Software abnormal behavior early warning and intelligent tracing method and system for secret-related environment

Abstract

The application discloses a software abnormal behavior early warning and intelligent tracing method and system for a secret-related environment, relates to the technical field of software development, and solves the technical problems that the abnormal escape rate is high, risk early warning lags behind, decision-making lacks basis, release management and control is extensive, tracing and positioning is inefficient, and it is difficult to adapt to the precise early warning and intelligent tracing demand of software abnormal behavior in the secret-related environment; the features extracted from the abstract syntax tree from the syntax level can get rid of the interference of the surface form of the code, accurately capture the structured nature of the secret-related code; the actual running path of the code is restored from the execution dimension through the control flow graph, and the quantifiable execution logic complexity is combined with the logic to enhance the features. The logic complexity analysis can quickly locate the high-risk features in the secret-related environment, and provide bottom feature support for the abnormal behavior early warning. The correlation analysis is based on the CFG and variable dependence; core quantitative indicators are set for each release link to realize link-level risk decomposition.

Description

Technical Field

[0001] This invention belongs to the field of software development, specifically a method and system for early warning and intelligent tracing of abnormal software behavior in classified environments. Background Technology

[0002] A classified environment refers to a physical or logical space where trade secrets or sensitive information are centrally stored, processed, or transmitted. Classified locations are typically physically isolated from external networks (e.g., classified computers are not allowed internet access) and equipped with access control, infrared alarms, video surveillance, and other devices to ensure 24-hour control. They contain classified media (such as paper documents and electronic storage media) or classified equipment (such as dedicated encrypted computers), and business activities directly involve security or core corporate interests. Examples include classified production workshops in some enterprises and classified data processing rooms in financial institutions. Classified environments require software anomaly warning and intelligent tracing methods, employing a warning-blocking-source tracing mechanism to build a multi-layered security protection system.

[0003] Existing software anomaly warning and intelligent tracing solutions rely on shallow text / lexical features, lacking AST structured parsing, control flow modeling, and logic enhancement features. Their ability to detect obfuscation, distortion, hidden logic, and backdoor anomalies is extremely poor. They cannot construct variable definitions and use relational relationships, making it impossible to identify the illegal flow of sensitive data, permission variables, and classified information. Without attention-based weighting mechanisms, features are redundant and noisy, and code security semantics cannot form a unified, robust structured vector. Relying on manual rules and fixed thresholds, they lack objective weights, trend prediction, and quantitative intervention effects, failing to achieve proactive warnings and scientific decision-making. Without process indicators, comprehensive risk indices, and tiered circuit breakers, risks can only be discovered after the fact, unable to be prevented or accurately traced beforehand. The current methods generally remain at the level of shallow text analysis, static rule matching, human experience judgment, and segmented process management. They lack unified quantification and in-depth modeling of code syntax structure, execution logic, data dependencies, and process risks, resulting in high anomaly escape rates, delayed risk warnings, lack of basis for decision-making, rough release control, and inefficient source tracing and location. They are unable to meet the needs of accurate early warning and intelligent tracing of abnormal software behavior in classified environments. Summary of the Invention

[0004] This invention aims to solve at least one of the technical problems existing in the prior art. To this end, this invention proposes a method and system for early warning and intelligent tracing of abnormal software behavior in classified environments. This system addresses the technical problem of high anomaly escape rates, delayed risk warnings, lack of basis for decision-making, crude release control, and inefficient source tracing in the absence of unified quantification and in-depth modeling of code syntax structure, execution logic, data dependencies, and process risks. It is difficult to meet the technical requirements for accurate early warning and intelligent tracing of abnormal software behavior in classified environments.

