Code risk analysis method and device

Abstract

The invention discloses a code risk analysis method and device, and relates to the technical field of computers. A specific embodiment of the method comprises the steps of obtaining a high-risk function in a detection code; in response to data interaction required by the high-risk function, determining whether a risk statement exists in the high-risk function; wherein the risk statement is used for executing sensitive operation, and the risk statement uses a risk variable; the risk variable is used for storing data input by a user; in response to existence of the risk statement in the high-risk function, generating a calling relation link of the high-risk function; and determining a risk analysis result of the calling relation link according to the link feature data corresponding to the calling relation link. According to the embodiment, the risk analysis result of the business code can be accurately determined.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a code risk analysis method and apparatus. Background Technology

[0002] With increasing awareness of cybersecurity, more and more enterprises are prioritizing the security of their business systems. Related technologies typically employ traffic-based risk analysis and detection of business code. After acquiring traffic, fuzzing is used to inject a large number of random or abnormal requests into the business code to uncover potential vulnerabilities. However, this traffic-based analysis and detection method introduces a large amount of dirty data into the business code, impacting the normal operation of the business system. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a code risk analysis method and apparatus that eliminates the need to input large amounts of random or abnormal data into business code, reduces the impact on the operation of business systems, and can accurately determine the risk analysis results of business code.

[0004] In a first aspect, embodiments of the present invention provide a code risk analysis method, including: Identify high-risk functions in the detection code; In response to the need for data interaction in high-risk functions, it determines whether there are risky statements in the high-risk functions; where risky statements are used to perform sensitive operations and use risky variables; risky variables are used to store user input data; In response to the presence of risky statements in high-risk functions, a call relationship chain for the high-risk functions is generated; Based on the link characteristic data corresponding to the call relationship link, the risk analysis results of the call relationship link are determined.

[0005] Optionally, multiple risk analysis models are preset; these models include: vulnerability function analysis model, vulnerability scenario matching model, risk variable identification model, risk path extraction model, and vulnerability inference model. The vulnerability function analysis model is used to identify high-risk functions in the detected code; the vulnerability scenario matching model is used to determine whether high-risk functions need to perform data interaction; the risk variable identification model is used to determine whether there are risky statements in high-risk functions; the risk path extraction model is used to generate the call relationship chain of high-risk functions; and the vulnerability inference model is used to determine the risk analysis results of the call relationship chain.

[0006] Optionally, before obtaining high-risk functions in the detection code, the following steps are also included: Obtain the training code; Determine the code feature data corresponding to the training code; Identify the associated vulnerability data corresponding to the training code from the vulnerability knowledge base; For each risk analysis model, sample data corresponding to the risk analysis model is extracted from the code feature data and associated vulnerability data corresponding to the training code; the sample data is combined to generate training samples; and the risk analysis model is optimized and trained using the training samples.

[0007] Optionally, determine the code feature data corresponding to the training code, including: The training code is parsed to construct its syntax tree and obtain its call relationship data. Extract dependency injection data from the configuration file of the training code; Based on the syntax tree, call relationship data, and dependency injection data of the training code, generate the call relationship chain of the training code; Utilize large code models to extract code logic data from training code; Based on the syntax tree, call relationship data, call relationship chain, and code logic data of the training code, code feature data of the training code is generated.

[0008] Optionally, before determining the risk analysis results of the call relationship link based on the link characteristic data corresponding to the call relationship link, the following steps are also included: Determine whether there is improper use of variables and / or improper function calls in the call chain; improperly used variables are those that have not been filtered or validated before use; improperly called functions are those that pose contextual security risks when called. In response to the presence of improper use of variables and / or improper function calls in the call relationship chain, the steps are performed to determine the risk analysis results of the call relationship chain based on the chain feature data corresponding to the call relationship chain.

