Automated Generation Method and System for Static Vulnerability Analysis and Assessment Data of MPI Programs

Abstract

This invention discloses an automated method and system for generating static vulnerability analysis and evaluation data for MPI programs, belonging to the field of software testing technology. Addressing the lack of high-quality evaluation datasets in existing MPI program static analysis tools, this invention employs a program mutation method driven by an MPI vulnerability pattern knowledge base. It constructs a formalized MPI vulnerability pattern description system, designs semantically preserved vulnerability injection operators, and combines lightweight symbolic execution technology for MPI programs to verify vulnerability reachability, thereby achieving automated generation and annotation of MPI vulnerability samples. The evaluation dataset generated by this invention features comprehensive vulnerability type coverage, accurate vulnerability annotation, high sample diversity, and strong traceability, providing crucial support for the testing, evaluation, and improvement of MPI program static analysis tools.

Description

Technical Field

[0001] This invention belongs to the field of software testing technology, and in particular relates to an automated method and system for generating static vulnerability analysis and evaluation data for MPI programs. Background Technology

[0002] Message Passing Interface (MPI) is the most widely used parallel programming standard in the field of high-performance computing, and it is widely used in computationally intensive fields such as scientific computing, weather simulation, molecular dynamics, and artificial intelligence training. MPI enables multiple processes running on a distributed memory system to efficiently exchange data and perform collaborative computation by defining a standardized set of message passing semantics.

[0003] However, the parallel nature of MPI programs also presents unique security challenges. Unlike traditional serial programs, MPI programs involve message passing, synchronization, and coordination among multiple processes. This makes MPI programs susceptible to various unique types of vulnerabilities, including but not limited to: deadlock vulnerabilities, race condition vulnerabilities, buffer overflow vulnerabilities, message type mismatch vulnerabilities, and resource leakage vulnerabilities. These vulnerabilities can not only cause program crashes or incorrect calculation results, but can also be exploited by malicious attackers, leading to serious security consequences such as information leakage or system control. Therefore, effective vulnerability detection and analysis of MPI programs has significant theoretical and practical value.

[0004] Static analysis is a technique that discovers potential vulnerabilities and defects by analyzing the source code or intermediate representation of a program without actually executing it. Compared to dynamic testing, static analysis has advantages such as high coverage, no need to construct test cases, and the ability to discover problems early in development. For static analysis of MPI programs, academia and industry have developed various tools and methods. Mainstream MPI static analysis tools include MUST, MPI-Checker, PARCOACH, and ISP. These tools employ different analysis techniques, such as data flow analysis, abstract interpretation, and model checking, and can detect various vulnerability types in MPI programs, such as deadlocks, race conditions, and parameter mismatches. However, due to the complexity of MPI programs and the special nature of parallel semantics, the detection capabilities and accuracy of these tools vary significantly, and a unified and comprehensive evaluation standard and benchmark dataset are lacking.

[0005] Benchmark datasets are a crucial resource for evaluating the effectiveness of static analysis tools. A high-quality benchmark dataset should contain a sufficient number of program samples, cover multiple vulnerability types, and provide accurate vulnerability annotation information, including vulnerability location, vulnerability type, and vulnerability triggering conditions. However, the current field of MPI program static analysis faces a severe shortage of benchmark datasets, mainly in the following aspects.

[0006] First, existing datasets are limited in size and coverage. Currently, publicly available MPI vulnerability datasets mainly come from manually constructed samples in academic research, such as the test case set accompanying the MUST tool and the verification samples of MPI-Checker. These datasets typically contain only dozens to hundreds of program samples and mainly cover basic vulnerability types such as deadlocks and simple parameter errors. They lack sufficient coverage for advanced vulnerability types such as complex race conditions, implicit type conversion errors, and collective communication mismatches.

[0007] Second, manually constructing datasets is costly and inefficient. Due to the complex parallel semantics of MPI programs, manually writing test cases with specific vulnerability patterns requires developers to have extensive MPI programming experience and security knowledge. Empirical estimates suggest that a qualified MPI vulnerability sample typically takes several hours to several days from design to verification, which severely limits the speed at which evaluation datasets can be expanded.

[0008] Third, existing datasets lack systematicity and traceability. Manually constructed vulnerability samples are usually based on developers' personal experience and lack a systematic review and formal description of MPI vulnerability patterns. This can lead to problems such as duplicate vulnerability patterns, uneven coverage, and difficulty in tracing the root causes of vulnerabilities in the generated datasets, affecting the scientific validity and credibility of the assessment results.

[0009] Fourth, the quality of dataset annotation is difficult to guarantee. Due to the lack of automated vulnerability verification mechanisms, manually annotated vulnerability information may contain errors or be incomplete, such as labeling unreachable vulnerabilities as real vulnerabilities or inaccurately labeling vulnerability locations. These annotation errors directly affect the accuracy of the evaluation results of static analysis tools.

[0010] To address the issue of automating the generation of software vulnerability assessment datasets, existing technologies have proposed several relevant technical methods.

[0011] Program mutation is a technique that generates variants by making minor modifications to the original program. Initially used in mutation testing, it has been applied to vulnerability sample generation. For example, the LAVA project automatically generates C program samples with buffer overflow vulnerabilities by injecting data flow-sensitive vulnerability triggering conditions into the program. However, existing program mutation methods are primarily designed for serial programming and fail to consider the parallel semantics and communication characteristics of MPI programs. Directly applying these methods to MPI programs may result in semantically incorrect or uncompileable variants.

[0012] Template-based code generation technology automatically generates program code that conforms to specific patterns by using predefined code templates and parameterized rules. This method is widely used in compiler testing (such as Csmith) and security testing. However, template-based methods can typically only generate program samples with similar structures, and their diversity is limited by the template design, making it difficult to cover the complex and varied code patterns and vulnerability triggering scenarios in real MPI programs.

[0013] Symbolic execution-based test generation techniques collect and solve path constraints by symbolizing program input, automatically generating test cases that cover specific program paths. Symbolic execution excels at discovering program vulnerabilities, but it is primarily used to generate input data that triggers vulnerabilities, rather than generating program code containing vulnerabilities. Furthermore, applying symbolic execution to MPI programs faces the challenge of state space explosion, because the execution path of an MPI program depends not only on the input data but also on the message passing order between processes.

[0014] In summary, existing technical methods have the following shortcomings in the automated generation of vulnerability assessment datasets for MPI programs: (1) lack of systematic modeling and formal description of MPI vulnerability patterns; (2) failure to effectively handle the parallel semantics and communication dependencies of MPI programs; (3) lack of an effective verification mechanism for the accessibility of vulnerabilities in generated samples; and (4) difficulty in guaranteeing the quality and diversity of the generated datasets. Summary of the Invention

[0015] To address the aforementioned technical problems, this invention proposes an automated method and system for generating static vulnerability analysis and evaluation data for MPI programs. By constructing an MPI vulnerability pattern knowledge base and combining program mutation technology and symbolic execution verification mechanisms, this invention automatically generates MPI program samples with clearly labeled vulnerabilities, providing a high-quality benchmark dataset for the evaluation and testing of MPI program static analysis tools.

[0016] The first aspect of this invention proposes an automated method for generating static vulnerability analysis and evaluation data for MPI programs, the method comprising:

[0017] S1. At the input layer, construct the MPI source code library and vulnerability pattern knowledge base;

[0018] S2. Call the code preprocessing module to perform lexical and syntactic analysis on the MPI source code in the MPI source code library and construct an abstract syntax tree (AST) to identify the API calls in the program corresponding to the MPI source code, thereby extracting the parameter information of the communication operation, and further performing control flow analysis and data flow analysis as the program analysis result.

[0019] S3. Call the vulnerability pattern matching module, load the formal description of the target vulnerability pattern from the vulnerability pattern knowledge base, and use the injection point detector to match and detect the program analysis results with the formal description of the target vulnerability pattern in order to determine the code location that meets the vulnerability preconditions and perform constraint checks.

