Vulnerability detection method and device, storage medium and electronic equipment

Abstract

The invention discloses a vulnerability detection method and device, a storage medium and electronic equipment. The method comprises the following steps: acquiring a cue word template corresponding to a to-be-detected vulnerability type; obtaining a to-be-detected code snippet and target vulnerability knowledge corresponding to the target financial system, and generating a target cue word according to the cue word template, the to-be-detected code snippet and the target vulnerability knowledge; and performing vulnerability detection on the target financial system according to the target cue word through a vulnerability detection model to obtain a vulnerability detection result, the vulnerability detection result being used for representing whether the target financial system has a vulnerability of the to-be-detected vulnerability type or not. Through the vulnerability detection method and device, the problem that vulnerability detection is low in accuracy due to the fact that vulnerability detection is achieved by depending on a manual maintenance rule in the prior art is solved.

Description

Technical Field

[0001] This application relates to the field of financial technology, and more specifically, to a vulnerability detection method and apparatus, storage medium, and electronic device. Background Technology

[0002] As the core infrastructure of financial services, the security and reliability of the financial system are of paramount importance. Therefore, vulnerability detection of the financial system's code is crucial. Current vulnerability detection methods primarily rely on rules and pattern matching, which depend on manual rule maintenance, resulting in relatively low accuracy.

[0003] For vulnerability detection based on rules maintained manually in related technologies, the accuracy of vulnerability detection is relatively low, and no effective solution has yet been proposed. Summary of the Invention

[0004] The main objective of this application is to provide a vulnerability detection method, apparatus, storage medium, and electronic device to address the problem that vulnerability detection relies on manually maintained rules, which results in low accuracy.

[0005] To achieve the above objectives, according to one aspect of this application, a vulnerability detection method is provided. The method includes: obtaining a prompt word template corresponding to a vulnerability type to be detected; obtaining a code segment to be detected and target vulnerability knowledge corresponding to a target financial system, and generating target prompt words based on the prompt word template, the code segment to be detected, and the target vulnerability knowledge; performing vulnerability detection on the target financial system based on the target prompt words using a vulnerability detection model, and obtaining a vulnerability detection result, wherein the vulnerability detection result is used to characterize whether the target financial system has a vulnerability of the type to be detected.

[0006] Furthermore, the vulnerability detection model performs vulnerability detection on the target financial system based on target prompts, and the vulnerability detection results are obtained as follows: the target prompts are processed by the input embedding layer of the vulnerability detection model to obtain the embedding vector representation of the target prompts; deep semantic analysis is performed by the encoder layer of the vulnerability detection model based on the embedding vector representation to obtain the code feature representation containing contextual information; knowledge enhancement processing is performed on the code feature representation containing contextual information by the knowledge fusion layer of the vulnerability detection model to obtain the knowledge-enhanced code feature representation; the knowledge-enhanced code feature representation is decoded by the decoder layer of the vulnerability detection model to obtain the vulnerability detection information; and the vulnerability detection information is transformed by the output layer of the vulnerability detection model to obtain the vulnerability detection result.

[0007] Furthermore, before acquiring the code segment to be detected and the target vulnerability knowledge corresponding to the target financial system, the method also includes: analyzing the code of the target financial system, identifying risk functions, and generating a list of risk functions; obtaining the code of each risk function and its sub-functions based on the risk function list, and determining the code segment to be detected based on the code of each risk function and its sub-functions.

[0008] Furthermore, based on the code of each risk function and its sub-functions, determining the code segment to be detected includes: comparing the total code length of the code of each risk function and its sub-functions with a preset threshold; if the total code length is less than the preset threshold, the code of each risk function and its sub-functions is taken as the code segment to be detected; if the total code length is greater than or equal to the preset threshold, the code of each risk function and its sub-functions is sliced ​​according to preset rules to obtain the code segment to be detected.

[0009] Furthermore, before obtaining the code snippet to be detected and the target vulnerability knowledge corresponding to the target financial system, the method also includes: retrieving the corresponding security development document snippet from the vulnerability knowledge base based on the vulnerability type to be detected and the configuration information of the target financial system; retrieving vulnerability information associated with the vulnerability type to be detected from the vulnerability knowledge base, wherein the vulnerability information includes at least the vulnerability definition, historical vulnerability cases and remediation solutions; and determining the target vulnerability knowledge based on the security development document snippet and the vulnerability information.

[0010] Furthermore, before obtaining the prompt word template corresponding to the type of vulnerability to be detected, the method also includes: obtaining preset security development document knowledge and preset vulnerability knowledge, and constructing a vulnerability knowledge base based on the preset security development document knowledge and preset vulnerability knowledge.