[0009] Optionally, after determining the risk analysis results of the call relationship chain based on the link characteristic data corresponding to the call relationship chain, the method further includes: Obtain the risk analysis results; the risk analysis results include: risk analysis conclusions; In response to the risk analysis conclusion that the call relationship chain indicates a call risk, the vulnerability triggering conditions and vulnerability functions in the risk analysis results are obtained; among them, the vulnerability triggering conditions include: the values ​​of the vulnerability input parameters and the values ​​of other input parameters; the vulnerability input parameters and other input parameters are all input parameters of the vulnerability function; Construct a virtual request based on the values ​​of the vulnerability input parameters and other input parameters; Use virtual requests to perform risk verification on the call relationship chain.

[0010] Optionally, the call chain of high-risk functions is generated, including: Obtain the input parameters, call relationship data, and code logic data of high-risk functions; Input the input parameters, call relationship data, and code logic data of high-risk functions into the risk path extraction model; Based on the risk path extraction model, the call relationship chain of high-risk functions is generated.

[0011] Secondly, embodiments of the present invention provide a code risk analysis device, comprising: The function retrieval module is used to identify high-risk functions in the detection code; The statement determination module is used to determine whether a high-risk function contains a risky statement in response to data interaction required by the high-risk function. The risky statement is used to perform sensitive operations and uses risk variables. The risk variables are used to store user input data. The link generation module is used to generate the call relationship link of high-risk functions in response to the presence of risky statements in high-risk functions; The result determination module is used to determine the risk analysis results of the call relationship link based on the link feature data corresponding to the call relationship link.

[0012] Thirdly, embodiments of the present invention provide an electronic device, including: One or more processors; A storage device for storing one or more programs that, when executed by one or more processors, cause the one or more processors to implement the methods of any of the above embodiments.

[0013] Fourthly, embodiments of the present invention provide a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the method of any of the above embodiments.

[0014] Fifthly, embodiments of the present invention provide a computer program product, including a computer program, wherein the computer program, when executed by a processor, implements the method of any of the above embodiments.

[0015] One embodiment of the above invention has the following advantages or beneficial effects: If a high-risk function requires data interaction, the user can input parameters into the high-risk function. If a risky statement exists in the high-risk function, the user can control the execution of sensitive operations by assigning values ​​to risky variables in the risky statement, thereby changing the normal execution logic of the detection code. Finally, based on the link characteristic data of the call relationship chain of the high-risk function, the risk analysis results of the business code can be accurately determined.

[0016] The detection code can be the business code within the business system that requires risk analysis. It eliminates the need to input large amounts of random or abnormal data into the business code, and the business code after risk analysis does not contain a large amount of dirty data, thus reducing the adverse impact on the operation of the business system.

[0017] Furthermore, the process involves first identifying high-risk functions in the detection code, then determining whether these functions require data interaction and whether they contain risky statements. By only performing risk analysis on the call chains of high-risk functions that meet the criteria, the scope of code analysis can be effectively reduced, improving the execution efficiency of the code risk analysis solution.

[0018] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0019] The accompanying drawings are provided to better understand the invention and are not intended to unduly limit the scope of the invention. Wherein: Figure 1 This is a schematic diagram of the flow of a code risk analysis method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the process of training a risk analysis model according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the flow of a code risk analysis method provided in another embodiment of the present invention; Figure 4 This is a schematic diagram of the structure of a risk analysis system provided in one embodiment of the present invention; Figure 5 This is a schematic diagram of the structure of a code risk analysis device provided in one embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers of the present invention. Detailed Implementation

[0020] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0021] It should be noted that the acquisition, storage, use, and processing of data in the technical solutions of this invention comply with the relevant provisions of national laws and regulations.

[0022] Figure 1 This is a schematic diagram illustrating the flow of a code risk analysis method provided in one embodiment of the present invention. Figure 1 As shown, the method includes: Step 101: Identify high-risk functions in the detection code.

[0023] High-risk functions are those that may pose execution risks. Functions involving database processing can be identified as high-risk. Functions without parameter filtering, parameter validation, or authentication are also considered high-risk. High-risk functions can also be manually designated.

[0024] In one embodiment of the present invention, a vulnerability function analysis model is used to obtain high-risk functions in the detection code. Specifically, code feature data of the detection code is obtained; the code feature data is input into the vulnerability function analysis model, and high-risk functions are obtained based on the output of the vulnerability function analysis model.