[0020] S4. Call the program mutation module, select the mutation operator according to the vulnerability type of the target vulnerability pattern, use the mutation operator to perform code mutation operation at the injection point corresponding to the code location, and check the syntax correctness and MPI semantic consistency of the mutated program code through the semantic verifier.

[0021] S5. Call the reachability verification module, which uses lightweight symbolic execution technology, combined with MPI semantic model and constraint solver, to analyze the execution path of the mutated program code, in order to obtain the feasible path from the program entry point to the vulnerability point, thereby verifying the reachability of the injection vulnerability and determining the triggering situation of the injection vulnerability under specific execution conditions.

[0022] S6. Call the dataset management module to store the verified vulnerability samples into the dataset, generate vulnerability annotation information, evaluate the quality indicators of the dataset, and optimize the dataset based on the diversity selection strategy.

[0023] S7. At the output layer, output the dataset containing the labeled vulnerabilities.

[0024] According to the method of the first aspect of the present invention, in S1, the vulnerability pattern knowledge base constructed in the input layer includes four types of vulnerabilities: communication vulnerabilities, synchronization vulnerabilities, resource vulnerabilities, and type vulnerabilities; for each type of vulnerability, a formal description format is used for storage, and the formal description information includes: vulnerability pattern identifier, vulnerability pattern name, vulnerability category, vulnerability preconditions, vulnerability triggering mode, vulnerability location information, and the impact effect of the vulnerability.

[0025] According to the method of the first aspect of the present invention, in S2, lexical and syntactic analysis includes: performing lexical and syntactic analysis on the MPI source code using a Clang-based front-end tool; converting the character stream of the MPI source code into a token sequence through lexical analysis; organizing the token sequence into a syntactic structure according to C / C++ syntax rules through syntactic analysis; and detecting lexical and syntactic errors in the MPI source code through analysis.

[0026] According to the method of the first aspect of the present invention, in S2, constructing an abstract syntax tree (AST) includes: constructing an abstract syntax tree (AST) based on lexical and syntactic analysis results; wherein each node corresponds to a syntactic component in the program, and attribute fields are added to the nodes.

[0027] According to the method of the first aspect of the present invention, in S2, identifying API calls in the program corresponding to the MPI source code to extract parameter information of the communication operation includes: traversing the abstract syntax tree (AST) to identify API calls in the program; for each MPI call, extracting parameter information of its communication operation; the parameter information includes: communication type, communication mode, source / target process, message tag, data type, communication domain, buffer address, and buffer size.

[0028] According to the method of the first aspect of the present invention, in S2, the control flow analysis includes: constructing a program control flow graph (CFG) to represent possible execution paths; wherein each node corresponds to a basic block, the basic block represents a sequence of statements executed consecutively, and the edges represent control transfer relationships between basic blocks; for the program corresponding to the MPI source code, adding potential inter-process synchronization edges in the program control flow graph (CFG) to represent inter-process dependencies that may be introduced by MPI communication operations.

[0029] According to the method of the first aspect of the present invention, in S2, the data flow analysis includes: defining variables for the program control flow graph (CFG) computation – using chain and activity information to quantify the impact of vulnerability injection on program data dependencies.

[0030] According to the method of the first aspect of the present invention, in S3, the code location that satisfies the preconditions of the vulnerability is determined by matching detection, wherein: a rule-based pattern matching method is adopted to transform the formally described preconditions into executable matching rules; the form of the matching rule is: R=(S,C,A); S is a selector used to locate the candidate code location, C is a checker used to verify whether the candidate code location satisfies the preconditions; A is an action used to record the matching result.

[0031] According to the method of the first aspect of the present invention, in S3, the constraint check includes: syntactic constraint check, semantic constraint check, and reachability constraint check.

[0032] According to the method of the first aspect of the present invention, in S4, performing the code mutation operation includes:

[0033] Based on the vulnerability type and injection point characteristics of the target vulnerability pattern, select applicable mutation operators from the mutation operator library; the selection strategy includes the applicable conditions, expected effects and historical success rate of the mutation operators;

[0034] Configure specific parameters for the selected mutation operator; adopt a constrained random strategy to randomly select parameter values ​​while satisfying the vulnerability mode constraints;

[0035] Code modification operations are performed at the Abstract Syntax Tree (AST) level, which involves adding, deleting, and / or modifying nodes in the AST.

[0036] Compile the mutated program code and check for syntax errors; if compilation fails, re-execute the code modification operation, reselect the mutation operator, or reconfigure the parameters.

[0037] Perform MPI semantic consistency checks on program code that passes the syntax correctness check; the checks include the consistency of collective operations and the validity of communication parameters.

[0038] According to the method of the first aspect of the present invention, in S4, the mutation operator includes a communication mutation operator, a synchronization mutation operator, a resource mutation operator, and a type mutation operator.

[0039] According to the method of the first aspect of the present invention, in S5, verifying the reachability of the injection vulnerability includes:

[0040] Create an initial symbolic execution state for the mutated program code, including symbolic program inputs and process state arrays;

[0041] A symbolic execution state space for multiple processes is constructed based on the number of program processes, and each process maintains an independent program counter and local symbolic state;

[0042] A partial order reduction strategy is adopted to selectively explore different process interleaving execution orders; for each interleaving, the statement sequence of each process is symbolically executed;

[0043] When an MPI call is executed, semantic analysis is performed using the MPI semantic model; for communication operations, the inter-process message queue state is updated; for synchronization operations, synchronization conditions are checked.

[0044] When execution reaches the injection point, collect the path constraints from the program entry point to the injection point; submit the path constraints to the constraint solver to determine if there are input values ​​that satisfy all constraints; if so, the vulnerability is reachable; otherwise, the vulnerability is unreachable.

[0045] For reachable vulnerabilities, record their triggering conditions; for unreachable vulnerabilities, mark the corresponding mutated program code as invalid samples.

[0046] According to the method of the first aspect of the present invention, in S5: the partial order reduction strategy is: if two operations are independent, only one of the orders is executed; independent operations include: operations between different communication domains, non-intersecting point-to-point communication, and completely local computation; in the partial order reduction strategy, the symbolic execution state space is reduced by identifying independent operations and performing pruning equivalent interleaving.

[0047] A second aspect of this invention proposes an automated data generation system for static vulnerability analysis and assessment of MPI programs, the system comprising:

[0048] The input module is configured to build the MPI source code repository and vulnerability pattern knowledge base;

[0049] The code preprocessing module is configured to perform lexical and syntactic analysis on the MPI source code in the MPI source code library and construct an abstract syntax tree (AST) to identify API calls in the program corresponding to the MPI source code, thereby extracting the parameter information of the communication operation, and further performing control flow analysis and data flow analysis as the program analysis result.

[0050] The vulnerability pattern matching module is configured to: load the formal description of the target vulnerability pattern from the vulnerability pattern knowledge base, use the injection point detector to match the program analysis results with the formal description of the target vulnerability pattern to determine the code location that meets the vulnerability preconditions, and perform constraint checks.

[0051] The program mutation module is configured to: select mutation operators based on the vulnerability type of the target vulnerability pattern, perform code mutation operations at the injection point corresponding to the code location using the mutation operators, and check the syntax correctness and MPI semantic consistency of the mutated program code through a semantic verifier.

[0052] The reachability verification module is configured to: analyze the execution path of the mutated program code based on lightweight symbolic execution technology, combined with MPI semantic model and constraint solver, to obtain the feasible path from the program entry point to the vulnerability point, thereby verifying the reachability of the injection vulnerability and determining the triggering situation of the injection vulnerability under specific execution conditions.

[0053] The dataset management module is configured to: store verified vulnerability samples into the dataset, generate vulnerability annotation information, evaluate the quality metrics of the dataset, and optimize the dataset based on a diversity selection strategy.

[0054] The output module is configured to output the dataset containing labeled vulnerabilities.

