Code feature recognition and vulnerability analysis system based on convolutional neural network
The code feature recognition and vulnerability analysis system based on convolutional neural networks solves the problems of difficult feature extraction, inaccurate component identification, and low vulnerability identification efficiency in complex code analysis using traditional tools. It achieves efficient and accurate vulnerability detection and intuitive visualization analysis, improving the efficiency and security of software development and supply chain security management.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- STATE GRID HUBEI ELECTRIC POWER INFORMATION & TELECOMMUNICATION COMPANY
- Filing Date
- 2025-12-31
- Publication Date
- 2026-05-08
AI Technical Summary
Traditional code analysis tools struggle to capture the high-level semantic features of complex code, resulting in inaccurate component identification, low vulnerability identification efficiency, and a lack of intuitive visualization support, making it difficult for users to understand complex analysis results.
A code feature recognition and vulnerability analysis system based on convolutional neural networks is adopted, including modules for data processing, feature extraction, code profile generation, vulnerability analysis, and visualization. The system extracts low-level semantic features from code fragments through convolutional neural networks, generates semantic profiles of code components, associates them with a vulnerability database, outputs a vulnerability list, and displays the analysis results in the form of charts.
It achieves efficient code feature extraction and component identification, improves component identification accuracy, increases vulnerability identification speed by 5 times, reduces the false negative rate by 20%, provides intuitive visualization analysis, significantly improves user experience, and enhances the security risk early warning capabilities for software development and supply chain security management.
Smart Images
Figure CN121997334A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network security technology, and in particular relates to a code feature recognition and vulnerability analysis system based on convolutional neural networks. Background Technology
[0002] Traditional code analysis tools struggle to capture the high-level semantic features of complex code, especially when code snippets are highly modular or obfuscated, failing to effectively extract low-level features and component relationships. Due to the diversity of code structures and naming conventions, existing technologies often rely on manual rules or fuzzy matching for component identification, which is prone to misjudgments. Manually checking for known vulnerabilities in code is inefficient, time-consuming, and prone to overlooking critical risks. Traditional code analysis tools often lack intuitive visualization support, making it difficult for users to understand complex analysis results.
[0003] Based on the above analysis, the problems and shortcomings of the existing technology are as follows: (1) Code complexity and difficulty in semantic extraction: Traditional code analysis tools struggle to capture the high-level semantic features of complex code, especially when code snippets are highly modular or obfuscated, making it difficult to effectively extract underlying features and component relationships.
[0004] (2) Inaccurate component identification: Due to the diversity of code structures and naming conventions, existing technologies often rely on manual rules or fuzzy matching to identify components, which can easily lead to misjudgments.
[0005] (3) Low efficiency in vulnerability identification: Manually checking for known vulnerabilities in code is inefficient, time-consuming, and prone to overlooking critical risks.
[0006] (4) Lack of visualization and analysis tools: Traditional code analysis tools often lack intuitive visualization support, making it difficult for users to understand complex analysis results. Summary of the Invention
[0007] To address the problems existing in the prior art, this invention provides a code feature recognition and vulnerability analysis system based on convolutional neural networks.
[0008] This invention is implemented as follows: a code feature recognition and vulnerability analysis system based on convolutional neural networks includes: Data processing module, feature extraction module, code profiling generation module, vulnerability analysis module, and visualization module; The data processing module, connected to the code profiling generation module, is used to decompress, segment, and preprocess the target source code or binary file; The feature extraction module, connected to the code profiling generation module, is used to extract low-level semantic features from code snippets using a convolutional neural network. The code profiling generation module, connected to the data processing module, feature extraction module, and vulnerability analysis module, is used to generate semantic profiles of code components based on the extracted features. The vulnerability analysis module, connected to the visualization module, is used to associate with the vulnerability database, identify known vulnerabilities in code components, and output a vulnerability list. The visualization module, connected to the vulnerability analysis module, is used to display the code component structure and vulnerability distribution in chart form.
[0009] Furthermore, the data processing module: File unzip: Unzip source code files or binary files; Extract the parsable content from the code file; Code block division: Divide the source code file into blocks with a fixed number of lines, or slice the binary file into slices of a fixed size; The purpose of chunking is to divide the entire file into multiple standardized segments to facilitate subsequent processing; Data preprocessing: 1) Decompressing and partitioning the target file: After decompressing the target code file, divide the code into fixed-length segments according to a preset length:
[0010] Where S is the set of code segments after partitioning, n is the number of code segments, and si represents the i-th code segment; Ensure that each code snippet does not overlap; 2) Vectorized encoding: Use vectorization mapping f(x) to map characters, identifiers, and keywords in the code snippet to numeric vectors:
[0011] Where X is the vectorized representation of code snippet si, and d is the dimension of the feature vector.
[0012] Furthermore, the feature extraction module: 1) Input layer: Receive the vectorized code snippet generated by the preprocessing module. The shape is n x d, where n is the length of the snippet and d is the feature dimension. 2) Convolution operation: Using multiple convolutional kernels K to slide and extract local features:
[0013] in, For convolution output, is the kernel size, and b is the bias; 3) Activation function: Using the ReLU activation function:
[0014] This gives the network nonlinear characteristics; 4) Pooling operations: Dimensionality reduction using max pooling or average pooling can extract key features and reduce the amount of data.
