Open source software code static analysis and detection implementation method based on feature recognition
By employing a feature-based static analysis method for open-source software code, utilizing multi-scale CNN-Inception neural networks and knowledge graph technology, defects and risks in open-source software are detected, addressing the issue of open-source software supply chain security and improving security and usability.
Patent Information
- Application Number
- CN202511553337.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-28
- Publication Date
- 2026-03-13
AI Technical Summary
The supply chain security of open-source software faces severe challenges, with frequent and serious security attacks. Existing technologies are insufficient to effectively detect and identify potential vulnerabilities and risks.
This paper proposes a static analysis and detection method for open-source software code based on feature recognition. The method judges the open-source software code by setting preset judgment conditions, uses a multi-scale CNN-Inception neural network algorithm for feature extraction and comparison, and combines knowledge graph for defect retrieval to achieve static analysis and detection of open-source software code.
It improves the security and availability of open-source software, reduces usage risks, reduces manpower and maintenance costs, and enhances the system's cost-effectiveness and competitiveness.
Smart Images
Figure CN121658339A_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the field of software detection and identification, and more specifically, to a method, apparatus, electronic device, and computer-readable storage medium for static analysis and detection of open-source software code based on feature recognition. Background Technology
[0002] With the rapid development of open-source software, its development and supply chain models have powerfully driven the rapid iteration and evolution of modern software, becoming a significant force in enhancing social benefits. Open-source software, with its openness and sharing characteristics, attracts numerous developers, accelerating the dissemination of knowledge and technological innovation, playing an irreplaceable role in software applications across various fields. However, along with this rapid development, the security of the open-source software supply chain faces severe challenges. In recent years, the number of security attacks targeting its supply chain has increased dramatically, and the impact has become increasingly serious.
[0003] Therefore, one or more methods are needed to solve the above problems.
[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention
[0005] The purpose of this disclosure is to provide a method, apparatus, electronic device, and computer-readable storage medium for static analysis and detection of open-source software code based on feature recognition, thereby overcoming, to at least to some extent, one or more problems caused by the limitations and defects of related technologies.
[0006] According to one aspect of this disclosure, a method for static analysis and detection of open-source software code based on feature recognition is provided, comprising:
[0007] Based on preset judgment conditions, the open-source software code used in the software to be detected is judged, and judgment results are generated.
[0008] If the judgment result is that the open-source software code does not meet the judgment condition requirements, then feature extraction and comparison are performed on the open-source software code based on the preset open-source code model to generate a comparison result;
[0009] Based on the comparison results, the defects in the open-source software code used in the software to be tested are retrieved from the preset knowledge graph for specific open-source defects.
[0010] Based on the defects in the open-source software code used in the software under test, static analysis and detection of the open-source software code are achieved.
[0011] In one exemplary embodiment of this disclosure, the method further includes:
[0012] If the judgment result indicates that the open-source software code meets the judgment conditions, then the static analysis and detection process of the open-source software code is terminated.
[0013] In one exemplary embodiment of this disclosure, the method further includes:
[0014] Based on a dataset containing training, validation, and test sets, the open-source software code is subjected to feature extraction and comparison using a pre-defined open-source code model, and comparison results are generated.
[0015] In one exemplary embodiment of this disclosure, the dataset is generated in the following manner:
[0016] We collect open-source static code with potential risks and vulnerabilities through web scraping, and then organize the data according to different risk levels by categorizing it with multiple tags.
[0017] The collected data is then cleaned, filtered, and checked.
[0018] The cleaned, filtered, and proofread dataset is divided into a training set, a validation set, and a test set.
[0019] In one exemplary embodiment of this disclosure, the method further includes:
[0020] Based on a dataset containing training, validation, and test sets, the open-source software code is subjected to feature extraction and comparison using an open-source code model based on a multi-scale CNN-Inception neural network algorithm, generating comparison results.
