Code vulnerability detection method and device, storage medium and electronic equipment

Abstract

The invention provides a code vulnerability detection method and device, a storage medium and electronic equipment, and relates to the technical field of artificial intelligence, and the method comprises the steps: extracting corresponding input code data from code auditing input streams of all dimensions, and carrying out the preprocessing to generate a code attribute graph; performing vulnerability reasoning on the code attribute graph by adopting a double-engine dynamic routing mode, and dynamically selecting a first detection model or a second detection model to execute detection according to the confidence coefficient of a vulnerability reasoning result; automatically labeling the vulnerability detection result based on feedback information of a developer on the vulnerability detection result, and screening effective labeled data to form an incremental training candidate set; automatically synthesizing a sample with a vulnerability code and corresponding labeling information based on user configuration parameters, and supplementing the synthesized sample to a training sample library; and based on the incremental training candidate set and the supplemented training sample library, periodically updating model parameters of the first detection model and the second detection model by adopting an incremental fine tuning technology. The vulnerability detection precision can be improved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, storage medium and electronic device for detecting code vulnerabilities. Background Technology

[0002] With the deepening of digital transformation, software systems have become the core infrastructure of key industries such as finance, energy, and healthcare. Cybersecurity incidents caused by code vulnerabilities are growing explosively, causing not only huge economic losses but also seriously threatening data privacy and business continuity.

[0003] Static Application Security Testing (SAST), as a core technology for early vulnerability prevention throughout the software development lifecycle, is widely integrated into the development process because it can achieve early vulnerability detection without running the target program. However, with the continuous updates to the CWE / CVE vulnerability databases and the emergence of new and business logic vulnerabilities, traditional SAST tools face a triple challenge in terms of vulnerability coverage timeliness, detection accuracy, and scenario adaptability. Existing technologies are no longer sufficient to meet the security auditing needs of rapidly iterating software development. Summary of the Invention

[0004] In view of this, this application provides a code vulnerability detection method, device, storage medium, and electronic device, which can improve vulnerability detection accuracy while covering the entire software development process and responding quickly to new vulnerabilities, thus meeting the security auditing needs of rapid iterative software development.

[0005] According to a first aspect of this application, a code vulnerability detection method is provided, comprising: Obtain a multi-dimensional code audit input stream, extract corresponding input code data from each dimension of the code audit input stream, and preprocess the input code data to generate a code attribute graph; A dual-engine dynamic routing mode is used to perform vulnerability inference on the code attribute graph. Based on the confidence level of the vulnerability inference result, the first detection model or the second detection model is dynamically selected to perform the detection, and the vulnerability detection result is obtained. The model computing power of the first detection model is less than that of the second detection model. Collect feedback from developers on the vulnerability detection results, automatically label the vulnerability detection results based on the feedback, and filter valid labeled data to form an incremental training candidate set; The sample factory receives user configuration parameters and automatically synthesizes vulnerable code samples and corresponding annotation information based on the user configuration parameters. The synthesized samples are then added to the training sample library. Based on the incremental training candidate set and the supplemented training sample library, the model parameters of the first detection model and the second detection model are periodically updated using incremental fine-tuning techniques.

[0006] According to a second aspect of this application, a code vulnerability detection device is provided, comprising: The generation module is used to acquire multi-dimensional code audit input streams, extract corresponding input code data from each dimension of the code audit input streams, and preprocess the input code data to generate a code attribute map. The detection module is used to perform vulnerability inference on the code attribute graph using a dual-engine dynamic routing mode. Based on the confidence level of the vulnerability inference result, it dynamically selects either the first detection model or the second detection model to perform the detection and obtains the vulnerability detection result. The model computing power of the first detection model is less than that of the second detection model. The filtering module is used to collect feedback information from developers on the vulnerability detection results, automatically label the vulnerability detection results based on the feedback content, and filter the effective labeled data to form an incremental training candidate set. The synthesis module is used to receive user configuration parameters through the sample factory, automatically synthesize vulnerable code samples and corresponding annotation information based on the user configuration parameters, and supplement the training sample library with the synthesized samples. The update module is used to periodically update the model parameters of the first detection model and the second detection model based on the incremental training candidate set and the supplemented training sample library using incremental fine-tuning technology.

[0007] According to a third aspect of this application, a storage medium is provided on which a computer program is stored, which, when executed by a processor, implements the above-described code vulnerability detection method.

[0008] According to a fourth aspect of this application, an electronic device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the program to implement the above-described code vulnerability detection method.

[0009] By employing the above technical solutions, this application provides a code vulnerability detection method, apparatus, storage medium, and electronic device. First, by acquiring a multi-dimensional code audit input stream and extracting corresponding input code data for preprocessing to generate a code attribute map, it can adapt to audit scenarios at different stages of the software development process, solving the problem of insufficient scenario adaptability. Furthermore, the code attribute map can fully capture the syntactic and semantic relationships of the code, laying the foundation for subsequent identification of business logic vulnerabilities. Second, it adopts a dual-engine dynamic routing mode. Based on the confidence level of the initial vulnerability inference results from the first detection model (low computing power), it dynamically selects whether to call the second detection model (high computing power) to perform secondary detection. This ensures the efficiency of conventional vulnerability detection through the low computing power model, while the high computing power model provides in-depth analysis of low-confidence results and long contextual logic, improving the detection accuracy of business logic and complex vulnerabilities and reducing the risk of false positives. Third, it collects and automatically labels feedback from developers on the vulnerability detection results, filtering valid data. The incremental training candidate set incorporates vulnerability features and false alarm scenarios from real-world development scenarios into the model optimization, making the model more aligned with real auditing needs. Simultaneously, the sample factory automatically synthesizes labeled samples from multiple industries, frameworks, and vulnerability types using configuration parameters, supplementing the training sample library. This addresses the issues of scarce labeled samples and limited scenario coverage in traditional technologies, providing the model with rich data support for novel vulnerabilities and multiple scenarios. Finally, based on the incremental training candidate set and the supplemented training sample library, incremental fine-tuning techniques are used to periodically update the dual-detection model parameters. This allows for the rapid integration of new vulnerability features into the model, significantly shortening the new vulnerability coverage cycle and enabling continuous self-evolution of the model. Ultimately, this ensures that the entire code auditing system covers the entire software development process in terms of scenario adaptability, effectively identifies business logic vulnerabilities and complex vulnerabilities with reduced false alarm rates in terms of detection accuracy, and rapidly responds to new vulnerabilities in terms of vulnerability coverage timeliness, fully meeting the security auditing needs of rapidly iterating software development.

[0010] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0011] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A flowchart illustrating a code vulnerability detection method provided in an embodiment of this application is shown; Figure 2A flowchart illustrating a code vulnerability detection method according to another embodiment of this application is shown; Figure 3 A schematic diagram of the structure of a code vulnerability detection device provided in an embodiment of this application is shown. Detailed Implementation

[0012] The present application will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of the present application can be combined with each other.

[0013] Static Application Security Testing (SAST), as a core technology for early vulnerability prevention throughout the software development lifecycle, is widely integrated into the development process because it can achieve early vulnerability detection without running the target program. However, with the continuous updates to the CWE / CVE vulnerability databases and the emergence of new and business logic vulnerabilities, traditional SAST tools face a triple challenge in terms of vulnerability coverage timeliness, detection accuracy, and scenario adaptability. Existing technologies are no longer sufficient to meet the security auditing needs of rapidly iterating software development.

[0014] To address the aforementioned technical problems, embodiments of the present invention provide a code vulnerability detection method, such as... Figure 1 As shown, the method includes: Step 110: Obtain multi-dimensional code audit input streams, extract corresponding input code data from each dimension of the code audit input streams, and preprocess the input code data to generate code attribute graphs.