[0015] 5) Output high-level features: The result of multiple convolutions and pooling is flattened into a vector F to represent the semantic features of each code segment.
[0016] Furthermore, the code profiling generation module: 1) Feature clustering: Cluster all extracted fragment feature vectors F = {F1, F2, ..., Fn} and match them to features in the known component library: Ck={Fj|Cluster(Fj)=k}, k {1,2,.,K} Where Ck is the clustering result of the kth class, and K is the number of known components in the component library; 2) Component information matching: Based on the clustering results, each clustering result is mapped to a specific component name and version number: Component_Info(Ck)={Name, Version}.
[0017] Furthermore, the vulnerability analysis module: 1) Vulnerability matching: Based on the component names and version numbers in the code profile, query vulnerability databases (such as CVE or NVD). V={CVE-ID, Severity,Description) 2) Vulnerability list generation: The identified vulnerabilities are compiled to generate a vulnerability list, which includes the following information: Vulnerability ID (CVE-ID); Vulnerability description; The vulnerability affects the component; Repair suggestions; 3) Priority sorting: Vulnerabilities are prioritized based on their severity, and it is recommended to fix high-risk vulnerabilities first.
[0018] Furthermore, the visualization module: Component structure display: Use pie charts or tree diagrams to show the component composition of code files; Display the name, version number, and corresponding feature clustering results for each component; Vulnerability distribution display: Use bar charts or heatmaps to display the number and distribution of vulnerabilities; Mark the components where high-risk vulnerabilities are located and their impact scope; Vulnerability priority display: Use radar charts or tables to indicate the severity of vulnerabilities and provide remediation recommendations.
[0019] Another objective of this invention is to provide a code feature recognition and vulnerability analysis method based on convolutional neural networks, comprising: Step 1: Decompress, segment, and preprocess the target source code or binary file using the data processing module; Step 2: Extract low-level semantic features from the code snippet using a convolutional neural network through the feature extraction module; Step 3: Generate semantic profiles of code components based on the extracted features using the code profile generation module; Step 4: Connect to the vulnerability database through the vulnerability analysis module, identify known vulnerabilities in the code components, and output a vulnerability list; Step 5: Use the visualization module to display the code component structure and vulnerability distribution in chart form.
[0020] Another object of the present invention is to provide a computer device, the computer device including a memory and a processor, the memory storing a computer program, the computer program being executed by the processor causing the processor to perform the steps of the code feature recognition and vulnerability analysis method based on convolutional neural networks.
[0021] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the code feature recognition and vulnerability analysis method based on a convolutional neural network.
[0022] Another objective of this invention is to provide an information data processing terminal for implementing the code feature recognition and vulnerability analysis system based on convolutional neural networks.
[0023] Based on the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solution to be protected by this invention are as follows:
[0024] 1. Efficient code feature extraction and component identification: Using a convolutional neural network model, the system can extract low-level features from a large-scale codebase within minutes to generate accurate component profiles. Compared to traditional methods, feature extraction efficiency is improved by 30%, and component recognition accuracy reaches over 95%.
[0025] 2. Enhanced automation and comprehensiveness of vulnerability analysis: The system can automatically associate component profiles with a vulnerability database, enabling rapid matching and inventory generation of known vulnerabilities. Experiments show that the system's vulnerability identification speed is 5 times faster than manual analysis, and the false negative rate is reduced by more than 20%.
[0026] 3. Full coverage of code and binary files: It supports end-to-end analysis from source code to binary files, and processes different types of input files through lexical analysis and disassembly techniques, expanding the system's applicability and making it particularly suitable for diverse software supply chain scenarios.
[0027] 4. Intuitive visual analysis: The system-generated visualizations (such as tree diagrams, bar charts, and radar charts) can intuitively display the component structure and vulnerability distribution, making it easier for users to quickly grasp the risk points and remediation suggestions in the code, significantly improving the user experience.
[0028] 5. Enhanced safety risk early warning capabilities: The system can detect potential high-risk vulnerabilities in real time and provide remediation suggestions, effectively helping enterprises reduce security risks at the code level. Especially in the security management of the software supply chain, the system's accurate identification of component vulnerabilities provides strong support for preventing supply chain attacks.
[0029] 6. Flexibility in cross-domain applications: This technology is not only applicable to software development companies, but also to industries with high security requirements for software components, such as finance and manufacturing, providing users in multiple fields with efficient and secure code analysis and vulnerability detection solutions.
[0030] Through the aforementioned technological improvements and enhanced performance, this technology significantly improves the efficiency, accuracy, and usability of code analysis and vulnerability detection, providing an innovative solution for modern software development and supply chain security management. Attached Figure Description
[0031] Figure 1 This is a block diagram of the code feature recognition and vulnerability analysis system based on convolutional neural networks provided in the embodiments of the present invention.
[0032] Figure 2 This is a flowchart of the data processing module method provided in an embodiment of the present invention.