[0011] Furthermore, after obtaining the vulnerability detection results, the method also includes: displaying the vulnerability detection results through the target interface.

[0012] To achieve the above objectives, according to another aspect of this application, a vulnerability detection apparatus is provided. The apparatus includes: a first acquisition unit, configured to acquire a prompt word template corresponding to a vulnerability type to be detected; a second acquisition unit, configured to acquire a code segment to be detected and target vulnerability knowledge corresponding to a target financial system, and generate target prompt words based on the prompt word template, the code segment to be detected, and the target vulnerability knowledge; and a first processing unit, configured to perform vulnerability detection on the target financial system based on the target prompt words using a vulnerability detection model, and obtain vulnerability detection results, wherein the vulnerability detection results are used to characterize whether the target financial system has a vulnerability of the type to be detected.

[0013] Further, the first processing unit includes: a first processing subunit, used to process the target prompt word through the input embedding layer of the vulnerability detection model to obtain the embedding vector representation of the target prompt word; a second processing subunit, used to perform deep semantic analysis based on the embedding vector representation through the encoder layer of the vulnerability detection model to obtain a code feature representation containing contextual information; a third processing subunit, used to perform knowledge enhancement processing on the code feature representation containing contextual information through the knowledge fusion layer of the vulnerability detection model to obtain a knowledge-enhanced code feature representation; a fourth processing subunit, used to decode the knowledge-enhanced code feature representation through the decoder layer of the vulnerability detection model to obtain vulnerability detection information; and a fifth processing subunit, used to transform the vulnerability detection information through the output layer of the vulnerability detection model to obtain a vulnerability detection result.

[0014] Furthermore, the device also includes: a second processing unit, used to analyze the code of the target financial system, identify risk functions, and generate a list of risk functions before acquiring the code segment to be detected and the target vulnerability knowledge corresponding to the target financial system; and a first determining unit, used to acquire the code of each risk function and its sub-functions based on the risk function list, and determine the code segment to be detected based on the code of each risk function and its sub-functions.

[0015] Further, the first determining unit includes: a first determining subunit, used to compare the total code length of the code of each risk function and its subfunctions with a preset threshold; a second determining subunit, used to take the code of each risk function and its subfunctions as a code segment to be detected when the total code length is less than the preset threshold; and a third determining subunit, used to slice the code of each risk function and its subfunctions according to preset rules when the total code length is greater than or equal to the preset threshold, to obtain the code segment to be detected.

[0016] Furthermore, the device also includes: a third processing unit, used to retrieve corresponding security development document fragments from the vulnerability knowledge base based on the type of vulnerability to be detected and the configuration information of the target financial system before acquiring the code fragment to be detected and the target vulnerability knowledge corresponding to the target financial system; a fourth processing unit, used to retrieve vulnerability information associated with the type of vulnerability to be detected from the vulnerability knowledge base, wherein the vulnerability information includes at least vulnerability definition, historical vulnerability cases and remediation solutions; and a second determining unit, used to determine the target vulnerability knowledge based on the security development document fragments and the vulnerability information.

[0017] Furthermore, the device also includes a construction unit, which is used to acquire preset security development document knowledge and preset vulnerability knowledge before acquiring the prompt word template corresponding to the vulnerability type to be detected, and to construct a vulnerability knowledge base based on the preset security development document knowledge and preset vulnerability knowledge.

[0018] Furthermore, the device also includes a display unit for displaying the vulnerability detection results through a target interface after the vulnerability detection results are obtained.

[0019] According to another aspect of the present invention, an electronic device is also provided, comprising: a memory storing an executable program; and a processor for running the program, wherein the program executes the vulnerability detection method described above during runtime.

[0020] According to another aspect of the present invention, a computer-readable storage medium is also provided, wherein the storage medium stores a program, and the program controls the device where the storage medium is located to execute the vulnerability detection method described above during runtime.

[0021] In this embodiment, the following steps are employed: obtaining a prompt word template corresponding to the type of vulnerability to be detected; obtaining the code snippet to be detected and target vulnerability knowledge corresponding to the target financial system, and generating target prompt words based on the prompt word template, the code snippet to be detected, and the target vulnerability knowledge; and performing vulnerability detection on the target financial system using a vulnerability detection model based on the target prompt words to obtain vulnerability detection results, wherein the vulnerability detection results are used to characterize whether the target financial system has vulnerabilities of the type to be detected. This solves the technical problem in related technologies where vulnerability detection relies on manually maintained rules, resulting in low accuracy. In this solution, by intelligently customizing prompt words and combining code snippets of the target financial system with industry-specific vulnerability knowledge, the analytical precision and professionalism of the vulnerability detection model are enhanced, and the accuracy of vulnerability detection is improved. This enables efficient and accurate identification of specific types of potential vulnerabilities in the financial system, thereby improving the overall security defense level. Attached Figure Description

[0022] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0023] Figure 1 A hardware structure block diagram of a computer terminal for implementing a vulnerability detection method is shown.

