Machine learning-based vulnerability mining and dynamic updating method, device and medium

Abstract

The embodiments of the present disclosure disclose a vulnerability mining and dynamic updating method and device based on machine learning, and a medium. The vulnerability mining method based on machine learning comprises the following steps: based on an open source code library and a known vulnerability database, a multi-dimensional code attribute graph is constructed; based on a graph neural network, deep representation learning is performed on the multi-dimensional code attribute graph, an implicit vulnerability semantic feature vector is extracted, and an initial vulnerability feature recognition model and a standard feature vector library are trained and generated; a target code attribute graph of a software code to be detected is constructed, and the target code attribute graph is divided into a plurality of subgraphs; based on the initial vulnerability feature recognition model, forward propagation is performed on each subgraph, and a suspected vulnerability candidate set is obtained; dynamic verification is performed on a target subgraph in the suspected vulnerability candidate set whose confidence score is greater than a preset threshold, and vulnerability information is obtained according to the verification result. The method can accurately identify vulnerabilities.

Description

Technical Field

[0001] This disclosure relates to the field of cybersecurity technology, and in particular to a method, apparatus, and medium for vulnerability discovery and dynamic updating based on machine learning. Background Technology

[0002] With the rapid development of the software industry, code size is growing exponentially, and software vulnerabilities have become a key factor threatening cybersecurity. Currently, traditional vulnerability discovery techniques mainly rely on manual auditing and rule-based static analysis tools. However, faced with massive and complex modern software code, manual auditing is not only time-consuming and labor-intensive but also has low coverage. Rule-based static analysis, on the other hand, is limited by the completeness of expert experience, making it difficult to discover new vulnerabilities outside the rule base, and it often falls short when dealing with complex cross-function data flows.

[0003] To improve the efficiency and intelligence of vulnerability discovery, researchers have begun to apply machine learning and deep learning technologies to this field. Current mainstream solutions typically utilize natural language processing (NLP) techniques, treating code snippets as text sequences and training vulnerability classification models by extracting sequence features. However, this simple serialization representation fragments the complex control flow and data dependencies within the code, making it difficult for the model to capture deep semantic logic vulnerabilities. Furthermore, purely static machine learning predictions often suffer from high false positive rates, lacking effective dynamic verification mechanisms to eliminate false alarms. In addition, most existing models employ a one-time training model, failing to utilize confirmed vulnerabilities or false positive data generated during detection for incremental updates. This results in a lack of adaptive evolution capabilities, making it difficult to cope with constantly changing attack and defense scenarios. Summary of the Invention

[0004] In view of this, the present disclosure provides a method, apparatus, and medium for vulnerability discovery and dynamic updating based on machine learning, which can overcome the problems of existing vulnerability analysis methods being one-sided, inaccurate in results, and having high manual costs.

[0005] In a first aspect, embodiments of this disclosure provide a vulnerability discovery method based on machine learning, comprising:

[0006] A multidimensional code attribute graph is constructed based on open-source code libraries and a database of known vulnerabilities.

[0007] Based on graph neural networks, deep representation learning is performed on the multidimensional code attribute graph to extract implicit vulnerability semantic feature vectors, and an initial vulnerability feature recognition model and a standard feature vector library are trained and generated.

[0008] Construct a target code attribute map of the software code to be detected, and divide the target code attribute map into several sub-maps;

[0009] Based on the initial vulnerability feature identification model, each subgraph is forward-propagated to obtain a set of suspected vulnerability candidates.

[0010] Dynamic verification is performed on target subgraphs with confidence scores greater than a preset threshold in the suspected vulnerability candidate set, and vulnerability information is obtained based on the verification results.

[0011] Secondly, embodiments of this disclosure also provide a machine learning-based method for dynamically updating vulnerability discovery, including:

[0012] Using the aforementioned machine learning-based vulnerability discovery method, a confirmed vulnerability dataset and a false positive interference dataset are obtained.

[0013] The standard feature vector library is updated based on the confirmed vulnerability dataset and the false alarm interference dataset;

[0014] The initial vulnerability feature identification model is dynamically trained and updated based on the updated standard feature vector library.

[0015] Thirdly, this disclosure also provides a computer device, which adopts the following technical solution:

[0016] The computer device includes:

[0017] At least one processor; and,

[0018] A memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform any of the machine learning-based vulnerability discovery and dynamic update methods described above.

[0020] Fourthly, embodiments of this disclosure also provide a computer-readable storage medium storing computer instructions; the computer instructions are used to cause a computer to execute any of the above-described machine learning-based vulnerability discovery and dynamic update methods.

[0021] Fifthly, embodiments of this disclosure also provide a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of any of the methods described above.

[0022] The vulnerability discovery method disclosed in this application, based on machine learning, first constructs a multi-dimensional code attribute graph based on open-source code repositories and a known vulnerability database. This not only overcomes the limitations of traditional text-based or single abstract syntax tree representations but also more comprehensively and structurally preserves program semantics and potential vulnerability patterns. Next, it performs deep representation learning on the multi-dimensional code attribute graph using graph neural networks to extract implicit vulnerability semantic feature vectors. This training generates an initial vulnerability feature recognition model and a standard feature vector library. The graph neural network automatically learns complex structural features in the code graph, eliminating the need for manually defined feature rules and reducing reliance on experts. The generated initial vulnerability feature recognition model can capture deep semantic patterns of vulnerabilities, and the standard feature... Vector libraries can serve as a benchmark reference for vulnerability features, improving the generalization ability and consistency of subsequent detection. During vulnerability mining, a target code attribute map of the software code to be detected is constructed, and the target code attribute map is divided into several sub-maps. Based on the initial vulnerability feature recognition model, each sub-map is forward-propagated to obtain a set of suspected vulnerability candidates, and a set of suspected vulnerability candidates with high similarity is quickly selected. Finally, dynamic verification is performed on the target sub-maps with confidence scores greater than a preset threshold in the obtained set of suspected vulnerability candidates. Vulnerability information is obtained based on the verification results. Dynamic verification is performed on high-confidence candidates to confirm real vulnerabilities and reduce false alarms. This scheme can achieve high-precision vulnerability mining through static detection and dynamic verification.

