Code vulnerability analysis method and device, computer equipment, storage medium and product

Abstract

The invention relates to the technical field of network security, in particular to a code vulnerability analysis method and device, computer equipment, a storage medium and a product. The method comprises the following steps: constructing a time sequence code attribute graph corresponding to a historical version code according to the historical version code corresponding to a to-be-detected code; according to the time sequence code attribute graph, determining an evolution perception soft prompt corresponding to the to-be-detected code; and performing vulnerability analysis on the to-be-detected code according to the evolution perception soft prompt to obtain a vulnerability detection result of the to-be-detected code. According to the method, the historical evolution process of the to-be-detected code is fully understood when vulnerability analysis is carried out on the to-be-detected code, and the vulnerability analysis accuracy of the to-be-detected code is ensured.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a code vulnerability analysis method, apparatus, computer equipment, storage medium, and product. Background Technology

[0002] As software systems become increasingly complex, automated vulnerability detection has become an indispensable part of ensuring software security. Current technologies mainly rely on Static Application Security Testing (SAST), which discovers potential vulnerabilities by analyzing snapshots of source code or binary files.

[0003] However, existing technologies lack an understanding of the historical evolution of code when performing code vulnerability analysis, which results in a low accuracy rate in code vulnerability detection. Summary of the Invention

[0004] Therefore, it is necessary to provide a code vulnerability analysis method, apparatus, computer equipment, storage medium, and product that can improve the accuracy of code vulnerability detection in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a code vulnerability analysis method. The method includes:

[0006] Based on the historical version code corresponding to the code to be detected, construct a time-series code attribute graph corresponding to the historical version code;

[0007] Based on the temporal code attribute graph, determine the evolution-aware soft cue corresponding to the code to be detected;

[0008] Based on the evolution-aware soft hints, vulnerability analysis is performed on the code to be detected to obtain the vulnerability detection results of the code to be detected.

[0009] In one embodiment, the step of constructing a timing code attribute graph corresponding to the historical version code based on the historical version code corresponding to the code to be detected includes:

[0010] The historical version code was analyzed to obtain the code commit sequence;

[0011] Based on the code submission sequence, construct a time-series code attribute graph corresponding to the historical version code.

[0012] In one embodiment, the step of performing code commit analysis on the historical version code to obtain the code commit sequence includes:

[0013] Identify the key commits corresponding to the keywords in the historical version code;

[0014] Determine the parent commit corresponding to the key commit from the historical version code;

[0015] Determine the code commit sequence based on the key commit and the parent commit.

[0016] In one embodiment, constructing a time-series code attribute graph corresponding to the historical version code based on the code commit sequence includes:

[0017] Construct a sub-code attribute graph corresponding to each commit contained in the code commit sequence;

[0018] Based on the evolution trend among the sub-code attribute graphs, construct the time sequence code attribute graph corresponding to the historical version code.

[0019] In one embodiment, determining the evolution-aware soft cue corresponding to the code to be detected based on the temporal code attribute map includes:

[0020] Deep learning analysis is performed on the time-series code attribute graph to obtain node embedding vectors;

[0021] The node embedding vector is transformed into a cue vector to obtain the evolution-aware soft cue corresponding to the code to be detected.

[0022] In one embodiment, the step of performing deep learning analysis on the temporal code attribute graph to obtain node embedding vectors includes:

[0023] A temporal graph network is used to perform deep learning analysis on the temporal code attribute graph to obtain node embedding vectors.

[0024] Secondly, this application also provides a code vulnerability analysis device. The device includes:

[0025] The construction module is used to construct a timing code attribute graph corresponding to the historical version code based on the historical version code corresponding to the code to be detected.

[0026] The determination module is used to determine the evolution-aware soft cue corresponding to the code to be detected based on the time-series code attribute map;

[0027] The analysis module is used to perform vulnerability analysis on the code to be detected based on the evolution-aware soft hints, and obtain the vulnerability detection results of the code to be detected.

[0028] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0029] Based on the historical version code corresponding to the code to be detected, construct a time-series code attribute graph corresponding to the historical version code;

[0030] Based on the temporal code attribute graph, determine the evolution-aware soft cue corresponding to the code to be detected;

[0031] Based on the evolution-aware soft hints, vulnerability analysis is performed on the code to be detected to obtain the vulnerability detection results of the code to be detected.