[0024] Figure 2 This is a flowchart of a vulnerability detection method provided according to an embodiment of this application;

[0025] Figure 3 This is a schematic diagram of a vulnerability detection device provided according to an embodiment of this application;

[0026] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0027] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0028] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0029] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0030] Example 1

[0031] According to an embodiment of this application, a method embodiment for vulnerability detection is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0032] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a vulnerability detection method is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0033] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0034] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the vulnerability detection method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the aforementioned vulnerability detection method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0035] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0036] The display may be a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0037] Under the aforementioned operating environment, this application provides the following: Figure 2 The vulnerability detection method shown. Figure 2 This is a flowchart of a vulnerability detection method according to Embodiment 1 of this application. The vulnerability detection method includes:

[0038] Step S201: Obtain the prompt word template corresponding to the type of vulnerability to be detected;

[0039] Step S202: Obtain the code snippet to be detected and the target vulnerability knowledge corresponding to the target financial system, and generate target prompt words based on the prompt word template, the code snippet to be detected and the target vulnerability knowledge;

[0040] Step S203: The vulnerability detection model is used to perform vulnerability detection on the target financial system based on the target prompt words, and the vulnerability detection results are obtained. The vulnerability detection results are used to characterize whether the target financial system has vulnerabilities of the type to be detected.

[0041] Optionally, independent prompt word templates are pre-built for different vulnerability types. The corresponding prompt word template is selected based on the type of vulnerability to be detected. Then, context preparation and knowledge retrieval are performed to obtain the code snippets to be detected and the target vulnerability knowledge corresponding to the target financial system. For example, to detect whether a transaction processing system has an SQL injection vulnerability, the system retrieves relevant knowledge from a pre-built vulnerability knowledge base as context based on the type of vulnerability to be detected (i.e., SQL injection vulnerability), and adds a small number of annotated instances to improve accuracy and help the model understand and apply knowledge of new tasks or domains more quickly. The knowledge types include secure coding standards, vulnerability type definitions, and historical vulnerability cases. For example, target vulnerability knowledge includes the definition, characteristics, and remediation methods of SQL injection, as well as financial industry-specific secure coding standards and historical vulnerability cases.

[0042] Optionally, the system fills the contextual knowledge and the code snippet to be detected into the corresponding prompt word template to construct a complete prompt word (i.e., target prompt word) to guide the vulnerability detection model to perform accurate vulnerability analysis. The vulnerability detection model can be obtained by fine-tuning a large language model through a large amount of code and security specifications. For example, the target prompt word is: Analyze whether the following code may cause an SQL injection vulnerability: [code snippet to be checked]. Please consider the following information: [definition and characteristics of SQL injection] and the following security coding specifications: [bank security coding specification snippet].

[0043] In summary, this solution addresses the technical problem of low accuracy in vulnerability detection due to reliance on manually maintained rules in related technologies. This solution enhances the analytical precision and professionalism of the vulnerability detection model by intelligently customizing prompts and combining code snippets from the target financial system with industry-specific vulnerability knowledge. This improves the accuracy of vulnerability detection, enabling efficient and accurate identification of specific types of potential vulnerabilities in financial systems and enhancing the overall security defense level.

[0044] Optionally, in the vulnerability detection method provided in this application embodiment, the vulnerability detection method performs vulnerability detection on the target financial system based on the target prompt words using a vulnerability detection model to obtain vulnerability detection results. This includes: processing the target prompt words through the input embedding layer of the vulnerability detection model to obtain the embedding vector representation of the target prompt words; performing deep semantic analysis based on the embedding vector representation through the encoder layer of the vulnerability detection model to obtain a code feature representation containing contextual information; performing knowledge enhancement processing on the code feature representation containing contextual information through the knowledge fusion layer of the vulnerability detection model to obtain a knowledge-enhanced code feature representation; decoding the knowledge-enhanced code feature representation through the decoder layer of the vulnerability detection model to obtain vulnerability detection information; and transforming the vulnerability detection information through the output layer of the vulnerability detection model to obtain the vulnerability detection result.

[0045] In an optional embodiment, the system sends the constructed target hints to a vulnerability detection model for analysis. Based on contextual knowledge and code slicing, the model identifies vulnerabilities and returns detailed analysis results, including vulnerability type, location, possible impact scope, and remediation suggestions. For example, it identifies the possibility of an SQL injection vulnerability in the code, locates the specific line number, and provides a vulnerability description and remediation suggestions.