[0025] Code feature data for code analysis includes: code logic data, code concatenation data, and code structure analysis data. Code logic data refers to data related to the execution semantics and behavioral logic of the code. A large code model can be used to obtain this code logic data. The large code model is built upon a large language model. Code concatenation data includes: the function call network within the code, and cross-service / cross-file call chains. Code structure analysis data includes: the code's syntax tree, and static and syntactic structural information.

[0026] In one embodiment of the present invention, a large language model is used to identify filtering logic functions, authentication functions, verification functions, etc. from the detection code, and the above functions are identified as high-risk functions.

[0027] Step 102: In response to the need for data interaction in high-risk functions, determine whether there are risky statements in the high-risk functions.

[0028] Data interaction refers to the interaction between the high-risk function and the user. If the high-risk function needs to interact with data, the user can input parameters into the high-risk function, or the user can change the values ​​of the input parameters of the high-risk function by inputting parameters.

[0029] Risk statements are used to perform sensitive operations, and they utilize risk variables. These risk variables store user-input data. Sensitive operations can be configured according to specific needs. For example, sensitive operations could include adding, deleting, or modifying data in a database; adding, deleting, or modifying files; changing passwords; and modifying permissions.

[0030] If a high-risk function contains risky statements, users can control the execution of sensitive operations by assigning values ​​to risky variables, thereby altering the normal execution logic of the detection code.

[0031] Step 103: In response to the presence of risky statements in high-risk functions, generate the call relationship chain of high-risk functions.

[0032] A call chain is a link consisting of multiple functions that have a call relationship. A high-risk function is one of these multiple functions that have a call relationship.

[0033] A risk path extraction model can be used to generate the call relationship chain of high-risk functions. Specifically, the input parameters, call relationship data, and code logic data of high-risk functions are obtained; these data are then input into the risk path extraction model; and the call relationship chain of high-risk functions is generated based on the model.

[0034] Call relationship data includes: the network of inter-function calls and the cross-service / cross-file call chains involved in functions. Function logic data consists of data related to the execution semantics and behavioral logic of functions. A large code model can be used to obtain the function logic data of high-risk functions. A risk path extraction model can then be used to output the call relationship chains of high-risk functions.

[0035] Step 104: Determine the risk analysis results of the call relationship link based on the link feature data corresponding to the call relationship link.

[0036] Link feature data refers to the relevant characteristic data of the call relationship link. Link feature data includes: link logic data, link concatenation data, and link structure parsing data. Link logic data is the relevant data on the execution semantics and behavioral logic of the call relationship link. A large code model can be used to obtain the call relationship link. Link concatenation data includes: the network of function call relationships within the link. Link structure parsing data includes: the link's syntax tree, and static and syntactic structural information, etc.

[0037] The link characteristic data is input into the vulnerability inference model to obtain the risk analysis results. The risk analysis results include: risk analysis conclusions, vulnerability type, vulnerable function, and parameter attributes of the vulnerability input parameters. The vulnerable function is a function on the call chain. The vulnerable function is a function that may contain execution vulnerabilities. For example, a vulnerable function may be a function with no parameter filtering, no parameter validation, or no authentication.

[0038] If the risk analysis concludes that there is a risk in the call relationship chain, users may control or change the execution logic of the vulnerable function through the vulnerable input parameters, affecting the normal operation of the business system.

[0039] In the solution of this embodiment of the invention, if a high-risk function needs to interact with data, the user can input parameters to the high-risk function. Risk statements use risk variables and are used to perform sensitive operations. Finally, based on the link characteristic data of the call relationship chain of the high-risk function, the risk analysis results of the business code can be accurately determined. The detection code can be the business code in the business system that requires risk detection. The solution of this embodiment of the invention does not require inputting a large amount of random or abnormal data into the business code, thereby reducing the impact on the operation of the business system.

[0040] In one embodiment of the present invention, before determining the risk analysis result of the call relationship link based on the link feature data corresponding to the call relationship link, the method further includes: determining whether there is improper use of variables and / or improper function calling in the call relationship link; and in response to the existence of improper use of variables and / or improper function calling in the call relationship link, performing the step of determining the risk analysis result of the call relationship link based on the link feature data corresponding to the call relationship link.