[0055] In summary, this invention addresses the lack of high-quality evaluation datasets in existing MPI program static analysis tools. It employs a program mutation method driven by an MPI vulnerability pattern knowledge base to construct a formalized MPI vulnerability pattern description system, designs semantically preserved vulnerability injection operators, and combines lightweight symbolic execution technology for MPI programs to verify vulnerability reachability. This achieves automated generation and annotation of MPI vulnerability samples. The evaluation dataset generated by this invention features comprehensive vulnerability type coverage, accurate vulnerability annotation, high sample diversity, and strong traceability. It effectively solves the problems of low efficiency, narrow coverage, and difficulty in guaranteeing quality when manually constructing MPI vulnerability datasets, providing crucial support for the testing, evaluation, and improvement of MPI program static analysis tools. Attached Figure Description

[0056] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0057] Figure 1 This is a flowchart illustrating an automated method for generating vulnerability static analysis and evaluation data for MPI programs according to an embodiment of the present invention. Detailed Implementation

[0058] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0059] This invention is driven by a formalized MPI vulnerability pattern knowledge base, uses real MPI program code libraries as seeds, automatically injects various MPI vulnerabilities through semantically aware program mutation technology, and combines symbolic execution verification to ensure the reachability of the generated vulnerabilities, and finally outputs a set of MPI vulnerability program samples with precise annotations.

[0060] First, this invention proposes a formal modeling and knowledge base construction scheme for MPI vulnerability patterns. This is the foundation of the entire method, determining the types of vulnerability samples that can be generated and the standardization of the generated samples. Traditional methods mainly rely on developers' experience for vulnerability injection, lacking systematicity and traceability. This invention, through analysis of MPI standard specifications and real-world vulnerability cases, constructs an MPI vulnerability pattern classification system covering four major categories: communication, synchronization, resource, and type. It then employs a constraint-based formal language to precisely describe each vulnerability pattern, including key attributes such as the vulnerability's preconditions, triggering mode, and scope of impact.

[0061] Formal modeling of MPI vulnerability patterns is the foundation of this invention. By analyzing the MPI-3.1 standard specification, publicly available MPI vulnerability reports, and MPI defect patterns described in academic literature, this invention constructs a hierarchical MPI vulnerability classification system and establishes a formal description for each vulnerability pattern.

[0062] The vulnerability classification system adopts a three-level hierarchical structure of category-subcategory-pattern. The first level is the vulnerability category, which includes four major categories: communication vulnerabilities, synchronization vulnerabilities, resource vulnerabilities, and type vulnerabilities. The second level is the vulnerability subcategories, which further subdivide each category. The third level is the specific vulnerability pattern, which describes a specific vulnerability triggering scenario. This hierarchical design facilitates the systematic management of vulnerability patterns and supports the generation and control of vulnerability samples at different granularities.

[0063] For each vulnerability pattern, this invention uses a quintuple {P, T, L, C, E} for formal description, where: P represents the preconditions of the vulnerability, describing the necessary code structure and context for the vulnerability's existence; T represents the triggering mode of the vulnerability, describing the specific code modification that leads to the vulnerability's behavior; L represents the vulnerability's location information, describing the specific location characteristics of the vulnerability in the program; C represents the vulnerability's constraints, describing the runtime conditions that must be met for the vulnerability to be triggered; and E represents the vulnerability's impact, describing the possible consequences after the vulnerability is triggered. This formal description provides a precise semantic foundation for subsequent vulnerability injection operator design and reachability verification.

[0064] Secondly, this invention proposes a semantically preserved MPI vulnerability injection operator design scheme. This is the core of ensuring the validity of the generated samples. Unlike serial programs, the correctness of MPI programs depends not only on the behavior of individual processes but also on the communication and coordination relationships between processes. Simple code modifications may cause the program to fail to compile, crash at runtime, or produce unexpected behavior. This invention designs a semantically preserved vulnerability injection operator that maintains the basic syntactic correctness of the program and the consistency of MPI communication semantics while injecting vulnerabilities, ensuring that the generated vulnerability samples can be compiled and executed normally and trigger the expected vulnerability behavior under specific conditions.

[0065] Vulnerability injection operators serve as a bridge, transforming formally described vulnerability patterns into concrete code modification operations. Unlike traditional program mutation testing, vulnerability injection requires introducing code defects that trigger specific security issues while maintaining the program's basic executability. Considering the unique characteristics of MPI programs, the vulnerability injection operator designed in this invention must satisfy the following three constraints.

[0066] Syntax preservation constraints: The program after injection must pass the compiler's syntax check. This requires that the injection operator considers the syntax rules of the C / C++ language when modifying the code, such as variable declaration, type compatibility, and scope rules.

[0067] MPI Semantic Consistency Constraint: Injection operations must not disrupt the fundamental communication semantics of an MPI program. For example, when injecting a point-to-point transmission vulnerability, it is essential to ensure that collective communication operations maintain a consistent call order across all participating processes; otherwise, the program will deadlock at runtime instead of triggering the intended specific vulnerability.

[0068] Vulnerability triggerability constraint: Injected code defects must be triggerable under reasonable program execution conditions. This requires that injection operators consider the control flow and data flow characteristics of the program when choosing the injection location and modification method, avoiding injecting vulnerabilities on code paths that are never reachable.

[0069] Based on the above constraints, this invention designs corresponding injection operator sets for the four major categories of MPI vulnerabilities. Taking the point-to-point communication deadlock vulnerability in the communication category as an example, the design idea of ​​its injection operator is as follows: First, identify matching send-receive operation pairs in the program; then analyze the execution order dependency of the two operations; finally, introduce potential circular wait conditions by adjusting the operation order or modifying the target process number. This injection operator automatically checks MPI semantic constraints during execution to ensure that the modified code is semantically reasonable.

[0070] Furthermore, this invention proposes a lightweight symbolic execution verification scheme for MPI programs. This is crucial for ensuring the accuracy of vulnerability labeling. Since program mutations may inject vulnerabilities on unreachable paths, or the injected vulnerabilities may never be triggered due to constraints from other code, directly labeling all mutated samples as vulnerability samples would introduce a large number of false positives. This invention proposes a lightweight symbolic execution technique for MPI programs. By abstractly modeling MPI communication primitives, it effectively prunes infeasible communication interleaving paths, verifies the reachability of injected vulnerabilities within acceptable time overhead, filters unreachable vulnerability samples, and accurately locates vulnerability triggering conditions.

[0071] Symbolic execution is a powerful program analysis technique that systematically explores the program's execution space by symbolizing program inputs and collecting constraints along the program path. However, directly applying traditional symbolic execution to MPI programs faces the severe state space explosion problem because the execution of an MPI program depends not only on the input data but also on the interleaved order of inter-process message passing. For example, if an MPI program has n processes, and each process performs m communication operations, the number of possible message interleaving operations is exponential.

[0072] To address this challenge, this invention proposes a lightweight symbolic execution technology for MPI programs, with its core innovations lying in two aspects.

[0073] First, MPI communication semantic abstraction: This invention semantically abstracts MPI communication primitives, establishing an abstract model of MPI communication operations. This model abstracts specific message content into symbolic values ​​and models the synchronization semantics of communication operations as inter-process relationships. Based on this abstraction, the symbolic execution engine does not need to simulate the specific message passing process, but instead deduces possible execution interleaving by analyzing the dependencies of communication operations.

[0074] Second, the partial order reduction strategy: This invention employs partial order reduction technology, utilizing the exchange property of MPI communication operations to identify and prune equivalent execution interleaving. Specifically, if there is no dependency between two communication operations (i.e., their execution order does not affect the final state of the program), then only one order needs to be explored. This optimization can significantly reduce the state space that needs to be explored, making it possible to complete vulnerability reachability verification within an acceptable time.

[0075] Through the above optimizations, the lightweight symbolic execution of this invention can complete the reachability verification of injected vulnerabilities in medium-sized MPI programs (hundreds to thousands of lines of code) within seconds to minutes, meeting the efficiency requirements for generating large-scale vulnerability samples.