[0021] In one exemplary embodiment of this disclosure, the method further includes:
[0022] Based on the comparison results, a search is performed in a pre-defined knowledge graph targeting specific open-source vulnerabilities;
[0023] The knowledge entities, entity attributes, and relationships between entities in the key expressions of open-source software vulnerabilities are extracted. The relationship analysis and reasoning of the open-source software vulnerability content are realized in the form of a knowledge network graph, thereby obtaining the defect problems of the open-source software code used in the software to be tested.
[0024] In one exemplary embodiment of this disclosure, the method further includes:
[0025] Based on the defect results, optimization is performed, and the open-source software code is iteratively optimized based on whether the optimization meets the requirements.
[0026] In one aspect of this disclosure, an open-source software code static analysis and detection implementation device based on feature recognition is provided, comprising:
[0027] The code judgment module is used to judge the open-source software code used in the software to be detected based on preset judgment conditions and generate judgment results.
[0028] The feature comparison module is used to extract and compare features of the open-source software code based on a preset open-source code model if the judgment result is that the open-source software code does not meet the judgment condition requirements, and generate a comparison result.
[0029] The defect retrieval module is used to retrieve, based on the comparison results, the defect problems of the open source software code used in the software to be tested from a preset knowledge graph for specific open source defects;
[0030] The defect detection module is used to perform static analysis and detection of open-source software code based on defects in the open-source software code used in the software under test.
[0031] In one aspect of this disclosure, an electronic device is provided, comprising:
[0032] Processor; and
[0033] A memory storing computer-readable instructions that, when executed by the processor, implement the method according to any one of the preceding claims.
[0034] In one aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the method according to any one of the preceding claims.
[0035] An exemplary embodiment of this disclosure provides a method for static analysis and detection of open-source software code based on feature recognition. The method includes: judging the open-source software code used in the software to be detected based on preset judgment conditions, and generating a judgment result; if the judgment result indicates that the open-source software code does not meet the judgment condition requirements, then performing feature extraction and comparison on the open-source software code based on a preset open-source code model, and generating a comparison result; based on the comparison result, retrieving the defect issues of the open-source software code used in the software to be detected from a preset knowledge graph targeting specific open-source defects; and realizing static analysis and detection of the open-source software code based on the defect issues of the open-source software code used in the software to be detected. This disclosure utilizes a multi-scale CNN-Inception model to detect vulnerabilities or other risks through feature comparison and dependency comparison techniques between different code types. It establishes a domain knowledge graph of open-source code risks, uses feature extraction methods to extract features from the target code, and performs precise retrieval through the knowledge graph to achieve vulnerability detection and risk identification for open-source software, thereby reducing the risks associated with using open-source software.
[0036] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description
[0037] The above and other features and advantages of this disclosure will become more apparent from the detailed description of exemplary embodiments thereof with reference to the accompanying drawings.
[0038] Figure 1 A flowchart is shown for an implementation method of static analysis detection of open-source software code based on feature recognition, according to an exemplary embodiment of the present disclosure.
[0039] Figure 2 A flowchart is shown for an implementation method of static analysis detection of open-source software code based on feature recognition, according to an exemplary embodiment of the present disclosure.
[0040] Figure 3 A flowchart is shown for an implementation method of static analysis detection of open-source software code based on feature recognition, according to an exemplary embodiment of the present disclosure.
[0041] Figure 4 A flowchart is shown for an implementation method of static analysis detection of open-source software code based on feature recognition, according to an exemplary embodiment of the present disclosure.
[0042] Figure 5 A structural block diagram of an implementation apparatus for static analysis and detection of open-source software code based on feature recognition, according to an exemplary embodiment of the present disclosure, is shown.
[0043] Figure 6A block diagram of an electronic device according to an exemplary embodiment of the present disclosure is shown schematically;
[0044] Figure 7 The illustration shows a schematic diagram of a computer-readable storage medium according to an exemplary embodiment of the present disclosure. Detailed Implementation
[0045] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, they are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted.