[0005] To address the aforementioned problems, the first aspect of this invention provides a method and system for early warning and intelligent tracing of abnormal software behavior in classified environments, comprising: Based on the node types, hierarchical relationships, and parent-child node associations of the abstract syntax tree, the syntactic features of the software code in the classified environment are extracted; a control flow graph is generated, the execution flow features are extracted, and logical enhancement features are extracted based on the syntactic features of the code to analyze the execution logic complexity of the code. Based on the execution flow characteristics and variable dependency data of the control flow graph, the relationship between variable definition and usage is analyzed. At the same time, the syntax characteristics of the code, the execution logic complexity of the code, and the relationship between variable definition and usage are weighted and fused through an attention mechanism to generate the final structured fusion vector of the code. Based on the final code structure fusion vector, the entropy weight method is used to determine the index weights, analyze the comprehensive quality index, and combine it with time series prediction algorithms to quantify the quality development trend. At the same time, a decision intervention effect evaluation formula is constructed, and based on the code structure fusion vector, the change in the quality index after the implementation of the decision is predicted. Based on the change, the decision effect early warning is realized. For each stage of the release process, core quantitative indicators are set, the pass rate of each stage is analyzed, and the comprehensive risk index of the entire release process is calculated by combining the correlation and weight of each stage, and the overall risk in the release process is analyzed. Based on the process qualification index and the comprehensive release risk index, a tiered circuit breaker is implemented for the release process. Once the circuit breaker is triggered, the source tracing and location are immediately established to pinpoint the risky process.

[0006] Optionally, in one example of the above aspects, generating a control flow graph, extracting execution flow features, and extracting execution flow features based on the syntax features of the code, and analyzing the execution logic complexity of the code, includes the following steps: The compiler front-end tool parses the source code into an Abstract Syntax Tree (AST), where each node represents a syntax element. Node types include: operator nodes, variable / constant nodes, function / method nodes, and type declaration nodes. Syntactic features are extracted based on node type, hierarchical relationship, and parent-child node association degree of abstract syntax tree. Node weight and hierarchical decay coefficient are defined, and the complexity of the syntax structure is calculated as the syntactic features of the code.

[0007] Optionally, in one example of the above aspects, generating a control flow graph, extracting execution flow features, and extracting logic enhancement features based on the syntax features of the code, and analyzing the execution logic complexity of the code, includes the following steps: The code is divided into continuous basic blocks, and the basic blocks are connected according to jump instructions to form a directed graph, thus constructing a CFG control flow graph; basic blocks that process classified data are marked in the CFG control flow graph, and classified branches are marked. Extract the number of edges, links, and branches from the CFG control flow graph as execution flow features; where: the number of edges is the total number of control flow transitions in the CFG control flow graph, the number of links is the number of loop structures in the CFG control flow graph, and the number of branches is the number of condition judgments in the CFG control flow graph; extract key features as execution flow features. Extract the logical enhancement features of classified basic blocks, including: classified basic block path length: the number of edges of the shortest path from the entry point to the classified basic block; classified code density: the complexity of VAST for calculating the syntax structure of the corresponding code in the classified basic block; and classified code ratio: the ratio of classified code in the classified basic block to the total amount of code. Based on the execution flow characteristics of the extracted CFG control flow graph and the logic enhancement characteristics of the classified basic blocks, the execution logic complexity of the code is analyzed.

[0008] Optionally, in one example of the above aspects, based on the execution flow characteristics and variable dependency data of the control flow graph, the characteristics of the definition and usage relationships of variables are analyzed, including the following steps: Based on the execution flow characteristics of the control flow graph, a breadth-first search (BFS) or a depth-first search (DFS) is performed starting from the variable. The dependency graph between all reachable nodes is extracted using code analysis tools to obtain the number of dependent nodes of the variable. The variable definition location is identified by AST parsing, the scope tree is used to record the visibility of variables in nested code blocks, and the scope dictionary of variables is obtained by the globals and locals functions to obtain the effective scope range of variables; By using data flow analysis to trace the paths of variable definition and usage, using topological sorting to detect dependency loops in the dependency graph between nodes, capturing exception logs at runtime, and counting the number of abnormal variable usages; Based on the number of dependent nodes, the effective scope of the variable, and the number of times the variable is used abnormally, analyze the characteristics of the relationship between the definition and use of the variable.