[0033] Figure 3 This is a flowchart of the code profiling generation module method provided in an embodiment of the present invention.
[0034] Figure 4 This is a flowchart of a code feature recognition and vulnerability analysis method based on convolutional neural networks provided in an embodiment of the present invention.
[0035] Figure 1 The module consists of: 1. Data processing module; 2. Feature extraction module; 3. Code profiling generation module; 4. Vulnerability analysis module; and 5. Visualization module. Detailed Implementation
[0036] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.
[0037] like Figure 1 As shown in the figure, an embodiment of the present invention provides a code feature recognition and vulnerability analysis system based on convolutional neural networks, comprising: Data processing module 1; Feature extraction module 2; Code profiling generation module 3; Vulnerability analysis module 4; Visualization module 5; Data processing module 1, connected to code profiling generation module 3, is used to decompress, segment, and preprocess the target source code or binary file; Feature extraction module 2, connected to code profiling generation module 3, is used to extract low-level semantic features from code fragments using a convolutional neural network; The code profile generation module 3 is connected to the data processing module 1, the feature extraction module 2, and the vulnerability analysis module 4, and is used to generate semantic profiles of code components based on the extracted features. Vulnerability analysis module 4, connected to visualization module 5, is used to associate with vulnerability database, identify known vulnerabilities in code components and output a vulnerability list; The visualization module 5, connected to the vulnerability analysis module 4, is used to display the code component structure and vulnerability distribution in chart form.
[0038] The first step of the system is completed by the data processing module. This module is responsible for receiving the target source code or binary file, decompressing it, and dividing the code content into blocks (e.g., 200 lines of code or 1 KB binary slices). Subsequently, the system parses the code fragments using a lexical analyzer or disassembler, extracting features such as keywords, variable names, or assembly instructions, and vectorizing them into a fixed-dimensional feature matrix. The purpose of this stage is to provide standardized and structured data input for subsequent feature extraction.
[0039] After data preprocessing, the feature matrix is input into the feature extraction module. This module, based on a convolutional neural network (CNN) model, extracts low-level semantic features from code snippets layer by layer. The CNN model uses multiple convolutional kernels (e.g., 3 x 3 kernels) and pooling operations (e.g., 2 x 2 pooling kernels) to progressively extract features, thereby capturing deep-seated patterns and semantic relationships between instructions in the code snippets. Finally, the feature extraction module provides the high-dimensional feature vector of each code snippet to the code profiling generation module.
[0040] In the code profiling module, the system utilizes extracted high-dimensional features, based on clustering analysis or specific pattern matching, to identify the component to which the code snippet belongs and its version information, generating a semantic profile. For example, the system might identify the component "Spring Framework" as version "5.2.9.RELEASE". Subsequently, the vulnerability analysis module correlates the generated component profile with the CVE vulnerability database to match known vulnerability information of the component. For each vulnerability, the system records its vulnerability number, severity (such as CVSS score), and vulnerability description, while generating a vulnerability list and remediation suggestions.
[0041] Finally, the system presents the analysis results in intuitive charts and graphs through a visualization module. Pie charts show the proportion of each component in the system, bar charts display the number and severity distribution of vulnerabilities, and heatmaps indicate the locations of high-risk components. The output also includes a complete report detailing component profiles, a vulnerability list, and remediation recommendations for user reference and decision-making. Through this stage, users can quickly understand the overall security status of the system and take appropriate remedial measures.
[0042] In summary, this system achieves full-process coverage from code preprocessing to vulnerability analysis through modular design, providing efficient and reliable technical support for the security assessment of target systems.
[0043] like Figure 2 As shown, the data processing module provided in this embodiment of the invention: S101, File decompression: Unzip source code files or binary files; Extract the parsable content from the code file; S102, Code Blocking: Divide the source code file into blocks with a fixed number of lines, or slice the binary file into slices of a fixed size; The purpose of chunking is to divide the entire file into multiple standardized segments to facilitate subsequent processing; S103, Data Preprocessing: 1) Decompressing and partitioning the target file: After decompressing the target code file, divide the code into fixed-length segments according to a preset length:
[0044] Where S is the set of code segments after partitioning, n is the number of code segments, and si represents the i-th code segment; Ensure that each code snippet does not overlap; 2) Vectorized encoding: Use vectorization mapping f(x) to map characters, identifiers, and keywords in the code snippet to numeric vectors:
[0045] Where X is the vectorized representation of code snippet si, and d is the dimension of the feature vector.
[0046] The feature extraction module provided in this embodiment of the invention: 1) Input layer: Receive the vectorized code snippet generated by the preprocessing module. The shape is n x d, where n is the length of the snippet and d is the feature dimension. 2) Convolution operation: Using multiple convolutional kernels K to slide and extract local features:
[0047] in, For convolution output, is the kernel size, and b is the bias; 3) Activation function: Using the ReLU activation function:
[0048] This gives the network nonlinear characteristics; 4) Pooling operations: Dimensionality reduction using max pooling or average pooling can extract key features and reduce the amount of data.