[0046] In an optional embodiment, the target prompt word is processed by the input embedding layer of the vulnerability detection model to obtain the embedding vector representation of the target prompt word. For example, the input embedding layer converts the text information in the code snippet and the prompt word into a numerical vector to provide a computable representation for the model.

[0047] In an optional embodiment, the encoder layer of the vulnerability detection model performs deep semantic analysis based on the embedded vector representation to obtain a code feature representation containing contextual information. The encoder layer consists of multiple encoders responsible for performing deep semantic analysis on the input code and knowledge, capturing dependencies in the code structure through a self-attention mechanism, and achieving feature extraction and information integration through a feedforward neural network.

[0048] In an optional embodiment, the knowledge fusion layer of the vulnerability detection model performs knowledge enhancement processing on the code feature representation containing context information to obtain a knowledge-enhanced code feature representation. The knowledge fusion layer is used to fuse information from a vulnerability knowledge base. By performing knowledge enhancement processing on the code feature representation containing context information, relevant knowledge is embedded into the intermediate representation of the model to enhance the model's domain awareness capability.

[0049] In an optional embodiment, the knowledge-enhanced code feature representation is decoded by the decoder layer of the vulnerability detection model to obtain vulnerability detection information. The decoder layer is responsible for generating meaningful output from the model's internal representation, and it predicts the output sequence through a self-attention mechanism.

[0050] In an optional embodiment, the vulnerability detection information is transformed through the output layer of the vulnerability detection model to obtain the vulnerability detection result. The output layer is used to transform the final representation into a predicted probability distribution of the vulnerability detection result. For vulnerability localization, a classification task is involved; for generating remediation suggestions, a text generation task is involved.

[0051] By conducting multi-level in-depth analysis and knowledge fusion of target prompts, the accuracy and understanding of the vulnerability detection model are effectively improved, enabling the output of detailed vulnerability detection results, thereby achieving a high degree of automated and intelligent detection of vulnerabilities in financial systems.

[0052] Optionally, in the vulnerability detection method provided in this application embodiment, before obtaining the code segment to be detected and the target vulnerability knowledge corresponding to the target financial system, the method further includes: analyzing the code of the target financial system, identifying risk functions, and generating a list of risk functions; obtaining the code of each risk function and its sub-functions based on the risk function list, and determining the code segment to be detected based on the code of each risk function and its sub-functions.

[0053] In an optional embodiment, before obtaining the code fragment to be detected and the target vulnerability knowledge corresponding to the target financial system, it is first necessary to determine the code fragment to be detected. For example, the code of the transaction processing system can be analyzed using code analysis tools to identify the risk functions contained therein (such as server request processing functions, expressive state transition interfaces, service-oriented call interfaces, etc.), generate a list of risk functions, and then extract the code of all functions involved based on the risk function list to obtain the code fragment to be detected.

[0054] In an optional embodiment, the code snippets to be inspected are extracted from the codebase, including the following steps:

[0055] The bank compiles a list of development frameworks and related development documentation, and analyzes the documentation to extract various definitions and request processing function methods.

[0056] Search the codebase for various configurations and, in conjunction with the configuration file definitions, find all request handling functions defined through the configuration files;

[0057] By analyzing the code through bytecode analysis and optimization frameworks, and combining the previously summarized documentation rules, we extracted various request handling functions defined in the code, including those defined through annotations and dynamically registered via APIs.

[0058] After extracting the list of functions to be analyzed, the call relationships of these functions are analyzed in turn, and all sub-functions called by each function are extracted. By extracting the code of all involved functions through the call relationships, the code to be tested is obtained.

[0059] By pre-analyzing the code of the target financial system, we can accurately locate potentially vulnerable functions and construct the code snippets to be tested. This improves the targeting and efficiency of vulnerability detection, reduces computational resource consumption, ensures the depth and breadth of vulnerability detection, and thus enhances the security of the entire financial system.

[0060] Optionally, in the vulnerability detection method provided in this application embodiment, determining the code segment to be detected based on the code of each risk function and its sub-functions includes: comparing the total code length of the code of each risk function and its sub-functions with a preset threshold; if the total code length is less than the preset threshold, taking the code of each risk function and its sub-functions as the code segment to be detected; if the total code length is greater than or equal to the preset threshold, performing code slicing on the code of each risk function and its sub-functions according to preset rules to obtain the code segment to be detected.

[0061] In an optional embodiment, the total code length of each risk function and its sub-functions is compared with a preset threshold. If the total code length is less than the preset threshold, the code of each risk function and its sub-functions is directly used as the code segment to be detected.