[0015] Among them, the multi-dimensional code audit input stream refers to a collection of multiple input sources that carry information related to the code to be audited and cover different audit scenarios in software development. Common dimensions include single file audit requests (developers actively upload a single code file), PR / MR event input streams (incremental code input triggered when merging code branches), and timed full repository scan input streams (complete code repository input triggered periodically). The core is to cover different audit needs through multiple dimensions. Input code data refers to the code content to be processed extracted from the code audit input streams of various dimensions and directly used for vulnerability auditing. Preprocessing refers to the standardized optimization operations performed on the input code data, with the aim of improving data quality to adapt to subsequent processing. This usually includes removing comments, blank lines and redundant spaces, correcting syntax anomalies, and unifying code format. The CodeProperty Graph (CPG) is a structured graph model that integrates code syntax and semantic information. Through the combination of nodes and edges, it fully presents the logical structure and deep relationships of the code.

[0016] Step 120: Use a dual-engine dynamic routing mode to perform vulnerability inference on the code attribute graph. Dynamically select the first detection model or the second detection model to perform detection based on the confidence level of the vulnerability inference results, and obtain the vulnerability detection results.

[0017] The dual-engine dynamic routing mode refers to a scheduling mode that includes two detection models (engines) with identical functions but different computing power. The corresponding model is dynamically selected for detection based on key indicators (such as confidence level) of the vulnerability inference results. The core principle is to achieve reasonable allocation of detection resources by selecting models on demand. The confidence level of the vulnerability inference results refers to the quantified value of the reliability of the output results after the detection model performs vulnerability inference on the code attribute graph. It is usually presented as a percentage or decimal. A higher confidence level indicates that the model's judgment of the inference results is more reliable. The first detection model in the dual-engine dynamic routing mode is the detection model with relatively lower computing power, mainly used to handle vulnerability inference results with high confidence. Its advantages are fast detection speed, low resource consumption, and suitability for conventional and simple vulnerability detection scenarios. The second detection model in the dual-engine dynamic routing mode is the detection model with relatively higher computing power, mainly used to handle vulnerability inference results with low confidence. Its advantages are the ability to deeply analyze the long context logic and cross-module relationships of the code, and suitability for complex and covert vulnerability detection scenarios.

[0018] In this embodiment of the disclosure, a dynamic routing mode including two detection models can be adopted. First, vulnerability inference is performed on the constructed code attribute graph to generate vulnerability inference results with confidence levels. Then, a detection model is dynamically selected to perform subsequent detection based on the confidence level. Specifically, if the confidence level meets the preset requirements, the first detection model with lower computing power is called to complete the detection; if the confidence level does not meet the preset requirements, the second detection model with higher computing power is called to perform the detection. Finally, a complete vulnerability detection result is output through this dynamic selection mechanism.

[0019] By using a dual-engine dynamic routing mode to perform vulnerability inference on the code attribute graph, it can quickly process the high-confidence conventional vulnerability inference results with the help of the first detection model with less computing power, ensuring the detection efficiency of basic audit scenarios; and for complex inference results with low confidence, it can call the second detection model with more computing power for in-depth analysis, effectively improving the identification accuracy of complex vulnerabilities such as business logic and cross-module correlations, avoiding the problem of low efficiency or insufficient accuracy caused by the fixed computing power of a single model, and ultimately achieving a balance between detection efficiency and accuracy.

[0020] Step 130: Collect feedback from developers on the vulnerability detection results, automatically label the vulnerability detection results based on the feedback, and filter the effective labeled data to form an incremental training candidate set.

[0021] In this embodiment of the disclosure, various feedback information submitted by developers regarding the output vulnerability detection results (such as confirming the authenticity of the vulnerability, pointing out false alarms, supplementing vulnerability details, etc.) can be collected. Then, based on these feedback contents as the core basis, structured tags (such as "valid vulnerability" and "false alarm") are automatically added to the corresponding vulnerability detection results, and key information in the feedback is associated and recorded. Subsequently, from all the labeled detection result data, valid labeled data with complete labeling information, matching the actual development scenario, and without logical contradictions are selected. Finally, these selected valid data are integrated to form an incremental training candidate set that can be used for subsequent model optimization.

[0022] By collecting developer feedback and automatically labeling vulnerability detection results based on that feedback, concrete information such as the real characteristics of vulnerabilities and the reasons for false alarms in actual development scenarios can be transformed into structured data. This avoids the inefficiency and subjective errors of manual labeling and ensures that the labeled data closely matches real auditing needs. Furthermore, by selecting effective labeled data to form an incremental training candidate set, the quality of subsequent model training data can be ensured, and the interference of invalid or erroneous data on model optimization can be eliminated. This provides accurate and high-quality data support for the incremental iteration of the detection model, which is in line with actual business scenarios, and helps the model continuously correct detection biases and adapt to diverse development scenarios.

[0023] Step 140: Receive user configuration parameters through the sample factory, automatically synthesize vulnerable code samples and corresponding annotation information based on the user configuration parameters, and supplement the training sample library with the synthesized samples.

[0024] The sample factory refers to a dedicated system module used to automatically generate vulnerable code samples and corresponding annotation information. Its core function is to synthesize and annotate samples in batches and accurately according to user-configured parameters, replacing the traditional manual sample creation mode. User-configured parameters refer to the key conditions set by the user according to their needs to constrain the direction of sample generation. Common parameters include target vulnerability type (such as SQL injection, XSS vulnerability), industry business scenario description (such as financial payment, e-commerce order), programming language (such as Java, Python), application framework (such as Spring Boot, Django), etc. Vulnerable code samples refer to runnable code snippets or complete code files containing specific preset vulnerabilities generated by the sample factory according to the configuration parameters. Their vulnerability characteristics are consistent with the target vulnerability type configured by the user and incorporate the logic of the corresponding industry business scenario. Annotation information refers to the structured data that accompanies the vulnerable code samples and is used to explain vulnerability-related information. It usually includes vulnerability tags (such as "SQL injection vulnerability"), vulnerability classification (such as "injection type vulnerability"), the location of the vulnerability in the code, vulnerability triggering conditions, and remediation suggestions, etc., which are key guiding data during model training.

[0025] In this embodiment of the disclosure, the sample factory can receive various configuration parameters set by the user and automatically generate code samples containing specific vulnerabilities based on these parameters. At the same time, it can simultaneously generate vulnerability-related annotation information that matches the sample. Finally, the generated code sample with vulnerabilities and its corresponding annotation information are added to the data repository (i.e., the training sample repository) used for model training, thus completing the complete process of automated sample generation and training resource supplementation.

[0026] By receiving user configuration parameters through the sample factory, the system can automatically synthesize vulnerable code samples, accurately matching the user's personalized needs such as vulnerability types and application scenarios. This solves the problems of low efficiency and insufficient scenario coverage in traditional manual sample construction. The simultaneous generation of corresponding annotation information eliminates the tedious process of subsequent manual annotation, which can significantly improve the efficiency of sample preparation. The synthesized samples are added to the training sample library, which can quickly enrich the vulnerability types and scenario coverage of the sample library, providing diversified and targeted training data support for the detection model and helping the model improve its ability to identify various vulnerabilities in different scenarios.

[0027] Step 150: Based on the incremental training candidate set and the supplemented training sample library, the model parameters of the first detection model and the second detection model are periodically updated using incremental fine-tuning technology.

[0028] Incremental fine-tuning is a model optimization technique. Its core is to update only some key parameters of the model (such as low-rank matrix parameters) instead of adjusting all parameters. This allows the model to absorb information from new data while significantly reducing computing power consumption and shortening training time.