[0041] Improper use of variables refers to variables that have not been filtered or validated before use. For example, a variable used to store a string of user input. If a function in the call chain does not filter or validate the variable and directly appends it to an SQL (Structured Query Language) statement, then the variable is considered improperly used.

[0042] An improperly invoked function is one whose call contains contextual security vulnerabilities. Contextual security vulnerabilities can be caused by the lack of permission checks, logical checks, etc. For example, if a call chain includes a first function and a second function, and the first function implements the "change password" function, and the second function does not verify the current user's permissions before calling the first function, then the second function is an improperly invoked function.

[0043] When there is improper use of variables and / or improper function calls in the call relationship chain, determining the risk analysis results of the call relationship chain can reduce the amount of data processed in the risk analysis and make the risk analysis results more accurate.

[0044] Multiple risk analysis models can be preset. These models include: a vulnerability function analysis model, a vulnerability scenario matching model, a risk variable identification model, a risk path extraction model, a risk attribute identification model, and a vulnerability inference model. The vulnerability function analysis model is used to identify high-risk functions in the detection code. The vulnerability scenario matching model is used to determine whether high-risk functions require data interaction. The risk variable identification model is used to determine whether high-risk functions contain risk variables and / or risky statements. The risk path extraction model is used to generate call relationship chains. The risk attribute identification model is used to determine whether there is improper use of variables and / or improper function calls in the call relationship chains. The vulnerability inference model is used to determine the risk analysis results.

[0045] Before using risk analysis models, each risk analysis model needs to be optimized and trained. Figure 2 This is a schematic diagram illustrating the flow of a risk analysis model training method according to an embodiment of the present invention. Figure 2 As shown, the method includes: Step 201: Obtain the training code.

[0046] Step 202: Determine the code feature data corresponding to the training code.

[0047] The code feature data of the training code includes: code logic data, code concatenation data, and code structure parsing data. The code logic data of the training code consists of data related to the execution semantics and behavioral logic of the training code. A large code model can be used to obtain the code logic data of the training code. The code concatenation data of the training code includes: the function call relationship network in the training code, and the cross-service / cross-file call chain in the training code. The code structure parsing data includes: the syntax tree of the training code, and the static and syntactic structural information of the training code, etc.

[0048] Step 203: Identify the associated vulnerability data corresponding to the training code from the vulnerability knowledge base.

[0049] The vulnerability knowledge base stores multiple vulnerability knowledge records. These records include: tainted parameters, vulnerability types, cleansing functions, vulnerable code snippets, and vulnerability descriptions. Associated vulnerability data corresponding to training code can be manually identified from the vulnerability knowledge base. This associated vulnerability data includes: tainted parameters, vulnerability types, etc.

[0050] Step 204: For each risk analysis model, extract the sample data corresponding to the risk analysis model from the code feature data and associated vulnerability data corresponding to the training code.

[0051] The vulnerability function analysis model is used to identify high-risk functions in code. It involves determining the vulnerability type corresponding to the training code, and then extracting the high-risk functions corresponding to that vulnerability type from the training code. The sample data for the vulnerability function analysis model includes: code feature data of the training code, vulnerability type, and high-risk functions.

[0052] The vulnerability scenario matching model is used to determine whether a function needs data interaction. The sample data for the vulnerability scenario matching model includes: the code logic data of the training code, the input parameters, and whether interaction is required.

[0053] The risk variable identification model is used to determine whether risk variables and / or risky statements exist in a function. It identifies the vulnerability type corresponding to the training code and extracts risk variables and risky statements from the training code. The sample data corresponding to the risk variable identification model includes: code feature data of the training code, vulnerability type, presence of risky statements, risk variables, and risky statements.

[0054] The risk path extraction model is used to generate call relationship chains. The sample data for the risk path extraction model includes: code logic data, code structure parsing data, function call relationship networks, and call relationship chains. Alternatively, the sample data for the risk path extraction model may include: function logic data, function input parameters, call relationship data, and call relationship chains.

