Open source environment software hidden vulnerability patch identification method and device

Abstract

The invention discloses an open source environment software hidden vulnerability patch identification method, which is based on a multi-stage architecture and collaborative relationship modeling, and provides a new patch group identification scheme: firstly, obtaining candidate code submission from an open source warehouse, extracting correlation characteristics of vulnerabilities and candidate code submission, including rule-based characteristics and semantic characteristics, calculating a correlation score and screening high-correlation submission; pairwise pairing the high-correlation submissions, and fusing multi-dimensional features to predict a cooperative relationship between the submissions; and finally, constructing an undirected graph based on the correlation score, dividing a maximum connected sub-graph, fusing the features in the group through maximum pooling, calculating the correlation with the vulnerability, and outputting an optimal patch group. Meanwhile, an existing patch identification technology based on sorting learning is combined, an enhancement method based on a submission cooperative relation is provided, ranking logic submitted by candidate codes is updated through internal association between code submission and by means of correlation between group vectors and vulnerabilities, and the identification precision in a multi-patch scene is improved.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a hidden vulnerability patch identification tool based on a large language model, specifically a method and apparatus for identifying hidden vulnerability patches in open-source software environments. Background Technology

[0002] In ensuring the security of the software supply chain, vulnerability management of open-source software (OSS) is a crucial aspect. Generally, OSS vulnerability management comprises three phases: vulnerability disclosure, patch identification, and vulnerability remediation. Among these phases, patch identification requires the most time and resources. Furthermore, because patch identification must be completed before vulnerability remediation, it holds a vital position in the OSS vulnerability management process. However, manually identifying vulnerability patches from massive amounts of code commits is time-consuming and labor-intensive. Therefore, automating and improving the effectiveness of hidden vulnerability patch identification to better assist downstream developers and security maintainers in shortening vulnerability remediation cycles is essential. Researchers have conducted numerous studies in the field of automated hidden vulnerability patch identification and proposed various patch identification technologies. These technologies include rule-based matching, semantic association, and ranking learning-based patch identification techniques. These technologies typically utilize vulnerability information from public security platforms and code commit information from open-source repositories to output a list of "suspicious" code commits. This allows maintainers to quickly focus their attention on specific code commits rather than examining the entire history of the code repository, thereby improving their productivity.

[0003] Among these patch identification technologies, ranking-based patch identification technology has the largest research share. This technology uses two core types of information to determine the ranking of code submissions: vulnerability information disclosed by public security platforms (such as CVE descriptions and CWE types) and code repository submission information (such as submission descriptions and code change details). Vulnerability information refers to structured and unstructured content such as the cause, scope of impact, and technical details of the vulnerability, while code submission information typically refers to the submission's metadata (author, time) and code modification details (added / deleted lines of code, affected files). Ranking-based patch identification technology usually uses machine learning models to calculate the suspiciousness of submissions based on the correlation features between vulnerabilities and submissions, and then ranks them according to their suspiciousness to identify the code submissions most likely to be vulnerability patches. This allows maintainers to start verifying submissions with high suspiciousness. Popular models include RankNet, Multilayer Perceptron (MLP), and pre-trained language models (such as BERT and CodeReviewer).

[0004] In ranking-based patch identification techniques, a correlation matrix is ​​typically constructed using multi-dimensional features of vulnerabilities and submissions. By calculating the degree of matching between each submission and the vulnerability under different feature dimensions, a matrix of the correlation between submissions and vulnerabilities can be obtained. Ranking-based patch identification techniques then analyze this matrix to locate the patches corresponding to the vulnerabilities. To improve the identification effect of this technique, a series of submission feature extraction methods have been proposed, all of which calculate the suspiciousness based on the one-way correlation between vulnerabilities and submissions. However, relying solely on one-way correlation information is often insufficient to select multiple patches from numerous submissions. Several factors can significantly affect the identification results. For example, when one-way correlation information cannot adequately distinguish multiple patches that collaboratively fix vulnerabilities, the reliability of ranking-based patch identification techniques will be affected. When there are a large number of submissions that are similar to the vulnerability description but are not patches, or collaborative patches with significantly different patch features, too many submissions may be misdiagnosed as suspicious patches, or key collaborative patches may be missed. Some collaborative patches used to fix the same vulnerability may have different degrees of one-way correlation strength with the vulnerability, making some patches less suspicious than submissions that are only superficially related to the vulnerability but are not patches.