[0023] The above description is merely an overview of the technical solution disclosed herein. In order to better understand the technical means of this disclosure and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0024] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 A flowchart illustrating the machine learning-based vulnerability discovery and dynamic update method provided in this embodiment of the disclosure.

[0026] Figure 2 This is a flowchart illustrating the initial vulnerability feature identification model and the method for obtaining the standard feature vector library provided in the embodiments of this disclosure.

[0027] Figure 3 This is a flowchart illustrating a method for obtaining a set of suspected vulnerability candidates provided in an embodiment of this disclosure.

[0028] Figure 4 This is a flowchart illustrating a method for obtaining vulnerability information based on execution verification results, provided in an embodiment of this disclosure.

[0029] Figure 5 This is a flowchart illustrating the machine learning-based vulnerability discovery dynamic update method provided in an embodiment of this disclosure.

[0030] Figure 6 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present disclosure. Detailed Implementation

[0031] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0032] It should be understood that the following specific examples illustrate the implementation of this disclosure, and those skilled in the art can easily understand other advantages and effects of this disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. This disclosure can also be implemented or applied through other different specific implementation methods, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0033] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0034] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this disclosure. The drawings only show the components related to this disclosure and are not drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0035] Furthermore, specific details are provided in the following description to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects can be practiced without these specific details.

[0036] Reference Figure 1 This application discloses a vulnerability discovery method based on machine learning, including:

[0037] S100 constructs a multi-dimensional code attribute graph based on open-source code libraries and a database of known vulnerabilities.

[0038] This step specifically includes: S110, extracting the abstract syntax tree, control flow graph, and data dependency graph of the code from the obtained open source code library and known vulnerability database.

[0039] Specifically, based on open-source code libraries of major programming languages ​​and databases of known vulnerabilities (such as CVE and CWE), code with known vulnerabilities is collected from the open-source code libraries (by finding the corresponding patch through the CVE number, and then extracting the code snippets before and after the patch). Code with vulnerabilities is marked as 1 (positive example), and secure code is marked as 0 (negative example). For each code snippet (which can be at the function level or file level), its abstract syntax tree (AST), control flow graph (CFG), and data dependency graph (DDG) are extracted through static analysis and combined into a graph structure. Then, it is labeled according to whether it contains known vulnerabilities.

[0040] Furthermore, an abstract syntax tree (AST) can be extracted using existing compiler front-ends or parser libraries; a control flow graph (CFG) can be obtained by acquiring the paths traversed during program execution, where each node is a basic block (a piece of code executed sequentially), and edges represent control flow transitions such as conditional branches, loops, and jumps; and a data dependency graph (DDG) can be obtained by acquiring the definition-usage relationships between data in the program.

[0041] In this abstract syntax tree (AST), the code's syntactic structure is represented, nodes are syntactic units (such as operators, identifiers, and literals), and edges represent strict syntactic component relationships. For example, the `vulnerable_function` node connects to the parameter list node and the function body (a compound statement block) node; the function body node then connects to the variable declaration node and the `if` statement node, and so on. The AST embodies the code's static syntactic structure and lexical elements.

[0042] A control flow graph represents the execution order of code. Nodes are basic blocks, such as consecutive statements, and edges represent possible execution paths. A conditional node branches into two edges: one pointing to the basic block executed when the condition is true (input != NULL), and the other pointing to the basic block skipped when the condition is false. The control flow graph illustrates the execution order and logical branches of the code.

[0043] In a program dependency graph, nodes represent data entities (variables, parameters, etc.) and their definition / usage points. For example, the parameter `input`, the array `buffer`, and the `input` used and defined in the `strcpy` call. Edges represent data flow relationships; one edge points from the definition of `input` (passed as a function parameter) to its usage in the conditional statement `input != NULL` and the `strcpy` call. Another critical edge points from the definition of `buffer` in the `strcpy` call to any subsequent location where the value of `buffer` might be used. The program dependency graph illustrates how data is created, modified, and transferred.

[0044] These three types of graphs capture the three core dimensions of the program source code—syntactic structure (AST), behavioral logic (CFG), and data relationships (DDG)—almost without omission. This lays the data foundation for comprehensive vulnerability analysis. This step transforms unstructured text code into structured, machine-readable graph models. Each graph is optimized and abstracted for a specific perspective, allowing subsequent analysis to focus on specific types of patterns.

[0045] S120 integrates and constructs a multidimensional code attribute graph based on shared code nodes (such as function declarations and variable usages) in the abstract syntax tree, control flow graph, and data dependency graph.

[0046] In the multidimensional code attribute graph, each node represents a code entity such as a function, statement, expression, or variable; each edge represents the relationship between nodes, which can be: AST parent-child relationship, CFG control flow edge, DDG data dependency edge, or AST to CFG mapping edge. That is, the edge features include relationship type, data flow direction, control flow conditions, etc.