[0055] The risk attribute identification model is used to determine whether there is improper use of variables and / or improper function calls in the call chain. It identifies the vulnerability type corresponding to the training code. The model extracts the improperly used variables or improperly called functions corresponding to the vulnerability types from the training code. The sample data for the risk attribute identification model includes: code feature data of the training code, vulnerability types, improperly used variables, and improperly called functions.

[0056] The vulnerability inference model is used to determine the risk analysis results. It determines whether the training code contains vulnerabilities corresponding to the vulnerability type. If the training code contains vulnerabilities corresponding to the vulnerability type, the risk analysis conclusion is affirmative. From the training code, it identifies the vulnerable functions and parameter attributes of the vulnerability input parameters corresponding to the vulnerability type. It also identifies the call relationship chain and chain characteristic data corresponding to the vulnerable functions. Finally, it combines the risk analysis conclusion, chain characteristic data, vulnerability type, vulnerable functions, and parameter attributes of the vulnerability input parameters to generate training samples.

[0057] Step 205: Combine sample data to generate training samples; use the training samples to optimize and train the risk analysis model.

[0058] In the process of optimizing and training the risk analysis model, in addition to generating training samples using the vulnerability knowledge base, corresponding training samples can also be generated based on general knowledge and code knowledge.

[0059] General knowledge includes: non-specific natural language text data, such as web pages, books, and articles. Training a risk analysis model using training samples corresponding to general knowledge enables the model to possess basic language understanding, logical reasoning, and common sense abilities. Code knowledge includes: open-source code libraries for various programming languages. Training a risk analysis model using training samples corresponding to code knowledge enables the model to learn code syntax, structure, common programming paradigms, and design patterns.

[0060] In one embodiment of the present invention, determining the code feature data corresponding to the training code includes: parsing the training code to construct a syntax tree of the training code and obtaining the call relationship data of the training code; extracting dependency injection data from the configuration file of the training code; generating a call relationship chain of the training code based on the syntax tree, call relationship data and dependency injection data of the training code; extracting the code logic data of the training code using a large code model; and generating the code feature data of the training code based on the syntax tree, call relationship data, call relationship chain and code logic data of the training code.

[0061] Using compilation tools, the training code is parsed to construct its syntax tree and obtain call relationship data. The call relationships between methods in the training code are traced, identifying interface implementations and abstract class inheritance relationships. The configuration file of the training code is parsed to extract dependency injection data. The syntax tree, call relationship data, and dependency injection data are then input into the SAST (Static Application Security Testing) tool to obtain the call relationship chain of the training code. Using a large code model, the code logic data and cross-service call chains of the training code are extracted. Finally, the above feature data of the training code are combined to generate the code feature data of the training code.

[0062] Figure 3 This is a schematic diagram of the flow of a code risk analysis method provided in another embodiment of the present invention. Figure 3 As shown, the method includes: Step 301: Obtain high-risk functions in the detection code.

[0063] Step 302: In response to the need for data interaction in high-risk functions, determine whether there are risky statements in the high-risk functions.

[0064] Step 303: In response to the presence of risky statements in high-risk functions, generate the call relationship chain of high-risk functions.

[0065] Step 304: Determine the risk analysis results of the call relationship link based on the link feature data corresponding to the call relationship link.

[0066] Step 305: Obtain the risk analysis results; whereby the risk analysis results include: risk analysis conclusions.

[0067] Risk analysis conclusions are used to characterize whether there are risks in the call relationship chain. Risk analysis results may also include: vulnerable functions, vulnerability triggering conditions, and preset results, etc.

[0068] Step 306: In response to the risk analysis conclusion that the call relationship chain indicates a call risk, obtain the vulnerability triggering conditions and vulnerable functions from the risk analysis results.

[0069] The vulnerability triggering conditions include: vulnerability input parameter information and other input parameter information. Vulnerability input parameter information includes: the vulnerability input parameter, its value, and its data type. Other input parameter information includes: other input parameters, their values, and their data types. Both the vulnerability input parameter and other input parameters are parameters of the vulnerable function.