[0005] Therefore, the accuracy of ranking-based patch identification technology needs further improvement. The main reason affecting its accuracy is that for code submissions with similar unidirectional correlation strength to vulnerabilities but exhibiting collaborative relationships, ranking-based patch identification technology can only assign them similar risk values, failing to reflect their collaborative remediation value. Although researchers have mitigated this problem by introducing information such as code change semantics, cross-submission reference relationships, and project development history, research on the inherent collaborative relationships between code submissions remains lacking. Studies have shown that 41% of vulnerabilities in the real-world open-source ecosystem require multiple patches for collaborative remediation. Therefore, incorporating collaborative correlation information between submissions into ranking-based patch identification technology is a worthwhile approach to enhance its effectiveness. How to design a hidden vulnerability patch identification method capable of capturing submission collaborative relationships is an important issue. Summary of the Invention

[0006] To address the issues of low identification accuracy and lack of utilization of patch collaboration relationships in existing technologies for multi-patch scenarios, this invention provides a method for identifying hidden vulnerability patches in open-source software environments. Based on a multi-stage architecture and collaboration relationship modeling, it enables the identification of hidden vulnerability patches in multi-patch scenarios and enhances traditional patch identification based on unidirectional associations by utilizing the collaborative associations between submissions.

[0007] According to one aspect of the present invention, a method for identifying hidden vulnerability patches in open-source environment software is provided, comprising: For a given vulnerability and candidate code submissions, the correlation features between the vulnerability and the candidate code submissions are extracted. The correlation features include rule-based features and semantic features. The correlation score between the vulnerability and each candidate code submission is calculated based on the two types of features. The submissions are sorted in descending order of the scores and the top-ranked highly correlated code submissions are selected. Highly relevant code submissions are paired up to form submission pairs. Multi-dimensional features of each submission pair are extracted. These multi-dimensional features include features generated by a large model, rule-based features, and semantic features. The multi-dimensional features are input into a relevance prediction model to calculate the relevance score of the submission pair, which indicates whether the two submissions are collaborative patches for the same vulnerability. An undirected graph is constructed based on the correlation score. The undirected graph is divided into multiple maximum connected subgraphs as candidate submission groups. The code submission features in each candidate submission group are fused by max pooling to obtain the group vector representation. The correlation between the group vector and the vulnerability is calculated. The candidate submission group with the highest correlation is selected as the patch group corresponding to the vulnerability and output.

[0008] As a further technical solution, the rule-based features include: code modification scale features, matching relationship features, time interval features, location information features, and text similarity features.

[0009] As a further technical solution, the expression for calculating the correlation score is as follows: , MLP stands for Multilayer Perceptron. This is a vector concatenation operation. For rule-based features, For semantic features, The score represents the relevance score; a higher score indicates a stronger correlation between the candidate code submission and the vulnerability.

[0010] As a further technical solution, multi-dimensional features of each submission pair are extracted, including: Extract rule-based features for each submission pair: ,in, These are the 1st, 2nd, ..., 30th dimension feature vectors; Extract the large model-generated features for each submission pair: ,in, , , These are the TF-IDF vector cosine similarity of the two submissions, the number of identical tokens in the two submissions, and the percentage of identical tokens. Extract the semantic features of each submission pair: Where CLS is the sequence start identifier and SEP is the delimiter. , For submission Description and summary, , For submission Description and summary.

[0011] As a further technical solution, the correlation prediction model is a multilayer perceptron, and the prediction formula is: , in, This is the encoding vector for the large model's prediction of whether a submission is a vulnerability patch; The relevance score is given to the submission pair. A higher score indicates a greater probability that the two submissions are collaborative patches for the same vulnerability.

[0012] As a further technical solution, an undirected graph is constructed based on the correlation score, including: Let the set of highly relevant code submissions be: , in A positive integer, representing the total number of highly relevant code submissions. ; The relevance score matrix of the submitted pairs is as follows: , in, Indicates code submission and The relevance score, All are positive integers, and their values ​​range from 1 to 2. ; Construct an undirected graph ,in , The threshold value is used.