[0062] In an optional embodiment, if the total code length is greater than or equal to a preset threshold, code slicing is performed on the code of each risk function and its sub-functions according to preset rules to obtain the code fragments to be detected. Optionally, the extraction rules are dynamically adjusted for different vulnerability detection types. For example, for SQL injection vulnerabilities, it is necessary to extract the relevant code fragments of the data flow path from the input parameters to the SQL query function; for file upload vulnerabilities, it is necessary to extract the code fragments related to file operations.

[0063] By extracting code relevant to the current vulnerability check through code slicing, the amount of code to be analyzed is reduced, the analysis efficiency is improved, and the situation of insufficient context window and lack of attention of large models due to excessively long code snippets is avoided, thereby improving the response speed and quality of large models.

[0064] Optionally, in the vulnerability detection method provided in this application embodiment, before obtaining the code segment to be detected and the target vulnerability knowledge corresponding to the target financial system, the method further includes: retrieving the corresponding security development document segment from the vulnerability knowledge base based on the vulnerability type to be detected and the configuration information of the target financial system; retrieving vulnerability information associated with the vulnerability type to be detected from the vulnerability knowledge base, wherein the vulnerability information includes at least vulnerability definition, historical vulnerability cases and remediation solutions; and determining the target vulnerability knowledge based on the security development document segment and the vulnerability information.

[0065] In an optional embodiment, before obtaining the code snippet to be detected and the target vulnerability knowledge corresponding to the target financial system, it is first necessary to determine the target vulnerability knowledge. Specifically, based on the type of vulnerability to be detected and the configuration information of the target financial system, the corresponding security development document snippet is retrieved from the vulnerability knowledge base, and then vulnerability information associated with the type of vulnerability to be detected is retrieved from the vulnerability knowledge base. Finally, the security development document snippet and the vulnerability information are integrated as the target vulnerability knowledge.

[0066] In an optional embodiment, the steps for using the vulnerability knowledge base are as follows: based on the type of vulnerability to be analyzed and the situation of the target being analyzed, relevant security development document fragments are retrieved; vulnerability definitions, historical vulnerability cases, and remediation solutions are retrieved; information related to the retrieval results is found through a knowledge graph; and additional knowledge related to the security development document fragments and vulnerability information is identified and integrated using knowledge graph technology to expand the knowledge coverage and enhance reasoning ability.

[0067] Through the above process, target vulnerability knowledge can be efficiently acquired and prepared to support the subsequent vulnerability detection process, ensuring that the large model can accurately identify and analyze vulnerabilities based on rich background information.

[0068] Optionally, in the vulnerability detection method provided in this application embodiment, before obtaining the prompt word template corresponding to the vulnerability type to be detected, the method further includes: obtaining preset security development document knowledge and preset vulnerability knowledge, and constructing a vulnerability knowledge base based on the preset security development document knowledge and preset vulnerability knowledge.

[0069] In one optional embodiment, a vulnerability knowledge base is pre-built. The financial sector vulnerability knowledge base mainly consists of security development documentation knowledge (such as general security development specifications and financial industry security development specifications) and vulnerability knowledge (such as general vulnerability knowledge, financial industry vulnerability knowledge, and historical vulnerability case knowledge).

[0070] In an optional embodiment, security development documentation knowledge is segmented according to document type: for text files, segmentation is based on paragraphs and headings; for table files, segmentation is based on the table's composition, determining whether to segment by column or row. When segmenting documents, a knowledge graph can also be used to establish relationships between segments. After retrieving the required document segments, related segments can be found through the knowledge graph, serving as knowledge to aid in the larger model analysis.

[0071] In an optional embodiment, vulnerability knowledge mainly includes the following:

[0072] General vulnerability knowledge: This will serve as a foundational knowledge base, responsible for providing basic vulnerability knowledge so that large models can grasp basic vulnerability definitions, such as common vulnerability types like SQL injection and file upload.

[0073] Financial Industry Vulnerability Knowledge: This section summarizes and categorizes common vulnerability types in the financial industry to enhance the ability of large models to perceive the risks faced by the financial industry. Examples include logical vulnerability types related to financial business, such as payment and reconciliation.

[0074] Historical vulnerability case studies: Using historical vulnerabilities from both inside and outside the bank as case studies enhances the large model's ability to reason about similar vulnerabilities.

[0075] In an alternative embodiment, when building a knowledge base for vulnerability knowledge processing, a knowledge graph can be used to link related different parts of knowledge so that relevant information can be retrieved.