[0047] Specifically, we analyze these three graphs to find nodes representing the same code entity. For example, the statement `strcpy(buffer,input);` is a function call expression node in the AST, located inside a basic block in the CFG, and involves the definition of `buffer` and the use of `input` in the DDG. We will use the function call expression node in the AST as the core anchor point. We retain all nodes from the AST, CFG, and DDG. The key operation is connecting edges: we connect the basic block node in the CFG containing the `strcpy` call to the `strcpy` node in the AST through a new edge, establishing the association between execution logic and syntax elements. We connect the `buffer` node defined by the `strcpy` call and the `input` node used in the DDG to the `strcpy` node in the AST through a data flow edge, establishing the association between data operations and syntax elements. Similarly, we connect the declaration node of the `input` parameter in the AST, the basic block node in the CFG that checks if it is NULL, and the node in the DDG that serves as the data source, creating a heterogeneous graph, i.e., a multidimensional code attribute graph. The nodes in the graph are of various types, including function declarations, variables, expressions, and basic blocks. The edges are also of various types, including syntactic parent-child edges, control flow edges, data flow edges, and containment edges. The strcpy, buffer, and input, and their complex relationships, which were originally scattered in three graphs, are now integrated into a unified topology.

[0048] S200 uses graph neural networks to perform deep representation learning on multi-dimensional code attribute graphs, extracts implicit vulnerability semantic feature vectors, trains and generates an initial vulnerability feature recognition model and a standard feature vector library.

[0049] Simultaneously refer to Figure 2 The initial vulnerability feature identification model and standard feature vector library acquisition method specifically include: S210, constructing a graph neural network model, which includes an input layer, multiple graph neural network layers and a classifier.

[0050] S220 performs deep representation learning on the multidimensional code attribute graph based on the graph neural network model. It iteratively aggregates the node neighbor information through the message passing mechanism to update the node features and generate the target vector, which is the vulnerability semantic feature vector corresponding to the multidimensional code attribute graph.

[0051] Specifically, a multidimensional code attribute graph is input into the input layer, which maps different types of nodes (such as function calls, variables, and basic blocks) and edges (syntactic inclusion, control flow, and data flow) into a unified initial feature vector that can be processed by the neural network. For example, the function name attribute is encoded for the strcpy node, and the array type and size attributes are encoded for the buffer node.

[0052] Each GNN layer in the multiple graph neural network layers performs message passing once. Specifically, for each edge in the graph, such as the data flow edge from the input variable node to the strcpy calling node, a message is generated based on the current features of the source node and the edge type. Each node, such as the strcpy node, collects messages from all its neighboring nodes (input, buffer) through different edge types. After aggregating messages from its neighbors, the node combines its features from the previous round and generates its new feature vector for the current round through a learnable update function such as a GRU unit or a fully connected layer. After multiple iterations, the features of a node eventually contain rich information about its multi-hop neighbors, i.e., distant related nodes. Once the features of all nodes have been updated, a graph-level aggregation function, such as attention pooling, scans all nodes in the entire graph, obtains feature patterns exhibited by key nodes such as strcpy, buffer, and input that show strong signs of danger, and weights and fuses these signals to finally output a fixed-length global feature vector that can holistically represent the semantics of the vulnerability in the code graph.

[0053] S230: Calculate the loss function value based on the target vector and its corresponding vulnerability label, and optimize the model parameters through backpropagation until the model converges, thus obtaining the initial vulnerability feature recognition model.

[0054] The target vector is input into a standard classifier, which consists of several fully connected layers and a softmax layer. The classifier outputs the probability that the code graph contains a vulnerability and the type of vulnerability. The model's prediction is compared with the ground truth label, and the degree of error is calculated using a loss function such as cross-entropy loss. Using backpropagation, the loss value is passed back from the classifier to each layer of the GNN. The algorithm calculates the contribution of each adjustable parameter in the model, such as the message generation function, update function, and classifier weights, to the final error (e.g., the gradient), and then uses an optimizer to adjust these parameters in the direction of reducing loss. This process is repeated, continuously fine-tuning the model parameters so that the generated global feature vector becomes increasingly sensitive to vulnerabilities, and the classifier's judgment becomes more accurate. When the model's performance on the validation set no longer shows significant improvement, it is considered converged, resulting in a trained initial vulnerability feature recognition model. The converged model has the ability to directly predict the probability of vulnerabilities in new, unseen code graphs, achieving automated vulnerability screening.

[0055] S240 stores the vulnerability semantic feature vector and its corresponding vulnerability label as a standard feature vector library.

[0056] In this embodiment, the standard feature vector library does not refer to training data, but rather to knowledge extracted from a trained model that represents known vulnerability patterns. When new code is detected as a vulnerability, its feature vector can be compared with the closest vector in the library, thus providing an explanation that it is similar to a specific historical vulnerability pattern. At the same time, newly confirmed vulnerability features can be easily added to the library, enabling continuous expansion of model knowledge without having to retrain the entire large model each time.

[0057] S300: Construct the target code attribute map of the software code to be tested, and divide the target code attribute map into several sub-maps.

[0058] This step specifically includes: S310, using the same code analysis tool as S100 (such as Joern) to parse the target software system code, extract the abstract syntax tree, control flow graph, and data dependency graph of each function, and integrate them to construct a multi-dimensional code attribute graph of each function.

[0059] Using the exact same toolchain and construction rules ensures that the code attribute graph of the code to be detected is fully compatible with the code attribute graph used when training the model in terms of node / edge type definition and attribute encoding method, effectively avoiding the degradation of model performance due to differences in input format.

[0060] S320 divides the code attribute graph of the entire target system into multiple subgraphs according to functions, with each subgraph corresponding to a code unit.

[0061] In this application, the target code attribute Figure 1 The target code attribute graph is usually very large, containing tens of thousands of nodes. For example, the code of an entire project. Directly inputting it into the model would bring a huge computational burden and make it difficult to locate the specific vulnerability. Since the model and vector library are usually trained at the function level or code fragment level, the target code attribute graph is divided into multiple subgraphs.