[0013] As a further technical solution, the correlation between the group vector and the vulnerability is calculated as follows: , in, It is obtained by concatenating the rule feature vector and semantic feature vector of the vulnerability. For group vectors, Cosine is the cosine similarity calculation function.

[0014] According to one aspect of the present invention, a device for identifying hidden vulnerability patches in open-source environment software is provided, comprising: The first main module is used to extract the correlation features between a given vulnerability and candidate code submissions. The correlation features include rule-based features and semantic features. Based on the two types of features, the correlation score between the vulnerability and each candidate code submission is calculated, and the submissions are sorted in descending order of the scores and the top-ranked highly correlated code submissions are selected. The second main module is used to pair up the highly relevant code submissions to form submission pairs, extract multi-dimensional features for each submission pair, including features generated by a large model, rule-based features and semantic features, and input the multi-dimensional features into the relevance prediction model to calculate the relevance score of the submission pair, which represents whether the two submissions are collaborative patches for the same vulnerability. The third main module is used to construct an undirected graph based on the correlation score, divide the undirected graph into multiple maximum connected subgraphs as candidate submission groups, perform maximum pooling fusion on the code submission features in each candidate submission group to obtain a group vector representation, calculate the correlation between the group vector and the vulnerability, select the candidate submission group with the highest correlation as the patch group corresponding to the vulnerability and output it.

[0015] According to one aspect of the present invention, an open-source environment software hidden vulnerability patch identification device is provided, including a memory and a processor. The memory stores program instructions that are executed by the processor, and the processor invokes the program instructions to execute the open-source environment software hidden vulnerability patch identification method.

[0016] According to one aspect of the present invention, a non-transitory computer-readable storage medium is provided, the non-transitory computer-readable storage medium storing computer instructions that cause the computer to execute the open-source environment software hidden vulnerability patch identification method.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention provides a method for identifying hidden vulnerability patches in multi-patch scenarios. It offers a patch identification scheme based on multi-stage architecture and collaborative relationship modeling, and enhances traditional unidirectional association-based patch identification techniques by using collaborative relationships between commits. Compared to traditional patch identification methods, where the reliability of ranking-based patch identification is affected when unidirectional association information cannot adequately distinguish between collaborative patches and non-patch commits, this invention uses collaborative relationships between code commits to enhance the accuracy of patch identification and combines unidirectional association between vulnerabilities and commits to assist in localization. This method improves the identification accuracy of ranking-based patch identification techniques, solves the problems of traditional techniques ignoring commit collaboration relationships and poor identification performance in multi-patch scenarios, and improves its localization effect and stability in the actual open-source ecosystem. This invention ultimately forms a complete method for identifying hidden vulnerability patches in multi-patch scenarios. Users can utilize this method to achieve efficient automated patch identification and apply it to open-source software vulnerability repair and security maintenance in actual production. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart of the method provided in an embodiment of the present invention;

[0020] Figure 2 This is a schematic diagram illustrating the definition of the rule features in step 1 of this embodiment of the invention;

[0021] Figure 3 This is a schematic diagram illustrating the rule-based feature and semantic feature extraction and splicing process in step 1 of this embodiment of the invention;

[0022] Figure 4 This is a schematic diagram illustrating the definition of rule features in step 2 of this embodiment of the invention;

[0023] Figure 5 This is a schematic diagram of multi-dimensional feature fusion in step 3 of the present invention;

[0024] Figure 6 This is a schematic diagram of the maximum pooling process in step 3 of an embodiment of the present invention.

[0025] Figure 7 This is a schematic diagram illustrating the code submission feature in step 3 of an embodiment of the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. In addition, the technical features of the various embodiments or individual embodiments provided by the present invention can be arbitrarily combined to form new technical solutions. Such combinations are not bound by the order of steps and / or structural composition patterns, but must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0027] Figure 1 This is a flowchart of the method of the present invention. The following is in conjunction with... Figures 1 to 6 The specific implementation of this invention is a hidden vulnerability patch identification tool for multi-patch scenarios, including the following steps:

[0028] Step 1: Initial sorting. For a given vulnerability and candidate code submission, extract the correlation features between the vulnerability and candidate code submission, including rule-based features and semantic features. Calculate the correlation score between the vulnerability and each candidate code submission based on the features, sort them in descending order of the score, and filter the top-ranked highly relevant code submissions.