[0049] 5) Output high-level features: The result of multiple convolutions and pooling is flattened into a vector F to represent the semantic features of each code segment.
[0050] The following is a detailed explanation of the working principle of the data processing module, divided into four sections: The first step in the data processing module is file decompression (step S101). The system receives target source code files (such as `.zip`, `.tar.gz` formats) or binary files (such as `.exe`, `.dll` formats) and decompresses them using the built-in decompression tool. After decompression, the system extracts parsable content from the files, such as text portions in the source code or instruction sequences in the binary files. The purpose of this process is to ensure that subsequent processing modules can successfully access the contents of the files, and to lay the foundation for unified processing of different file types.
[0051] After the file is decompressed, the system performs block processing on the decompressed content (step S102). For source code files, the system blocks them according to a fixed number of lines (e.g., every 200 lines), splitting large files into multiple fragments to reduce processing complexity; for binary files, the system slices them into standardized binary fragments according to a fixed size (e.g., every 1 KB). The main purpose of block segmentation is to divide the original file content into multiple small units, facilitating parallel processing and analysis in the subsequent feature extraction stage.
[0052] After segmentation, the system performs data preprocessing on each segment (step S103). For source code segments, the system uses a lexical analyzer to extract semantic information such as keywords, variable names, and operators, and converts them into numerical representations. For binary file segments, the system uses a disassembler to convert binary instructions into assembly code and extracts features such as instruction patterns. After preprocessing, each code segment is transformed into a fixed-dimensional feature matrix. This standardized processing method ensures that the subsequent feature extraction module can efficiently receive and analyze the input data.
[0053] After decompression, segmentation, and data preprocessing, the feature matrices of all code snippets are uniformly formatted and output as standardized data to the feature extraction module. Through this hierarchical processing mechanism, the data processing module achieves compatibility support for different file types while ensuring the integrity and standardization of input data, providing high-quality initial data input for subsequent feature extraction and vulnerability analysis.
[0054] In summary, the data processing module completes the transformation from the original file to a standardized feature matrix through steps such as decompression, segmentation, and preprocessing, providing a reliable data foundation for code analysis and vulnerability detection.
[0055] like Figure 3 As shown, the code profiling generation module provided in this embodiment of the invention: S201, Feature Clustering: Cluster all extracted fragment feature vectors F = {F1, F2, ..., Fn} and match them to features in the known component library: Ck={Fj|Cluster(Fj)=k}, k {1,2,.,K} Where Ck is the clustering result of the kth class, and K is the number of known components in the component library; S202, Component Information Matching: Based on the clustering results, each clustering result is mapped to a specific component name and version number: Component_Info(Ck)={Name, Version}.
[0056] The vulnerability analysis module provided in this embodiment of the invention: 1) Vulnerability matching: Based on the component names and version numbers in the code profile, query vulnerability databases (such as CVE or NVD). V={CVE-ID, Severity,Description) 2) Vulnerability list generation: The identified vulnerabilities are compiled to generate a vulnerability list, which includes the following information: Vulnerability ID (CVE-ID); Vulnerability description; The vulnerability affects the component; Repair suggestions; 3) Priority sorting: Vulnerabilities are prioritized based on their severity, and it is recommended to fix high-risk vulnerabilities first.
[0057] The visualization module provided in this embodiment of the invention: Component structure display: Use pie charts or tree diagrams to show the component composition of code files; Display the name, version number, and corresponding feature clustering results for each component; Vulnerability distribution display: Use bar charts or heatmaps to display the number and distribution of vulnerabilities; Mark the components where high-risk vulnerabilities are located and their impact scope; Vulnerability priority display: Use radar charts or tables to indicate the severity of vulnerabilities and provide remediation recommendations.
[0058] like Figure 4 As shown in the figure, the code feature recognition and vulnerability analysis method based on convolutional neural networks provided by this invention includes: S301 decompresses, segments, and preprocesses the target source code or binary file through the data processing module; S302, the feature extraction module uses a convolutional neural network to extract low-level semantic features from code snippets; S303, the code profiling generation module generates semantic profiles of code components based on the extracted features; S304 uses the vulnerability analysis module to associate with the vulnerability database, identifies known vulnerabilities in code components, and outputs a vulnerability list. S305 uses a visualization module to display the code component structure and vulnerability distribution in chart form.
[0059] Another object of the present invention is to provide a computer device, the computer device including a memory and a processor, the memory storing a computer program, the computer program being executed by the processor causing the processor to perform the steps of the code feature recognition and vulnerability analysis method based on convolutional neural networks.
[0060] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the code feature recognition and vulnerability analysis method based on a convolutional neural network.
[0061] Another objective of this invention is to provide an information data processing terminal for implementing the code feature recognition and vulnerability analysis system based on convolutional neural networks.
[0062] Specific implementation of the present invention: 1. System Architecture The system consists of the following modules: Data processing module: Decompresses, segments, and preprocesses the target source code or binary file.
[0063] Feature extraction module: Uses convolutional neural networks (CNN) to extract low-level semantic features from code snippets.
[0064] Code profile generation module: Generates semantic profiles of code components (component name + version number) based on extracted features.