[0062] Because functions are fundamental functional modules of software, they typically possess complete internal logic. The complete patterns of most vulnerabilities are manifested within a single function or between a few closely related functions. Tools naturally support extracting local code attribute graph subgraphs based on functions. Therefore, dividing the entire target system's code attribute graph into multiple independent subgraphs based on function boundaries involves: locating all nodes representing function definitions, such as function declarations or function body entry nodes, within the code attribute graph; starting from each function definition node, traversing control flow, data flow, and other edges to collect all nodes belonging to that function and the edges between them, forming the corresponding subgraph; each subgraph should contain the complete internal structure of the corresponding function while avoiding overlap with other function subgraphs (i.e., nodes and edges should not be repeated), ensuring that subgraphs do not interfere with each other. Each subgraph corresponds to a code unit.

[0063] Furthermore, each subgraph is converted into an input format consistent with that used when training the initial vulnerability feature recognition model to ensure that the model can process it correctly. This mainly includes: checking the dimensions of node and edge features in the subgraph; if they are inconsistent with the feature dimensions during training, adjusting them by padding, truncation, or mapping; and representing each subgraph as a graph data structure containing node feature matrices, edge indices, and edge feature matrices for model input.

[0064] In this embodiment, systematic code analysis and intelligent subgraph segmentation make it possible to perform full and rapid vulnerability scanning on large projects with millions or even tens of millions of lines of code. Since each detection result is associated with a specific function subgraph, it not only reports vulnerabilities but also clearly displays the function signature, code file, and even suspicious nodes and paths within the subgraph. For example, it can highlight risky strcpy call nodes, unchecked input variable nodes, and the data flow paths connecting them, greatly enhancing the interpretability of the detection results and their user-friendliness for developers.

[0065] From the construction of training data (S100) to the training of the model (S210-S230), and then to the data processing during prediction (S310-S320), the entire process uses a unified code representation and the same processing granularity. This consistency is the fundamental guarantee for the high accuracy and high reliability of the entire system.

[0066] S400 performs forward propagation on each subgraph based on the initial vulnerability feature identification model to obtain a set of suspected vulnerability candidates.

[0067] Simultaneously refer to Figure 3 The method for obtaining the suspected vulnerability candidate set includes: S410, which performs forward propagation on each subgraph based on the initial vulnerability feature recognition model to obtain the graph-level feature vector of each subgraph.

[0068] Specifically, the subgraph is input into the initial vulnerability feature recognition model, and the trained model weights are loaded. After passing through multiple graph neural network layers, the neighbor information of each node is iteratively aggregated through a message passing mechanism, the node features are updated, and finally the high-level feature representation of all nodes is obtained. All node features are aggregated into a single graph-level feature vector through global pooling layers such as summation, mean, or attention pooling, which is the vulnerability semantic feature vector of the subgraph.

[0069] The generated graph-level feature vectors are digital fingerprints of the corresponding code snippets, containing not only surface syntactic information but also encoding deep control logic and data flow relationships, providing a semantically rich foundation for subsequent analysis. The model can simultaneously perform forward propagation on a large number of subgraphs, leveraging the parallel computing capabilities of GPUs to achieve fast and efficient scanning of the entire codebase.

[0070] S420 retrieves risk code information from the graph-level feature vectors of each subgraph based on a standard feature vector library.

[0071] Specifically, the cosine similarity between the graph-level feature vector of the subgraph and all known vulnerability feature vectors in the standard feature vector library is obtained; a similarity score is determined based on the cosine similarity; and known vulnerability types with similarity scores greater than a preset similarity threshold are used as the risk vulnerability code types of the graph-level feature vector of the subgraph. The purpose of this step is to compare the fingerprint to be tested obtained in the previous step with a known risk fingerprint library to identify known vulnerability patterns. In this step, the higher the similarity, the closer the subgraph is to a known vulnerability pattern.

[0072] S430 performs anomaly analysis on the graph-level feature vectors of each subgraph to identify deviations from normal code patterns and obtains anomaly information.

[0073] Specifically, feature vectors extracted from a large number of labeled safe training sample subgraphs during the training phase (S230) can be used to establish a statistical distribution model of normal code patterns. This model can be a multivariate Gaussian distribution or a normal feature space learned through unsupervised methods such as autoencoders or isolation forests. For the feature vectors of the subgraph to be detected, the degree to which they deviate from this normal baseline is calculated. Specifically, the Mahalanobis distance between the feature vector and the center of the normal feature vector distribution can be calculated, and an anomaly score is determined based on the Mahalanobis distance. The graph-level feature vectors are then input into a pre-trained autoencoder to obtain reconstructed vectors, and the anomaly score is determined based on the reconstruction error between the graph-level feature vectors and the reconstructed vectors. Alternatively, the graph-level feature vectors can be input into a pre-trained isolation forest model to obtain the path length or anomaly score of the isolated graph-level feature vectors, and the anomaly score is determined based on the path length or anomaly score. The higher the anomaly score, the higher the corresponding anomaly score is determined. The anomaly score output in this step is used to quantify the strangeness or rarity of the code in the subgraph.

[0074] The purpose of this step is to discover novel or unusual code patterns that do not conform to normal or benign code patterns but are not explicitly matched in the standard library. Through this step, even if a vulnerability pattern has never appeared in the training set, as long as its code structure and data flow pattern are significantly different from the vast majority of secure code, it can be marked as an anomaly, thus providing important clues for discovering new vulnerabilities.

[0075] S440 generates a set of potential vulnerability candidates, including location coordinates and confidence scores, based on risk code information and anomaly information.

[0076] Specifically, the similarity score and the anomaly score are weighted and summed to obtain the confidence score. The weight of each item can be flexibly adjusted according to actual needs.

[0077] In this embodiment, the suspected vulnerability candidate set includes the confidence score of each subgraph, the location of the risky code in each subgraph, and the location of the anomaly. High-risk areas are filtered out by setting dual thresholds, and the corresponding file paths and line numbers are marked to output the suspected vulnerability candidate set.