[0032] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0033] Based on the historical version code corresponding to the code to be detected, construct a time-series code attribute graph corresponding to the historical version code;

[0034] Based on the temporal code attribute graph, determine the evolution-aware soft cue corresponding to the code to be detected;

[0035] Based on the evolution-aware soft hints, vulnerability analysis is performed on the code to be detected to obtain the vulnerability detection results of the code to be detected.

[0036] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0037] Based on the historical version code corresponding to the code to be detected, construct a time-series code attribute graph corresponding to the historical version code;

[0038] Based on the temporal code attribute graph, determine the evolution-aware soft cue corresponding to the code to be detected;

[0039] Based on the evolution-aware soft hints, vulnerability analysis is performed on the code to be detected to obtain the vulnerability detection results of the code to be detected.

[0040] The aforementioned code vulnerability analysis method, apparatus, computer equipment, storage medium, and product construct a temporal code attribute graph corresponding to historical versions of the code to be detected. Then, based on the temporal code attribute graph, they determine the evolution-aware soft hints corresponding to the code to be detected. Finally, they perform vulnerability analysis on the code to be detected based on the evolution-aware soft hints to obtain the vulnerability detection results. As can be seen from the above, this application, during the code vulnerability analysis process, pre-constructs a temporal code attribute graph corresponding to historical versions of the code, representing the temporal evolution relationship between different historical versions of the code. Then, based on the temporal code attribute graph, it determines the evolution-aware soft hints corresponding to the code to be detected, using the evolution-aware soft hints as the basis for vulnerability analysis of the code to be detected. This ensures a thorough understanding of the historical evolution process of the code to be detected during vulnerability analysis, guaranteeing the accuracy of the vulnerability analysis for the code to be detected. Attached Figure Description

[0041] Figure 1 This application provides an application environment diagram for a code vulnerability analysis method.

[0042] Figure 2 A flowchart illustrating the first code vulnerability analysis method provided for embodiments of this application is shown below;

[0043] Figure 3 A flowchart illustrating a second code vulnerability analysis method is provided for embodiments of this application;

[0044] Figure 4 A flowchart illustrating a third code vulnerability analysis method is provided for embodiments of this application;

[0045] Figure 5 A flowchart illustrating the fourth code vulnerability analysis method provided in this application embodiment;

[0046] Figure 6 This application provides a logical diagram illustrating a first method of code vulnerability analysis.

[0047] Figure 7 A logical diagram illustrating a second type of code vulnerability analysis is provided for embodiments of this application;

[0048] Figure 8 This application provides a structural block diagram of a code vulnerability analysis device.

[0049] Figure 9 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0051] The code vulnerability analysis method provided in this application can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. A temporal code attribute graph corresponding to the historical version code is constructed using the historical version code corresponding to the code to be detected; then, based on the temporal code attribute graph, the evolution-aware soft hints corresponding to the code to be detected are determined; finally, vulnerability analysis is performed on the code to be detected based on the evolution-aware soft hints to obtain the vulnerability detection results. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, etc. Portable wearable devices can be smartwatches, smart bracelets, head-mounted devices, etc. Server 104 can be implemented using a standalone server or a server cluster composed of multiple servers.

[0052] In one embodiment, such as Figure 2 As shown, a code vulnerability analysis method is provided, which can be applied to... Figure 1 Taking server 104 as an example, the following steps are included:

[0053] S201, construct a timing code attribute diagram corresponding to the historical version code based on the historical version code corresponding to the code to be detected.

[0054] It should be noted that the temporal code attribute graph is an image used to characterize the temporal relationship and evolution of different versions of historical code; among them, the historical version code is the code corresponding to the code to be detected in the historical version.

[0055] Specifically, the temporal code attribute graph contains temporal nodes, structural edges, and evolutionary edges. Each temporal node not only represents a code element (such as a function call or variable assignment) but also has a timestamp or version identifier attached. Structural edges represent the control flow, data flow, and abstract syntax tree (AST) relationships within a single code version. Evolutionary edges represent changes in nodes or edges between different versions, such as the creation or deletion of nodes or the redirection of data flow edges.

[0056] In one embodiment of this application, when it is necessary to construct a timing code attribute graph corresponding to a historical version code based on the historical version code corresponding to the code to be detected, the following may be included: performing code submission analysis on the historical version code to obtain a code submission sequence; and constructing a timing code attribute graph corresponding to the historical version code based on the code submission sequence.

[0057] S202, Based on the timing code attribute diagram, determine the evolution-aware soft cue corresponding to the code to be detected.