[0029] The rule-based features mentioned in step 1 specifically include: Code modification scale characteristics include: the number of lines of code added in code commits (Added Line Num), the number of lines of code deleted (Deleted Line Num), and the total number of modified lines of code (Modified Line Num); Matching relationship features include: the number of CVE IDs (CVE Num), Bug IDs (Bug Num), and Issue IDs (Issue Num) mentioned in the code submission description; whether the code submission mentions the CVE ID (CVEMatch), Issue ID (Issue Match), and CWE type name (CWE Match) from the NVD page; and the triplet correlation between the vulnerability description and the code submission (Vulnerability Type Relevance). Time interval characteristic: the interval between code submission time and vulnerability disclosure time; Location information features include the number and proportion of identical file paths (SameFilepath Num, Same Filepath Ratio) and the number of unrelated file paths (Unrelated Filepath Num) in code submissions and vulnerability descriptions; the number and proportion of identical files (Same File Num, Same File Ratio) and the number of unrelated files (Unrelated File Num); and the number and proportion of identical functions (Same Function Num, Same Function Ratio) and the number of unrelated functions (Unrelated Function Num). Text similarity features include: TF-IDF vector cosine similarity between vulnerability descriptions and code submission descriptions; the number and percentage of identical tokens in the code submission description and vulnerability CWE type name, vulnerability descriptions; the maximum term frequency, sum, mean, and variance of identical tokens; the number and percentage of identical tokens in the code submission changes and vulnerability descriptions; and the maximum term frequency, sum, mean, and variance of identical tokens.

[0030] Among the relevance features described in step 1, the rule-based features consist of five categories and a total of 38-dimensional feature vectors: , The definition of each feature dimension is as follows: Figure 2 As shown.

[0031] The semantic features are extracted as follows: the original submission descriptions of the two code submissions are concatenated with the summaries generated by the large language model, a SEP separator is added between the concatenation results, and a CLS identifier is added at the beginning of the sequence. After being input into the RoBERTa pre-trained model, the sequence is passed through a fully connected layer to obtain a 32-dimensional semantic feature vector.

[0032] The large language model uses DeepSeek-V3, which inputs the code submission description, code change content, and preset prompt words into the model to generate a code submission summary, which is used to supplement text similarity class features.

[0033] The formula for extracting semantic feature vectors is:

[0034] , in, For vulnerability description text, Submit a description text for the code. Submit changes to the code; the RoBERTa model outputs a 1024-dimensional vector, while the CodeReviewer model outputs a 786-dimensional vector; the FC (Fully Connected) layer consists of two fully connected layers (with ReLU activation function), mapping the two types of vectors to 32 dimensions respectively; The vector concatenation operation ultimately yields a 64-dimensional semantic feature vector: .

[0035] The correlation score calculation method in step 1 is as follows: , The MLP is a 3-layer multilayer perceptron (102-dimensional input layer, 64-dimensional hidden layer, 32-dimensional hidden layer, and 1-dimensional output layer), with ReLU activation function and Sigmoid function for the output layer. The relevance score (range [0,1]) indicates the stronger the correlation between the candidate code submission and the vulnerability.

[0036] Step 1: The set of highly relevant code submissions is as follows: , in, To be according to The collection of submissions that are sorted in descending order and then filtered to get the highest ranking. To filter the quantity, Submit a single highly relevant piece of code.

[0037] In one embodiment, the rule-based feature and semantic feature extraction and concatenation process is as follows: Figure 3 As shown.

[0038] Step 2: Pair the highly relevant code submissions selected in Step 1 to form submission pairs. Extract multi-dimensional features (large model generated features, rule-based features, semantic features) for each submission pair. Input the features into the relevance prediction model to calculate the relevance score of the submission pair. This score indicates whether the two submissions are collaborative patches for the same vulnerability and captures the inherent collaborative relationship between the submissions.

[0039] The set of submissions mentioned in step 2 is: , in, Submit a set of pairs of highly relevant code. =50 hours Contains 1225 commit pairs, , For highly relevant code submissions, , It is a positive integer.