[0078] Furthermore, a structured record can be generated for each candidate, containing at least: 1) Location coordinates: the specific location in the source code (filename, function name, start and end line numbers); 2) Vulnerability type inference: based on the S420 matching result; 3) Final confidence score: the fused score; 4) Evidence summary: a brief description of "matched a known pattern X" and / or "exhibited highly anomalous features Y". Then, all candidate records are sorted (e.g., in descending order of confidence) and output as a structured list or report file (e.g., JSON, SARIF format). This step is the decision and reporting phase, integrating the independent evidence from the first two steps to form the final deliverable detection result.

[0079] In this embodiment, feature-based known vulnerability detection (S420) and anomaly-based unknown risk discovery (S430) are combined to form a dual protection network of known and unknown vulnerabilities. This provides significantly higher detection coverage (recall rate) and stronger adaptability than a single method. Each alert is supported by quantitative evidence of pattern matching and / or statistical anomalies, making the results more interpretable and more confident. From code input to the generation of a candidate list with location and score, the entire process requires no manual intervention and can be seamlessly integrated into modern software development and security processes to achieve scalable and continuous security detection. The output candidate set is not a final decision, but a high-quality, sorted list of suspicious points, which greatly reduces the scope of code that needs to be manually reviewed.

[0080] S500 performs dynamic verification on the target subgraphs in the set of suspected vulnerability candidates with confidence scores greater than the preset threshold, and obtains vulnerability information based on the verification results.

[0081] Meanwhile, referring to Figure 4 , the method for obtaining vulnerability information based on the verification results specifically includes:

[0082] S510, obtain the target subgraphs in the set of suspected vulnerability candidates with confidence scores greater than the preset threshold.

[0083] Specifically, preset one or more confidence score thresholds. These thresholds can be empirically set based on historical verification results (e.g., in previous iterations, 80% of the candidates with scores higher than X were confirmed as real vulnerabilities), or calibrated through a small-scale verification set. Sort the set of suspected vulnerability candidates in descending order according to the comprehensive confidence scores generated by S440, and automatically select all candidate entries with scores higher than the preset threshold. Each entry is precisely associated with a specific code property subgraph and its location in the source code.

[0084] S520, generate test cases that can trigger the corresponding execution paths according to the specific code units of the target subgraph.

[0085] Specifically, based on the specific code units (functions) corresponding to the target subgraph and the risk characteristics and abnormal patterns revealed in the analysis of S410 - S430, determine the key execution paths that need to be triggered. For example, if the subgraph characteristics point to a buffer overflow, the focus of the analysis is to find a data flow path that starts from the user input point to the dangerous copy function and whose constraint conditions can be satisfied.

[0086] The method for generating test cases can be based on symbolic execution generation or generated according to directed fuzz testing. Among them, the generation based on symbolic execution includes: converting the constraint conditions of the target code path, such as if (input_len<buffer_size), into mathematical expressions, and using a constraint solver such as Z3 to solve for the specific input values that can satisfy the path conditions, and generating highly accurate and path-reachable test cases.

[0087] The generation according to directed fuzz testing includes: using the risk positions and input points provided by static analysis as seeds and guides, and using fuzz testing tools such as AFL, libFuzzer, etc. for mutation, and guiding it to explore towards the target vulnerability code area.

[0088] S530, execute the test cases and monitor the memory status (such as out-of-bounds read and write, use-after-free) and control flow (such as abnormal jumps) during the program runtime in real time.

[0089] Specifically, in a sandbox or isolated testing environment, test cases generated by S520 are used as input to run the target program or its executable unit containing the target function. Instrumentation tools, such as AddressSanitizer / ASAN and Valgrind, are used in real time to detect memory safety violations such as stack overflows, use after free, double free, and memory leaks; unexpected control flow transfers are monitored, such as jumps achieved through stack overflows or function pointer tampering, or unhandled exceptions; sensitive data such as unencrypted passwords are checked for accidental output or logging; and all events during test execution are recorded in detail, including crashes, assertion failures, errors reported by Sanitizer, code coverage information, etc.

[0090] The program crashes and precise error messages reported by the Sanitizer obtained in this step are the strongest evidence proving the existence of a vulnerability. This completely resolves the ambiguities that static analysis may have, and can capture vulnerabilities that only manifest under specific runtime conditions, such as synchronization race conditions and complex logical errors—blind spots that pure static analysis often misses. The fact that the program actually executes the target code region proves that the trigger path is logically reachable given the input, providing a foundation for further judgment. This step is the core of dynamic verification; the program is run in a controlled environment to observe whether its behavior matches the vulnerability predictions.

[0091] S540: If a program crashes and the path that triggers the vulnerability is logically reachable in a real environment, it is determined that the corresponding target subgraph is vulnerable.

[0092] Specifically, the complete execution path and input constraints leading to program anomalies, especially crashes, in S530 are analyzed. This analysis examines whether the path could logically be triggered in a real-world deployment environment, such as with specific service configurations, user permissions, and system states. A real vulnerability is confirmed when the following two core conditions are met: Condition 1: Clear negative runtime behavior exists, such as program crashes or a Sanitizer reporting an exploitable memory corruption error; Condition 2: The triggering path is logically reachable in a real-world environment, meaning an attacker can construct or satisfy the input and state conditions required to cause a crash in a real-world application scenario, not just a special case in a test environment. Finally, a final vulnerability report is generated, including: the verified vulnerability type, precise source code location, reproducible test cases or PoCs, the runtime context at the time of triggering, and a severity assessment.

[0093] In this step, by using the dual strict criteria of runtime crashes and logical reachability, false positive reports that have a high static pattern matching degree but cannot be triggered under real conditions can be filtered out. This results in a highly reliable vulnerability list that can be directly used for remediation. The generated report can not only point out the vulnerability, but also provide reproducible test cases and specific context, which greatly facilitates developers to understand and locate the problem and accelerates the remediation process.