[0029] In this embodiment of the disclosure, the incremental training candidate set formed in the early stage and the training sample library supplemented with automatically synthesized samples can be integrated to merge the two types of data into a unified model optimization data source. Then, an incremental fine-tuning technique that updates only the key parameters of the model is adopted. According to a preset fixed period (such as once a week), the internal parameters of the first detection model and the second detection model are iteratively adjusted respectively, so that the two models can continuously absorb the vulnerability features and scene information in the new data source, and finally complete the periodic update of the dual model parameters to achieve dynamic optimization of model performance.

[0030] By integrating the incremental training candidate set with the supplemented training sample library, it incorporates real vulnerability data verified by feedback in actual development scenarios, as well as automatically synthesized samples covering multiple scenarios. This provides a rich and practical data source for model updates. The incremental fine-tuning technology can accurately update key model parameters while avoiding the high computational consumption of full training, thus improving optimization efficiency. Periodically updating the parameters of the dual detection model ensures that the model can absorb new vulnerability features and scenario experience in a timely manner, continuously optimizing the vulnerability identification accuracy of the two models and reducing the false alarm rate. This allows the dual-engine detection system to always adapt to the dynamic changes in vulnerability types and business scenarios in software development, ensuring long-term detection effectiveness.

[0031] In summary, the code vulnerability detection method provided by this invention, by acquiring a multi-dimensional code audit input stream and extracting corresponding input code data for preprocessing to generate a code attribute graph, can adapt to audit scenarios at different stages of the software development process, solving the problem of insufficient scenario adaptability. Furthermore, the code attribute graph can fully capture the syntactic and semantic relationships of the code, laying the foundation for subsequent identification of business logic vulnerabilities. Secondly, a dual-engine dynamic routing mode is adopted. Based on the confidence level of the initial vulnerability inference results of the first detection model (low computing power), the method dynamically selects whether to call the second detection model (high computing power) to perform secondary detection. This ensures the efficiency of conventional vulnerability detection through the low computing power model, while the high computing power model provides in-depth analysis of low-confidence results and long contextual logic, improving the detection accuracy of business logic and complex vulnerabilities and reducing the risk of false positives. Thirdly, feedback from developers on vulnerability detection results is collected and automatically labeled, and effective data is selected to form an incremental training candidate set. This system incorporates vulnerability characteristics and false alarm scenarios from real-world development into its model optimization, making the model more aligned with actual auditing needs. Simultaneously, by receiving configuration parameters through a sample factory, it automatically synthesizes labeled samples from multiple industries, frameworks, and vulnerability types, supplementing the training sample library. This addresses the issues of scarce labeled samples and limited scenario coverage in traditional technologies, providing the model with rich data support for novel vulnerabilities and multiple scenarios. Finally, based on the incremental training candidate set and the supplemented training sample library, incremental fine-tuning techniques are used to periodically update the dual-detection model parameters. This allows for the rapid integration of new vulnerability characteristics into the model, significantly shortening the new vulnerability coverage cycle and enabling continuous self-evolution of the model. Ultimately, this ensures that the entire code auditing system covers the entire software development process in terms of scenario adaptability, effectively identifies business logic vulnerabilities and complex vulnerabilities with reduced false alarm rates in terms of detection accuracy, and rapidly responds to new vulnerabilities in terms of vulnerability coverage timeliness, fully meeting the security auditing needs of rapidly iterating software development.

[0032] Furthermore, as a refinement and extension of the specific implementation methods of the above embodiments, and to fully illustrate the implementation methods of this embodiment, this embodiment also provides another code vulnerability detection method, such as... Figure 2 As shown, the method includes: Step 210: Obtain multi-dimensional code audit input streams, extract corresponding input code data from each dimension of the code audit input streams, and preprocess the input code data to generate code attribute graphs.

[0033] For embodiments of this disclosure, step 210 may include the following steps: Step 210-1: Determine the multi-dimensional code audit input stream. The multi-dimensional code audit input stream should include at least single file audit requests, PR / MR events, and scheduled full repository scans.

[0034] Among them, single-file audit requests refer to audit applications for a single code file submitted by developers to the audit system during the coding process (such as after completing a functional module). It is the core input method for real-time and accurate auditing on the development side. PR / MR events are typical input streams in code collaboration scenarios. They refer to audit events triggered when developers submit a merge request to the main branch after completing branch code development. At this time, the input stream carries incremental code data between branches, which is used to focus on new risks in the merging process. Scheduled full repository scans refer to comprehensive audit input streams for the entire code repository that are triggered periodically through preset time scheduling rules (such as Cron expressions). The input stream carries complete code repository data, which is used to achieve periodic vulnerability back-end auditing of the entire code.

[0035] For the embodiments disclosed herein, a multi-dimensional code audit input flow system covering development, collaboration, operation and maintenance scenarios can be defined and determined by combining the audit requirements of different stages in the entire software development process. The core of this system can include at least three types of basic input flows: first, single-file audit requests initiated by developers during the coding process; second, event-type input flows triggered when branches are merged during code collaboration (such as PR / MR operations in Git repositories); and third, full code repository scanning input flows automatically triggered by preset time rules (such as early morning every day or fixed time periods every week).

[0036] Step 210-2: Extract the corresponding input code data from the code audit input stream of each dimension. The input code data includes a single code file corresponding to a single file audit request, an incremental code fragment corresponding to a PR / MR event, and complete code repository data corresponding to a scheduled full repository scan.

[0037] For the embodiments of this disclosure, extraction logic adapted to each dimension can be adopted for the determined multi-dimensional code audit input stream (such as single file audit requests, PR / MR events, and scheduled full repository scans). For example, for a single file audit request initiated by a developer, the single code file to be audited can be directly extracted; for a PR / MR event triggered when a code branch is merged, the incremental code fragment generated by the merge can be extracted by comparing the code differences between the source branch and the target branch; for a scheduled full repository scan triggered according to preset rules, the current complete code repository data (including all code files, configuration files, etc.) can be pulled from the code repository, and finally, the data extracted from these three types can be integrated into input code data that accurately corresponds to each input stream dimension.

[0038] Step 210-3: After preprocessing the input code data, construct the syntax tree using the syntax parser of the corresponding programming language.

[0039] The syntax tree, also known as the abstract syntax tree (AST), is a tree structure formed by a syntax parser breaking down code according to the syntax rules of a programming language. The nodes of the tree represent syntactic units in the code (such as keywords, identifiers, expressions, and statements), and the relationships between the nodes reflect the syntactic hierarchy and logical connections of the code.

[0040] In this embodiment, the extracted input code data can first be preprocessed to remove comments, blank lines, and redundant spaces that do not affect the code logic, retaining only the core code logic that reflects the code's function. Then, based on this core code logic, a syntax parser adapted to the syntax rules of the corresponding programming language (e.g., Java, Python, JavaScript) is selected. The parser performs syntactic analysis on the core code logic and constructs a corresponding syntax tree. Subsequently, anomaly detection is performed on the constructed syntax tree to identify abnormal syntactic structures that do not conform to the programming language's syntax rules (e.g., mismatched brackets, misspelled keywords). Abnormal structures that can be automatically corrected by syntax rules (e.g., missing semicolons, non-standard indentation) are repaired. Serious abnormal structures that cannot be automatically corrected (e.g., undefined core functions, broken syntax logic) are marked, and the anomaly location and cause are fed back to the developer. Finally, the repaired syntax tree without serious anomalies is converted into a standardized data format that meets the requirements for subsequent Code Property Graph (CPG) data format construction, preparing for subsequent structured analysis of vulnerability detection.