[0046] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced without one or more of the specific details described, or other methods, components, materials, apparatuses, steps, etc., can be employed. In other instances, well-known structures, methods, apparatuses, implementations, materials, or operations are not shown or described in detail to avoid obscuring various aspects of this disclosure.
[0047] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, or in one or more software-hardened modules, or in different network and / or processor devices and / or microcontroller devices.
[0048] In this example embodiment, a method for static analysis and detection of open-source software code based on feature recognition is first provided; see reference Figure 1 As shown, this method for static analysis and detection of open-source software code based on feature recognition may include the following steps:
[0049] Step S110: Based on preset judgment conditions, judge the open-source software code used in the software to be tested and generate a judgment result;
[0050] Step S120: If the judgment result is that the open-source software code does not meet the judgment condition requirements, then feature extraction and comparison are performed on the open-source software code based on the preset open-source code model to generate a comparison result;
[0051] Step S130: Based on the comparison results, retrieve the defect problems of the open source software code used in the software to be detected from the preset knowledge graph for specific open source defects;
[0052] Step S140: Based on the defects in the open-source software code used in the software to be tested, static analysis and detection of the open-source software code are performed.
[0053] An exemplary embodiment of this disclosure provides a method for static analysis and detection of open-source software code based on feature recognition. The method includes: judging the open-source software code used in the software to be detected based on preset judgment conditions, and generating a judgment result; if the judgment result indicates that the open-source software code does not meet the judgment condition requirements, then performing feature extraction and comparison on the open-source software code based on a preset open-source code model, and generating a comparison result; based on the comparison result, retrieving the defect issues of the open-source software code used in the software to be detected from a preset knowledge graph targeting specific open-source defects; and realizing static analysis and detection of the open-source software code based on the defect issues of the open-source software code used in the software to be detected. This disclosure utilizes a multi-scale CNN-Inception model to detect vulnerabilities or other risks through feature comparison and dependency comparison techniques between different code types. It establishes a domain knowledge graph of open-source code risks, uses feature extraction methods to extract features from the target code, and performs precise retrieval through the knowledge graph to achieve vulnerability detection and risk identification for open-source software, thereby reducing the risks associated with using open-source software.
[0054] The following will further explain an implementation method for static analysis and detection of open-source software code based on feature recognition in this example embodiment.
[0055] Example 1:
[0056] In this example embodiment, this disclosure provides a method for static analysis and detection of open-source software code based on feature recognition. This method detects vulnerabilities or other risks by leveraging feature comparison and dependency comparison techniques between different code segments. A domain knowledge graph of open-source code risks is established, feature extraction methods are used to extract features from the target code, and precise retrieval is performed through the knowledge graph to achieve vulnerability detection and risk identification in open-source software, thereby reducing the risks associated with using open-source software.
[0057] In step S110, the open-source software code used in the software to be tested can be judged based on preset judgment conditions, and a judgment result can be generated.
[0058] In this example embodiment, the method further includes:
[0059] If the judgment result indicates that the open-source software code meets the judgment conditions, then the static analysis and detection process of the open-source software code is terminated.
[0060] In step S120, if the judgment result is that the open-source software code does not meet the judgment condition requirements, then feature extraction and comparison are performed on the open-source software code based on the preset open-source code model to generate a comparison result.
[0061] In this example embodiment, the method further includes:
[0062] Based on a dataset containing training, validation, and test sets, the open-source software code is subjected to feature extraction and comparison using a pre-defined open-source code model, and comparison results are generated.
[0063] In this example embodiment, the dataset is generated in the following way:
[0064] We collect open-source static code with potential risks and vulnerabilities through web scraping, and then organize the data according to different risk levels by categorizing it with multiple tags.
[0065] The collected data is then cleaned, filtered, and checked.
[0066] The cleaned, filtered, and proofread dataset is divided into a training set, a validation set, and a test set.
[0067] In this example embodiment, the method further includes:
[0068] Based on a dataset containing training, validation, and test sets, the open-source software code is subjected to feature extraction and comparison using an open-source code model based on a multi-scale CNN-Inception neural network algorithm, generating comparison results.