[0076] Finally, this invention proposes a quality measurement and diversity assurance scheme for the evaluation dataset. This is a crucial step in ensuring the practical value of the generated dataset. A high-quality evaluation dataset should possess characteristics such as good vulnerability type coverage, code pattern diversity, and difficulty level distribution. This invention designs a set of quality measurement indicators for the evaluation dataset and implements an adaptive sample selection strategy based on these indicators, maximizing its diversity and coverage while ensuring the dataset's size.

[0077] The quality of a dataset directly impacts its practical value in tool evaluation. This invention constructs a dataset quality metric system from the following four dimensions.

[0078] Vulnerability type coverage: This measures the proportion of vulnerability types included in the dataset relative to all types in the vulnerability pattern knowledge base. A dataset with high coverage allows for a more comprehensive evaluation of the static analysis tools' ability to detect various types of vulnerabilities.

[0079] Code pattern diversity: This measures the degree of difference in code structure among program samples in a dataset. This invention employs an Abstract Syntax Tree (AST)-based similarity calculation method to ensure that the samples in the dataset are not simple template copies, but rather exhibit diverse code patterns.

[0080] Vulnerability Difficulty Distribution: Vulnerability samples are graded by difficulty based on factors such as the complexity of vulnerability triggering conditions, the number of processes involved, and the depth of control flow. A balanced difficulty distribution allows the dataset to be evaluated by static analysis tools of varying capabilities.

[0081] Completeness of annotations: This measures the completeness of vulnerability annotation information, including the completeness of information such as vulnerability location (file, line number, function), vulnerability type, vulnerability triggering conditions, and expected impact. Complete annotation information facilitates accurate comparison of analysis tool evaluation results.

[0082] Based on the aforementioned metrics, this invention implements an adaptive sample selection strategy. After generating a large number of candidate vulnerability samples, this strategy uses a greedy algorithm to select a subset of samples that maximizes the overall quality of the dataset, ensuring its diversity and coverage while controlling the dataset size.

[0083] The first aspect of this invention proposes an automated method for generating static vulnerability analysis and assessment data for MPI programs, such as... Figure 1 As shown, the method includes:

[0084] S1. At the input layer, construct the MPI source code library and vulnerability pattern knowledge base;

[0085] S2. Call the code preprocessing module to perform lexical and syntactic analysis on the MPI source code in the MPI source code library and construct an abstract syntax tree (AST) to identify the API calls in the program corresponding to the MPI source code, thereby extracting the parameter information of the communication operation, and further performing control flow analysis and data flow analysis as the program analysis result.

[0086] S3. Call the vulnerability pattern matching module, load the formal description of the target vulnerability pattern from the vulnerability pattern knowledge base, and use the injection point detector to match and detect the program analysis results with the formal description of the target vulnerability pattern in order to determine the code location that meets the vulnerability preconditions and perform constraint checks.

[0087] S4. Call the program mutation module, select the mutation operator according to the vulnerability type of the target vulnerability pattern, use the mutation operator to perform code mutation operation at the injection point corresponding to the code location, and check the syntax correctness and MPI semantic consistency of the mutated program code through the semantic verifier.

[0088] S5. Call the reachability verification module, which uses lightweight symbolic execution technology, combined with MPI semantic model and constraint solver, to analyze the execution path of the mutated program code, in order to obtain the feasible path from the program entry point to the vulnerability point, thereby verifying the reachability of the injection vulnerability and determining the triggering situation of the injection vulnerability under specific execution conditions.

[0089] S6. Call the dataset management module to store the verified vulnerability samples into the dataset, generate vulnerability annotation information, evaluate the quality indicators of the dataset, and optimize the dataset based on the diversity selection strategy.

[0090] S7. At the output layer, output the dataset containing the labeled vulnerabilities.

[0091] According to the method of the first aspect of the present invention, in S1, the vulnerability pattern knowledge base constructed in the input layer includes four types of vulnerabilities: communication vulnerabilities, synchronization vulnerabilities, resource vulnerabilities, and type vulnerabilities; for each type of vulnerability, a formal description format is used for storage, and the formal description information includes: vulnerability pattern identifier, vulnerability pattern name, vulnerability category, vulnerability preconditions, vulnerability triggering mode, vulnerability location information, and the impact effect of the vulnerability.

[0092] According to the method of the first aspect of the present invention, in S2, lexical and syntactic analysis includes: performing lexical and syntactic analysis on the MPI source code using a Clang-based front-end tool; converting the character stream of the MPI source code into a token sequence through lexical analysis; organizing the token sequence into a syntactic structure according to C / C++ syntax rules through syntactic analysis; and detecting lexical and syntactic errors in the MPI source code through analysis.

[0093] According to the method of the first aspect of the present invention, in S2, constructing an abstract syntax tree (AST) includes: constructing an abstract syntax tree (AST) based on lexical and syntactic analysis results; wherein each node corresponds to a syntactic component in the program, and attribute fields are added to the nodes.

[0094] According to the method of the first aspect of the present invention, in S2, identifying API calls in the program corresponding to the MPI source code to extract parameter information of the communication operation includes: traversing the abstract syntax tree (AST) to identify API calls in the program; for each MPI call, extracting parameter information of its communication operation; the parameter information includes: communication type, communication mode, source / target process, message tag, data type, communication domain, buffer address, and buffer size.

[0095] According to the method of the first aspect of the present invention, in S2, the control flow analysis includes: constructing a program control flow graph (CFG) to represent possible execution paths; wherein each node corresponds to a basic block, the basic block represents a sequence of statements executed consecutively, and the edges represent control transfer relationships between basic blocks; for the program corresponding to the MPI source code, adding potential inter-process synchronization edges in the program control flow graph (CFG) to represent inter-process dependencies that may be introduced by MPI communication operations.

[0096] According to the method of the first aspect of the present invention, in S2, the data flow analysis includes: defining variables for the program control flow graph (CFG) computation – using chain and activity information to quantify the impact of vulnerability injection on program data dependencies.

[0097] According to the method of the first aspect of the present invention, in S3, the code location that satisfies the preconditions of the vulnerability is determined by matching detection, wherein: a rule-based pattern matching method is adopted to transform the formally described preconditions into executable matching rules; the form of the matching rule is: R=(S,C,A); S is a selector used to locate the candidate code location, C is a checker used to verify whether the candidate code location satisfies the preconditions; A is an action used to record the matching result.

[0098] According to the method of the first aspect of the present invention, in S3, the constraint check includes: syntactic constraint check, semantic constraint check, and reachability constraint check.

[0099] According to the method of the first aspect of the present invention, in S4, performing the code mutation operation includes:

[0100] Based on the vulnerability type and injection point characteristics of the target vulnerability pattern, select applicable mutation operators from the mutation operator library; the selection strategy includes the applicable conditions, expected effects and historical success rate of the mutation operators;

[0101] Configure specific parameters for the selected mutation operator; adopt a constrained random strategy to randomly select parameter values ​​while satisfying the vulnerability mode constraints;

[0102] Code modification operations are performed at the Abstract Syntax Tree (AST) level, which involves adding, deleting, and / or modifying nodes in the AST.

[0103] Compile the mutated program code and check for syntax errors; if compilation fails, re-execute the code modification operation, reselect the mutation operator, or reconfigure the parameters.

[0104] Perform MPI semantic consistency checks on program code that passes the syntax correctness check; the checks include the consistency of collective operations and the validity of communication parameters.

[0105] According to the method of the first aspect of the present invention, in S4, the mutation operator includes a communication mutation operator, a synchronization mutation operator, a resource mutation operator, and a type mutation operator.

[0106] According to the method of the first aspect of the present invention, in S5, verifying the reachability of the injection vulnerability includes:

[0107] Create an initial symbolic execution state for the mutated program code, including symbolic program inputs and process state arrays;

[0108] A symbolic execution state space for multiple processes is constructed based on the number of program processes, and each process maintains an independent program counter and local symbolic state;

[0109] A partial order reduction strategy is adopted to selectively explore different process interleaving execution orders; for each interleaving, the statement sequence of each process is symbolically executed;

[0110] When an MPI call is executed, semantic analysis is performed using the MPI semantic model; for communication operations, the inter-process message queue state is updated; for synchronization operations, synchronization conditions are checked.