[0041] Accordingly, step 210-3 of the embodiment may include the following steps: removing comments, blank lines and redundant spaces from the input code data, and retaining the core code logic; based on the core code logic, constructing a syntax tree for the input code data of different programming languages ​​using the corresponding syntax parser; identifying abnormal syntax structures in the syntax tree, automatically repairing repairable abnormal syntax structures, marking unrepairable abnormal syntax structures and feeding them back to the developer; and converting the repaired syntax tree into a standardized data format for constructing a code property graph.

[0042] Step 210-4: Extract key information from the code based on the syntax tree. The key information should include at least the function call relationships, variable dependencies, and control flow execution paths in the code.

[0043] In this embodiment of the disclosure, a syntax tree that has been preprocessed, repaired, and converted into a standardized format can be used as a basis. By parsing the hierarchical relationships and logical connections between different nodes (such as function nodes, variable nodes, and statement nodes) in the syntax tree, key information that reflects the core running logic of the code can be extracted from the syntax tree. On the one hand, the calling and called relationships between functions in the code can be identified, forming function call relationships. On the other hand, the entire chain of variables from definition and assignment to participation in calculations or transmission can be traced, and variable dependencies can be sorted out. At the same time, the control flow execution path of the code during actual runtime can be restored based on the order and connection of statement nodes such as condition judgment, loop execution, and branch jump in the syntax tree.

[0044] By extracting function call relationships, variable dependencies, and control flow execution paths from the syntax tree, we can deeply deconstruct the dynamic execution logic and data relationships of the code: function call relationships can help identify vulnerability propagation paths across functions; variable dependencies can accurately locate the source and scope of impact of vulnerabilities such as data leakage and injection attacks; control flow execution paths can discover business logic vulnerabilities such as incomplete branch coverage and abnormal logic judgments; the combination of the three can provide a panoramic view of the deep logic of the code for subsequent vulnerability detection, which can effectively avoid the problem of traditional surface syntax analysis missing complex vulnerabilities and greatly improve the depth and accuracy of vulnerability detection.

[0045] Step 210-5: Construct a code attribute graph that covers the relationship between code syntax and semantics based on key code information.

[0046] In this embodiment of the disclosure, the key code information extracted in the early stage can be used as the core data foundation. First, the core syntactic units in the code (such as functions, variables, and statement blocks) are defined as nodes of the code attribute graph (CPG). Then, based on the association relationship in the key code information, edges with clear semantics are established between the nodes. During the construction process, the syntactic structure of the code (such as function definition hierarchy and statement nesting relationship) and semantic association (such as the flow logic of variables from input to operation and the connection of business logic across functions) are integrated into the association rules of the node attributes and edges of the graph. Finally, a complete code attribute graph that can reflect the syntactic structure of the code and depict the deep semantic logic is formed.

[0047] Step 220: Input the code attribute graph into the first detection model to perform preliminary vulnerability inference and obtain vulnerability inference results. The vulnerability inference results include a vulnerability candidate set and the confidence level of each candidate vulnerability.

[0048] In this embodiment of the disclosure, a code attribute graph that has been constructed in the early stage and covers the code syntax and semantic association can be used as input data and fed into a pre-deployed first detection model. The model identifies code segments that meet the characteristics of known vulnerabilities by parsing the syntactic structure and semantic logic carried by the nodes and edges of the code attribute graph, thereby generating a vulnerability candidate set containing all suspected vulnerabilities. At the same time, for each candidate vulnerability, the model judges the degree of matching of vulnerability features and outputs the confidence level that represents the possibility of the vulnerability's actual existence, thus forming a preliminary vulnerability inference result containing the vulnerability candidate set and the confidence level of each candidate vulnerability.

[0049] Step 230: Identify the candidate vulnerabilities in the vulnerability candidate set whose confidence level is greater than a preset threshold as the first candidate vulnerabilities, and incorporate the first candidate vulnerabilities into the vulnerability detection results of the first detection model.

[0050] Among them, the preset threshold refers to the confidence threshold (such as 80%) set in advance based on factors such as the system audit accuracy requirements and historical detection data. It is the core standard for judging whether a candidate vulnerability has high credibility and can be included in the results of the first detection model.

[0051] In this embodiment of the disclosure, the vulnerability candidate set output by the first detection model and the confidence level corresponding to each candidate vulnerability can be obtained first. Then, a pre-set confidence threshold value (preset threshold) can be retrieved. By comparing the confidence level of each candidate vulnerability with the preset threshold, candidate vulnerabilities with confidence values ​​exceeding the preset threshold are selected and defined as first candidate vulnerabilities. Subsequently, detailed information of the first candidate vulnerabilities (such as vulnerability type, specific location in the code, and description of triggering conditions) is collected and organized into structured result data. Finally, it is incorporated into the vulnerability detection results independently output by the first detection model to form a list of high-confidence vulnerabilities that do not require subsequent deep detection by the model. This avoids passing high-confidence vulnerabilities to subsequent high-computing-power models, which can significantly reduce unnecessary computing power consumption and improve the efficiency of the overall audit process.

[0052] Step 240: Identify the candidate vulnerabilities in the vulnerability candidate set whose confidence level is less than or equal to the preset threshold as the second candidate vulnerabilities, input the code attribute graph corresponding to the second candidate vulnerabilities into the second detection model for secondary vulnerability detection, focus on analyzing the long context logic and business association, and obtain the vulnerability detection results of the second detection model.

[0053] In this embodiment of the disclosure, after the first candidate vulnerability screening is completed, the remaining candidate vulnerabilities whose confidence level in the vulnerability candidate set is less than or equal to a preset threshold can be defined as second candidate vulnerabilities that require further in-depth detection. Then, the local or associated complete code attribute map corresponding to each second candidate vulnerability in the code attribute map is located and extracted. These targeted code attribute maps are input into a second detection model with higher computing power than the first detection model to perform secondary vulnerability detection. During the detection process, the second detection model focuses on the long context logic (such as code execution links across multiple functions, condition judgments with deep nesting levels) and business associations (such as the adaptability of the vulnerability code to industry business rules, cross-module data interaction logic) that are not fully covered by the first detection model to conduct in-depth analysis, accurately determine the authenticity and details of the second candidate vulnerabilities, and finally output the vulnerability detection results of the second detection model, which include the verification results of the second candidate vulnerabilities (real vulnerabilities / false alarms) and detailed vulnerability information.

[0054] Step 250: Merge the vulnerability detection results of the first detection model and the second detection model, remove duplicate vulnerability information, and form the final vulnerability detection result.

[0055] In this embodiment of the disclosure, the high-confidence vulnerability results output by the first detection model and the deep verification vulnerability results output by the second detection model can be obtained respectively. Then, the judgment dimensions of duplicate vulnerabilities are set (such as vulnerability type, file and line number of the code, and whether the triggering logic is completely consistent). By comparing these core dimensions of the vulnerabilities in the results of the two models, duplicate vulnerability information that exists in both results and whose core information is completely matched is filtered out and removed. Finally, the remaining non-duplicate vulnerabilities are integrated and sorted according to a unified structured format (such as vulnerability priority, risk level, detailed description, and remediation suggestions) to form a final vulnerability detection result that covers both common and complex vulnerabilities and has no redundant information.

[0056] By merging the vulnerability detection results of the first and second detection models, we can retain the rapid identification results of the first detection model for common vulnerabilities, while incorporating the in-depth verification results of the second detection model for complex and hidden vulnerabilities. This achieves dual coverage of vulnerability detection efficiency and accuracy, avoiding the omission of vulnerabilities caused by a single model.