[0094] This embodiment achieves a perfect closed loop between static screening and dynamic verification. Dynamic verification reduces the false positive rate of static analysis tools, typically reaching 50% or higher, to single-digit percentages, enabling security teams to truly trust and efficiently respond to alerts from automated tools. The final output includes reproducible PoCs, precise context, and high-confidence verified vulnerability reports, significantly improving collaboration efficiency between development and security teams and making vulnerability remediation work more targeted and well-founded. Dynamic execution can verify unusual code patterns that are only captured by S430 anomaly analysis due to their novelty, determining whether they truly constitute exploitable flaws. This expands the system's ability to discover and verify unknown threats and complex logic vulnerabilities. In this dynamic verification phase, the predictions of the machine learning model are placed in a real-world runtime environment for ultimate testing, ensuring the authority, operability, and high credibility of the system's output results. This allows automated vulnerability detection technology to be truly integrated into high-standard software security development and operation practices.

[0095] This application discloses a machine learning-based vulnerability discovery method that automates the entire process from code processing to vulnerability reporting, reducing manual intervention. Subgraph partitioning and parallel computing accelerate large-scale code analysis, making it suitable for modern large-scale software projects. The multi-dimensional code graph retains rich semantics, and the GNN model learns deep vulnerability patterns, enabling the discovery of more complex vulnerabilities compared to traditional rule-based methods. A dynamic verification stage further filters false positives, improving the reliability of the results. Based on machine learning rather than fixed rules, it can adapt to different programming languages, coding styles, and new vulnerability patterns. A standard feature vector library supports cross-project knowledge transfer. The feature library and model can be continuously updated with new vulnerability data, keeping detection capabilities up-to-date. The overall framework is compatible with other static or dynamic analysis tools, effectively reducing reliance on manually defined rules by security experts, allowing non-professional developers or testers to use this tool for effective vulnerability discovery. This solution uses a multi-dimensional code attribute graph to uniformly represent code, utilizes graph neural networks to achieve deep feature learning, and combines static detection and dynamic verification to construct an end-to-end intelligent vulnerability discovery system. It outperforms traditional vulnerability discovery methods in terms of detection accuracy, automation, and generalization ability. It is suitable for security testing, code auditing, and other scenarios in the software development cycle, and helps to discover potential risks at an early stage and improve software security.

[0096] Reference Figure 5 Secondly, this application discloses a machine learning-based method for dynamically updating vulnerability discovery, including:

[0097] S10, obtain the confirmed vulnerability dataset and the false alarm interference dataset.

[0098] In this embodiment, the vulnerability mining method based on machine learning of the first aspect of this application is adopted to obtain a confirmed vulnerability dataset and a false alarm interference dataset. The method specifically includes: if there is a program crash and the path that triggers the vulnerability is logically reachable in the real environment, generating crash scene information (crash scene, type, severity), and associating and integrating the crash scene information, the corresponding target subgraph, and the graph-level feature vector, and storing them in the confirmed vulnerability dataset.

[0099] If a program crashes and the path that triggers the vulnerability is logically unreachable in the real environment, or if no program crash occurs, false alarm information is generated (such as unreachable path, similar pattern but no logic trigger), and the false alarm information, the corresponding target subgraph, and graph-level feature vectors are associated and integrated, and stored in the false alarm interference dataset.

[0100] S20 updates the standard feature vector library based on the confirmed vulnerability dataset and the false alarm interference dataset.

[0101] This step is used to incorporate the knowledge of newly identified vulnerability patterns (positive samples) and false positive patterns (negative samples) into the system's basic feature representation, making the feature space more able to distinguish between real vulnerabilities and interference items.

[0102] Specifically, for each code sample (function / basic block / subgraph) in the confirmed vulnerability dataset and the false positive interference dataset, the same feature extraction pipeline as that used to build the initial standard feature vector library is used to ensure the consistency of the new and old features in terms of semantics and dimensions. For the newly extracted feature vectors, the normalization parameters (such as mean, standard deviation, maximum and minimum values) used in the initial feature library are used to process them to prevent data distribution shift, and then the feature library is iteratively optimized.

[0103] One method for iteratively optimizing the feature library is to perform clustering analysis (such as K-Means or DBSCAN) on the new sample set (separately for positive and negative samples), adding only the cluster centers or boundary samples farthest from the existing library centers to the feature library, ensuring that the largest pattern space is covered with the fewest vectors. Alternatively, each feature vector in the library can be associated with a weight or timestamp, with newly added vectors having higher weights and older vectors that have not been matched or triggered for a long time gradually having lower weights. When the library capacity reaches its limit, the vector with the lowest weight is eliminated first. Another method is to evaluate the importance of each feature vector in historical classifications (e.g., through feature importance analysis of the model), eliminating vectors with consistently low contributions.

[0104] This step ensures that the number of feature vectors for positive samples (vulnerabilities) and negative samples (normal / false positives) in the feature library is maintained at a reasonable ratio, preventing the model from being biased towards the majority class. Oversampling (copying or synthesizing minority class features) or undersampling (selectively removing redundant features from the majority class) strategies can be used.

[0105] Furthermore, the application also includes outlier detection for newly added vectors. If the feature value of a new vector differs greatly from that of similar samples, its corresponding code sample needs to be manually reviewed to confirm whether it is a labeling error or an extremely special case, so as to avoid introducing noise.

[0106] S30 dynamically trains and updates the initial vulnerability feature recognition model based on the updated standard feature vector library.

[0107] This step utilizes an updated and richer feature library to train the existing model, improving its discrimination accuracy, generalization ability, and mitigating catastrophic forgetting. Specifically, new training, validation, and test sets can be constructed by stratifying sampling by category from the updated standard feature vector library, ensuring that newly added samples are included while retaining a sufficient number of validated old samples to maintain existing knowledge. For scarce data such as vulnerability samples, feature space-based augmentation can be used, such as adding small perturbations to the feature vectors (within the distribution range of similar samples) to simulate subtle variations in the code and enhance model robustness.