[0111] When execution reaches the injection point, collect the path constraints from the program entry point to the injection point; submit the path constraints to the constraint solver to determine if there are input values ​​that satisfy all constraints; if so, the vulnerability is reachable; otherwise, the vulnerability is unreachable.

[0112] For reachable vulnerabilities, record their triggering conditions; for unreachable vulnerabilities, mark the corresponding mutated program code as invalid samples.

[0113] According to the method of the first aspect of the present invention, in S5: the partial order reduction strategy is: if two operations are independent, only one of the orders is executed; independent operations include: operations between different communication domains, non-intersecting point-to-point communication, and completely local computation; in the partial order reduction strategy, the symbolic execution state space is reduced by identifying independent operations and performing pruning equivalent interleaving.

[0114] A second aspect of this invention proposes an automated data generation system for static vulnerability analysis and assessment of MPI programs, the system comprising:

[0115] The input module is configured to build the MPI source code repository and vulnerability pattern knowledge base;

[0116] The code preprocessing module is configured to perform lexical and syntactic analysis on the MPI source code in the MPI source code library and construct an abstract syntax tree (AST) to identify API calls in the program corresponding to the MPI source code, thereby extracting the parameter information of the communication operation, and further performing control flow analysis and data flow analysis as the program analysis result.

[0117] The vulnerability pattern matching module is configured to: load the formal description of the target vulnerability pattern from the vulnerability pattern knowledge base, use the injection point detector to match the program analysis results with the formal description of the target vulnerability pattern to determine the code location that meets the vulnerability preconditions, and perform constraint checks.

[0118] The program mutation module is configured to: select mutation operators based on the vulnerability type of the target vulnerability pattern, perform code mutation operations at the injection point corresponding to the code location using the mutation operators, and check the syntax correctness and MPI semantic consistency of the mutated program code through a semantic verifier.

[0119] The reachability verification module is configured to: analyze the execution path of the mutated program code based on lightweight symbolic execution technology, combined with MPI semantic model and constraint solver, to obtain the feasible path from the program entry point to the vulnerability point, thereby verifying the reachability of the injection vulnerability and determining the triggering situation of the injection vulnerability under specific execution conditions.

[0120] The dataset management module is configured to: store verified vulnerability samples into the dataset, generate vulnerability annotation information, evaluate the quality metrics of the dataset, and optimize the dataset based on a diversity selection strategy.

[0121] The output module is configured to output the dataset containing labeled vulnerabilities.

[0122] In one embodiment, the system consists of five core modules: a code preprocessing module, a vulnerability pattern matching module, a program mutation module, a reachability verification module, and a dataset management module. These modules interact through standardized data interfaces, forming a complete vulnerability sample generation pipeline.

[0123] In one embodiment, the code preprocessing module is responsible for analyzing the input MPI source code and constructing various intermediate representations of the program. This module first performs lexical and syntactic analysis to construct an abstract syntax tree (AST); then it identifies MPI API calls in the program and extracts parameter information for communication operations; finally, it performs control flow and data flow analysis to provide necessary program analysis results for subsequent vulnerability injection point identification and reachability analysis.

[0124] Code preprocessing is a fundamental step in vulnerability sample generation, aiming to extract various program information from the original MPI source code for vulnerability injection decisions. The code preprocessing method of this invention comprises the following five steps.

[0125] Lexical and Syntax Analysis: This step uses a Clang-based front-end tool to perform lexical and syntax analysis on the MPI source code. Lexical analysis converts the source code character stream into a sequence of tokens, while syntax analysis organizes these token sequences into a syntactic structure according to C / C++ syntax rules. This step detects and reports syntax errors in the source code, ensuring the basic correctness of the input program.

[0126] Abstract Syntax Tree Construction: Based on the results of syntax analysis, an Abstract Syntax Tree (AST) is constructed for the program. An AST is a hierarchical representation of the program's syntactic structure, where each node corresponds to a syntactic component of the program, such as a function definition, statement, or expression. This invention extends the standard AST by adding additional attribute fields to MPI-related nodes, facilitating subsequent MPI-specific analysis.

[0127] MPI Call Identification and Parameter Extraction: Traverse the Abstract Syntax Tree (AST) to identify all MPI API calls in the program. For each MPI call, extract its key parameter information, including: communication type (point-to-point / collective), communication mode (blocking / non-blocking), source / target process, message tag, data type, buffer address and size, and communication domain. This parameter information is crucial for understanding the communication behavior of the MPI program and identifying vulnerability injection points.

[0128] Control Flow Analysis: A Control Flow Graph (CFG) is constructed to represent the possible execution paths in the program. Each node in the CFG corresponds to a basic block (a sequence of continuously executed statements), and edges represent the control transfer relationships between basic blocks. For MPI programs, this invention adds potential inter-process synchronization edges to the standard CFG to represent the inter-process dependencies that MPI communication operations may introduce.

[0129] Data flow analysis: Based on the control flow graph, data flow analysis is performed to calculate the definition-use chain and activity information of variables in the program. The results of data flow analysis are used to determine the impact of vulnerability injection on program data dependencies, ensuring that injection operations do not disrupt the core data flow logic of the program.

[0130] The preprocessing results are stored in a structured intermediate representation for use by subsequent modules.

[0131] In one embodiment, this invention constructs a knowledge base comprising four main categories, twelve subcategories, and over forty specific vulnerability patterns by systematically analyzing MPI standard specifications, security vulnerability reports, and academic research findings, as shown in Table 1. The MPI vulnerability pattern knowledge base is the core knowledge resource driving the generation of vulnerability samples.

[0132] Table 1: MPI Vulnerability Classification System

[0133]

[0134] For each vulnerability pattern in the knowledge base, this invention adopts a unified formal description format. Taking the point-to-point communication deadlock vulnerability pattern as an example, its formal description is as follows:

[0135] Vulnerability pattern identifier: COMM-DL-001;

[0136] Vulnerability Mode Name: Point-to-Point Communication Blocking Deadlock;

[0137] Category: Communication Vulnerability / Deadlock Vulnerability;

[0138] Precondition P:

[0139] The program contains at least two processes;

[0140] There are communication operations that use blocking send (MPI_Send) or blocking receive (MPI_Recv);

[0141] There are potential dependencies between communication operations;

[0142] Trigger mode T:

[0143] Mode T1: Two processes simultaneously execute blocking send, with each other as the target;

[0144] Mode T2: Two processes execute blocking receive simultaneously, with each other as the source;

[0145] Mode T3: The circular transmission dependency chain forms a closed loop;

[0146] Location information L:

[0147] The following MPI functions are involved: MPI_Send, MPI_Recv, and MPI_Sendrecv.

[0148] Code location characteristics: Blocking communication call point;

[0149] Constraint C:

[0150] Processes involved in deadlock must be in the same communication domain;

[0151] The communication tag must be able to match (or use MPI_ANY_TAG);

[0152] There is no timeout or exception handling mechanism to break the deadlock;

[0153] Impact effect E:

[0154] The program is suspended and cannot continue execution;

[0155] Resources are continuously being occupied;

[0156] External intervention may be required to terminate the procedure.

[0157] This formal description provides a precise semantic specification for the design of vulnerability injection operators, making the automated generation process traceable and verifiable.

[0158] In one embodiment, the vulnerability pattern matching module is responsible for matching formal vulnerability patterns with the preprocessed program to identify potential vulnerability injection points. This module first loads a formal description of the target vulnerability pattern from a vulnerability pattern knowledge base; then, based on the program analysis results, it detects code locations that meet the preconditions for vulnerability injection; finally, it verifies whether these locations are suitable for vulnerability injection through constraint checks.