[0057] Step 260: Collect feedback from developers on the vulnerability detection results, automatically label the vulnerability detection results based on the feedback, and filter the effective labeled data to form an incremental training candidate set.

[0058] In this embodiment of the disclosure, the final vulnerability detection result can be pushed to the developer's terminal, and feedback instructions (including types such as confirming vulnerabilities, ignoring vulnerabilities, and supplementing vulnerability descriptions) submitted by the developer based on actual business scenarios and code logic can be waited for and received. Then, corresponding processing is performed for different feedback instructions: if it is a confirmed vulnerability (including confirmed vulnerability only or confirmed vulnerability + supplementary description), the vulnerability detection result is automatically labeled with a valid vulnerability tag. When the feedback instruction only contains confirmed vulnerability, the vulnerability severity level and remediation priority are directly recorded. When it contains supplementary vulnerability description, the information supplemented by the developer is first integrated into the result before labeling is completed. If it is an ignored vulnerability (including ignored vulnerability only or ignored vulnerability + supplementary description), a false alarm tag is marked. When the feedback instruction only contains ignored vulnerability, the business scenario corresponding to the false alarm is recorded (such as detection deviation caused by special business logic). When it contains supplementary vulnerability description, the supplementary information is associated with the tag as evidence of the false alarm. Then, all associated data with valid vulnerability tags are filtered, and these data are cleaned. Finally, the cleaned valid data is integrated to form an incremental training candidate set that can be used for subsequent model optimization.

[0059] Accordingly, step 260 of the embodiment may include the following steps: pushing vulnerability detection results to the developer's terminal, receiving feedback instructions from the developer, including confirming the vulnerability, ignoring the vulnerability, and supplementing the vulnerability description; if the feedback instruction is to confirm the vulnerability, then the vulnerability detection results are automatically labeled with valid vulnerability tags, and the vulnerability severity level and remediation priority are recorded; if the feedback instruction is to supplement the vulnerability description and confirm the vulnerability, then the vulnerability information supplemented by the developer is integrated into the vulnerability detection results and labeled with valid vulnerability tags; if the feedback instruction is to ignore the vulnerability, then the vulnerability detection results are labeled with false alarm tags, and the business scenario corresponding to the false alarm is recorded; if the feedback instruction is to supplement the vulnerability description and ignore the vulnerability, then the supplementary information is used as evidence of the false alarm and associated with the false alarm tags labeled with the vulnerability detection results; filtering the associated data labeled with valid vulnerability tags, the associated data including the original input code data corresponding to the vulnerability, the original vulnerability detection results, the vulnerability detection results after integrating the supplementary information, and the developer's supplementary description; cleaning the associated data, removing records with incomplete format and contradictory information, and integrating them to form an incremental training candidate set.

[0060] Among them, the valid vulnerability label refers to the structured identifier automatically added to the vulnerability confirmed by the developer. It is used to mark the vulnerability as real and valid, and at the same time, it records the vulnerability severity level (such as high / medium / low risk) and the remediation priority (such as urgent / normal / low priority). It is the core basis for screening valid training data. The false positive label refers to the structured identifier automatically added to the vulnerability that the developer judges as a false positive. It is used to mark the vulnerability as a detection deviation, and at the same time, it records the business scenario corresponding to the false positive (such as special business logic, detection misjudgment caused by custom rules), providing data reference for the model to correct the judgment deviation.

[0061] Step 270: Receive user configuration parameters through the sample factory, automatically synthesize vulnerable code samples and corresponding annotation information based on user configuration parameters, and supplement the training sample library with the synthesized samples.

[0062] For embodiments of this disclosure, step 270 may include the following steps: Step 270-1: Receive user configuration parameters through the sample factory. The user configuration parameters include at least the target vulnerability type, industry business description, programming language, and application framework.

[0063] Among them, the target vulnerability type refers to the specific type of vulnerability that the user wants to implant in the generated code sample (such as SQL injection vulnerability, cross-site scripting (XSS) vulnerability, business logic vulnerability, etc.), which determines the vulnerability characteristics that the sample must carry; the industry business description refers to the specific industry and business scenario that the user sets and the sample must fit, to ensure that the business logic of the sample is consistent with the real application scenario; the programming language refers to the development language (such as Java, Python, JavaScript, etc.) that the user sets and the code sample is used to generate, which must match the user's actual development technology stack; and the application framework refers to the development framework that the user sets and the code sample depends on, which determines the technical implementation environment of the sample.

[0064] Step 270-2: Generate development guide information based on user configuration parameters, and call the code generation model to generate a code sample with vulnerabilities based on the development guide information. The development guide information includes the code logic location where the vulnerability is implanted and the business scenario relevance point.

[0065] Among them, the development guide information refers to the structured document generated based on user configuration parameters to guide the code generation model in creating vulnerability samples; the code generation model refers to the AI ​​model that can automatically generate code files that conform to the syntax specifications of a specific programming language and application framework based on the structured guidance information, and can identify the technical constraints and vulnerability implantation rules in the development guide, and output code that has both completeness and target vulnerability characteristics.

[0066] In this embodiment of the disclosure, structured development guide information can be extracted and generated based on the user configuration parameters received in the early stage. Then, this development guide information, which contains details of vulnerability implantation and business association rules, is fed into a preset code generation model. Based on the constraints of programming language and application framework in the guide, combined with the logical location of vulnerability implantation and business scenario, the model automatically generates a code file with a complete syntactic structure, integrated into the target business process and containing preset vulnerabilities, i.e., a code sample with vulnerabilities.

[0067] Step 270-3: Input the vulnerable code sample into the code auditing model to generate annotation information. The annotation information should include at least the vulnerability tag, vulnerability category, vulnerability description, and modification suggestions.

[0068] Among them, the code audit big model refers to an AI model with the ability to parse code, sort out business logic and identify vulnerability features. It is specifically used to analyze vulnerable code samples, automatically locate vulnerabilities and generate structured annotation information.

[0069] In this embodiment of the disclosure, a vulnerable code sample generated based on user-configured parameters can be input into a large code auditing model specifically used for code vulnerability analysis. This model first performs syntax parsing, business logic analysis, and vulnerability feature matching on the code sample. Then, based on the analysis results, it automatically generates structured annotation information, which includes at least vulnerability tags to clarify the core type of the vulnerability, vulnerability classification according to the nature of the vulnerability, vulnerability descriptions that detail the vulnerability location, triggering conditions, and business impact, and modification suggestions for specific technical solutions for vulnerability remediation. Finally, it outputs complete annotation information and stores it in association with the vulnerable code sample.

[0070] By inputting vulnerable code samples into a large code auditing model to generate annotation information, the annotation process can be fully automated, significantly replacing the tedious manual annotation work and greatly improving the efficiency of sample preparation. At the same time, it avoids biases such as labeling errors and incomplete descriptions that may occur in manual annotation. The generated annotation information covers vulnerability labels, classifications, descriptions, and modification suggestions. It is comprehensive and structured, which can provide a standardized data format for subsequent training sample libraries (facilitating efficient model learning) and enrich the details of vulnerability features (such as specific code modification methods) through modification suggestions, helping the detection model to more accurately identify similar vulnerabilities.

[0071] Step 270-4: Add the vulnerability-enabled code samples with configuration annotation information to the training sample library.

[0072] Step 280: Based on the incremental training candidate set and the supplemented training sample library, the model parameters of the first detection model and the second detection model are periodically updated using incremental fine-tuning technology.