[0070] Step 307: Construct a virtual request based on the values ​​of the vulnerability input parameters and other input parameters.

[0071] Step 308: Use virtual requests to verify the risks of the call relationship chain.

[0072] Users may control or alter the processing logic of vulnerability parameter calls by assigning values ​​to vulnerability input parameters. A virtual request, using the values ​​of the vulnerability parameter and other input parameters as input parameters, is sent to the vulnerability parameter to obtain the output results of the vulnerability parameter or the call chain. The output results are compared with preset results. The preset results are determined from the risk analysis results. The vulnerable function is then called. If the output results match the preset results, it is determined that the call chain has a vulnerability risk. If the output results do not match the preset results, it is determined that the call chain does not have a vulnerability risk or that the call chain is a risk-determined chain.

[0073] Figure 4 This is a schematic diagram of the structure of a risk analysis system provided in one embodiment of the present invention. Figure 4 As shown, the solution of this invention mainly consists of three parts: training data processing, model fine-tuning, and capability integration and interaction. First, code snippets, comments, entity classes, input parameters, and configuration files of the training code are obtained. Then, an abstract syntax tree is constructed by parsing the training code to deeply analyze the code structure. Next, the configuration files of the training code are parsed to extract dependency injection data. Finally, the code logic data of the training code is understood through a large language model. The above feature data of the training code are combined to generate code feature data for the training code. Finally, the code feature data is constructed through a vulnerability function analysis model to improve the focus of code risk detection.

[0074] By mapping code feature data to vulnerable code snippets, tainted parameters, vulnerability types, and cleanup functions in the vulnerability knowledge base, training samples are generated based on the code feature data corresponding to the training code and associated vulnerability data. Using fine-tuning methods, the risk analysis model is optimized and trained using these training samples. The risk analysis model is used to accurately analyze and determine the risks in the detection code. The risk analysis model interacts with the fine-tuned larger code model to obtain high-risk functions. The risk analysis model further identifies key variables and statements within these high-risk functions and infers whether vulnerabilities exist in the detection code.

[0075] Figure 5 This is a schematic diagram of the structure of a code risk analysis device provided in one embodiment of the present invention. Figure 5 As shown, the device includes: Function acquisition module 501 is used to acquire high-risk functions in the detection code; The statement determination module 502 is used to determine whether there are risky statements in a high-risk function in response to the need for data interaction. The risky statement is used to perform sensitive operations and uses risky variables. The risky variables are used to store user input data. The link generation module 503 is used to generate a call relationship link of a high-risk function in response to the presence of risky statements in the high-risk function. The result determination module 504 is used to determine the risk analysis result of the call relationship link based on the link feature data corresponding to the call relationship link.

[0076] Optionally, multiple risk analysis models are preset; these models include: vulnerability function analysis model, vulnerability scenario matching model, risk variable identification model, risk path extraction model, and vulnerability inference model. The vulnerability function analysis model is used to identify high-risk functions in the detected code; the vulnerability scenario matching model is used to determine whether high-risk functions need to perform data interaction; the risk variable identification model is used to determine whether there are risky statements in high-risk functions; the risk path extraction model is used to generate the call relationship chain of high-risk functions; and the vulnerability inference model is used to determine the risk analysis results of the call relationship chain.

[0077] Optionally, the device further includes: The training module is used to obtain the training code; Determine the code feature data corresponding to the training code; Identify the associated vulnerability data corresponding to the training code from the vulnerability knowledge base; For each risk analysis model, sample data corresponding to the risk analysis model is extracted from the code feature data and associated vulnerability data corresponding to the training code; the sample data is combined to generate training samples; and the risk analysis model is optimized and trained using the training samples.

[0078] Optionally, the training module is specifically used for: The training code is parsed to construct its syntax tree and obtain its call relationship data. Extract dependency injection data from the configuration file of the training code; Based on the syntax tree, call relationship data, and dependency injection data of the training code, generate the call relationship chain of the training code; Utilize large code models to extract code logic data from training code; Based on the syntax tree, call relationship data, call relationship chain, and code logic data of the training code, code feature data of the training code is generated.