[0076] By building a vulnerability knowledge base in the financial field, we can fill the gaps in the domain knowledge of large models, reduce false positives and false negatives, and improve the ability of large models in vulnerability discovery. The historical vulnerability cases and remediation solutions in the vulnerability knowledge base can enhance the reasoning ability of large models, support multimodal analysis, and assist in generating verification code and remediation suggestions, realizing closed-loop automation from detection to remediation, making vulnerability discovery more accurate and efficient.

[0077] Optionally, in the vulnerability detection method provided in the embodiments of this application, after obtaining the vulnerability detection result, the method further includes: displaying the vulnerability detection result through a target interface.

[0078] In an optional embodiment, the vulnerability detection results are displayed to the user via a web interface, including vulnerability description, risk level, number of lines of code affected, and remediation suggestions. For example, it may display potential SQL injection vulnerabilities in the code.

[0079] The vulnerability detection method provided in this application adopts the following steps: obtaining a prompt word template corresponding to the type of vulnerability to be detected; obtaining the code segment to be detected and target vulnerability knowledge corresponding to the target financial system, and generating target prompt words based on the prompt word template, the code segment to be detected, and the target vulnerability knowledge; performing vulnerability detection on the target financial system based on the target prompt words using a vulnerability detection model, and obtaining vulnerability detection results, wherein the vulnerability detection results are used to characterize whether the target financial system has vulnerabilities of the type of vulnerability to be detected. This solves the technical problem in related technologies where vulnerability detection relies on manually maintained rules, resulting in low accuracy. In this solution, by intelligently customizing prompt words and combining code segments of the target financial system with industry-specific vulnerability knowledge, the analytical precision and professionalism of the vulnerability detection model are enhanced, and the accuracy of vulnerability detection is improved. This enables efficient and accurate identification of specific types of potential vulnerabilities in the financial system, thereby improving the overall security defense level.

[0080] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0081] Example 2

[0082] This application also provides a vulnerability detection device. It should be noted that the vulnerability detection device of this application can be used to execute the vulnerability detection method provided in this application. The vulnerability detection device provided in this application is described below.

[0083] According to embodiments of this application, a vulnerability detection apparatus for implementing the above-described vulnerability detection method is also provided, such as... Figure 3 As shown, the device includes: a first acquisition unit 301, a second acquisition unit 302, and a first processing unit 303.

[0084] The first acquisition unit 301 is used to acquire the prompt word template corresponding to the type of vulnerability to be detected;

[0085] The second acquisition unit 302 is used to acquire the code fragment to be detected and the target vulnerability knowledge corresponding to the target financial system, and generate target prompt words based on the prompt word template, the code fragment to be detected and the target vulnerability knowledge;

[0086] The first processing unit 303 is used to perform vulnerability detection on the target financial system based on the target prompt words using a vulnerability detection model, and obtain vulnerability detection results. The vulnerability detection results are used to characterize whether the target financial system has vulnerabilities of the type to be detected.

[0087] The vulnerability detection device provided in this application embodiment acquires a prompt word template corresponding to the type of vulnerability to be detected by a first acquisition unit 301; a second acquisition unit 302 acquires the code segment to be detected and the target vulnerability knowledge corresponding to the target financial system, and generates a target prompt word based on the prompt word template, the code segment to be detected and the target vulnerability knowledge; a first processing unit 303 performs vulnerability detection on the target financial system based on the target prompt word through a vulnerability detection model to obtain a vulnerability detection result, wherein the vulnerability detection result is used to characterize whether the target financial system has a vulnerability of the type of vulnerability to be detected.

[0088] Optionally, in the vulnerability detection device provided in this application embodiment, the first processing unit includes: a first processing subunit, used to process the target prompt word through the input embedding layer of the vulnerability detection model to obtain the embedding vector representation of the target prompt word; a second processing subunit, used to perform deep semantic analysis based on the embedding vector representation through the encoder layer of the vulnerability detection model to obtain a code feature representation containing context information; a third processing subunit, used to perform knowledge enhancement processing on the code feature representation containing context information through the knowledge fusion layer of the vulnerability detection model to obtain a knowledge-enhanced code feature representation; a fourth processing subunit, used to decode the knowledge-enhanced code feature representation through the decoder layer of the vulnerability detection model to obtain vulnerability detection information; and a fifth processing subunit, used to transform the vulnerability detection information through the output layer of the vulnerability detection model to obtain a vulnerability detection result.

[0089] Optionally, in the vulnerability detection device provided in this application embodiment, the device further includes: a second processing unit, used to analyze the code of the target financial system, identify risk functions, and generate a risk function list before obtaining the code segment to be detected and the target vulnerability knowledge corresponding to the target financial system; and a first determining unit, used to obtain the code of each risk function and its sub-functions according to the risk function list, and determine the code segment to be detected according to the code of each risk function and its sub-functions.