[0073] In each preset fine-tuning cycle, the incremental training candidate set formed through developer feedback and the training sample library supplemented with labeled synthetic samples are first integrated to ensure that the two types of data have the same format and compatible labels. Then, they are divided into a fine-tuning training set for model parameter updates and a fine-tuning validation set for performance evaluation according to a preset ratio (e.g., 8:2). The fine-tuning training set is then input into the first detection model and the second detection model respectively, and parameter update training is carried out using incremental fine-tuning technology that updates only the key parameters of the model rather than all parameters. After each round of training, the three core indicators of vulnerability identification accuracy, vulnerability coverage, and false positive rate of the two models are immediately evaluated using the fine-tuning validation set. The training-evaluation iterative process is then repeated until the vulnerability identification accuracy of both models exceeds the preset accuracy threshold, the vulnerability coverage exceeds the preset coverage threshold, and the false positive rate is lower than the preset false positive rate threshold. At this point, it is determined that the first detection model and the second detection model have completed this round of periodic parameter update training.

[0074] Accordingly, step 280 of the embodiment may include the following steps: In each fine-tuning cycle, integrate the incremental training candidate set and the supplemented training sample library, and divide them into a fine-tuning training set and a fine-tuning validation set; input the fine-tuning training set into the first detection model and the second detection model respectively for updating and training the model parameters; after each round of training, use the fine-tuning validation set to evaluate the vulnerability identification accuracy, vulnerability coverage, and false alarm rate of the first detection model and the second detection model; repeat the above iterative training process until the vulnerability identification accuracy is greater than the preset accuracy threshold, the vulnerability coverage is greater than the preset coverage threshold, and the false alarm rate is less than the preset false alarm rate threshold, and determine that the first detection model and the second detection model have completed training.

[0075] Among them, vulnerability identification accuracy is an indicator for evaluating the accuracy of the model's detection, referring to the proportion of results that the model identifies as real vulnerabilities, but which are actually real vulnerabilities (formula: number of real vulnerabilities / total number of vulnerabilities identified by the model). The higher the value, the more accurate the model's judgment. Vulnerability coverage is an indicator for evaluating the completeness of the model's detection, referring to the proportion of real vulnerabilities detected by the model to the total number of real vulnerabilities in the fine-tuning validation set. The higher the value, the more comprehensive the types of vulnerabilities the model can cover. False positive rate is an indicator for evaluating the reliability of the model's detection, referring to the proportion of results that the model identifies as vulnerabilities but are actually normal code to the total number of vulnerabilities identified by the model. The lower the value, the lower the risk of false positives.

[0076] In summary, the technical solution in this application, by acquiring a multi-dimensional code audit input stream and extracting corresponding input code data for preprocessing to generate a code attribute graph, can adapt to audit scenarios at different stages of the software development process, solving the problem of insufficient scenario adaptability. Furthermore, the code attribute graph can fully capture the syntactic and semantic relationships of the code, laying the foundation for subsequent identification of business logic vulnerabilities. Secondly, it adopts a dual-engine dynamic routing mode, dynamically selecting whether to call the second detection model (high computing power) for secondary detection based on the confidence level of the initial vulnerability inference results of the first detection model (low computing power). This ensures the efficiency of conventional vulnerability detection through the low computing power model, while improving the detection accuracy of business logic and complex vulnerabilities and reducing the risk of false positives through the in-depth analysis of low-confidence results and long contextual logic by the high computing power model. Thirdly, it collects and automatically labels feedback from developers on vulnerability detection results, filters effective data to form an incremental training candidate set, and can effectively identify vulnerabilities. The system incorporates vulnerability characteristics and false alarm scenarios from real-world development scenarios into its model optimization, making the model more aligned with actual auditing needs. Simultaneously, by receiving configuration parameters through a sample factory, it automatically synthesizes labeled samples from multiple industries, frameworks, and vulnerability types, supplementing the training sample library. This addresses the issues of scarce labeled samples and limited scenario coverage in traditional technologies, providing the model with rich data support for novel vulnerabilities and multiple scenarios. Finally, based on the incremental training candidate set and the supplemented training sample library, incremental fine-tuning techniques are used to periodically update the dual-detection model parameters. This allows for the rapid integration of new vulnerability characteristics into the model, significantly shortening the new vulnerability coverage cycle and enabling continuous self-evolution of the model. Ultimately, this ensures that the entire code auditing system can cover the entire software development process in terms of scenario adaptability, effectively identify business logic vulnerabilities and complex vulnerabilities with reduced false alarm rates in terms of detection accuracy, and quickly respond to new vulnerabilities in terms of vulnerability coverage timeliness, fully meeting the security auditing needs of rapidly iterating software development.

[0077] Furthermore, as Figure 1 and Figure 2 The specific implementation of the method shown in this embodiment provides a code vulnerability detection device, such as... Figure 3 As shown, the device may include: a generation module 31, a detection module 32, a screening module 33, a synthesis module 34, and an update module 35.

[0078] The generation module 31 can be used to obtain multi-dimensional code audit input streams, extract corresponding input code data from each dimension of the code audit input streams, and preprocess the input code data to generate code attribute graphs. The detection module 32 can be used to perform vulnerability inference on the code attribute graph using a dual-engine dynamic routing mode. It dynamically selects the first detection model or the second detection model to perform detection based on the confidence level of the vulnerability inference result, and obtains the vulnerability detection result. The model computing power of the first detection model is less than that of the second detection model. The filtering module 33 can be used to collect feedback information from developers on vulnerability detection results, automatically label vulnerability detection results based on feedback content, and filter effective labeled data to form an incremental training candidate set. The synthesis module 34 can be used to receive user configuration parameters through the sample factory, automatically synthesize vulnerable code samples and corresponding annotation information based on the user configuration parameters, and supplement the training sample library with the synthesized samples. The update module 35 can be used to periodically update the model parameters of the first detection model and the second detection model based on the incremental training candidate set and the supplemented training sample library, using incremental fine-tuning technology.

[0079] In some embodiments of this application, the generation module 31 is specifically used to determine a multi-dimensional code audit input stream, which includes at least single-file audit requests, PR / MR events, and scheduled full-repository scans; extract corresponding input code data from each dimension of the code audit input stream, wherein the input code data includes a single code file corresponding to a single-file audit request, an incremental code fragment corresponding to a PR / MR event, and complete code repository data corresponding to a scheduled full-repository scan; after preprocessing the input code data, construct a syntax tree using a syntax parser for the corresponding programming language; extract key code information based on the syntax tree, which includes at least function call relationships, variable dependencies, and control flow execution paths in the code; and construct a code attribute graph covering the syntax and semantic relationships of the code based on the key code information.

[0080] In some embodiments of this application, after preprocessing the input code data, when constructing the syntax tree using a syntax parser for the corresponding programming language, the generation module 31 can be used to remove comments, blank lines, and redundant spaces from the input code data while retaining the core code logic; based on the core code logic, the corresponding syntax parser is used to construct the syntax tree for the input code data of different programming languages; abnormal syntax structures in the syntax tree are identified, repairable abnormal syntax structures are automatically repaired, unrepairable abnormal syntax structures are marked and fed back to the developer; and the repaired syntax tree is converted into a standardized data format for constructing a code attribute graph.

[0081] In some embodiments of this application, the detection module 32 can be specifically used to input the code attribute graph into the first detection model for preliminary vulnerability inference, and obtain vulnerability inference results, which include a vulnerability candidate set and the confidence level of each candidate vulnerability; determine the candidate vulnerabilities in the vulnerability candidate set whose corresponding confidence level is greater than a preset threshold as first candidate vulnerabilities, and incorporate the first candidate vulnerabilities into the vulnerability detection results of the first detection model; determine the candidate vulnerabilities in the vulnerability candidate set whose corresponding confidence level is less than or equal to the preset threshold as second candidate vulnerabilities, input the code attribute graph corresponding to the second candidate vulnerabilities into the second detection model for secondary vulnerability detection, focusing on analyzing long context logic and business association, and obtain the vulnerability detection results of the second detection model; merge the vulnerability detection results of the first detection model and the second detection model, remove duplicate vulnerability information, and form the final vulnerability detection result.