[0009] Optionally, in one example of the above aspects, based on the final code structure fusion vector, the entropy weight method is used to determine the indicator weights, the comprehensive quality index is analyzed, and the quality development trend is quantified by combining a time series prediction algorithm, including the following steps: Based on the final code structure fusion vector, the entropy weight method is used to determine the index weights and calculate the comprehensive quality index. An early warning will be issued when the overall quality index is lower than a preset threshold; An LSTM time-series prediction model is trained using the quality composite index sequence of historical data. The trained LSTM time-series prediction model is then used to predict the quality index for the next τ time steps based on the detected quality composite index sequence {Q(1),Q(2),…,Q(t)}.

[0010] Optionally, in an example of the above aspect, a decision intervention effect evaluation formula is constructed to predict the change in the quality index after the decision is implemented based on the code structured fusion vector, and at the same time, decision effect early warning is realized based on the change amount, including the following steps: For the optimization decision proposed by the developer, construct a decision intervention effect quantification formula to predict the change in the quality index after the decision is implemented; Perform decision effect early warning based on the change in the quality index after the decision is implemented.

[0011] Optionally, in an example of the above aspect, set core quantification indicators for each release link, analyze the qualification degree of each link, and calculate the comprehensive risk index of the entire release process in combination with the link correlation degree and link weight to analyze the overall risk in the release process, including the following steps: The expert presets the security-related index weights for different classified scenarios, sets core quantification indicators for each link of the code structured fusion vector, and calculates the link qualification degree as the basis for automatic determination; Based on the qualification degree index of each link, calculate the comprehensive risk index of the entire process in combination with the link correlation degree and link weight; When the comprehensive risk index of the entire process is greater than the threshold, perform risk early warning.

[0012] Optionally, in an example of the above aspect, perform hierarchical fusing of the release process based on the link qualification degree index and the release comprehensive risk index. Immediately trigger traceability positioning after fusing to locate the risk link, including the following steps: Design hierarchical fusing rules and perform automatic fusing of the release process based on the link qualification degree index and the release comprehensive risk index; Immediately trigger traceability analysis after fusing to locate the problem link.

[0013] According to another aspect of the present disclosure, there is provided a software abnormal behavior early warning and intelligent traceability system for a classified environment. This system uses the software abnormal behavior early warning and intelligent traceability method for a classified environment as described above to realize software abnormal behavior early warning and intelligent traceability for a classified environment Compared with the prior art, the beneficial effects of the present invention are: The features extracted by the present invention from the syntax level through the abstract syntax tree can get rid of the interference of the code surface form and accurately capture the structured essence of the classified code; the actual running path of the code is restored from the execution dimension through the control flow graph, and the logical complexity can be quantified by combining the logic enhancement features, solving the problem of insufficient feature extraction caused by the logical concealment of the classified code. The logical complexity analysis can quickly locate high-risk features in the classified environment such as "overly complex, unnecessary nesting, abnormal branches", providing underlying feature support for abnormal behavior early warning.

[0014] This invention, based on CFG and variable dependency correlation analysis, can accurately track the entire chain of definition, transmission, and use of classified variables, solving the problem of difficulty in detecting hidden anomalies such as "variable abuse and illegal data transmission" in classified code. By using an attention mechanism to weightedly fuse syntactic features, logical complexity, and variable correlation features, it can automatically focus on core features in classified scenarios, weaken irrelevant features, and generate a structured fusion vector that can more accurately represent the security attributes of the code, avoiding feature dimensional redundancy or the obscuring of core features.

[0015] This invention sets core quantitative indicators for each release stage, realizing risk decomposition at the "stage level," and solving the problem of "vague risks and inability to locate specific stages" in the entire process of releasing classified software. The comprehensive risk index, which is calculated by combining the correlation and weight of stages, can fully reflect the overall risk of the release process and avoid the situation where "single stages are qualified but the overall risk exceeds the standard." Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of the method flow of the present invention. Detailed Implementation