[0040] The multi-dimensional features mentioned in step 2 include features generated by the large model, rule-based features, and semantic features, among which the rule-based features are four categories of feature vectors totaling 30 dimensions: , The definition of each feature dimension is as follows: Figure 4 As shown.

[0041] The large model generates features using the DeepSeek-V3 model: , in , , The formulas for generating submission summaries are as follows: TF-IDF vector cosine similarity between the two submission summaries, the number of identical tokens in the two summaries, and the percentage of identical tokens. , in Preset prompt words; The formula for extracting semantic feature vectors is:

[0042] , Where CLS is the sequence start identifier and SEP is the delimiter. , For submission Description and summary, , For submission Description and summary; the RoBERTa model output vector is mapped through a fully connected layer to obtain a 32-dimensional semantic feature vector: .

[0043] The relevance prediction model described in step 2 is a multilayer perceptron. It takes a 30-dimensional rule-based feature vector, a 32-dimensional semantic feature vector, and the prediction results (yes / no / unknown) of whether the code submission is a vulnerability patch from the large language model as input into the model, and outputs a relevance score in the range of 0 to 1. The higher the score, the more likely the two code submissions are to be used to fix the same vulnerability.

[0044] The prediction formula is: , in, This is the encoding vector for the prediction result of whether a submission is a vulnerability patch in the large model; the MLP has a 3-layer structure (65-dimensional input layer, 64-dimensional hidden layer, 32-dimensional hidden layer, and 1-dimensional output layer), the activation function is ReLU, and the output layer uses the Sigmoid function. The relevance score (range [0,1]) indicates that the higher the score, the greater the probability that the two submissions are collaborative patches for the same vulnerability.

[0045] In one embodiment, a schematic diagram of multi-dimensional feature fusion is provided as attached. Figure 5 As shown in the figure, the dimensions, composition, and input process of various features are clearly marked.

[0046] Step 3: Construct an undirected graph based on the relevance scores from Step 2. Divide the graph into candidate submission groups by using a breadth-first search algorithm to form the maximum connected subgraph. Perform maximum pooling fusion on the code submission features within each candidate group to obtain a group vector. Calculate the relevance between the group vector and the vulnerability. Select the candidate group with the highest relevance as the optimal patch group and output it in order of suspicion. Finally, locate the set of collaborative patches corresponding to the vulnerability.

[0047] The method for constructing the undirected graph in step 3 is as follows: Let the set of highly relevant code submissions selected in step 1 be: , in A positive integer, representing the total number of highly relevant code submissions. That is, the set must contain at least 2 submissions to satisfy the construction condition of the undirected graph edge; The relevance score matrix of the submitted pairs is as follows: , in, Indicates code submission and The relevance score, All are positive integers, and their values ​​range from 1 to 2. ; Construct an undirected graph ,in , The threshold value is 0.9.

[0048] Step 3 describes the method of dividing the undirected graph into multiple maximally connected subgraphs: using the maximally connected subgraph algorithm, the undirected graph is divided into multiple maximally connected subgraphs. Divide the code into multiple disjoint, maximally connected subgraphs (MCS) whose union covers all candidate code submissions, denoted as: , Where M is an undirected graph The set of the largest connected subgraphs obtained by the breadth-first search algorithm. Number of subgraphs; For a single maximally connected subgraph, satisfying the formula: , That is, the subgraphs do not overlap and cover all highly relevant submissions.

[0049] Step 3 describes the group vector The generation method is as follows: First, represent the code submissions as vectors, using the following formula: , in, The feature vector for new rules related to code changes includes the TF-IDF similarity between the vulnerability description and the change summary generated by the large model, the number and proportion of identical tokens, the maximum term frequency, the sum, the mean, and the variance. The semantic feature vectors obtained by concatenating the vulnerability description, submission description, and change summary generated by the large model are input into the RoBERTa model and the fully connected layer; the MLP has a 2-layer structure (62-dimensional input layer, 31-dimensional hidden layer, and 15-dimensional output layer), and outputs a 15-dimensional unified submission representation vector.

[0050] Here, the code submission summary generated by the large model in step 2 is reused, and based on this, all rule-based features involving code changes in step 1 are redefined to form new features such as... Figure 7 As shown, based on the multi-dimensional features in step 1, the features related to code changes are modified into the new features shown in the figure.

