵢ × Purification coefficient ᵢ × Propagation distance weight ᵢ) / Path depth Wherein: path weight reflects the credibility of the data flow path, purification coefficient represents the degree of risk reduction after processing by the security function, and propagation distance weight considers the distance the taint propagates in the code. Path weight ᵢ represents the weight of the i-th path, purification coefficient ᵢ represents the purification coefficient of the i-th path, propagation distance weight ᵢ represents the propagation distance weight of the i-th path, and n is the total number of paths.

[0043] Finally, check for security vulnerabilities at risk convergence points. Risk convergence points include DOM manipulation functions (innerHTML, outerHTML, document.write), dynamic code execution (eval, Function, setTimeout string parameters), and network request construction (XMLHttpRequest, fetch URL parameters).

[0044] As an optional implementation, the symbolic execution strategy is used to analyze the deobfuscated source code and syntax tree to identify multiple dynamic analysis vulnerabilities that pose a risk, including: A lightweight sandbox is built using a file object model tree, key reference interfaces, a JavaScript interpreter, and simulated request and response. The deobfuscated source code and syntax tree are analyzed using a symbolic execution strategy within the lightweight sandbox to identify multiple dynamic analysis vulnerabilities that pose a risk.

[0045] In some embodiments, building a lightweight sandbox can reduce resource consumption during the vulnerability identification process. A lightweight sandbox can employ, for example, selective environment simulation, simulating only the DOM API and JavaScript runtime necessary for front-end code execution, rather than a full browser; a customized execution engine, i.e., a lightweight JavaScript interpreter designed specifically for the characteristics of front-end code; and intelligent resource management, i.e., controlling resource usage to within 512MB through memory pools and object reuse techniques.

[0046] Specifically, the lightweight sandbox used in this step is compared with the technical architecture of traditional dynamic analysis as follows:

[0047] The lightweight sandbox used in this step only implements the DOM APIs necessary for front-end security testing. Key objects typically include `document`, `window`, `navigator`, and `location`. Furthermore, it requires monitoring of dangerous functions, which typically include `eval`, `innerHTML`, and `createElement`. To ensure the security of the testing process, environment isolation is also necessary. For example, code within the sandbox cannot access host system resources, network requests are redirected to a local simulated service, and file system access is completely disabled.

[0048] As an optional implementation, the symbolic execution strategy is used to analyze the deobfuscated source code and syntax tree to identify multiple dynamic analysis vulnerabilities that pose a risk, including: Construct a syntax tree corresponding to the source code, and inject corresponding context information into each node of the syntax tree according to the dependency graph; Based on the upper and lower information of each node, the path of symbol execution is solved; Symbolic execution is performed based on the execution path obtained from the solution, and it is determined whether there are dynamic analysis vulnerabilities in the path.

[0049] In some embodiments, symbolic execution strategies can be optimized based on the syntax tree. For example, priority can be prioritized based on taint analysis results, execution paths that do not contain user input can be pruned, and recursion depth can be limited to avoid path explosion. Furthermore, for the constraint solver, an incremental constraint solver can be employed, the results of solving duplicate constraints can be cached, and heuristic algorithms can be used to quickly filter reachable paths. Additionally, symbolic state compression can be implemented, for example, by merging semantically equivalent program states, using abstract domain techniques to reduce the state space, and implementing path-sensitive alias analysis.

[0050] As an optional implementation, the step of inputting the deobfuscated source code and dependency graph into the machine learning model to obtain code segments in the deobfuscated code that deviate from the cluster center, thereby identifying multiple machine learning analysis vulnerabilities that pose a risk, includes: The deobfuscated source code and dependency graph are input into the encoding layer of the machine learning model, so that the encoding layer outputs code sequence encoding, control flow graph encoding, and position encoding. The code sequence encoding, control flow graph encoding, and position encoding are processed using a multi-head attention mechanism to obtain feature data corresponding to the source code; The feature data is input into the classification layer, and the deviation results between the feature vectors corresponding to multiple code segments and the cluster centers are determined to identify multiple machine learning analysis vulnerabilities that may be at risk.

[0051] In some embodiments, the machine learning model may employ a Transformer model. During machine learning analysis, the source code and dependency graph are first input into the encoding layer of the Transformer model, resulting in code sequence encoding, control flow graph encoding, and positional encoding. Code sequence encoding corresponds to the token sequence formed by transforming the source code; control flow graph encoding corresponds to the topological features extracted from the control flow graph in the dependency graph; and positional encoding is used to preserve the position and hierarchical information of the code. During feature data extraction, a multi-head attention mechanism is employed, including at least syntactic attention, data flow attention, and control flow attention. Specifically, syntactic attention focuses on syntactic structures and function call relationships, data flow attention tracks variable definition-usage relationships, and control flow attention analyzes the safety impact of branching and looping structures.

[0052] After extracting the feature data, the vulnerability is detected using the following formula: Anomaly score = ||Eigenvector - Cluster center|| 2 > 3σ Wherein: the feature vector is the code representation extracted by the Transformer model, the cluster center is the center point of the normal code pattern, σ is the standard deviation of the normal distribution, and the threshold 3σ is the anomaly judgment criterion based on the 3-sigma rule. The cluster center and standard deviation are obtained during the training process of the machine learning model by learning the pattern distribution of normal code based on anomaly detection theory.