[0065] Vulnerability Analysis Module: Connects to vulnerability databases (such as CVE), identifies known vulnerabilities in code components, and outputs a vulnerability list.
[0066] Visualization module: Displays code component structure and vulnerability distribution in chart form.
[0067] Detailed Explanation of Working Principle
[0068] 1. Data Processing Module
[0069] Objective: To decompress, segment, and preprocess the target source code or binary file to provide standardized input for subsequent feature extraction.
[0070] Workflow: File unzip: Extract source code files (such as .zip or .tar format) or binary files (such as .exe or .dll format).
[0071] Extract the parsable content (source code or binary instructions) from the code file.
[0072] Code block division: Divide the source code file into blocks of a fixed number of lines (e.g., every 100 lines), or slice the binary file into blocks of a fixed size (e.g., 1 KB).
[0073] The purpose of chunking is to divide the entire file into multiple standardized segments to facilitate subsequent processing.
[0074] Data preprocessing: Lexical analysis is performed on the code to convert keywords, variable names, and operators into a unified notation.
[0075] The instruction set of the binary file is extracted using a disassembler (such as IDA Pro or Radare2) and mapped to the corresponding feature representation.
[0076] The segmented code or instruction fragments are vectorized and input into the feature extraction module in the form of a standardized matrix.
[0077] 2. Feature Extraction Module
[0078] Objective: To extract low-level semantic features from code snippets using convolutional neural networks (CNNs) and capture latent formulas and relationships.
[0079] Workflow: 1). Input layer: Receive the vectorized code snippet generated by the preprocessing module, with shape n x d, where n is the length of the snippet and d is the feature dimension.
[0080] 2) Convolution operation: Using multiple convolutional kernels K to slide and extract local features:
[0081] in, For convolution output, is the kernel size, and b is the bias.
[0082] 3) Activation function: Using the ReLU activation function:
[0083] This gives the network nonlinear characteristics.
[0084] 4) Pooling operation: Dimensionality reduction using max pooling or average pooling can extract key features and reduce the amount of data.
[0085] 5) Output high-level features: The result of multiple convolutions and pooling is flattened into a vector F to represent the semantic features of each code segment.
[0086] 3. Code profiling generation module
[0087] Objective: To generate semantic profiles of code components based on extracted features, including component names and version numbers.
[0088] Workflow: 1) Feature clustering: Clustering algorithms (such as K-Means or DBSCAN) are used to cluster the feature vector F to obtain a set of code snippets belonging to the same component: Ck = {Fi|Cluster(Fi) = k} Where Ck is the clustering result of the kth class.
[0089] 2) Component matching: The clustering results are then matched against a database of known components (containing a mapping table of component names and version numbers): Component_Info(Ck)={Name, Version} 3).Image generation: • Generate a code profile for each cluster, including component name, version number, and feature distribution map.
[0090] 4. Vulnerability Analysis Module
[0091] Objective: To correlate with vulnerability databases, identify known vulnerabilities in code components, and output a vulnerability list.
[0092] Workflow: 1) Vulnerability matching: Based on the component names and version numbers in the code profile, query vulnerability databases (such as CVE or NVD). V={CVE-ID, Severity,Description) 2) Vulnerability List Generation: The identified vulnerabilities are compiled to generate a vulnerability list, which includes the following information: Vulnerability ID (CVE-ID) Vulnerability Description Vulnerability affects components Repair suggestions 3. Priority sorting: Vulnerabilities are ranked according to their severity (e.g., CVSS score), and it is recommended to prioritize patching high-risk vulnerabilities. 5. Visualization module Objective: To present the code component structure and vulnerability distribution in a graphical format for easy user understanding.
[0093] Workflow: Component structure display: Use pie charts or tree diagrams to show the component composition of code files.
[0094] Display the name, version number, and corresponding feature clustering results for each component.
[0095] Vulnerability distribution display: Use bar charts or heatmaps to show the number and distribution of vulnerabilities.
[0096] Mark the components where high-risk vulnerabilities are located and their impact scope.
[0097] Vulnerability priority display: Use radar charts or tables to indicate the severity of vulnerabilities and provide remediation recommendations.
[0098] Summarize
[0099] Each module collaborates to achieve a complete process from code segmentation to vulnerability list generation. Through feature extraction and cluster analysis, the system can accurately identify the component structure in the code and quickly match it with the vulnerability database, providing users with an intuitive and efficient security assessment tool.
[0100] 2. Implementation Steps
[0101] Data preprocessing: The target code file is decompressed, divided into fixed-length code segments, and then vectorized.
[0102] CNN Feature Extraction: Use multi-layer convolutional networks to extract low-level features from code snippets.
[0103] High-level semantic features of the code are obtained through multiple convolution and pooling operations.
[0104] Component profile generation: Based on the features extracted by CNN, code snippets are clustered and matched to a database of known components.
[0105] Generate a code profile that includes component names and version numbers.
[0106] Vulnerability matching: By linking to the CVE vulnerability database, known vulnerabilities in code components are identified, and a vulnerability list is generated.
[0107] System verification: Test known code snippets to verify the system's accuracy in identifying vulnerabilities.