[0159] Vulnerability injection point identification is the process of determining where specific vulnerabilities can be injected into a program. The injection point identification method of this invention is based on two stages: pattern matching and constraint checking.

[0160] The goal of the pattern matching phase is to locate the code positions in the program that satisfy the preconditions of the vulnerability pattern. This invention employs a rule-based pattern matching method, transforming formally described preconditions into executable matching rules.

[0161] The matching rule takes the form: R=(S,C,A), where S is the selector, used to locate the candidate code position; C is the checker, used to verify whether the candidate position meets the conditions; and A is the action, used to record the matching result.

[0162] Taking the matching rules for point-to-point communication deadlock vulnerabilities as an example:

[0163] Selector S: Selects all MPI_Send and MPI_Recv call points;

[0164] Inspector C: Checks whether there are two communication calls whose target processes form a potential circular dependency;

[0165] Action A: Record the matched communication call pairs and their location information.

[0166] The matching process is performed on the intermediate representation generated by code preprocessing, and the code patterns that meet the conditions are efficiently identified by using AST traversal and control flow analysis results.

[0167] The goal of the constraint checking phase is to further verify whether the matched candidate locations are suitable for vulnerability injection. This phase mainly checks the following types of constraints.

[0168] Syntax constraint checking: Verifies that the program can still compile after code modifications are made at candidate locations. For example, it checks whether the modifications will lead to syntax errors such as undefined variables or type incompatibilities.

[0169] Semantic constraint checks: Verify that the modified code is reasonable at the MPI semantic level. For example, check whether the modified communication operations still meet the requirements of the MPI specification, such as the consistency constraints of collective operations.

[0170] Reachability constraint check: Initially determine whether the candidate location is on the program's executable path. For code that is clearly unreachable (such as code within a perpetually false conditional branch), exclude it as an injection point.

[0171] Through a two-stage identification method, this invention can efficiently and accurately determine the program location suitable for injection into specific vulnerabilities, providing a basis for subsequent program mutations.

[0172] In one embodiment, the program mutation module is responsible for modifying the original program according to the selected vulnerability pattern and injection point, generating a program variant containing the vulnerability. This module selects the appropriate mutation operator based on the vulnerability type, executes the specific code modification operations through the code transformation engine, and checks the syntactic correctness and MPI semantic consistency of the mutated program through a semantic verifier.

[0173] The program mutation engine is the core component for performing vulnerability injection operations. It is responsible for modifying the original program's code based on the selected vulnerability pattern and injection point. The program mutation engine of this invention adopts a modular design and supports flexible mutation operator extensions.

[0174] This invention designs a set of corresponding mutation operators for four major categories of MPI vulnerabilities. The main mutation operators are shown in Table 2.

[0175] Table 2: Mutation Operators

[0176]

[0177] The specific steps for executing the mutation are as follows:

[0178] Operator selection: Select appropriate mutation operators from the operator library based on the target vulnerability pattern and injection point characteristics; the selection strategy considers factors such as the operator's applicability conditions, expected effects, and historical success rate;

[0179] Parameter configuration: Configure specific parameters for the selected mutation operator; the parameter configuration adopts a constrained random strategy, randomly selecting parameter values ​​to increase the diversity of generated samples while satisfying the vulnerability pattern constraints.

[0180] Code transformation: Execute specific code modification operations; code transformation is performed at the AST level, and is achieved through the addition, deletion and modification operations of AST nodes; after the transformation is completed, the modified AST is reserialized into source code;

[0181] Syntax check: Compile the generated variants and check for syntax errors; if compilation fails, roll back the changes and try other operators or parameter configurations;

[0182] Semantic checking: Perform MPI semantic consistency checks on variants that pass the syntax check; the checks include consistency of collective operations, legality of communication parameters, etc.

[0183] Output Variants: Add the variants that pass all checks to the variant set, awaiting subsequent reachability verification.

[0184] Taking the CommOrderSwap operator as an example, the working principle of the mutation operator is explained in detail.

[0185] The goal of this operator is to introduce a potential deadlock vulnerability by swapping the execution order of two communication operations. The operator's input consists of AST node references for the two MPI communication calls, and its output is the swapped code snippet.

[0186] Operator execution includes the following key steps.

[0187] Dependency analysis: Analyzes the data and control dependencies between two communication operations. If a strong dependency exists (such as the second operation using the result of the first operation), the exchange may lead to semantic errors in the program, requiring dependency fixing or abandoning the injection point.

[0188] Sequential swap: Swap the positions of two communication operation nodes in the AST. If the two operations reside in different base blocks, more complex code refactoring may be required.

[0189] Auxiliary modifications: Based on the swapped code structure, make necessary auxiliary modifications, such as adjusting variable declaration positions and fixing dangling references.

[0190] Deadlock condition verification: Analyze the swapped code to verify whether the necessary condition for deadlock (circular wait) has been formed. If the swap does not form a deadlock condition, then the mutation is invalid.

[0191] In one embodiment, the reachability verification module is responsible for verifying the reachability of injection vulnerabilities and filtering out untriggerable vulnerability samples. This module is based on lightweight symbolic execution technology, combined with an MPI semantic model and constraint solver, to analyze the feasible path from the program entry point to the vulnerability point and determine whether the vulnerability can be triggered under reasonable execution conditions.

[0192] The goal of vulnerability reachability verification is to determine whether an injected vulnerability can be triggered during the actual execution of the program. This invention employs lightweight symbolic execution technology for MPI programs for reachability verification.

[0193] To handle MPI communication primitives in symbolic execution, this invention establishes an MPI semantic model. This model abstracts MPI operations into the following categories of semantic behaviors.

[0194] Sending semantics: A process places a message into a communication channel and waits for the target process to receive it. Blocking sending does not return until the message is retrieved, while non-blocking sending returns immediately, but the buffer cannot be modified until the operation is complete.

[0195] Receive semantics: A process retrieves a matching message from the communication channel. Blocking receive does not return until the message is retrieved, while non-blocking receive returns immediately, even if the message has not yet arrived.

[0196] Synchronization semantics: The barrier operation synchronizes all processes at this point, and execution can only continue when all processes have reached the barrier.

[0197] Collective semantics: Collective communication operations (such as MPI_Bcast, MPI_Reduce, etc.) require the participation of all processes within the communication domain, and the order of invocation must be consistent.

[0198] Based on the semantic model described above, the symbolic execution engine can infer the execution effect of MPI operations and determine the synchronization relationship between processes and potential deadlock conditions.

[0199] The specific verification steps are as follows:

[0200] Initialization: Creates the initial symbolic execution state for the mutant program, including symbolic program input, process state array, etc.

[0201] Multi-process state space construction: Based on the number of processes in the MPI program, construct a multi-process symbolic execution state space; each process maintains an independent program counter and local symbolic state;

[0202] Interleaved execution: Employing a partial order reduction strategy, it selectively explores different interleaved execution orders of processes; for each interleaving, symbolic execution of the statement sequence of each process is performed.

[0203] MPI semantic processing: When an MPI call is executed, its effect is processed according to the MPI semantic model; for communication operations, the message queue state between processes is updated; for synchronization operations, the synchronization conditions are checked.

[0204] Vulnerability detection: When execution reaches an injection vulnerability, collect path constraints from the program entry point to that point;

[0205] Constraint solving: Submit the collected path constraints to the SMT solver (such as Z3) to determine if there are input values ​​that satisfy all constraints; if so, the vulnerability is reachable; otherwise, the vulnerability is unreachable.

[0206] Results recording: For reachable vulnerabilities, record their triggering conditions (a satisfyable solution to the constraint); for unreachable vulnerabilities, mark the corresponding variants as invalid samples.

[0207] Partial order reduction is a key optimization technique for improving symbolic execution efficiency. Its core idea is that if two operations are independent (the execution order does not affect the final result), then only one of the orders needs to be explored.

[0208] In MPI programs, this invention identifies the following types of independent operations:

[0209] Operations in different communication domains: Communication operations belonging to different communication domains are independent of each other;

[0210] Disjoint point-to-point communication: Point-to-point communication operations are independent of each other, where the source and target processes do not intersect.