[0058] It should be noted that when it is necessary to determine the evolution-aware soft cue corresponding to the code to be detected based on the temporal code attribute graph, the following can be included: perform deep learning analysis on the temporal code attribute graph to obtain node embedding vectors; perform cue vector transformation on the node embedding vectors to obtain the evolution-aware soft cue corresponding to the code to be detected.

[0059] S203, based on evolution-aware soft hints, perform vulnerability analysis on the code to be tested and obtain the vulnerability detection results of the code to be tested.

[0060] It should be noted that when performing vulnerability analysis on the code to be tested based on evolution-aware soft hints, an LLM model can be used. The evolution-aware soft hints and the code to be tested are then input into the LLM model, so that the LLM model can perform vulnerability analysis on the code to be tested based on the evolution-aware soft hints and obtain the output result of the LLM model, which is the vulnerability detection result of the code to be tested.

[0061] To further explain, in order to ensure the effective execution of the LLM model, text prompts are entered into the LLM model to instruct the LLM model to trigger the operation of vulnerability analysis of the code to be detected based on evolution-aware soft prompts.

[0062] As an example, the text prompt could be: Please check if the following code has any vulnerabilities.

[0063] The aforementioned code vulnerability analysis method constructs a temporal code attribute graph corresponding to historical versions of the code to be detected. Then, based on the temporal code attribute graph, it determines the evolutionary awareness soft hints corresponding to the code to be detected. Finally, it performs vulnerability analysis on the code to be detected based on the evolutionary awareness soft hints to obtain the vulnerability detection results. As can be seen from the above, this application, in the process of code vulnerability analysis, pre-constructs a temporal code attribute graph corresponding to historical versions of the code, realizing the representation of the temporal evolution relationship between different historical versions of the code based on the temporal code attribute graph. Then, it determines the evolutionary awareness soft hints corresponding to the code to be detected based on the temporal code attribute graph, realizing the use of evolutionary awareness soft hints as the basis for judgment in vulnerability analysis of the code to be detected. This ensures a full understanding of the historical evolution process of the code to be detected during vulnerability analysis, guaranteeing the accuracy of vulnerability analysis for the code to be detected.

[0064] In one embodiment, such as Figure 3 As shown, when it is necessary to construct a timing code attribute graph corresponding to the historical version code based on the historical version code of the code to be detected, the following can be included:

[0065] S301, perform code commit analysis on historical versions of the code to obtain the code commit sequence.

[0066] It should be noted that when it is necessary to perform code commit analysis on historical versions of code to obtain the code commit sequence, the following can be included: identifying the key commits corresponding to keywords in the historical version of code; identifying the parent commits corresponding to the key commits in the historical version of code; and determining the code commit sequence based on the key commits and parent commits.

[0067] Keywords may include, but are not limited to, "fix", "vulnerability", and "security".

[0068] S302, construct a time-series code attribute graph corresponding to historical version code based on the code commit sequence.

[0069] It should be noted that when it is necessary to construct a time-series code attribute graph corresponding to historical versions of code based on the code commit sequence, the following can be included: constructing a sub-code attribute graph corresponding to each commit contained in the code commit sequence; and constructing a time-series code attribute graph corresponding to historical versions of code based on the evolution trend between the sub-code attribute graphs.

[0070] In one embodiment of this application, when it is necessary to construct a time-series code attribute graph corresponding to historical version code, a static code attribute graph (CPG) is constructed for each commit contained in the code commit sequence. Subsequently, by comparing the differences between adjacent version code attribute graphs, the evolution trend between each sub-code attribute graph is determined, and an "evolution edge" spanning time is established. Finally, based on the evolution trend between each sub-code attribute graph, a time-series code attribute graph (TCPG) corresponding to historical version code is constructed.

[0071] The aforementioned code vulnerability analysis method obtains the code submission sequence by analyzing the code submissions of historical versions of the code; then, based on the code submission sequence, it constructs a temporal code attribute graph corresponding to the historical versions of the code; this realizes the representation of the temporal evolution relationship between different historical versions of the code based on the temporal code attribute graph, providing a judgment basis for subsequent vulnerability analysis of the code to be detected, and ensuring the smooth progress of subsequent processes.

[0072] In one embodiment, such as Figure 4 As shown, when it is necessary to determine the evolution-aware soft cue corresponding to the code to be detected based on the timing code attribute graph, the following can be included:

[0073] S401 performs deep learning analysis on the timing code attribute graph to obtain node embedding vectors.