[0090] Optionally, in the vulnerability detection device provided in this application embodiment, the first determining unit includes: a first determining subunit, used to compare the total code length of the code of each risk function and its subfunctions with a preset threshold; a second determining subunit, used to take the code of each risk function and its subfunctions as a code segment to be detected when the total code length is less than the preset threshold; and a third determining subunit, used to slice the code of each risk function and its subfunctions according to preset rules when the total code length is greater than or equal to the preset threshold, to obtain the code segment to be detected.

[0091] Optionally, in the vulnerability detection device provided in this application embodiment, the device further includes: a third processing unit, used to retrieve corresponding security development document fragments from the vulnerability knowledge base based on the type of vulnerability to be detected and the configuration information of the target financial system before obtaining the code fragment to be detected and the target vulnerability knowledge corresponding to the target financial system; a fourth processing unit, used to retrieve vulnerability information associated with the type of vulnerability to be detected from the vulnerability knowledge base, wherein the vulnerability information includes at least vulnerability definition, historical vulnerability cases and remediation schemes; and a second determining unit, used to determine the target vulnerability knowledge based on the security development document fragments and the vulnerability information.

[0092] Optionally, in the vulnerability detection device provided in this application embodiment, the device further includes: a construction unit, used to acquire preset security development document knowledge and preset vulnerability knowledge before acquiring the prompt word template corresponding to the vulnerability type to be detected, and to construct a vulnerability knowledge base based on the preset security development document knowledge and preset vulnerability knowledge.

[0093] Optionally, in the vulnerability detection device provided in the embodiments of this application, the device further includes: a display unit, used to display the vulnerability detection results through a target interface after obtaining the vulnerability detection results.

[0094] It should be noted that the first acquisition unit 301, the second acquisition unit 302, and the first processing unit 303 mentioned above correspond to steps S201 to S203 in Embodiment 1. The three units and the corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above units can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0095] Example 3

[0096] Embodiments of this application may provide an electronic device. Figure 4This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 (Only one is shown) Processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0097] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0098] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: obtaining a prompt word template corresponding to the type of vulnerability to be detected; obtaining the code fragment to be detected and the target vulnerability knowledge corresponding to the target financial system, and generating a target prompt word based on the prompt word template, the code fragment to be detected, and the target vulnerability knowledge; performing vulnerability detection on the target financial system based on the target prompt word using a vulnerability detection model, and obtaining vulnerability detection results, wherein the vulnerability detection results are used to characterize whether the target financial system has a vulnerability of the type of vulnerability to be detected.

[0099] The processor can access information and applications stored in memory via a transmission device to perform the following steps: Processing the target prompt word through the input embedding layer of the vulnerability detection model to obtain its embedding vector representation; performing deep semantic analysis based on the embedding vector representation through the encoder layer of the vulnerability detection model to obtain a code feature representation containing contextual information; performing knowledge enhancement processing on the code feature representation containing contextual information through the knowledge fusion layer of the vulnerability detection model to obtain a knowledge-enhanced code feature representation; decoding the knowledge-enhanced code feature representation through the decoder layer of the vulnerability detection model to obtain vulnerability detection information; and transforming the vulnerability detection information through the output layer of the vulnerability detection model to obtain the vulnerability detection result.

[0100] The processor can access information and applications stored in memory via a transmission device to perform the following steps: before acquiring the code fragment to be detected and the target vulnerability knowledge corresponding to the target financial system, analyze the code of the target financial system, identify risk functions, and generate a list of risk functions; obtain the code of each risk function and its sub-functions based on the risk function list, and determine the code fragment to be detected based on the code of each risk function and its sub-functions.

[0101] The processor can access the information and application programs stored in the memory via the transmission device to perform the following steps: compare the total code length of the code for each risk function and its sub-functions with a preset threshold; if the total code length is less than the preset threshold, use the code for each risk function and its sub-functions as a code segment to be detected; if the total code length is greater than or equal to the preset threshold, slice the code for each risk function and its sub-functions according to preset rules to obtain the code segment to be detected.

[0102] The processor can invoke information and applications stored in the memory via a transmission device to perform the following steps: Before obtaining the code snippet to be detected and the target vulnerability knowledge corresponding to the target financial system, based on the type of vulnerability to be detected and the configuration information of the target financial system, retrieve the corresponding security development document snippet from the vulnerability knowledge base; retrieve vulnerability information associated with the type of vulnerability to be detected from the vulnerability knowledge base, wherein the vulnerability information includes at least the vulnerability definition, historical vulnerability cases and remediation solutions; determine the target vulnerability knowledge based on the security development document snippet and the vulnerability information.