[0211] Pure local computation: Local computation that does not involve MPI calls is independent of the operations of other processes.

[0212] By identifying independent operations and pruning equivalent interleaving, partial order reduction can reduce the state space by one to two orders of magnitude, enabling reachability verification of medium-sized MPI programs to be completed within an acceptable time.

[0213] In one embodiment, the dataset management module is responsible for managing the generated vulnerability samples, performing annotation generation and quality assessment. This module stores verified vulnerability samples in the dataset, automatically generates detailed vulnerability annotation information, evaluates the quality metrics of the current dataset, and optimizes the dataset composition based on a diversity selection strategy.

[0214] For vulnerability samples that pass reachability verification, this invention automatically generates detailed annotation information. The annotation information is stored in JSON format and includes the following fields:

[0215] sample_id: A unique sample identifier;

[0216] source_file: The path to the original program file;

[0217] mutant_file: Path to the mutant file;

[0218] type: Vulnerability type (pattern identifier in the knowledge base);

[0219] category: vulnerability category;

[0220] file: The file where the vulnerability is located;

[0221] line: the line number where the vulnerability is located;

[0222] function: The function where the vulnerability is located;

[0223] column: The column number where the vulnerability is located;

[0224] trigger_condition: Description of the vulnerability trigger condition;

[0225] affected_processes: A list of processes that were affected;

[0226] severity: Assessment of the severity of the vulnerability;

[0227] operator: The mutation operator used;

[0228] original_code: The original code snippet;

[0229] mutated_code: The mutated code snippet;

[0230] method: Verification method (symbolic execution);

[0231] path_constraint: Symbolic representation of path constraints;

[0232] witness_input: Example input that triggers the vulnerability;

[0233] generation_time: Generates a timestamp;

[0234] generator_version: Generator version.

[0235] This invention uses the following metrics to evaluate the quality of the generated dataset:

[0236] Vulnerability Type Coverage (VTC):

[0237]

[0238] in It is the set of vulnerability types contained in the dataset. It is the collection of all vulnerability types in the knowledge base.

[0239] Code Diversity Index (CDI):

[0240]

[0241] in It is the number of samples in the dataset. It represents the similarity of the ASTs of sample i and sample j.

[0242] Difficulty Distribution Entropy (DDE):

[0243]

[0244] in It is a set of difficulty levels. It is the first l The proportion of samples at each difficulty level. A higher entropy value indicates a more balanced distribution of difficulty.

[0245] Annotation Completeness Score (ACS):

[0246]

[0247] in It is the first The number of filled labeled fields for each sample. This is the total number of fields in the annotation template.

[0248] To maximize the quality of the dataset while controlling its size, this invention employs a greedy selection strategy:

[0249] Calculate the marginal quality contribution value of each candidate sample, taking into account its contribution to type coverage, code diversity, and difficulty distribution.

[0250] Select the sample with the largest marginal contribution to add to the dataset;

[0251] Update the quality metrics of the current dataset and recalculate the marginal contribution of the remaining candidate samples;

[0252] Repeat the steps of "selecting the sample with the largest marginal contribution to add to the dataset" and "updating the quality metrics of the current dataset and recalculating the marginal contribution of the remaining candidate samples" until the target dataset size is reached or the marginal contribution is below the threshold.

[0253] The following specific example illustrates the implementation process of the method described in this invention.

[0254] Implementation Background: An evaluation dataset needs to be generated for a certain MPI static analysis tool, with the goal of generating an MPI program sample containing a "point-to-point communication deadlock" vulnerability.

[0255] Step 1: Prepare the input. Prepare a simple MPI program as a seed program, which will enable data exchange between the two processes.

[0256] Step 2: Code Preprocessing. The seed program is preprocessed to obtain the following analysis results.

[0257] AST structure: contains the main function, and includes nodes such as MPI_Init, MPI_Comm_rank, MPI_Comm_size, conditional branches, MPI_Send, MPI_Recv, and MPI_Finalize.

[0258] MPI call identification: Identified 4 MPI communication calls (2 Send, 2 Recv) and their parameters.

[0259] Control Flow Graph: Construct a CFG containing 6 basic blocks, where two conditional branches correspond to the cases of rank==0 and rank!=0, respectively.

[0260] Step 3: Vulnerability Injection Point Identification. Based on the preconditions of the point-to-point communication deadlock vulnerability pattern, the following potential injection points were identified.

[0261] Injection point 1: Send-Recv sequence of process 0 (lines 18-19);

[0262] Injection point 2: Recv-Send sequence of process 1 (lines 21-22);

[0263] Constraint checks confirm that these injection points meet syntactic and semantic constraints.

[0264] Step 4: Program Mutation. Select the CommOrderSwap mutation operator to mutate the communication sequence of process 0, swapping the order of Send and Recv. Perform syntax check: compilation succeeds. Perform semantic check: MPI communication parameters are valid.

[0265] Step 5: Reachability Verification. Perform symbolic execution verification on the mutated program. Analyze the execution of the two processes:

[0266] Process 0: First executes Recv, waiting to receive a message with tag=1 from process 1;

[0267] Process 1: First, execute Recv and wait to receive the tag=0 message from process 0.

[0268] Both processes are waiting for the other to send a message, creating a circular wait and satisfying the deadlock condition. The symbolic execution vulnerability is reachable, triggered by the program running as two processes.

[0269] Step Six: Generate annotations. Generate annotation information for the vulnerability samples.

[0270] Step 7: Output Results. Add the verified vulnerability samples and their annotations to the evaluation dataset. The system automatically calculates the quality metrics of the dataset and decides whether to continue generating more samples or adjust the generation strategy based on the diversity optimization strategy.

[0271] Through the above process, the present invention can automatically generate MPI vulnerability program samples with clear annotations, significantly improving the efficiency and quality of constructing evaluation datasets.

[0272] In summary, this invention addresses the lack of high-quality evaluation datasets in existing MPI program static analysis tools. It employs a program mutation method driven by an MPI vulnerability pattern knowledge base to construct a formalized MPI vulnerability pattern description system, designs semantically preserved vulnerability injection operators, and combines lightweight symbolic execution technology for MPI programs to verify vulnerability reachability. This achieves automated generation and annotation of MPI vulnerability samples. The evaluation dataset generated by this invention features comprehensive vulnerability type coverage, accurate vulnerability annotation, high sample diversity, and strong traceability. It effectively solves the problems of low efficiency, narrow coverage, and difficulty in guaranteeing quality when manually constructing MPI vulnerability datasets, providing crucial support for the testing, evaluation, and improvement of MPI program static analysis tools.

[0273] Please note that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementations of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the appended claims.

Claims

1. A method for automatically generating vulnerability static analysis evaluation data for an MPI program, characterized in that, The method includes: S1. At the input layer, construct the MPI source code library and vulnerability pattern knowledge base; S2. Call the code preprocessing module to perform lexical and syntactic analysis on the MPI source code in the MPI source code library and construct an abstract syntax tree (AST) to identify the API calls in the program corresponding to the MPI source code, thereby extracting the parameter information of the communication operation, and further performing control flow analysis and data flow analysis as the program analysis result. S3. Call the vulnerability pattern matching module, load the formal description of the target vulnerability pattern from the vulnerability pattern knowledge base, and use the injection point detector to match and detect the program analysis results with the formal description of the target vulnerability pattern in order to determine the code location that meets the vulnerability preconditions and perform constraint checks. S4. Call the program mutation module, select the mutation operator according to the vulnerability type of the target vulnerability pattern, use the mutation operator to perform code mutation operation at the injection point corresponding to the code location, and check the syntax correctness and MPI semantic consistency of the mutated program code through the semantic verifier. S5. Call the reachability verification module, which uses lightweight symbolic execution technology, combined with MPI semantic model and constraint solver, to analyze the execution path of the mutated program code, in order to obtain the feasible path from the program entry point to the vulnerability point, thereby verifying the reachability of the injection vulnerability and determining the triggering situation of the injection vulnerability under specific execution conditions. S6. Call the dataset management module to store the verified vulnerability samples into the dataset, generate vulnerability annotation information, evaluate the quality indicators of the dataset, and optimize the dataset based on the diversity selection strategy. S7. At the output layer, output the dataset containing the labeled vulnerabilities; In S4, code mutation operations include: Based on the vulnerability type and injection point characteristics of the target vulnerability pattern, select applicable mutation operators from the mutation operator library; the selection strategy includes the applicable conditions, expected effects and historical success rate of the mutation operators; Configure parameters for the selected mutation operator; adopt a constrained random strategy to randomly select parameter values ​​while satisfying the vulnerability mode constraints; Code modification operations are performed at the Abstract Syntax Tree (AST) level, which involves adding, deleting, and / or modifying nodes in the AST. Compile the mutated program code and check for syntax errors; if compilation fails, re-execute the code modification operation, reselect the mutation operator, or reconfigure the parameters. Perform MPI semantic consistency checks on program code that passes the syntax correctness check; the checks include the consistency of collective operations and the validity of communication parameters.