[0074] It should be noted that when deep learning analysis of the temporal code attribute graph is required, a temporal graph network can be used to perform deep learning analysis on the temporal code attribute graph to obtain node embedding vectors.

[0075] Specifically, the constructed temporal code attribute graph is input into a temporal graph network (TGN) to perform deep learning analysis on the temporal code attribute graph. A temporal graph network is a deep learning model specifically designed for dynamic graphs; it includes a memory module and a graph embedding module.

[0076] The memory module updates its internal state to remember the recent evolution history of the graph as it processes interactions at each time step (i.e., each code commit). The graph embedding module uses the memory information and the current graph structure to generate an embedding vector for each node that reflects its temporal context.

[0077] S402, perform cue vector transformation on the node embedding vector to obtain the evolution-aware soft cue corresponding to the code to be detected.

[0078] In one embodiment of this application, a neural network is used to map the node embedding vector to a low-dimensional cue vector space, thereby realizing the cue vector transformation of the node embedding vector to obtain the evolution-aware soft cue corresponding to the code to be detected.

[0079] In cases where there are multiple node embedding vectors, the node embedding vectors are aggregated.

[0080] The aforementioned code vulnerability analysis method obtains node embedding vectors by performing deep learning analysis on the temporal code attribute graph; and transforms the node embedding vectors into hint vectors to obtain evolution-aware soft hints corresponding to the code to be detected. This enables the use of evolution-aware soft hints as the basis for vulnerability analysis of the code to be detected, and achieves a full understanding of the historical evolution process of the code to be detected during vulnerability analysis, thus ensuring the accuracy of vulnerability analysis for the code to be detected.

[0081] In one embodiment, such as Figure 5 As shown, when vulnerability analysis is required on the code to be tested, the following can be included:

[0082] S501 identifies the key commits corresponding to keywords in historical code versions.

[0083] S502, determine the parent commit corresponding to the critical commit from the historical version code.

[0084] S503 determines the code commit sequence based on critical commits and parent commits.

[0085] S504, construct a sub-code attribute graph corresponding to each commit in the code commit sequence.

[0086] S505: Based on the evolution trend between the attribute graphs of each sub-code, construct the timing code attribute graph corresponding to the historical version code.

[0087] S506 uses a temporal graph network to perform deep learning analysis on the temporal code attribute graph to obtain node embedding vectors.

[0088] S507, perform cue vector transformation on the node embedding vector to obtain the evolution-aware soft cue corresponding to the code to be detected.

[0089] S508 performs vulnerability analysis on the code to be tested based on evolution-aware soft hints, and obtains the vulnerability detection results of the code to be tested.

[0090] In one embodiment of this application, when detecting a data flow bypass vulnerability caused by reconstruction in a web application, such as Figure 6As shown, this could include the following: Suppose a web application that processes user comments has two consecutive commits in its codebase. In the first version (Commit A), the user-submitted comment content (comment_text) is processed by a function called `sanitize_html()` before being stored in the database. The data flow path is: `user_input->sanitize_html()->database_save()`. In the second version (Commit B), a developer merged the functionality of `sanitize_html()` into a more general `process_data()` function to integrate the data processing logic, but mistakenly omitted the HTML sanitization step or used an inappropriate sanitization library. The new data flow path becomes: `user_input->process_data()->database_save()`. For static analysis tools, if the `process_data()` function itself seems reasonable (e.g., it performs other types of data validation), it's difficult to determine whether this refactoring introduced an XSS vulnerability because it lacks awareness of the historical information that "a critical HTML sanitization step existed here previously."

[0091] First, a deep analysis of CommitA and CommitB is performed. For each commit, the system uses open-source tools (such as Joern or CodeQL) to generate a comprehensive code attribute graph (CPG) from the source code, containing an abstract syntax tree (AST), a control flow graph (CFG), and a data dependency graph (DDG). Node attributes include metadata such as line number, variable type, and function signature. Subsequently, the system executes a graph difference comparison algorithm to identify changes between the two CPGs and establishes "evolutionary edges" accordingly. Evolutionary edges not only mark the "deletion" of the sanitize_html node and the "creation" of the process_data node in CommitB, but more importantly, they establish a type of "data-flow redirection" evolutionary edge. This edge records the correspondence between the source data flow (from user_input to sanitize_html) and the target data flow (from user_input to process_data), and its attributes can be encoded as {type:'redirect',from_node:'sanitize_html',to_node:'process_data'}. In this way, TCPG accurately captured the core operation of this refactoring: a critical security handling function was replaced by another general function.