[0051] Then, max pooling fusion is performed. The specific steps of max pooling fusion are as follows: Construct feature vectors for code submissions in each maximum connected subgraph (MCS): Construct rule feature vectors based on new features related to code changes (including TF-IDF vector cosine similarity of vulnerability descriptions and code change summaries generated by large language models, the number and proportion of identical tokens, the maximum term frequency, sum, mean, and variance of identical tokens). The vulnerability description, code submission description, and code change summary generated by the large language model are concatenated and input into the RoBERTa model and the fully connected layer to obtain the semantic feature vector. By inputting the two types of vectors into a multilayer perceptron, a unified representation vector for code submission is obtained; Max pooling is performed on the unified representation vector of all code submissions within the MCS to extract the maximum value of each dimension, resulting in the group vector representation of the MCS; the formula is: , in, For vector dimensions, The number of submissions within a single maximum connected subgraph, Vec_Unified1, …, Given a unified representation vector for each submission within a subgraph, the core features of the submissions within the subgraph are extracted using max pooling, resulting in a 15-dimensional group vector. .

[0052] Step 3 calculates the correlation between the group vector and the vulnerability, selects the MCS with the highest correlation as the patch group corresponding to the vulnerability and outputs it. The correlation calculation is achieved by the cosine similarity between the group vector and the vulnerability feature vector. The higher the similarity, the stronger the association between the candidate submission group and the vulnerability.

[0053] The formula for calculating the correlation between the group vector and the vulnerability mentioned in step 3 is as follows: , in, It is obtained by concatenating the rule feature vector and semantic feature vector of the vulnerability. Cosine is the cosine similarity calculation function with a value range of [0,1]. The higher the similarity, the stronger the association between the candidate submission group and the vulnerability. The optimal patch group mentioned in step 3 is the maximum connected subgraph with the highest correlation, and the formula is: , In one embodiment, the maximum pooling fusion process is as follows: Figure 6 As shown.

[0054] This invention aims to provide a method for identifying hidden vulnerability patches based on a multi-stage architecture and collaborative relationship modeling. The first stage is an initial ranking phase, which primarily obtains candidate code submissions from open-source repositories, extracts rule-based and semantic features between vulnerabilities and candidate code submissions, calculates relevance scores, and filters highly relevant submissions to narrow down the scope of subsequent analysis. Next is the submission relevance prediction phase, where highly relevant submissions are paired, and multi-dimensional features (including large model auxiliary features) are fused to predict collaborative repair relationships between submissions, establishing submission associations. Finally, in the submission grouping and ranking phase, a maximum connected subgraph is constructed based on the relevance scores to form candidate submission groups. Maximum pooling is used to fuse features within each group and calculate their relevance to the vulnerability, outputting the optimal patch group. Simultaneously, combining existing ranking-based patch identification techniques, an enhancement method based on submission collaborative relationships is proposed. By leveraging the inherent relationships between code submissions and utilizing the relevance between group vectors and vulnerabilities, the ranking logic of candidate code submissions is updated, resulting in accurate patch groups and rankings. This invention ultimately forms a complete method for identifying hidden vulnerability patches in multi-patch scenarios.

[0055] The implementation of the various embodiments of the present invention is based on programmed processing through a device with processor functionality. Therefore, in practical engineering, the technical solutions and functions of the various embodiments of the present invention are encapsulated into various modules. Based on this reality, and building upon the above embodiments, the embodiments of the present invention provide an open-source environment software hidden vulnerability patch identification device, which is used to execute the open-source environment software hidden vulnerability patch identification method in the above method embodiments.

[0056] The device includes: a first main module, used to extract correlation features between a given vulnerability and candidate code submissions, the correlation features including rule-based features and semantic features, calculate the correlation score between the vulnerability and each candidate code submission based on the two types of features, sort them in descending order of score and filter the top-ranked highly correlated code submissions; a second main module, used to pair the filtered highly correlated code submissions to form submission pairs, extract multi-dimensional features for each submission pair, the multi-dimensional features including large model-generated features, rule-based features and semantic features, input the multi-dimensional features into a correlation prediction model to calculate the correlation score of the submission pair, characterizing whether the two submissions are collaborative patches for the same vulnerability; a third main module, used to construct an undirected graph based on the correlation score, divide the undirected graph into multiple maximally connected subgraphs as candidate submission groups, perform max pooling fusion on the code submission features within each candidate submission group to obtain a group vector representation, calculate the correlation between the group vector and the vulnerability, select the candidate submission group with the highest correlation as the patch group corresponding to the vulnerability and output it.