[0108] Dynamic training and updating methods can employ either periodic full retraining or incremental learning. Periodic full retraining involves training a new model from scratch using the entire updated feature library once new data accumulates to a certain scale (e.g., 20% of the original dataset). Incremental learning (online learning) involves using the current model as a starting point, continuing training only with the newly added dataset, using a smaller learning rate to prevent excessive erosion of old knowledge by new data, randomly retaining a portion of feature data from old samples and mixing it with the new data for training; identifying and protecting model parameters important to the old task (identifying old vulnerability patterns), allowing only unimportant parameters to be significantly updated.

[0109] Furthermore, evaluate the overall precision, recall, and F1 score of the updated model. Specifically, a small, fixed dataset containing all previously discovered confirmed vulnerabilities and typical persistent false positives can be used for regression testing to ensure that the update does not cause performance regression. The updated model should first be run in parallel for a period of time in a small, non-core codebase, and its results should be compared with the results of the original model and manually reviewed. Once the improvement in performance is confirmed, the model should be fully replaced.

[0110] In this application, S10 (based on the first aspect of the approach) inherently includes automated verification of suspected vulnerabilities using techniques such as symbolic execution and test case generation. This process automatically generates high-quality, labeled confirmed vulnerabilities and confirmed false positives, eliminating most of the manual classification work. S20 and S30 implement automated updates to the feature library and model. Once new verification data accumulates to a certain scale, the system can automatically or semi-automatically trigger a retraining process, incorporating previously unseen legitimate patterns (learned from false positives) and novel vulnerability patterns (learned from confirmed vulnerabilities) that appear in new projects. Dynamic training based on the updated feature library enables the model to quickly adapt to new code contexts and technology stacks without the need for costly retraining from scratch. This gives the model stronger generalization capabilities across projects and time, making it a more stable enterprise-level general-purpose tool serving constantly changing code assets.

[0111] The method disclosed in this application, leveraging machine learning technology, analyzes a large amount of software code and known vulnerability data to establish a vulnerability feature recognition model. This model can automatically discover potential vulnerabilities and dynamically update the model based on newly discovered vulnerabilities, improving the accuracy and timeliness of vulnerability detection. In practical applications, this method can quickly scan software systems, accurately locate vulnerability positions, and provide timely remediation suggestions for security teams. It effectively shortens the vulnerability discovery and remediation cycle, reduces security risks, and can be widely applied in the fields of software development and security testing, significantly improving the security and reliability of software systems.

[0112] A computer device according to embodiments of the present disclosure includes a memory and a processor. The memory is used to store non-transitory computer-readable instructions. Specifically, the memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory. The non-volatile memory may, for example, include read-only memory (ROM), hard disk, flash memory, etc.

[0113] The processor may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the computer device to perform desired functions. In one embodiment of this disclosure, the processor is used to execute computer-readable instructions stored in the memory, causing the computer device to perform all or part of the steps of the machine learning-based vulnerability discovery and dynamic update method described in the foregoing embodiments of this disclosure.

[0114] Those skilled in the art will understand that, in order to solve the technical problem of how to achieve a good user experience, this embodiment may also include well-known structures such as communication buses and interfaces, and these well-known structures should also be included within the protection scope of this disclosure.

[0115] like Figure 6 This is a schematic diagram of a computer device provided for an embodiment of the present disclosure. It illustrates a structural schematic diagram suitable for implementing the computer device in the embodiments of the present disclosure. Figure 6 The computer device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0116] like Figure 6 As shown, a computer device may include a processor (such as a central processing unit, graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) or programs loaded from storage devices into random access memory (RAM). The RAM also stores various programs and data required for the operation of the computer device. The processor, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0117] Typically, the following devices can be connected to the I / O interface: input devices, such as sensors or visual information acquisition devices; output devices, such as displays; storage devices, such as magnetic tapes or hard drives; and communication devices. Communication devices allow the computer device to communicate wirelessly or wiredly with other devices (such as edge computing devices) to exchange data. Although Figure 6 A computer apparatus with various devices is shown, but it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or included alternatively.

[0118] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from ROM. When the computer program is executed by a processor, all or part of the steps of the machine learning-based vulnerability discovery and dynamic update method of embodiments of this disclosure are performed.

[0119] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0120] A computer-readable storage medium according to embodiments of the present disclosure stores non-transitory computer-readable instructions. When these non-transitory computer-readable instructions are executed by a processor, all or part of the steps of the machine learning-based vulnerability discovery and dynamic update methods described in the foregoing embodiments of the present disclosure are performed.

[0121] The aforementioned computer-readable storage media include, but are not limited to: optical storage media (e.g., CD-ROM and DVD), magneto-optical storage media (e.g., MO), magnetic storage media (e.g., magnetic tape or portable hard drive), media with built-in rewritable non-volatile memory (e.g., memory card), and media with built-in ROM (e.g., ROM cartridge).

[0122] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0123] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0124] In this disclosure, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The block diagrams of devices, apparatuses, devices, and systems involved in this disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as "comprising," "including," "having," etc., are open-ended terms meaning "including but not limited to," and are used interchangeably with them. The terms "or" and "and" as used herein refer to the terms "and / or," and are used interchangeably with them unless the context clearly indicates otherwise. The term "such as" as used herein refers to the phrase "such as but not limited to," and is used interchangeably with it.

[0125] Additionally, as used herein, the "or" used in a list of items beginning with "at least one" indicates a separate list, such that a list of, for example, "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not imply that the described example is preferred or better than other examples.