[0092] The constructed TCPG is then fed into a memory-enhanced TGN model. The core of this TGN model is its MemoryModule, which maintains a state vector for each node in the graph, recording its historical evolution information. When the TGN processes TCPG interactions sequentially (i.e., from Commit A to Commit B), it performs the following steps:

[0093] Message computation: For each interaction event (such as the establishment or evolution of a data stream), the model computes a "message" for the source node and the target node, which integrates the current state of the two nodes and the features of the interaction edge.

[0094] Message aggregation: A node may receive multiple messages at the same time step. Aggregators (such as summation or mean aggregation) combine these messages into an update vector.

[0095] Memory update: A gated recurrent unit (GRU) or LSTM is used to update the node's memory state vector, with the formula new_memory = GRU(old_memory, aggregated_message). This allows the node's memory to evolve smoothly, rather than abruptly.

[0096] TGN, trained on a large amount of historical data on similar security fixes and vulnerability introductions, has learned a key evolutionary pattern: "If a data flow path previously connected to a known security function (such as a purifying function), is redirected in a subsequent version, and the new path lacks equivalent security guarantees, then this evolution is highly likely to introduce a vulnerability." TGN's graph attention mechanism pays special attention to this evolutionary pattern when calculating node embeddings. Its core computation can be abstracted into the following formula:

[0097] ;

[0098] in, It is the attention weight of node i (e.g., user_input) to its neighbor node j (e.g., process_data) at time step t (i.e., CommitB). and These are the embedding vectors of nodes i and j at the previous time step (CommitA), provided by the TGN's memory module. is the feature vector of the edge (including evolutionary edges) connecting nodes i and j. 'a' is a learnable weight vector, and LeakyReLU is the activation function. Using this formula, TGN can compute a highly vigilant embedding vector for the process_data node because it takes into account that its input data stream evolves from a path with a purification history.

[0099] The embedding vectors output by the TGN for the `process_data` node and its related neighboring nodes (the `sanitize_html` nodes connected via evolutionary edges) are aggregated. The aggregation strategy can employ weighted average pooling, where the weights are determined by the attention scores. This decision allows for greater focus on nodes that trigger dangerous evolutionary patterns. The aggregated vector is then subjected to dimensionality reduction and nonlinear transformation via a two-layer multilayer perceptron (MLP) to generate a soft cue vector of length d (e.g., d=128). .

[0100] In the final detection phase, the system will use the original code snippet, a general task instruction (such as "Check the following code for XSS vulnerabilities"), and the generated evolution-aware soft hints. Together, they are input into the embedding layer of a large language model. Soft cue vectors Functionally, it acts as a "virtual token," not corresponding to any specific word, but its vector representation contains rich evolutionary context. When processing the input sequence, LLM's self-attention mechanism computes the relationships between all tokens (including real code tokens and virtual hint tokens). Because... Encoding a risk signal that "the sanitization function has been removed" guides the LLM to focus more on the implementation details of the `process_data` function and match it against patterns of XSS vulnerabilities in the model's internal knowledge base. This allows the LLM to go beyond the literal meaning of the code, perform deeper logical reasoning, and ultimately accurately report a high-risk XSS vulnerability with an explanation: "This function replaced the `sanitize_html` function in the previous version but failed to achieve equivalent HTML sanitization, therefore posing an XSS risk."

[0101] In another embodiment of this application, when it is necessary to detect TOCTOU vulnerabilities introduced by changes in locking mechanisms in a concurrent environment, such as Figure 7As shown, this could include the following: Suppose a file service program needs to securely create files in a specific directory. To prevent path traversal attacks, the program checks the validity of the target path (e.g., whether it's within the expected root directory) before writing to the file. In the first version (Commit A), to ensure atomicity, the developers used a global lock to wrap the "path checking" and "file writing" operations within the same critical section. Its pseudocode logic is: `lock(); check_path(); write_file(); unlock();`. This ensures that no other thread can modify the file system state after path checking and before file writing. However, in the second version (Commit B), to improve system performance, another developer attempted to refactor this coarse-grained global lock into two finer-grained locks: one lock (lock_A) protects path checking, and the other lock (lock_B) protects file writing. The new pseudocode logic becomes: lock_A(); check_path(); unlock_A(); ...; lock_B(); write_file(); unlock_B();. This refactoring creates a dangerous time window between unlock_A() and lock_B(). An attacker could exploit this window to add a valid symbolic link to an invalid path (such as / etc / passwd) via another thread after the path check passes but before the file is written. For static analysis tools, each locking and unlocking operation in CommitB appears to occur in pairs, and the code structure seems fine, making it difficult to detect this race condition vulnerability introduced by the change in timing logic.