[0079] Optionally, it also includes: The attribute identification module is used to determine whether there is improper use of variables and / or improper function calls in the call relationship chain; improperly used variables are variables that have not been filtered or validated before use; improperly called functions are functions that have context security risks when called. In response to the presence of improper use of variables and / or improper function calls in the call relationship chain, the steps are performed to determine the risk analysis results of the call relationship chain based on the chain feature data corresponding to the call relationship chain.

[0080] Optionally, the device further includes: Obtain the risk analysis results; the risk analysis results include: risk analysis conclusions; In response to the risk analysis conclusion that the call relationship chain indicates a call risk, the vulnerability triggering conditions and vulnerability functions in the risk analysis results are obtained; among them, the vulnerability triggering conditions include: the values ​​of the vulnerability input parameters and the values ​​of other input parameters; the vulnerability input parameters and other input parameters are all input parameters of the vulnerability function; Construct a virtual request based on the values ​​of the vulnerability input parameters and other input parameters; Use virtual requests to perform risk verification on the call relationship chain.

[0081] Optionally, the link generation module 503 is specifically used for: Obtain the input parameters, call relationship data, and code logic data of high-risk functions; Input the input parameters, call relationship data, and code logic data of high-risk functions into the risk path extraction model; Based on the risk path extraction model, the call relationship chain of high-risk functions is generated.

[0082] This invention provides an electronic device, comprising: One or more processors; A storage device for storing one or more programs that, when executed by one or more processors, cause the one or more processors to implement the methods of any of the above embodiments.

[0083] This invention provides a computer program product, including a computer program that, when executed by a processor, implements the method of any of the above embodiments.

[0084] The following is for reference. Figure 6 It shows a schematic diagram of the structure of a computer system 600 suitable for implementing a terminal device of the present invention. Figure 6 The terminal device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0085] like Figure 6 As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 602 or programs loaded from storage section 608 into random access memory (RAM) 603. The RAM 603 also stores various programs and data required for the operation of the system 600. The CPU 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0086] The following components are connected to I / O interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to I / O interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 610 as needed so that computer programs read from it can be installed into storage section 608 as needed.

[0087] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 609, and / or installed from removable medium 611. When the computer program is executed by central processing unit (CPU) 601, it performs the functions defined above in the system of this invention.

[0088] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0089] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0090] The modules described in the embodiments of the present invention can be implemented in software or hardware. The described modules can also be located in a processor, and for example, can be described as: a function acquisition module, a statement determination module, a link generation module, and a result determination module. The names of these modules do not necessarily limit the module itself; for example, the function acquisition module can also be described as "a module for acquiring high-risk functions in the detection code".

[0091] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs, which, when executed by the device, cause the device to include: Identify high-risk functions in the detection code; In response to the need for data interaction in high-risk functions, it determines whether there are risky statements in the high-risk functions; where risky statements are used to perform sensitive operations and use risky variables; risky variables are used to store user input data; In response to the presence of risky statements in high-risk functions, a call relationship chain for the high-risk functions is generated; Based on the link characteristic data corresponding to the call relationship link, the risk analysis results of the call relationship link are determined.

[0092] According to the technical solution of this embodiment of the invention, if a high-risk function requires data interaction, the user can input parameters to the high-risk function. Risk statements use risk variables and are used to perform sensitive operations. If a high-risk function contains risk statements, the user can control the execution of sensitive operations by assigning values ​​to risk variables, thereby changing the normal execution logic of the detection code and adversely affecting the business system. Finally, based on the link characteristic data of the call relationship chain of the high-risk function, the risk analysis results of the business code can be accurately determined. The detection code can be the business code in the business system that requires risk detection. The solution of this embodiment of the invention does not require inputting a large amount of random or abnormal data into the business code, thereby reducing the impact on the operation of the business system.

[0093] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A code risk analysis method, characterized in that, include: Identify high-risk functions in the detection code; In response to the need for data interaction in the high-risk function, it is determined whether there is a risky statement in the high-risk function; wherein the risky statement is used to perform sensitive operations, and the risky statement uses a risky variable; the risky variable is used to store user-input data; In response to the presence of the risky statement in the high-risk function, a call relationship chain for the high-risk function is generated; Based on the link feature data corresponding to the call relationship link, the risk analysis result of the call relationship link is determined.