[0069] In step S130, based on the comparison results, the defect problems of the open source software code used in the software to be detected can be retrieved from a preset knowledge graph for specific open source defects.
[0070] In this example embodiment, the method further includes:
[0071] Based on the comparison results, a search is performed in a pre-defined knowledge graph targeting specific open-source vulnerabilities;
[0072] The knowledge entities, entity attributes, and relationships between entities in the key expressions of open-source software vulnerabilities are extracted. The relationship analysis and reasoning of the open-source software vulnerability content are realized in the form of a knowledge network graph, thereby obtaining the defect problems of the open-source software code used in the software to be tested.
[0073] In step S140, static analysis and detection of the open-source software code can be performed based on the defects in the open-source software code used in the software to be detected.
[0074] In this example embodiment, the method further includes:
[0075] Based on the defect results, optimization is performed, and the open-source software code is iteratively optimized based on whether the optimization meets the requirements.
[0076] Example 2:
[0077] In the embodiments of this example, this disclosure aims to provide a method for static analysis and detection of open-source software code based on feature recognition. When using open-source code, by running this method, vulnerabilities or other risks can be detected through feature recognition and comparison technology, and specific risk content can be retrieved through the established knowledge graph, so as to achieve the security and usability of development relying on open-source software code.
[0078] Specific objectives include:
[0079] 1. Improve the security and usability of using open source software code: Since open source code may contain vulnerabilities and other security issues, using this method to detect and match vulnerabilities and other security issues can help software systems discover potential security risks and make improvements, thereby improving the security and usability of open source software code.
[0080] 2. Improve the system's cost-effectiveness and competitiveness: By predicting potential system security vulnerabilities in advance, avoiding system security threats, reducing labor and maintenance costs, and achieving resource conservation.
[0081] In this example embodiment, this disclosure provides a feature-based static code analysis method for open-source software. This method can optimize open-source software defects through feature recognition combined with knowledge graph retrieval. Open-source software (OSS) refers to open-source software distributed in accordance with open-source licenses that conform to the definition of open source. Open-source software allows users to use, learn, modify, and redistribute the software free of charge in accordance with the license requirements.
[0082] The process of this method is as follows: Figure 2 As shown, the open-source software code used in the software is input into the condition judgment to determine whether the requirements are met. If the requirements are met, no modification is needed. If the requirements are not met, the code is input into the already trained open-source code model. Through feature extraction and comparison, the results are input into the established knowledge graph for specific open-source defects to retrieve the specific defect problem of the open-source software. Optimization is performed based on the defect results, and finally it is judged whether the optimization meets the requirements. The optimization is iterated until the requirements are met.
[0083] In the embodiments of this example, as Figure 3 As shown, the trained intelligent models targeting potential problems in open-source code include:
[0084] First, we collect open-source static code with potential risks and vulnerabilities through methods such as web scraping. Then, we categorize the data using multiple tags and organize it according to different risk levels.
[0085] The collected data is then cleaned to remove any incorrectly collected data, and the collected data is then checked and verified.
[0086] The cleaned dataset is divided into training, validation, and test sets for training neural network algorithms.
[0087] The neural network algorithm used in this disclosure is multi-scale CNN-Inception. Convolutional Neural Networks (CNNs) can learn local features of text, and their structure typically consists of convolutional layers, pooling layers, and fully connected layers. CNN models extract various deep features through different convolutional kernels. To extract high-dimensional features, deeper convolutions are mainly performed, but this leads to problems such as increased network depth and performance saturation. Therefore, Google proposed the Inception convolutional module, which increases the width of the network. The Inception network uses multiple convolutional kernels of different scales in parallel, and the output results are concatenated into a deeper feature map, fully extracting multi-scale features and making more comprehensive use of hidden feature information. The multi-scale convolutional module (CNN-Inception) is designed to increase the number of convolutional layers and channels in the CNN model, learn different feature information of the text through convolutional kernels of different scales, better capture the local and high-order features of the text, and concatenate these multi-scale features to obtain the key semantic features of the policy sentence.