[0102] First, CPGs are constructed for CommitA and CommitB respectively. In CommitA's CPG, the check_path node and write_file node are directly connected via control flow edges (CFGEdge), and they are both contained within the same critical section defined by the lock and unlock nodes. The TCPG building module recognizes this "wrapped-by" relationship and encodes it as a structured feature. In CommitB's CPG, the direct CFG edge between the check_path and write_file nodes is broken; they are wrapped by lock_A / unlock_A and lock_B / unlock_B respectively. The graph difference comparison algorithm clearly identifies this "critical-section-split" evolution pattern. TCPG creates an evolutionary edge of the "structural reorganization" type, whose attributes can be encoded as {type:'split',original_lock:'lock',new_locks:['lock_A','lock_B']}. More importantly, TCPG can detect changes in the control flow relationship between check_path and write_file, meaning they are no longer in the same atomic unit of operation.

[0103] When processing this TCPG, the trained TGN model's memory module records the tight coupling relationship between the `check_path` and `write_file` nodes in Commit A. When processing Commit B, the TGN's graph embedding module notices the following key changes:

[0104] Control flow interruption: Two critical operation nodes that were originally directly connected are now separated by unlock_A and lock_B.

[0105] Lock scope change: check_path and write_file no longer share the same lock. TGN, trained on numerous patches involving concurrency safety, has learned a core dangerous evolutionary pattern: "If a pair of operations with a 'check-use' dependency were protected by the same lock in a previous version, and this shared protection is removed in a new version, this is highly likely to introduce a TOCTOU vulnerability." TGN's graph attention mechanism is therefore highly sensitive to the "time window" between check_path and write_file. When calculating the embedding vector of the write_file node, the model assigns extremely high attention weights to historical information from the check_path node (passed through a memory module) and the evolutionary edges indicating changes in their relationship.

[0106] By aggregating the output embeddings of the check_path and write_file nodes, as well as the associated lock nodes, in TGN, a soft cue vector containing a "atomic violation" risk signal is generated using MLP. When this soft suggestion is submitted to the LLM along with the code in CommitB, it guides the LLM to reason as follows: "The write_file operation in this code depends on the check_path check result. However, according to the code's evolution history (as indicated by the soft suggestion)..." (Provided) These two operations, which were previously executed atomically, are now separated. This separation creates a race condition window between the two operations, potentially leading to the TOCTOU vulnerability. Ultimately, LLM was able to accurately identify this high-risk vulnerability hidden in changes to code structure and timing logic, and provide a clear risk explanation.

[0107] The aforementioned code vulnerability analysis method constructs a temporal code attribute graph corresponding to historical versions of the code to be detected. Then, based on the temporal code attribute graph, it determines the evolutionary awareness soft hints corresponding to the code to be detected. Finally, it performs vulnerability analysis on the code to be detected based on the evolutionary awareness soft hints to obtain the vulnerability detection results. As can be seen from the above, this application, in the process of code vulnerability analysis, pre-constructs a temporal code attribute graph corresponding to historical versions of the code, realizing the representation of the temporal evolution relationship between different historical versions of the code based on the temporal code attribute graph. Then, it determines the evolutionary awareness soft hints corresponding to the code to be detected based on the temporal code attribute graph, realizing the use of evolutionary awareness soft hints as the basis for judgment in vulnerability analysis of the code to be detected. This ensures a full understanding of the historical evolution process of the code to be detected during vulnerability analysis, guaranteeing the accuracy of vulnerability analysis for the code to be detected.

[0108] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0109] Based on the same inventive concept, this application also provides a code vulnerability analysis apparatus for implementing the code vulnerability analysis method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more code vulnerability analysis apparatus embodiments provided below can be found in the limitations of the code vulnerability analysis method described above, and will not be repeated here.

[0110] In one embodiment, such as Figure 8 As shown, a code vulnerability analysis device is provided, including: a construction module 10, a determination module 20, and an analysis module 30, wherein:

[0111] Module 10 is used to construct a timing code attribute graph corresponding to the historical version code based on the historical version code corresponding to the code to be detected.