[0108] 1. Data Preprocessing
[0109] 1) Decompressing and partitioning the target file: After decompressing the target code file, divide the code into fixed-length segments according to a preset length:
[0110] Where S is the set of code segments after partitioning, n is the number of code segments, and si represents the i-th code segment.
[0111] Ensure that each code snippet does not overlap.
[0112] 2) Vectorized encoding: Use vectorization mapping f(x) to map characters, identifiers, and keywords in the code snippet to numeric vectors:
[0113] Where X is the vectorized representation of code snippet si, and d is the dimension of the feature vector.
[0114] 2. CNN Feature Extraction
[0115] 1) Convolution operation: We perform a convolution operation on the input Xi using kernel K to extract local features:
[0116] in, Let r be a feature value of the convolution output, c be the row and column size of the convolution kernel, and b be the bias.
[0117] 2) Activation function: The convolution output is then passed through the non-linear activation function ReLU:
[0118] 3) Pooling operation: Use pooling layers to reduce the dimensionality of convolutional features: e} in, These are the eigenvalues after pooling.
[0119] 4) High-level semantic feature extraction: Through multiple layers of convolution and pooling, the high-level semantic features of the code snippet are finally obtained: ,
[0120] in, is the high-level feature vector of the code snippet, and m is the dimension of the high-level feature vector.
[0121] 3. Component Profile Generation
[0122] 1) Feature clustering: Cluster all extracted fragment feature vectors F = {F1, F2, ..., Fn} and match them to features in the known component library: Ck={Fj|Cluster(Fj)=k}, k {1,2,.,K} Where Ck is the clustering result of the kth class, and K is the number of known components in the component library.
[0123] 2) Component information matching: Based on the clustering results, each clustering result is mapped to a specific component name and version number: Component_Info(Ck)={Name, Version} 4. Vulnerability Matching 1) Connect to vulnerability database: Based on the component information, query vulnerability databases (such as CVE) to obtain relevant vulnerability information: V={CVE-ID,Severity,Description} 2) Vulnerability list generation: The vulnerability information is associated with the component profile to output a complete vulnerability list, including vulnerability ID, severity, and remediation recommendations.
[0124] 5. System Verification
[0125] 1) Validate the dataset: Code snippets with known vulnerabilities are used as a verification set and input into the system for feature extraction and vulnerability matching.
[0126] 2) Verify accuracy: Compare the vulnerability list generated by the system with the results of manual analysis, and calculate the accuracy rate: Accuracy=
[0127] The above process standardizes code snippets through data preprocessing, extracts code features using CNN, and generates component profiles and vulnerability lists through clustering and database association. The entire process, based on feature extraction and matching, achieves efficient code feature recognition and vulnerability analysis.
[0128] 3. Format of deliverables
[0129] A code feature recognition and vulnerability analysis system based on convolutional neural networks can generate code component profiles and automatically identify vulnerabilities, improving the efficiency and accuracy of software security analysis.
[0130] Example 1: Security Assessment of Core Business Systems in the Financial Industry
[0131] A financial institution plans to conduct a security audit of its core business system to ensure that all components used in the system are free of known vulnerabilities, thereby reducing the risk of data breaches and business interruptions.
[0132] Data processing module: Obtain the source code file (e.g., .zip format) of the business system, decompress it, and divide the code file into blocks, with each block consisting of 200 lines of code.
[0133] A lexical analyzer is used to convert keywords, variable names, and operators in the code into numerical tokens and then quantize them into a fixed-dimensional feature matrix.
[0134] Feature extraction module: The vectorized feature matrix of the input code snippet is fed into the CNN model.
[0135] Using 3 convolutional layers, each with a kernel size of 3×33, and a pooling size of 2×22, low-level features are extracted and gradually aggregated into high-level semantic feature vectors.
[0136] Code profiling generation module: Features extracted through cluster analysis identify third-party libraries and components used in the system, such as Spring Framework and Apache Commons. It generates system component profiles based on component names and version numbers, including: Component Name: Spring Framework
[0137] Version number: 5.2.9.RELEASE
[0138] Vulnerability Analysis Module: Matches component profiles with the CVE vulnerability database, discovering the following vulnerabilities: CVE-2021-22118: Spring Framework remote code execution vulnerability, CVSS score 9.8 (high risk).
[0139] CVE-2020-5398: Spring Framework data disclosure vulnerability, CVSS score 7.5 (medium risk).
[0140] Generate a list of vulnerabilities, along with suggested remediation measures.
[0141] Visualization module: Uses pie charts to display the proportions of business system components. Uses bar charts to indicate the number and severity of each vulnerability. Outputs a report containing component profiles, a vulnerability list, and remediation recommendations for review.
[0142] The system detected a total of 15 known vulnerabilities, of which 3 are high-risk vulnerabilities. The priority remediation recommendation is to upgrade the Spring Framework to version 5.3.x.
[0143] Example 2: Software Supply Chain Risk Detection
[0144] A manufacturing company needs to conduct security assessments on the software in its supply chain to ensure that software components provided by third-party suppliers have no known security vulnerabilities.