2. The method according to claim 1, characterized in that, Multiple risk analysis models are preset; these multiple risk analysis models include: vulnerability function analysis model, vulnerability scenario matching model, risk variable identification model, risk path extraction model, and vulnerability inference model; The vulnerability function analysis model is used to identify high-risk functions in the detected code; the vulnerability scenario matching model is used to determine whether high-risk functions need to perform data interaction; the risk variable identification model is used to determine whether there are risky statements in high-risk functions; the risk path extraction model is used to generate the call relationship chain of high-risk functions; and the vulnerability reasoning model is used to determine the risk analysis results of the call relationship chain.

3. The method according to claim 1, characterized in that, Before obtaining the high-risk functions in the detection code, the process also includes: Obtain the training code; Determine the code feature data corresponding to the training code; The associated vulnerability data corresponding to the training code is determined from the vulnerability knowledge base; For each risk analysis model, sample data corresponding to the risk analysis model is extracted from the code feature data and associated vulnerability data corresponding to the training code; the sample data is combined to generate training samples; and the risk analysis model is optimized and trained using the training samples.

4. The method according to claim 3, characterized in that, Determining the code feature data corresponding to the training code includes: The training code is parsed to construct a syntax tree for the training code and to obtain the call relationship data of the training code. Extract dependency injection data from the configuration file of the training code; Based on the syntax tree, call relationship data, and dependency injection data of the training code, generate the call relationship chain of the training code; Using a large code model, extract the code logic data from the training code; Based on the syntax tree, call relationship data, call relationship chain, and code logic data of the training code, code feature data of the training code is generated.

5. The method according to claim 1, characterized in that, Before determining the risk analysis result of the call relationship link based on the link feature data corresponding to the call relationship link, the method further includes: Determine whether there is improper use of variables and / or improper function calls in the call chain; wherein, improperly used variables are variables that have not been filtered or validated before use; improperly called functions are functions that have context security vulnerabilities when called; In response to the presence of improper use of variables and / or improper function calls in the call relationship chain, the step of determining the risk analysis result of the call relationship chain based on the link feature data corresponding to the call relationship chain is executed.

6. The method according to claim 1, characterized in that, After determining the risk analysis result of the call relationship link based on the link feature data corresponding to the call relationship link, the method further includes: Obtain the risk analysis results; wherein, the risk analysis results include: risk analysis conclusions; In response to the risk analysis conclusion indicating that the call relationship chain has a call risk, the vulnerability triggering conditions and vulnerability functions in the risk analysis results are obtained; wherein, the vulnerability triggering conditions include: the values ​​of the vulnerability input parameters and the values ​​of other input parameters; the vulnerability input parameters and the other input parameters are all input parameters of the vulnerability function; Based on the values ​​of the vulnerability input parameters and the values ​​of the other input parameters, construct a virtual request; The virtual request is used to perform risk verification on the call relationship chain.

7. The method according to claim 1, characterized in that, The call chain that generates the high-risk function includes: Obtain the input parameters, call relationship data, and code logic data of the high-risk function; The input parameters, call relationship data, and code logic data of the high-risk function are input into the risk path extraction model; Based on the risk path extraction model, the call relationship chain of the high-risk function is generated.

8. A code risk analysis device, characterized in that, include: The function retrieval module is used to identify high-risk functions in the detection code; The statement determination module is used to determine whether a risky statement exists in the high-risk function in response to the need for data interaction; wherein the risky statement is used to perform a sensitive operation, and the risky statement uses a risk variable; the risk variable is used to store user-input data; The link generation module is used to generate the call relationship link of the high-risk function in response to the presence of the risky statement in the high-risk function; The result determination module is used to determine the risk analysis result of the call relationship link based on the link feature data corresponding to the call relationship link.

9. An electronic device, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-7.

10. A computer-readable medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-7.

11. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1-7.

Images