[0112] The determination module 20 is used to determine the evolution-aware soft cue corresponding to the code to be detected based on the timing code attribute map.

[0113] Analysis module 30 is used to perform vulnerability analysis on the code to be detected based on evolution-aware soft hints, and obtain vulnerability detection results for the code to be detected.

[0114] In one embodiment, code commit analysis is performed on historical versions of the code to obtain a code commit sequence;

[0115] Based on the code commit sequence, construct a time-series code attribute graph corresponding to historical versions of the code.

[0116] In one embodiment, key commits corresponding to keywords in historical version code are identified;

[0117] Identify the parent commit corresponding to the key commit from historical code versions;

[0118] Determine the code commit sequence based on the critical commit and its parent commit.

[0119] In one embodiment, a sub-code attribute graph corresponding to each commit contained in the code commit sequence is constructed;

[0120] Based on the evolution trend among the attribute graphs of each sub-code, construct the timing code attribute graph corresponding to the historical version code.

[0121] In one embodiment, deep learning analysis is performed on the temporal code attribute graph to obtain node embedding vectors;

[0122] The node embedding vector is transformed into a cue vector to obtain the evolution-aware soft cue corresponding to the code to be detected.

[0123] In one embodiment, a temporal graph network is used to perform deep learning analysis on the temporal code attribute graph to obtain node embedding vectors.

[0124] The aforementioned code vulnerability analysis device constructs a temporal code attribute graph corresponding to historical versions of the code to be detected. Then, based on the temporal code attribute graph, it determines the evolution-aware soft hints corresponding to the code to be detected. Finally, it performs vulnerability analysis on the code to be detected based on the evolution-aware soft hints to obtain the vulnerability detection results. As can be seen from the above, this application, during the code vulnerability analysis process, pre-constructs a temporal code attribute graph corresponding to historical versions of the code, representing the temporal evolution relationship between different historical versions of the code. Then, it determines the evolution-aware soft hints corresponding to the code to be detected based on the temporal code attribute graph, using the evolution-aware soft hints as the basis for vulnerability analysis of the code to be detected. This ensures a thorough understanding of the historical evolution process of the code to be detected during vulnerability analysis, guaranteeing the accuracy of the vulnerability analysis.

[0125] Each module in the aforementioned code vulnerability analysis device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0126] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 9As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a code vulnerability analysis method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0127] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0128] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0129] Based on the historical version code corresponding to the code to be detected, construct a time-series code attribute diagram corresponding to the historical version code;

[0130] Based on the temporal code attribute diagram, determine the evolution-aware soft cue corresponding to the code to be detected;

[0131] Based on evolution-aware soft suggestions, vulnerability analysis is performed on the code to be tested, and the vulnerability detection results of the code to be tested are obtained.

[0132] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0133] Analyze code commits in historical versions of the code to obtain the code commit sequence;

[0134] Based on the code commit sequence, construct a time-series code attribute graph corresponding to historical versions of the code.

[0135] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0136] Identify the key commits corresponding to keywords in historical code versions;

[0137] Identify the parent commit corresponding to the key commit from historical code versions;

[0138] Determine the code commit sequence based on the critical commit and its parent commit.

[0139] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0140] Construct a sub-code attribute graph corresponding to each commit in the code commit sequence;

[0141] Based on the evolution trend among the attribute graphs of each sub-code, construct the timing code attribute graph corresponding to the historical version code.

[0142] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0143] Deep learning analysis is performed on the temporal code attribute graph to obtain node embedding vectors;

[0144] The node embedding vector is transformed into a cue vector to obtain the evolution-aware soft cue corresponding to the code to be detected.

[0145] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0146] A temporal graph network is used to perform deep learning analysis on the temporal code attribute graph to obtain node embedding vectors.

[0147] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0148] Based on the historical version code corresponding to the code to be detected, construct a time-series code attribute diagram corresponding to the historical version code;

[0149] Based on the temporal code attribute diagram, determine the evolution-aware soft cue corresponding to the code to be detected;

[0150] Based on evolution-aware soft suggestions, vulnerability analysis is performed on the code to be tested, and the vulnerability detection results of the code to be tested are obtained.

[0151] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0152] Analyze code commits in historical versions of the code to obtain the code commit sequence;

[0153] Based on the code commit sequence, construct a time-series code attribute graph corresponding to historical versions of the code.

[0154] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0155] Identify the key commits corresponding to keywords in historical code versions;

[0156] Identify the parent commit corresponding to the key commit from historical code versions;

[0157] Determine the code commit sequence based on the critical commit and its parent commit.