[0088] The final trained model is an intelligent model that addresses potential problems in open-source code.
[0089] In the embodiments of this example, as Figure 4 As shown, establishing a knowledge graph of open-source code risks and vulnerabilities includes:
[0090] Establish a knowledge graph retrieval library for specific defects in open source software. By employing knowledge graph technologies such as knowledge extraction, linking, and storage, it is possible to extract the knowledge entities, entity attributes, and relationships between entities that are key expressions in the vulnerabilities of open source software, and realize the relationship analysis and reasoning of the vulnerabilities in the form of a knowledge network graph.
[0091] The established specific defect knowledge graph retrieval library can be used to retrieve the results obtained from feature recognition and comparison in the current code, obtain the corresponding open source code entities and relationships, and thus obtain specific and detailed open source software defects.
[0092] In this example embodiment, this disclosure provides a method for static analysis and detection of open-source software code based on feature recognition. This method utilizes a multi-scale CNN-Inception model to detect vulnerabilities or other risks through feature comparison and dependency comparison techniques between different code segments. A domain knowledge graph of open-source code risks is established, feature extraction methods are used to extract features from the target code, and precise retrieval is performed through the knowledge graph to achieve vulnerability detection and risk identification in open-source software, thereby reducing the risks associated with using open-source software.
[0093] In summary, the purpose of this invention is to provide a static code analysis method for open-source software based on feature recognition, combined with knowledge graph retrieval capabilities, to provide security vulnerability detection functions for software systems, reduce labor and maintenance costs, and improve the security and availability of systems developed based on open-source software.
[0094] It should be noted that although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.
[0095] Furthermore, this example embodiment also provides an implementation device for static analysis and detection of open-source software code based on feature recognition. (Refer to...) Figure 5 As shown, the open-source software code static analysis and detection implementation device 200 based on feature recognition may include: a code judgment module 210, a feature comparison module 220, a defect retrieval module 230, and a defect detection module 240. Wherein:
[0096] The code judgment module 210 is used to judge the open source software code used in the software to be detected based on preset judgment conditions and generate judgment results;
[0097] The feature comparison module 220 is used to extract and compare features of the open-source software code based on a preset open-source code model if the judgment result is that the open-source software code does not meet the judgment condition requirements, and generate a comparison result.
[0098] The defect retrieval module 230 is used to retrieve the defect problems of the open source software code used in the software to be tested from a preset knowledge graph for specific open source defects based on the comparison results.
[0099] The defect detection module 240 is used to perform static analysis and detection of open-source software code based on defects in the open-source software code used in the software to be tested.
[0100] The specific details of each of the above-mentioned open-source software code static analysis and detection implementation device modules based on feature recognition have been described in detail in the corresponding implementation method of open-source software code static analysis and detection based on feature recognition, so they will not be repeated here.
[0101] It should be noted that although several modules or units of the feature-recognition-based open-source software code static analysis and detection implementation device 200 have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.
[0102] Furthermore, in an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.
[0103] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented as entirely hardware embodiments, entirely software embodiments (including firmware, microcode, etc.), or embodiments combining hardware and software aspects, collectively referred to herein as “circuit,” “module,” or “system.”
[0104] The following reference Figure 6 To describe an electronic device 300 according to such an embodiment of the present invention. Figure 6 The electronic device 300 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.
[0105] like Figure 6 As shown, the electronic device 300 is presented in the form of a general-purpose computing device. The components of the electronic device 300 may include, but are not limited to: at least one processing unit 310, at least one storage unit 320, a bus 330 connecting different system components (including storage unit 320 and processing unit 310), and a display unit 340.
[0106] The storage unit stores program code that can be executed by the processing unit 310, causing the processing unit 310 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of the present invention. For example, the processing unit 310 can perform actions such as... Figure 1 Steps S110 to S140 are shown in the diagram.