[0082] In some embodiments of this application, the filtering module 33 can be specifically used to push vulnerability detection results to the developer's terminal and receive feedback instructions from the developer. The feedback instructions include confirming the vulnerability, ignoring the vulnerability, and supplementing the vulnerability description. If the feedback instruction is to confirm the vulnerability, the vulnerability detection result is automatically labeled with a valid vulnerability tag, and the vulnerability severity level and remediation priority are recorded. If the feedback instruction is to supplement the vulnerability description and confirm the vulnerability, the vulnerability information supplemented by the developer is integrated into the vulnerability detection result and labeled with a valid vulnerability tag. If the feedback instruction is to ignore the vulnerability, the vulnerability detection result is labeled with a false alarm tag, and the business scenario corresponding to the false alarm is recorded. If the feedback instruction is to supplement the vulnerability description and ignore the vulnerability, the supplementary information is used as evidence of the false alarm and associated with the false alarm tag labeled with the vulnerability detection result. The associated data labeled with a valid vulnerability tag is filtered. The associated data includes the original input code data corresponding to the vulnerability, the original vulnerability detection result, the vulnerability detection result after integrating the supplementary information, and the developer's supplementary description. The associated data is cleaned, records with incomplete format and contradictory information are removed, and integrated to form an incremental training candidate set.

[0083] In some embodiments of this application, the synthesis module 34 can be specifically used to receive user configuration parameters through a sample factory. The user configuration parameters include at least the target vulnerability type, industry business description, programming language, and application framework. Based on the user configuration parameters, it generates development guide information and calls a code generation model to generate vulnerable code samples based on the development guide information. The development guide information includes the code logic location where the vulnerability is implanted and the business scenario relevance point. The vulnerable code samples are input into a large code audit model to generate annotation information. The annotation information includes at least vulnerability tags, vulnerability classifications, vulnerability descriptions, and modification suggestions. The vulnerable code samples with configured annotation information are then added to the training sample library.

[0084] In some embodiments of this application, the update module 35 is specifically used to integrate the incremental training candidate set and the supplemented training sample library in each fine-tuning cycle, and divide them into a fine-tuning training set and a fine-tuning validation set; the fine-tuning training set is input into the first detection model and the second detection model respectively for updating and training the model parameters; after each round of training, the vulnerability identification accuracy, vulnerability coverage and false alarm rate of the first detection model and the second detection model are evaluated using the fine-tuning validation set; the above iterative training process is repeated until the vulnerability identification accuracy is greater than the preset accuracy threshold, the vulnerability coverage is greater than the preset coverage threshold, and the false alarm rate is less than the preset false alarm rate threshold, and it is determined that the first detection model and the second detection model have completed training.

[0085] It should be noted that other corresponding descriptions of the functional units involved in the code vulnerability detection device provided in this embodiment can be found in [reference needed]. Figure 1 and Figure 2 The corresponding description in [the document] will not be repeated here.

[0086] Based on the above, Figure 1 and Figure 2 Accordingly, this embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements the above-described method. Figure 1 and Figure 2 The code vulnerability detection method shown.

[0087] Based on this understanding, the technical solution of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as CD-ROM, USB flash drive, mobile hard drive, etc.) and includes several instructions to cause an electronic device (such as personal computer, server, or network device, etc.) to execute the methods of various implementation scenarios of this application.

[0088] Based on the above, Figure 1 and Figure 2 The method shown, and Figure 3 To achieve the above objectives, the present application also provides an electronic device, specifically a personal computer, tablet computer, server, or other network device, as shown in the virtual device embodiment. This device includes a storage medium and a processor; the storage medium stores a computer program; the processor executes the computer program to achieve the above-described objectives. Figure 1 and Figure 2 The code vulnerability detection method shown.

[0089] Optionally, the aforementioned physical devices may also include a user interface, a network interface, a camera, radio frequency (RF) circuitry, sensors, audio circuitry, a Wi-Fi module, etc. The user interface may include a display screen, input units such as a keyboard, etc., and optional user interfaces may also include USB interfaces, card reader interfaces, etc. The network interface may optionally include standard wired interfaces, wireless interfaces (such as Wi-Fi interfaces), etc.

[0090] Those skilled in the art will understand that the physical device structure provided in this embodiment does not constitute a limitation on the physical device, and may include more or fewer components, or combine certain components, or have different component arrangements.

[0091] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the hardware and software resources of the aforementioned physical device, supporting the operation of information processing programs and other software and / or programs. The network communication module is used to enable communication between the various components within the storage medium, as well as communication with other hardware and software in the information processing physical device.

[0092] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platform, or it can be implemented by hardware.

[0093] This invention, through acquiring a multi-dimensional code audit input stream and extracting corresponding input code data for preprocessing to generate a code attribute graph, can adapt to audit scenarios at different stages of the software development process, solving the problem of insufficient scenario adaptability. Furthermore, the code attribute graph can fully capture the syntactic and semantic relationships of the code, laying the foundation for subsequent identification of business logic vulnerabilities. Secondly, it adopts a dual-engine dynamic routing mode, dynamically selecting whether to call the second detection model (high computing power) for secondary detection based on the confidence level of the initial vulnerability inference results from the first detection model (low computing power). This ensures the efficiency of conventional vulnerability detection through the low computing power model, while the high computing power model improves the detection accuracy of business logic and complex vulnerabilities and reduces the risk of false positives through in-depth analysis of low-confidence results and long contextual logic, using a deeper analysis of these. Thirdly, it collects and automatically labels developer feedback on vulnerability detection results, filtering effective data to form an incremental training candidate set, enabling the application of real-world development scenarios. The vulnerability characteristics and false alarm scenarios in the context are incorporated into the model optimization, making the model more closely aligned with real auditing needs. Simultaneously, by receiving configuration parameters through a sample factory, labeled samples from multiple industries, frameworks, and vulnerability types are automatically synthesized and added to the training sample library. This addresses the problems of scarce labeled samples and limited scenario coverage in traditional technologies, providing the model with rich data support for novel vulnerabilities and multiple scenarios. Finally, based on the incremental training candidate set and the supplemented training sample library, incremental fine-tuning techniques are used to periodically update the dual-detection model parameters. This allows for the rapid integration of new vulnerability characteristics into the model, significantly shortening the new vulnerability coverage cycle and enabling continuous self-evolution of the model. Ultimately, this ensures that the entire code auditing system can cover the entire software development process in terms of scenario adaptability, effectively identify business logic vulnerabilities and complex vulnerabilities with reduced false alarm rates in terms of detection accuracy, and quickly respond to new vulnerabilities in terms of vulnerability coverage timeliness, fully meeting the security auditing needs of rapidly iterating software development.

[0094] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of a preferred embodiment, and the modules or processes shown in the drawings are not necessarily essential for implementing this application. Those skilled in the art will understand that the modules in the apparatus of the embodiment can be distributed within the apparatus of the embodiment as described, or can be modified to be located in one or more apparatuses different from this embodiment. The modules of the above-described embodiment can be combined into one module, or further divided into multiple sub-modules.

[0095] The serial numbers in this application are for descriptive purposes only and do not represent the superiority or inferiority of any particular implementation scenario. The above disclosures are merely a few specific implementation scenarios of this application; however, this application is not limited thereto, and any variations conceived by those skilled in the art should fall within the protection scope of this application.