[0103] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: before obtaining the prompt word template corresponding to the type of vulnerability to be detected, obtain preset security development document knowledge and preset vulnerability knowledge, and construct a vulnerability knowledge base based on the preset security development document knowledge and preset vulnerability knowledge.

[0104] The processor can access information and applications stored in memory via a transmission device to perform the following steps: After obtaining the vulnerability detection results, display the vulnerability detection results through the target interface.

[0105] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4The different configurations shown.

[0106] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0107] Example 4

[0108] Embodiments of this application also provide a computer-readable storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the vulnerability detection method provided in Embodiment 1.

[0109] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0110] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing vulnerability detection method steps.

[0111] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0112] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0113] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0114] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0115] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0116] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0117] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A vulnerability detection method, characterized in that, include: Obtain the prompt word template corresponding to the type of vulnerability to be detected; Obtain the code snippet to be detected and the target vulnerability knowledge corresponding to the target financial system, and generate target prompt words based on the prompt word template, the code snippet to be detected and the target vulnerability knowledge; The target financial system is subjected to vulnerability detection based on the target prompt words using a vulnerability detection model, and the vulnerability detection results are obtained. The vulnerability detection results are used to characterize whether the target financial system has a vulnerability of the type to be detected.

2. The method according to claim 1, characterized in that, The vulnerability detection model performs vulnerability detection on the target financial system based on the target prompt words, and the vulnerability detection results include: The target prompt word is processed by the input embedding layer of the vulnerability detection model to obtain the embedding vector representation of the target prompt word; The encoder layer of the vulnerability detection model performs deep semantic analysis based on the embedded vector representation to obtain a code feature representation containing contextual information. The knowledge fusion layer of the vulnerability detection model performs knowledge enhancement processing on the code feature representation containing context information to obtain a knowledge-enhanced code feature representation. The vulnerability detection model decodes the knowledge-enhanced code feature representation through its decoder layer to obtain vulnerability detection information. The vulnerability detection information is transformed through the output layer of the vulnerability detection model to obtain the vulnerability detection result.

3. The method according to claim 1, characterized in that, Before acquiring the code snippet to be detected and the target vulnerability knowledge corresponding to the target financial system, the method further includes: The code of the target financial system is analyzed to identify risk functions and generate a list of risk functions. The code of each risk function and its sub-functions is obtained based on the risk function list, and the code segment to be detected is determined based on the code of each risk function and its sub-functions.

4. The method according to claim 3, characterized in that, Based on the code of each risk function and its sub-functions, the code fragment to be detected is determined to include: The total code length of each risk function and its sub-functions is compared with a preset threshold. If the total code length is less than the preset threshold, the code of each risk function and its sub-functions will be used as the code segment to be detected. If the total code length is greater than or equal to the preset threshold, the code of each risk function and its sub-functions is sliced ​​according to preset rules to obtain the code segment to be detected.

5. The method according to claim 1, characterized in that, Before acquiring the code snippet to be detected and the target vulnerability knowledge corresponding to the target financial system, the method further includes: Based on the type of vulnerability to be detected and the configuration information of the target financial system, retrieve the corresponding security development document fragments from the vulnerability knowledge base; Retrieve vulnerability information associated with the vulnerability type to be detected from the vulnerability knowledge base, wherein the vulnerability information includes at least the vulnerability definition, historical vulnerability cases and remediation solutions; Based on the security development document fragment and the vulnerability information, the target vulnerability knowledge is determined.

6. The method according to claim 1, characterized in that, Before obtaining the prompt word template corresponding to the type of vulnerability to be detected, the method further includes: Acquire preset security development document knowledge and preset vulnerability knowledge, and construct a vulnerability knowledge base based on the preset security development document knowledge and preset vulnerability knowledge.

7. The method according to claim 1, characterized in that, After obtaining the vulnerability detection results, the method further includes: The vulnerability detection results are displayed through the target interface.

8. A vulnerability detection device, characterized in that, include: The first acquisition unit is used to acquire the prompt word template corresponding to the type of vulnerability to be detected; The second acquisition unit is used to acquire the code fragment to be detected and the target vulnerability knowledge corresponding to the target financial system, and generate target prompt words based on the prompt word template, the code fragment to be detected and the target vulnerability knowledge; The first processing unit is used to perform vulnerability detection on the target financial system based on the target prompt words using a vulnerability detection model, and obtain vulnerability detection results, wherein the vulnerability detection results are used to characterize whether the target financial system has a vulnerability of the type to be detected.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device containing the computer-readable storage medium to perform the vulnerability detection method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program executes the vulnerability detection method according to any one of claims 1 to 7 when it runs.

Images