[0107] Storage unit 320 may include readable media in the form of volatile storage units, such as random access memory (RAM) 3201 and / or cache memory 3202, and may further include read-only memory (ROM) 3203.
[0108] Storage unit 320 may also include a program / utility 3204 having a set (at least one) program module 3205, such program module 3205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.
[0109] Bus 330 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.
[0110] Electronic device 300 can also communicate with one or more external devices 370 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 300, and / or with any device that enables electronic device 300 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 350. Furthermore, electronic device 300 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 360. As shown, network adapter 360 communicates with other modules of electronic device 300 via bus 330. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.
[0111] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.
[0112] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the invention may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of the invention described in the "Exemplary Methods" section above.
[0113] refer to Figure 7 As shown, a program product 400 for implementing the above-described method according to an embodiment of the present invention is described. This product may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, the readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.
[0114] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.
[0115] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.
[0116] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.
[0117] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages such as Java and C++, and conventional procedural programming languages such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).
[0118] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.
[0119] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.
[0120] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.
Claims
1. A method for static analysis and detection of open-source software code based on feature recognition, characterized in that, The method includes: Based on preset judgment conditions, the open-source software code used in the software to be detected is judged, and judgment results are generated. If the judgment result is that the open-source software code does not meet the judgment condition requirements, then feature extraction and comparison are performed on the open-source software code based on the preset open-source code model to generate a comparison result; Based on the comparison results, the defects in the open-source software code used in the software to be tested are retrieved from the preset knowledge graph for specific open-source defects. Based on the defects in the open-source software code used in the software under test, static analysis and detection of the open-source software code are achieved.
2. The method as described in claim 1, characterized in that, The method further includes: If the judgment result indicates that the open-source software code meets the judgment conditions, then the static analysis and detection process of the open-source software code is terminated.
3. The method as described in claim 1, characterized in that, The method further includes: Based on a dataset containing training, validation, and test sets, the open-source software code is subjected to feature extraction and comparison using a pre-defined open-source code model, and comparison results are generated.
4. The method as described in claim 3, characterized in that, The dataset generation method described above is as follows: We collect open-source static code with potential risks and vulnerabilities through web scraping, and then organize the data according to different risk levels by categorizing it with multiple tags. The collected data is then cleaned, filtered, and checked. The cleaned, filtered, and proofread dataset is divided into a training set, a validation set, and a test set.
5. The method as described in claim 3, characterized in that, The method further includes: Based on a dataset containing training, validation, and test sets, the open-source software code is subjected to feature extraction and comparison using an open-source code model based on a multi-scale CNN-Inception neural network algorithm, generating comparison results.
6. The method as described in claim 1, characterized in that, The method further includes: Based on the comparison results, a search is performed in a pre-defined knowledge graph targeting specific open-source vulnerabilities; The knowledge entities, entity attributes, and relationships between entities in the key expressions of open-source software vulnerabilities are extracted. The relationship analysis and reasoning of the open-source software vulnerability content are realized in the form of a knowledge network graph, thereby obtaining the defect problems of the open-source software code used in the software to be tested.
7. The method as described in claim 1, characterized in that, The method further includes: Based on the defect results, optimization is performed, and the open-source software code is iteratively optimized based on whether the optimization meets the requirements.
8. A device for static analysis and detection of open-source software code based on feature recognition, characterized in that, The device includes: The code judgment module is used to judge the open-source software code used in the software to be detected based on preset judgment conditions and generate judgment results. The feature comparison module is used to extract and compare features of the open-source software code based on a preset open-source code model if the judgment result is that the open-source software code does not meet the judgment condition requirements, and generate a comparison result. The defect retrieval module is used to retrieve, based on the comparison results, the defect problems of the open source software code used in the software to be tested from a preset knowledge graph for specific open source defects; The defect detection module is used to perform static analysis and detection of open-source software code based on defects in the open-source software code used in the software under test.
9. An electronic device, characterized in that, include Processor; and A memory storing computer-readable instructions that, when executed by the processor, implement the method according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 7.