[0145] Data processing module: Extracts content from binary files (such as .exe and .dll) provided by the vendor.
[0146] The binary instructions were converted into assembly code using a disassembler and then vectorized after being sliced into 1 KB segments.
[0147] Feature extraction module: Uses a pre-trained CNN model to process code slices and extract the underlying instruction patterns of each segment.
[0148] By using multiple layers of convolution and pooling, high-level feature vectors are generated to capture the correlation between instructions.
[0149] Code profiling generation module: Clustering identifies components in binary files and matches them with component libraries.
[0150] Image generation result: Component name: Log4j
[0151] Version number: 2.14.1
[0152] Vulnerability analysis module: A query of the CVE database revealed a known vulnerability in Log4j 2.14.1. CVE-2021-44228: Log4j remote code execution vulnerability, CVSS score 10.0 (extremely high risk).
[0153] Generate a vulnerability list and provide remediation solutions; it is recommended to upgrade to Log4j 2.17.x.
[0154] Visualization module: Uses a tree diagram to show the hierarchical relationships between different components in the supply chain. Uses heatmaps to indicate the risk distribution of components.
[0155] The system detected two high-risk vulnerabilities. It is recommended to immediately patch the Log4j component to reduce the risk of potential supply chain attacks.
[0156] Example 1 focuses on the core security assessment of financial business systems, emphasizing component identification and vulnerability correlation.
[0157] Example 2 focuses on supply chain security testing to ensure that third-party software complies with enterprise security standards. These two examples demonstrate the practical application value of the system in different scenarios.
[0158] I. Specific application areas or related products of this invention
[0159] 1. Cybersecurity
[0160] Used for security assessments of core business systems in industries such as finance, manufacturing, and e-commerce to prevent attacks caused by known vulnerabilities.
[0161] 2. Supply Chain Management
[0162] It is suitable for testing the security of the software supply chain to ensure that software components provided by third-party suppliers do not pose any security risks.
[0163] 3. Information technology audit
[0164] An internal information security audit process verifies the security of system components and reduces the risk of data breaches.
[0165] 4. Intelligent Operation and Maintenance
[0166] In automated operations and maintenance, the security status of the software stack and its components is monitored, and vulnerability remediation suggestions are provided.
[0167] Related products: 1. Vulnerability scanning tools Used to detect known vulnerabilities in business systems or software components.
[0168] 2. Code security testing platform
[0169] For the source code security analysis system, generate component profiles and match them with vulnerability databases.
[0170] 3. Supply Chain Risk Assessment System
[0171] A security risk detection platform focused on third-party software and components.
[0172] 4. Network Threat Monitoring System
[0173] A cybersecurity solution that uses visualization technology to show the distribution and severity of vulnerabilities.
[0174] II. Evidence related to the technical effects obtained by the embodiments of the present invention
[0175] 1. Vulnerability detection capabilities
[0176] In Example 1, a security assessment of the core financial business system detected 15 vulnerabilities, including 3 high-risk vulnerabilities (such as CVE-2021-22118 and CVSS 9.8).
[0177] This invention verifies that it can accurately identify known vulnerabilities in business systems, ensuring comprehensive coverage of security risks.
[0178] 2. Accuracy of component profile generation
[0179] In Example 2, the Log4j component and its version (2.14.1) were successfully identified through cluster analysis for binary files in the supply chain.
[0180] This demonstrates that the code profiling generation module of the present invention has high precision and can accurately capture the name and version number of components, laying the foundation for vulnerability analysis.
[0181] 3. Practicality of Vulnerability Remediation Recommendations
[0182] In both embodiments, a detailed vulnerability list including remediation solutions was generated (such as recommendations to upgrade Log4j to 2.17.x or Spring Framework to 5.3.x).
[0183] This invention not only detects vulnerabilities but also provides effective remediation suggestions, helping users quickly reduce risks.
[0184] 4. Diverse visualization and analysis capabilities
[0185] Use various formats such as pie charts, bar charts, tree diagrams, and heatmaps to display the system component composition and vulnerability distribution.
[0186] It improves the efficiency of data interpretation, enabling users to intuitively understand the security status of the system, which facilitates decision-making and action.
[0187] The above evidence fully demonstrates the effectiveness and reliability of this invention in practical applications, providing significant technical support for related fields.
[0188] It should be noted that embodiments of the present invention can be implemented in hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and / or included in processor control code, for example, such code provided on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuitry such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., or by software executed by various types of processors, or by a combination of the above-described hardware circuitry and software, such as firmware.
[0189] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions, and improvements made by those skilled in the art within the scope of the technology disclosed in the present invention, and within the spirit and principles of the present invention, should be covered within the scope of protection of the present invention.