[0057] This invention provides an open-source environment software hidden vulnerability patch identification device, which addresses the problems of low identification accuracy and unutilized patch collaboration relationships in existing technologies under multi-patch scenarios. It adopts the aforementioned modules, based on a multi-stage architecture and collaboration relationship modeling, to achieve hidden vulnerability patch identification for multi-patch scenarios, and enhances traditional patch identification based on unidirectional association by utilizing the collaborative association between submissions.

[0058] It should be noted that the device embodiments provided by the present invention are used not only to implement the methods in the above method embodiments, but also to implement the methods in other method embodiments provided by the present invention. The only difference is that corresponding functional modules are set. The principle is basically the same as that of the above device embodiments provided by the present invention. As long as those skilled in the art can improve the modules in the above device embodiments by referring to the specific technical solutions in other method embodiments and combining technical features to obtain corresponding technical means and technical solutions composed of these technical means, on the basis of the above device embodiments, and on the premise of ensuring the practicality of the technical solutions, they can obtain corresponding device-type embodiments for implementing the methods in other method-type embodiments.

[0059] Based on the same inventive concept as any of the foregoing embodiments, this embodiment of the invention also provides an open-source environment software hidden vulnerability patch identification device, including a memory and a processor. The memory stores program instructions that are executed by the processor, and the processor calls the program instructions to execute the open-source environment software hidden vulnerability patch identification method.

[0060] Based on the same inventive concept as any of the foregoing embodiments, this embodiment of the invention also provides a non-transitory computer-readable storage medium that stores computer instructions that cause the computer to execute the open-source environment software hidden vulnerability patch identification method.

[0061] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0062] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0063] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0064] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0065] In summary, this invention provides a method for identifying hidden vulnerability patches in multi-patch scenarios. This method, based on a multi-stage architecture and collaborative relationship modeling, proposes a novel patch group identification scheme. First, it obtains candidate code submissions from open-source repositories, extracts relevance features between vulnerabilities and candidate code submissions (including rule-based and semantic features), calculates relevance scores, and filters highly relevant submissions. Then, it pairs highly relevant submissions and fuses multi-dimensional features (including large-model generated features, rule-based features, and semantic features) to predict the collaborative relationship between submissions. Finally, it constructs an undirected graph based on the relevance scores and divides it into maximum connected subgraphs. It then fuses features within the group using max pooling and calculates the relevance with the vulnerability, outputting the optimal patch group. Simultaneously, it combines existing ranking-based patch identification techniques and proposes an enhancement method based on submission collaborative relationships. This method improves the identification accuracy in multi-patch scenarios by updating the ranking logic of candidate code submissions using the inherent correlation between code submissions and the relevance of group vectors to vulnerabilities. Therefore, this invention provides a method for identifying hidden vulnerability patches that captures submission collaborative relationships and is adapted to multi-patch scenarios.

[0066] The terms “comprising” and “having”, and any variations thereof, in the specification, claims, and accompanying drawings of this invention are intended to cover a non-exclusive inclusion, such as a process, method, system, product, or apparatus that includes a series of steps or units, not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0067] Finally, it should be noted that those skilled in the art, once they understand the basic inventive concept, can make further changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this invention.

[0068] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying hidden vulnerability patches in open-source software, characterized in that, include: For a given vulnerability and candidate code submissions, the correlation features between the vulnerability and the candidate code submissions are extracted. The correlation features include rule-based features and semantic features. The correlation score between the vulnerability and each candidate code submission is calculated based on the two types of features. The submissions are sorted in descending order of the scores and the top-ranked highly correlated code submissions are selected. Highly relevant code submissions are paired up to form submission pairs. Multi-dimensional features of each submission pair are extracted. These multi-dimensional features include features generated by a large model, rule-based features, and semantic features. The multi-dimensional features are input into a relevance prediction model to calculate the relevance score of the submission pair, which indicates whether the two submissions are collaborative patches for the same vulnerability. An undirected graph is constructed based on the correlation score. The undirected graph is divided into multiple maximum connected subgraphs as candidate submission groups. The code submission features in each candidate submission group are fused by max pooling to obtain the group vector representation. The correlation between the group vector and the vulnerability is calculated. The candidate submission group with the highest correlation is selected as the patch group corresponding to the vulnerability and output.