[0126] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0127] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0128] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0129] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A vulnerability discovery method based on machine learning, characterized in that, include: A multidimensional code attribute graph is constructed based on open-source code libraries and a database of known vulnerabilities. Based on graph neural networks, deep representation learning is performed on the multidimensional code attribute graph to extract implicit vulnerability semantic feature vectors, and an initial vulnerability feature recognition model and a standard feature vector library are trained and generated. Construct a target code attribute map of the software code to be detected, and divide the target code attribute map into several sub-maps; Based on the initial vulnerability feature identification model, forward propagation is performed on each of the subgraphs to obtain a set of suspected vulnerability candidates. Specifically, this includes: obtaining graph-level feature vectors by forward propagation on each of the subgraphs based on the initial vulnerability feature identification model; obtaining risk code information from the graph-level feature vectors of each subgraph according to the standard feature vector library for performing feature-based known vulnerability detection; performing anomaly analysis on the graph-level feature vectors of each subgraph to obtain anomaly information for performing anomaly-based unknown risk discovery; and generating a set of suspected vulnerability candidates containing location coordinates and confidence scores based on the risk code information and the anomaly information. The step of performing anomaly analysis on the graph-level feature vectors of each subgraph to obtain anomaly information includes: establishing a statistical distribution model of the normal code pattern using feature vectors extracted from a large number of training sample subgraphs marked as safe during the training phase; calculating the Mahalanobis distance between the feature vector of the subgraph to be detected and the distribution center of the normal feature vector, and determining anomaly score based on the Mahalanobis distance; inputting the graph-level feature vectors into a pre-trained autoencoder to obtain reconstructed vectors, and determining anomaly score based on the reconstruction error between the graph-level feature vectors and the reconstructed vectors; or, inputting the graph-level feature vectors into a pre-trained isolated forest model to obtain the path length or anomaly score of the isolated graph-level feature vectors, and determining anomaly score based on the path length or anomaly score. Dynamic verification is performed on target subgraphs in the suspected vulnerability candidate set whose confidence scores are greater than a preset threshold. Vulnerability information is obtained based on the verification results. Specifically, this includes: acquiring target subgraphs in the suspected vulnerability candidate set whose confidence scores are greater than a preset threshold; generating test cases that can trigger corresponding execution paths based on the specific code units of the target subgraphs; executing the test cases in a sandbox or isolated test environment and monitoring the memory state and control flow of the program in real time; if the program crashes and the path that triggers the vulnerability is logically reachable in the real environment, it is determined that the corresponding target subgraph has a vulnerability; wherein, the dynamic verification includes dynamic execution analysis of the corresponding test cases.

2. The vulnerability discovery method based on machine learning according to claim 1, characterized in that, The process of performing deep representation learning on the multi-dimensional code attribute graph based on graph neural networks to extract implicit vulnerability semantic feature vectors, training and generating an initial vulnerability feature recognition model and a standard feature vector library, includes: Construct a graph neural network model, which includes an input layer, multiple graph neural network layers, and a classifier; Based on the graph neural network model, deep representation learning is performed on the multidimensional code attribute graph. The node neighbor information is iteratively aggregated through a message passing mechanism to update the node features and generate a target vector, which is the vulnerability semantic feature vector corresponding to the multidimensional code attribute graph. The loss function value is calculated based on the target vector and its corresponding vulnerability label, and the model parameters are optimized through backpropagation until the model converges, thus obtaining the initial vulnerability feature identification model. The vulnerability semantic feature vectors and their corresponding vulnerability tags are stored as a standard feature vector library.

3. The vulnerability discovery method based on machine learning according to claim 1, characterized in that, The step of obtaining risk code information from the graph-level feature vectors of each subgraph according to the standard feature vector library includes: Obtain the cosine similarity between the graph-level feature vector of the subgraph and all known vulnerability feature vectors in the standard feature vector library; A similarity score is determined based on the cosine similarity. Known vulnerability types with similarity scores greater than a preset similarity threshold are used as the risk vulnerability code types in the graph-level feature vector of the subgraph.

4. A machine learning-based method for dynamically updating vulnerability discovery, characterized in that, include: Using the machine learning-based vulnerability discovery method described in any one of claims 1-3, a confirmed vulnerability dataset and a false positive interference dataset are obtained; The standard feature vector library is updated based on the confirmed vulnerability dataset and the false alarm interference dataset; The initial vulnerability feature identification model is dynamically trained and updated based on the updated standard feature vector library.

5. The machine learning-based vulnerability discovery dynamic update method according to claim 4, characterized in that, The obtained confirmed vulnerability dataset and false positive interference dataset include: If a program crashes and the path that triggers the vulnerability is logically reachable in a real environment, crash scene information is generated, and the crash scene information, the corresponding target subgraph, and the graph-level feature vector are associated and integrated, and stored in the confirmed vulnerability dataset. If a program crashes and the path that triggers the vulnerability is logically unreachable in the real environment, or if no program crash occurs, a false alarm is generated. The false alarm, the corresponding target subgraph, and the graph-level feature vector are then associated and integrated and stored in the false alarm interference dataset.

6. A computer device, characterized in that, The computer device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the machine learning-based vulnerability discovery method according to any one of claims 1-3 or the machine learning-based vulnerability discovery dynamic update method according to any one of claims 4-5.

7. A computer-readable storage medium storing computer instructions; the computer instructions being configured to cause a computer to perform the machine learning-based vulnerability discovery method of any one of claims 1-3 or the machine learning-based vulnerability discovery dynamic update method of any one of claims 4-5.

8. A computer program product comprising computer instructions, characterized in that, When executed by a processor, the computer instructions implement the steps of the machine learning-based vulnerability discovery method according to any one of claims 1-3 or the machine learning-based vulnerability discovery dynamic update method according to any one of claims 4-5.

Images