Claims
1. A code feature recognition and vulnerability analysis system based on convolutional neural networks, characterized in that, The code feature recognition and vulnerability analysis system based on convolutional neural networks includes: Data processing module, feature extraction module, code profiling generation module, vulnerability analysis module, and visualization module; The data processing module, connected to the code profiling generation module, is used to decompress, segment, and preprocess the target source code or binary file; The feature extraction module, connected to the code profiling generation module, is used to extract low-level semantic features from code snippets using a convolutional neural network. The code profiling generation module, connected to the data processing module, feature extraction module, and vulnerability analysis module, is used to generate semantic profiles of code components based on the extracted features. The vulnerability analysis module, connected to the visualization module, is used to associate with the vulnerability database, identify known vulnerabilities in code components, and output a vulnerability list. The visualization module, connected to the vulnerability analysis module, is used to display the code component structure and vulnerability distribution in chart form.
2. The code feature recognition and vulnerability analysis system based on convolutional neural networks as described in claim 1, characterized in that, The data processing module: File unzip: Unzip source code files or binary files; Extract the parsable content from the code file; Code block division: Divide the source code file into blocks with a fixed number of lines, or slice the binary file into slices of a fixed size; The purpose of chunking is to divide the entire file into multiple standardized segments to facilitate subsequent processing; Data preprocessing: 1) Decompressing and partitioning the target file: After decompressing the target code file, divide the code into fixed-length segments according to a preset length: Where S is the set of code segments after partitioning, n is the number of code segments, and si represents the i-th code segment; Ensure that each code snippet does not overlap; 2) Vectorized encoding: Use vectorization mapping f(x) to map characters, identifiers, and keywords in the code snippet to numeric vectors: Where X is the vectorized representation of code snippet si, and d is the dimension of the feature vector.
3. The code feature recognition and vulnerability analysis system based on convolutional neural networks as described in claim 1, characterized in that, The feature extraction module: 1) Input layer: Receive the vectorized code snippet generated by the preprocessing module. The shape is n x d, where n is the length of the snippet and d is the feature dimension. 2) Convolution operation: Using multiple convolutional kernels K to slide and extract local features: in, For convolution output, is the kernel size, and b is the bias; 3) Activation function: Using the ReLU activation function: This gives the network nonlinear characteristics; 4) Pooling operations: Dimensionality reduction using max pooling or average pooling can extract key features and reduce the amount of data. 5) Output high-level features: The result of multiple convolutions and pooling is flattened into a vector F to represent the semantic features of each code segment.
4. The code feature recognition and vulnerability analysis system based on convolutional neural networks as described in claim 1, characterized in that, The code profiling generation module: 1) Feature clustering: Cluster all extracted fragment feature vectors F = {F1, F2, ..., Fn} and match them to features in the known component library: Ck={Fj|Cluster(Fj)=k}, k {1,2,.,K} Where Ck is the clustering result of the kth class, and K is the number of known components in the component library; 2) Component information matching: Based on the clustering results, each clustering result is mapped to a specific component name and version number: Component_Info(Ck)={Name, Version}.
5. The code feature recognition and vulnerability analysis system based on convolutional neural networks as described in claim 1, characterized in that, The vulnerability analysis module: 1) Vulnerability matching: Based on the component names and version numbers in the code profile, query vulnerability databases (such as CVE or NVD). V={CVE-ID, Severity,Description) 2) Vulnerability list generation: The identified vulnerabilities are compiled to generate a vulnerability list, which includes the following information: Vulnerability ID (CVE-ID); Vulnerability description; The vulnerability affects the component; Repair suggestions; 3) Priority sorting: Vulnerabilities are prioritized based on their severity, and it is recommended to fix high-risk vulnerabilities first.
6. The code feature recognition and vulnerability analysis system based on convolutional neural networks as described in claim 1, characterized in that, The visualization module: Component structure display: Use pie charts or tree diagrams to show the component composition of code files; Display the name, version number, and corresponding feature clustering results for each component; Vulnerability distribution display: Use bar charts or heatmaps to display the number and distribution of vulnerabilities; Mark the components where high-risk vulnerabilities are located and their impact scope; Vulnerability priority display: Use radar charts or tables to indicate the severity of vulnerabilities and provide remediation recommendations.
7. A method for code feature recognition and vulnerability analysis based on convolutional neural networks, implementing the code feature recognition and vulnerability analysis system based on any one of claims 1-6, characterized in that, The code feature recognition and vulnerability analysis method based on convolutional neural networks includes: Step 1: Decompress, segment, and preprocess the target source code or binary file using the data processing module; Step 2: Extract low-level semantic features from the code snippet using a convolutional neural network through the feature extraction module; Step 3: Generate semantic profiles of code components based on the extracted features using the code profile generation module; Step 4: Connect to the vulnerability database through the vulnerability analysis module, identify known vulnerabilities in the code components, and output a vulnerability list; Step 5: Use the visualization module to display the code component structure and vulnerability distribution in chart form.
8. A computer device, characterized in that, The computer device includes a memory and a processor. The memory stores a computer program, which, when executed by the processor, causes the processor to perform the steps of the code feature recognition and vulnerability analysis method based on convolutional neural networks as described in claim 7.
9. A computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the code feature recognition and vulnerability analysis method based on a convolutional neural network as described in claim 7.
10. An information data processing terminal, characterized in that, The information data processing terminal is used to implement the code feature recognition and vulnerability analysis system based on convolutional neural networks as described in any one of claims 1-6.