Claims

1. A code vulnerability detection method, characterized in that, include: Obtain a multi-dimensional code audit input stream, extract corresponding input code data from each dimension of the code audit input stream, and preprocess the input code data to generate a code attribute graph; A dual-engine dynamic routing mode is used to perform vulnerability inference on the code attribute graph. Based on the confidence level of the vulnerability inference result, the first detection model or the second detection model is dynamically selected to perform the detection, and the vulnerability detection result is obtained. The model computing power of the first detection model is less than that of the second detection model. Collect feedback from developers on the vulnerability detection results, automatically label the vulnerability detection results based on the feedback, and filter valid labeled data to form an incremental training candidate set; The sample factory receives user configuration parameters and automatically synthesizes vulnerable code samples and corresponding annotation information based on the user configuration parameters. The synthesized samples are then added to the training sample library. Based on the incremental training candidate set and the supplemented training sample library, the model parameters of the first detection model and the second detection model are periodically updated using incremental fine-tuning techniques.

2. The method according to claim 1, characterized in that, The process of acquiring a multi-dimensional code audit input stream, extracting corresponding input code data from each dimension of the code audit input stream, and preprocessing the input code data to generate a code attribute graph includes: Determine a multi-dimensional code audit input stream, which includes at least single-file audit requests, PR / MR events, and scheduled full repository scans. Extract corresponding input code data from the code audit input stream of each dimension, wherein the input code data includes a single code file corresponding to the single file audit request, an incremental code fragment corresponding to the PR / MR event, and complete code repository data corresponding to the scheduled full repository scan; After preprocessing the input code data, a syntax tree is constructed using a syntax parser for the corresponding programming language; Based on the syntax tree, key code information is extracted, which includes at least the function call relationships, variable dependencies, and control flow execution paths in the code. Based on the key information of the code, a code attribute graph covering the relationship between code syntax and semantics is constructed.

3. The method according to claim 2, characterized in that, After preprocessing the input code data, a syntax tree is constructed using a syntax parser for the corresponding programming language, including: Remove comments, blank lines, and redundant spaces from the input code data, retaining the core code logic; Based on the core code logic, a syntax tree is constructed using the corresponding syntax parser for the input code data of different programming languages; Identify abnormal syntax structures in the syntax tree, automatically repair repairable abnormal syntax structures, mark unrepairable abnormal syntax structures and provide feedback to the developer. The repaired syntax tree is converted into a standardized data format for building code property graphs.

4. The method according to claim 1, characterized in that, The method employs a dual-engine dynamic routing mode to perform vulnerability inference on the code attribute graph. Based on the confidence level of the vulnerability inference results, it dynamically selects either a first detection model or a second detection model to perform the detection, thereby obtaining vulnerability detection results, including: The code attribute graph is input into the first detection model for preliminary vulnerability inference to obtain vulnerability inference results, which include a vulnerability candidate set and the confidence level of each candidate vulnerability. The candidate vulnerabilities in the vulnerability candidate set whose confidence level is greater than a preset threshold are identified as first candidate vulnerabilities, and the first candidate vulnerabilities are included in the vulnerability detection results of the first detection model. Candidate vulnerabilities in the vulnerability candidate set whose confidence level is less than or equal to the preset threshold are identified as second candidate vulnerabilities. The code attribute graph corresponding to the second candidate vulnerability is input into the second detection model for secondary vulnerability detection. The focus is on analyzing the long context logic and business association to obtain the vulnerability detection result of the second detection model. The vulnerability detection results of the first detection model and the second detection model are combined, and duplicate vulnerability information is removed to form the final vulnerability detection result.

5. The method according to claim 1, characterized in that, The process of collecting feedback from developers regarding the vulnerability detection results, automatically labeling the vulnerability detection results based on the feedback, and filtering valid labeled data to form an incremental training candidate set includes: Push vulnerability detection results to the developer's terminal and receive feedback instructions from the developer, including confirming the vulnerability, ignoring the vulnerability, and supplementing the vulnerability description; If the feedback instruction is a confirmation of vulnerability, then the vulnerability detection result will be automatically labeled with a valid vulnerability tag, and the vulnerability severity level and remediation priority will be recorded. If the feedback instruction is to supplement the vulnerability description and confirm the vulnerability, then the vulnerability information supplemented by the developer will be integrated into the vulnerability detection result and the valid vulnerability label will be marked. If the feedback instruction is to ignore the vulnerability, then the vulnerability detection result is labeled as a false alarm, and the corresponding business scenario is recorded. If the feedback instruction is to supplement the vulnerability description or ignore the vulnerability, the supplementary information will be used as evidence of a false alarm and associated with the false alarm label marked for the vulnerability detection result. Filter the associated data marked as valid vulnerability tags. The associated data includes the original input code data corresponding to the vulnerability, the original vulnerability detection results, the vulnerability detection results after integrating and supplementing information, and the developer's supplementary description. The associated data is cleaned to remove records with incomplete formats or contradictory information, and then integrated to form an incremental training candidate set.

6. The method according to claim 1, characterized in that, The process of receiving user configuration parameters through a sample factory, automatically synthesizing vulnerable code samples and corresponding annotation information based on the user configuration parameters, and supplementing the training sample library with the synthesized samples includes: User configuration parameters are received through the sample factory, and the user configuration parameters include at least the target vulnerability type, industry business description, programming language, and application framework. Based on the user configuration parameters, development guide information is generated, and a code generation model is invoked to generate a vulnerable code sample based on the development guide information. The development guide information includes the code logic location where the vulnerability is implanted and the business scenario relevance point. The vulnerable code sample is input into the code auditing model to generate annotation information, which includes at least vulnerability tag, vulnerability category, vulnerability description, and modification suggestions. Add the vulnerable code samples with the above-mentioned annotation information to the training sample library.

7. The method according to claim 1, characterized in that, Based on the incremental training candidate set and the supplemented training sample library, the model parameters of the first detection model and the second detection model are periodically updated using incremental fine-tuning techniques, including: In each fine-tuning cycle, the incremental training candidate set and the supplemented training sample library are integrated and divided into a fine-tuning training set and a fine-tuning validation set. The fine-tuned training set is input into the first detection model and the second detection model respectively to update the model parameters and train them. After each round of training, the vulnerability identification accuracy, vulnerability coverage and false alarm rate of the first detection model and the second detection model are evaluated using the fine-tuned validation set. Repeat the above iterative training process until the vulnerability identification accuracy is greater than a preset accuracy threshold, the vulnerability coverage is greater than a preset coverage threshold, and the false alarm rate is less than a preset false alarm rate threshold, then determine that the first detection model and the second detection model have completed training.

8. A code vulnerability detection device, characterized in that, include: The generation module is used to acquire multi-dimensional code audit input streams, extract corresponding input code data from each dimension of the code audit input streams, and preprocess the input code data to generate a code attribute map. The detection module is used to perform vulnerability inference on the code attribute graph using a dual-engine dynamic routing mode. Based on the confidence level of the vulnerability inference result, it dynamically selects either the first detection model or the second detection model to perform the detection and obtains the vulnerability detection result. The model computing power of the first detection model is less than that of the second detection model. The filtering module is used to collect feedback information from developers on the vulnerability detection results, automatically label the vulnerability detection results based on the feedback content, and filter the effective labeled data to form an incremental training candidate set. The synthesis module is used to receive user configuration parameters through the sample factory, automatically synthesize vulnerable code samples and corresponding annotation information based on the user configuration parameters, and supplement the training sample library with the synthesized samples. The update module is used to periodically update the model parameters of the first detection model and the second detection model based on the incremental training candidate set and the supplemented training sample library using incremental fine-tuning technology.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

10. An electronic device comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 7.

Images