2. The method for identifying hidden vulnerability patches in open-source software according to claim 1, characterized in that, The rule-based features include: code modification scale features, matching relationship features, time interval features, location information features, and text similarity features.

3. The method for identifying hidden vulnerability patches in open-source software according to claim 2, characterized in that, The formula for calculating the correlation score is: ， MLP stands for Multilayer Perceptron. This is a vector concatenation operation. For rule-based features, For semantic features, The score represents the relevance score; a higher score indicates a stronger correlation between the candidate code submission and the vulnerability.

4. The method for identifying hidden vulnerability patches in open-source software according to claim 1, characterized in that, Extract multi-dimensional features for each submission pair, including: Extract rule-based features for each submission pair: ,in, These are the 1st, 2nd, ..., 30th dimension feature vectors; Extract the large model-generated features for each submission pair: ,in, , , These are the TF-IDF vector cosine similarity of the two submissions, the number of identical tokens in the two submissions, and the percentage of identical tokens. Extract the semantic features of each submission pair: Where CLS is the sequence start identifier and SEP is the delimiter. , For submission Description and summary, , For submission Description and summary.

5. The method for identifying hidden vulnerability patches in open-source software according to claim 4, characterized in that, The correlation prediction model is a multilayer perceptron, and the prediction formula is: ， in, This is the encoding vector for the large model's prediction of whether a submission is a vulnerability patch; The relevance score is given to the submission pair. A higher score indicates a greater probability that the two submissions are collaborative patches for the same vulnerability.

6. The method for identifying hidden vulnerability patches in open-source software according to claim 1, characterized in that, Constructing undirected graphs based on correlation scores, including: Let the set of highly relevant code submissions be: ， in A positive integer, representing the total number of highly relevant code submissions. ; The relevance score matrix of the submitted pairs is as follows: ， in, Indicates code submission and The relevance score, All are positive integers, and their values ​​range from 1 to 2. ; Construct an undirected graph ,in , The threshold value is used.

7. The method for identifying hidden vulnerability patches in open-source software according to claim 1, characterized in that, The correlation between the group vector and the vulnerability is calculated as follows: ， in, It is obtained by concatenating the rule feature vector and semantic feature vector of the vulnerability. For group vectors, Cosine is the cosine similarity calculation function.

8. A device for identifying hidden vulnerability patches in open-source software, characterized in that, include: The first main module is used to extract the correlation features between a given vulnerability and candidate code submissions. The correlation features include rule-based features and semantic features. Based on the two types of features, the correlation score between the vulnerability and each candidate code submission is calculated, and the submissions are sorted in descending order of the scores and the top-ranked highly correlated code submissions are selected. The second main module is used to pair up the highly relevant code submissions to form submission pairs, extract multi-dimensional features for each submission pair, including features generated by a large model, rule-based features and semantic features, and input the multi-dimensional features into the relevance prediction model to calculate the relevance score of the submission pair, which represents whether the two submissions are collaborative patches for the same vulnerability. The third main module is used to construct an undirected graph based on the correlation score, divide the undirected graph into multiple maximum connected subgraphs as candidate submission groups, perform maximum pooling fusion on the code submission features in each candidate submission group to obtain a group vector representation, calculate the correlation between the group vector and the vulnerability, select the candidate submission group with the highest correlation as the patch group corresponding to the vulnerability and output it.

9. A device for identifying hidden vulnerability patches in open-source software, characterized in that: The method includes a memory and a processor, wherein the memory stores program instructions that are executed by the processor, and the processor invokes the program instructions to execute the open-source environment software hidden vulnerability patch identification method according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores computer instructions that cause the computer to execute the open-source environment software hidden vulnerability patch identification method according to any one of claims 1 to 7.

Images