[0053] Those skilled in the art will understand that all or part of the processes in the above method embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0054] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method of detecting code vulnerabilities, the method comprising: The method comprises: preprocessing the source code to obtain de-obfuscated source code and a dependency graph corresponding to the source code; establishing a syntax tree corresponding to the source code according to the de-obfuscated source code and the dependency graph, and performing a taint analysis according to the syntax tree to obtain a plurality of static analysis vulnerabilities with a risk of existing; analyzing the de-obfuscated source code and the syntax tree using a symbolic execution strategy to obtain a plurality of dynamic analysis vulnerabilities with a risk of existing; inputting the de-obfuscated source code and the dependency graph into a machine learning model to obtain a plurality of machine learning analysis vulnerabilities with a risk of existing by acquiring code segments deviating from a cluster center in the de-obfuscated code; inputting the static analysis vulnerabilities, the dynamic analysis vulnerabilities and the machine learning analysis vulnerabilities into a Bayesian decision network to determine occurrence probabilities of the static analysis vulnerabilities, the dynamic analysis vulnerabilities and the machine learning analysis vulnerabilities; weighting and summing the occurrence probabilities of the static analysis vulnerabilities, the dynamic analysis vulnerabilities and the machine learning analysis vulnerabilities to determine a risk probability of each vulnerability.

2. The method of claim 1, wherein, The weighting and summing of the occurrence probabilities of the static analysis vulnerabilities, the dynamic analysis vulnerabilities and the machine learning analysis vulnerabilities to determine a risk probability of each vulnerability comprises: summing the occurrence probabilities of each vulnerability in the static analysis vulnerabilities, the dynamic analysis vulnerabilities and the machine learning analysis vulnerabilities according to preset weights to obtain the risk probability of the each vulnerability.

3. The method of claim 2, wherein, After the weighting and summing of the occurrence probabilities of the static analysis vulnerabilities, the dynamic analysis vulnerabilities and the machine learning analysis vulnerabilities to determine a risk probability of each vulnerability, the method further comprises: scoring the vulnerabilities with a risk probability greater than a preset value according to a preset vulnerability scoring system to obtain a risk rating of the corresponding vulnerability.

4. The method of claim 3, wherein, The scoring of the vulnerabilities with a risk probability greater than a preset value according to a preset vulnerability scoring system to obtain a risk rating of the corresponding vulnerability comprises: weighting and summing an attack path complexity, a data leakage risk and a code modification complexity corresponding to the vulnerability to obtain the risk rating of the corresponding vulnerability.

5. The method of claim 3, wherein, After the scoring of the vulnerabilities with a risk probability greater than a preset value according to a preset vulnerability scoring system to obtain a risk rating of the corresponding vulnerability, the method further comprises: weighting and summing the risk ratings of all vulnerabilities with a risk probability greater than the preset value to obtain a total risk score corresponding to the source code.

6. The method of claim 5, wherein, The weighting and summing of the risk ratings of all vulnerabilities with a risk probability greater than the preset value to obtain a total risk score corresponding to the source code comprises: determining a dependency depth weight and a usage frequency of the vulnerability according to the dependency graph; multiplying the risk rating, the depth dependency weight and the usage frequency of each vulnerability to obtain a risk degree of a single vulnerability; summing the risk degrees of all vulnerabilities to obtain the total risk score corresponding to the source code.

7. The method of claim 1, wherein, The establishing a syntax tree corresponding to the source code according to the de-obfuscated source code and the dependency graph, and performing a taint analysis according to the syntax tree to obtain a plurality of static analysis vulnerabilities with a risk of existence includes: building a syntax tree corresponding to the source code, and injecting corresponding context information at each node of the syntax tree according to the dependency graph; performing context tracking on taint data according to the context information in the syntax tree; when the taint data has not been purified when reaching a dangerous sink point, determining that a propagation path of the taint data has the static analysis vulnerability.

8. The method of claim 1, wherein, The analyzing the de-obfuscated source code and the syntax tree using a symbolic execution strategy to obtain a plurality of dynamic analysis vulnerabilities with a risk of existence includes: building a lightweight sandbox using a file object model tree, a key reference interface, a JavaScript interpreter, and a simulated request response; analyzing the de-obfuscated source code and the syntax tree in the lightweight sandbox using the symbolic execution strategy to obtain the plurality of dynamic analysis vulnerabilities with a risk of existence.

9. The method of claim 1, wherein, The analyzing the de-obfuscated source code and the syntax tree using a symbolic execution strategy to obtain a plurality of dynamic analysis vulnerabilities with a risk of existence includes: building a syntax tree corresponding to the source code, and injecting corresponding context information at each node of the syntax tree according to the dependency graph; solving a path of symbolic execution according to the context information of each node; performing symbolic execution according to the solved execution path, and determining whether the path has the dynamic analysis vulnerability.

10. The method of claim 1, wherein, The inputting the de-obfuscated source code and the dependency graph into a machine learning model, and obtaining a code segment deviating from a clustering center in the de-obfuscated code to obtain a plurality of machine learning analysis vulnerabilities with a risk of existence includes: inputting the de-obfuscated source code and the dependency graph into an encoding layer of the machine learning model, so that the encoding layer outputs code sequence encoding, control flow graph encoding, and position encoding; processing the code sequence encoding, the control flow graph encoding, and the position encoding using a multi-head attention mechanism to obtain feature data corresponding to the source code; inputting the feature data into a classification layer of the machine learning model, and judging a deviation result of a feature vector corresponding to a plurality of code segments from a clustering center to obtain the plurality of machine learning analysis vulnerabilities with a risk of existence.

Images