2. The MPI program-oriented vulnerability static analysis evaluation data automatic generation method according to claim 1, characterized in that, In S1, the vulnerability pattern knowledge base built at the input layer includes four types of vulnerabilities: communication vulnerabilities, synchronization vulnerabilities, resource vulnerabilities, and type vulnerabilities. Each type of vulnerability is stored using a formal description format. The formal description information includes: vulnerability pattern identifier, vulnerability pattern name, vulnerability category, vulnerability preconditions, vulnerability triggering mode, vulnerability location information, and the impact of the vulnerability.

3. The method for automatically generating static vulnerability analysis and evaluation data for MPI programs according to claim 2, characterized in that, In S2: Lexical and syntax analysis includes: performing lexical and syntax analysis on MPI source code using Clang-based front-end tools; lexical analysis converts the character stream of MPI source code into a sequence of tokens; syntax analysis organizes the token sequence into a syntactic structure according to C / C++ syntax rules; and analysis detects lexical and syntax errors in the MPI source code. Constructing an Abstract Syntax Tree (AST) involves: building the AST based on lexical and syntactic analysis results; where each node corresponds to a syntactic component in the program, and attribute fields are added to the nodes; Identify the API calls in the program corresponding to the MPI source code to extract the parameter information of the communication operation, including: traversing the abstract syntax tree (AST) to identify the API calls in the program; for each MPI call, extract the parameter information of its communication operation; the parameter information includes: communication type, communication mode, source / target process, message tag, data type, communication domain, buffer address, and buffer size; Control flow analysis includes: constructing a program control flow graph (CFG) to represent possible execution paths; where each node corresponds to a basic block, the basic block represents a sequence of continuously executed statements, and the edges represent the control transfer relationships between basic blocks. For the program corresponding to the MPI source code, potential inter-process synchronization edges are added to the program control flow graph (CFG) to represent the inter-process dependencies that MPI communication operations may introduce. Data flow analysis includes: defining variables for program control flow graph (CFG) computation - using chain and activity information to quantify the impact of vulnerability injection on program data dependencies.

4. The method for automatically generating static vulnerability analysis and evaluation data for MPI programs according to claim 3, characterized in that, In S3, the code locations that meet the preconditions for a vulnerability are determined through matching detection, where: A rule-based pattern matching method is adopted to transform the formally described preconditions into executable matching rules; The matching rule is in the form of: R=(S,C,A); S is the selector, used to locate the candidate code position; C is the checker, used to verify whether the candidate code position meets the preconditions; A is the action, used to record the matching result.

5. The method for automatically generating static vulnerability analysis and evaluation data for MPI programs according to claim 4, characterized in that, In S3, constraint checks include: syntax constraint checks, semantic constraint checks, and reachability constraint checks.

6. The method for automatically generating static vulnerability analysis and evaluation data for MPI programs according to claim 5, characterized in that, In S4, mutation operators include communication mutation operators, synchronization mutation operators, resource mutation operators, and type mutation operators.

7. The method for automatically generating static vulnerability analysis and evaluation data for MPI programs according to claim 6, characterized in that, In S5, verifying the reachability of injection vulnerabilities includes: Create an initial symbolic execution state for the mutated program code, including symbolic program inputs and process state arrays; A symbolic execution state space for multiple processes is constructed based on the number of program processes, and each process maintains an independent program counter and local symbolic state; A partial order reduction strategy is adopted to selectively explore different process interleaving execution orders; for each interleaving, the statement sequence of each process is symbolically executed; When an MPI call is executed, semantic analysis is performed using the MPI semantic model; for communication operations, the inter-process message queue state is updated; for synchronization operations, synchronization conditions are checked. When execution reaches the injection point, collect the path constraints from the program entry point to the injection point; submit the path constraints to the constraint solver to determine if there are input values ​​that satisfy all constraints; if so, the vulnerability is reachable; otherwise, the vulnerability is unreachable. For reachable vulnerabilities, record their triggering conditions; for unreachable vulnerabilities, mark the corresponding mutated program code as invalid samples.

8. The method for automatically generating static vulnerability analysis and evaluation data for MPI programs according to claim 7, characterized in that, In S5: The partial order reduction strategy is: if two operations are independent, only one of the orders is executed; Independent operations include: operations between different communication domains, non-overlapping point-to-point communication, and fully local computation; In the partial order reduction strategy, the symbolic execution state space is reduced by identifying independent operations and performing pruning and equivalent interleaving.

9. An automated data generation system for static vulnerability analysis and assessment of MPI programs, characterized in that, The system includes: The input module is configured to build the MPI source code repository and vulnerability pattern knowledge base; The code preprocessing module is configured to perform lexical and syntactic analysis on the MPI source code in the MPI source code library and construct an abstract syntax tree (AST) to identify API calls in the program corresponding to the MPI source code, thereby extracting the parameter information of the communication operation, and further performing control flow analysis and data flow analysis as the program analysis result. The vulnerability pattern matching module is configured to: load the formal description of the target vulnerability pattern from the vulnerability pattern knowledge base, use the injection point detector to match the program analysis results with the formal description of the target vulnerability pattern to determine the code location that meets the vulnerability preconditions, and perform constraint checks. The program mutation module is configured to: select mutation operators based on the vulnerability type of the target vulnerability pattern, perform code mutation operations at the injection point corresponding to the code location using the mutation operators, and check the syntax correctness and MPI semantic consistency of the mutated program code through a semantic verifier. The reachability verification module is configured to: analyze the execution path of the mutated program code based on lightweight symbolic execution technology, combined with MPI semantic model and constraint solver, to obtain the feasible path from the program entry point to the vulnerability point, thereby verifying the reachability of the injection vulnerability and determining the triggering situation of the injection vulnerability under specific execution conditions. The dataset management module is configured to: store verified vulnerability samples into the dataset, generate vulnerability annotation information, evaluate the quality metrics of the dataset, and optimize the dataset based on a diversity selection strategy. The output module is configured to output the dataset containing labeled vulnerabilities; The program mutation module is configured to perform code mutation operations, specifically including: Based on the vulnerability type and injection point characteristics of the target vulnerability pattern, select applicable mutation operators from the mutation operator library; the selection strategy includes the applicable conditions, expected effects and historical success rate of the mutation operators; Configure parameters for the selected mutation operator; adopt a constrained random strategy to randomly select parameter values ​​while satisfying the vulnerability mode constraints; Code modification operations are performed at the Abstract Syntax Tree (AST) level, which involves adding, deleting, and / or modifying nodes in the AST. Compile the mutated program code and check for syntax errors; if compilation fails, re-execute the code modification operation, reselect the mutation operator, or reconfigure the parameters. Perform MPI semantic consistency checks on program code that passes the syntax correctness check; the checks include the consistency of collective operations and the validity of communication parameters.

Images