[0158] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0159] Construct a sub-code attribute graph corresponding to each commit in the code commit sequence;

[0160] Based on the evolution trend among the attribute graphs of each sub-code, construct the timing code attribute graph corresponding to the historical version code.

[0161] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0162] Deep learning analysis is performed on the temporal code attribute graph to obtain node embedding vectors;

[0163] The node embedding vector is transformed into a cue vector to obtain the evolution-aware soft cue corresponding to the code to be detected.

[0164] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0165] A temporal graph network is used to perform deep learning analysis on the temporal code attribute graph to obtain node embedding vectors.

[0166] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0167] Based on the historical version code corresponding to the code to be detected, construct a time-series code attribute diagram corresponding to the historical version code;

[0168] Based on the temporal code attribute diagram, determine the evolution-aware soft cue corresponding to the code to be detected;

[0169] Based on evolution-aware soft suggestions, vulnerability analysis is performed on the code to be tested, and the vulnerability detection results of the code to be tested are obtained.

[0170] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0171] Analyze code commits in historical versions of the code to obtain the code commit sequence;

[0172] Based on the code commit sequence, construct a time-series code attribute graph corresponding to historical versions of the code.

[0173] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0174] Identify the key commits corresponding to keywords in historical code versions;

[0175] Identify the parent commit corresponding to the key commit from historical code versions;

[0176] Determine the code commit sequence based on the critical commit and its parent commit.

[0177] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0178] Construct a sub-code attribute graph corresponding to each commit in the code commit sequence;

[0179] Based on the evolution trend among the attribute graphs of each sub-code, construct the timing code attribute graph corresponding to the historical version code.

[0180] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0181] Deep learning analysis is performed on the temporal code attribute graph to obtain node embedding vectors;

[0182] The node embedding vector is transformed into a cue vector to obtain the evolution-aware soft cue corresponding to the code to be detected.

[0183] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0184] A temporal graph network is used to perform deep learning analysis on the temporal code attribute graph to obtain node embedding vectors.

[0185] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0186] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0187] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0188] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A code vulnerability analysis method, characterized in that, The method includes: Based on the historical version code corresponding to the code to be detected, construct a time-series code attribute graph corresponding to the historical version code; Based on the temporal code attribute graph, determine the evolution-aware soft cue corresponding to the code to be detected; Based on the evolution-aware soft hints, vulnerability analysis is performed on the code to be detected to obtain the vulnerability detection results of the code to be detected.

2. The method according to claim 1, characterized in that, The step of constructing a timing code attribute graph corresponding to the historical version code based on the code to be detected includes: The historical version code was analyzed to obtain the code commit sequence; Based on the code submission sequence, construct a time-series code attribute graph corresponding to the historical version code.

3. The method according to claim 2, characterized in that, The code commit analysis of the historical version code to obtain the code commit sequence includes: Identify the key commits corresponding to the keywords in the historical version code; Determine the parent commit corresponding to the key commit from the historical version code; Determine the code commit sequence based on the key commit and the parent commit.

4. The method according to claim 2, characterized in that, The step of constructing a time-series code attribute graph corresponding to the historical version code based on the code submission sequence includes: Construct a sub-code attribute graph corresponding to each commit contained in the code commit sequence; Based on the evolution trend among the sub-code attribute graphs, construct the time sequence code attribute graph corresponding to the historical version code.

5. The method according to any one of claims 1-4, characterized in that, The step of determining the evolution-aware soft cue corresponding to the code to be detected based on the temporal code attribute map includes: Deep learning analysis is performed on the time-series code attribute graph to obtain node embedding vectors; The node embedding vector is transformed into a cue vector to obtain the evolution-aware soft cue corresponding to the code to be detected.

6. The method according to claim 5, characterized in that, The deep learning analysis of the temporal code attribute graph to obtain node embedding vectors includes: A temporal graph network is used to perform deep learning analysis on the temporal code attribute graph to obtain node embedding vectors.

7. A code vulnerability analysis device, characterized in that, The device includes: The construction module is used to construct a timing code attribute graph corresponding to the historical version code based on the historical version code corresponding to the code to be detected. The determination module is used to determine the evolution-aware soft cue corresponding to the code to be detected based on the time-series code attribute map; The analysis module is used to perform vulnerability analysis on the code to be detected based on the evolution-aware soft hints, and obtain the vulnerability detection results of the code to be detected.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images