[0018] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Please see Figure 1 The first aspect of this invention provides a method and system for early warning and intelligent tracing of abnormal software behavior in classified environments, comprising: Based on the node types, hierarchical relationships, and parent-child node associations of the abstract syntax tree, the syntactic features of the software code in the classified environment are extracted; a control flow graph is generated, the execution flow features are extracted, and logical enhancement features are extracted based on the syntactic features of the code to analyze the execution logic complexity of the code. Based on the execution flow characteristics and variable dependency data of the control flow graph, the relationship between variable definition and usage is analyzed. At the same time, the syntax characteristics of the code, the execution logic complexity of the code, and the relationship between variable definition and usage are weighted and fused through an attention mechanism to generate the final structured fusion vector of the code. Based on the final code structure fusion vector, the entropy weight method is used to determine the index weights, analyze the comprehensive quality index, and combine it with time series prediction algorithms to quantify the quality development trend. At the same time, a decision intervention effect evaluation formula is constructed, and based on the code structure fusion vector, the change in the quality index after the implementation of the decision is predicted. Based on the change, the decision effect early warning is realized. For each stage of the release process, core quantitative indicators are set, the pass rate of each stage is analyzed, and the comprehensive risk index of the entire release process is calculated by combining the correlation and weight of each stage, and the overall risk in the release process is analyzed. Based on the process qualification index and the comprehensive release risk index, a tiered circuit breaker is implemented for the release process. Once the circuit breaker is triggered, the source tracing and location are immediately established to pinpoint the risky process.

[0020] Specifically, in this embodiment, the features extracted by the Abstract Syntax Tree (AST) at the syntactic level (node ​​type, level, and correlation) can overcome the interference of the code's surface form and accurately capture the structured essence of classified code. By reconstructing the actual execution path of the code from the execution dimension through the control flow graph, and combining logic enhancement features, the execution logic complexity can be quantified, solving the problem of insufficient feature extraction caused by the logical concealment of classified code. Logic complexity analysis can quickly locate high-risk features in classified environments such as "excessive complexity, unnecessary nesting, and abnormal branches" (e.g., hidden permission bypass logic, data leakage branches), providing underlying feature support for abnormal behavior warnings.

[0021] Based on CFG and variable dependency correlation analysis, it can accurately track the entire chain of definition, transmission, and use of classified variables (such as keys, permission parameters, and sensitive data identifiers), solving the problem of difficulty in detecting hidden anomalies such as "variable abuse and illegal data transmission" in classified code. By using an attention mechanism to weightedly fuse syntactic features, logical complexity, and variable correlation features, it can automatically focus on core features in classified scenarios (such as the usage chain of permission variables and highly complex sensitive data processing logic), weaken irrelevant features, and generate a structured fusion vector that can more accurately represent the security attributes of the code, avoiding feature dimension redundancy or the obscuring of core features.

[0022] The weights are automatically determined based on the inherent dispersion of the features, avoiding the subjectivity of manually setting weights and adapting to the characteristics of classified environments where "there is no unified scoring standard and core features change dynamically." Time series prediction can quantify the development trend of code quality / risk based on historical fused vector data, and identify abnormal trends of "gradual risk accumulation" in advance (such as a continuous increase in the frequency of use of sensitive variables). The decision intervention effect evaluation formula can predict the change in quality index after the implementation of the decision based on the fused vector. It can not only verify the effectiveness of decisions such as "code remediation and access restriction", but also trigger early warnings for situations where "risk still increases after the decision", avoiding security vulnerabilities caused by ineffective remediation measures for classified code.

[0023] By setting core quantitative indicators (such as the syntax feature compliance rate in the review stage and the variable dependency compliance rate in the deployment stage) for each release stage (such as code review, compilation, deployment, and permission configuration), the risk decomposition at the "stage level" is realized, which solves the problem of "vague risk and inability to locate specific stages" in the entire process of releasing classified software. The comprehensive risk index calculated by combining the correlation between stages (such as the impact of abnormality in the compilation stage on the deployment stage) and weight (such as the higher weight of the permission configuration stage than the compilation stage) can comprehensively reflect the overall risk of the release process and avoid the situation of "single stage being qualified but the overall risk exceeding the standard".

[0024] A tiered circuit breaker mechanism based on process qualification and a comprehensive risk index (e.g., low-risk triggers only, medium-risk triggers suspension of release, and high-risk triggers direct blocking) can take differentiated measures according to the risk level. This avoids excessive control that could affect efficiency and prevents high-risk classified code from entering the production environment. The source tracing triggered after a circuit breaker can accurately locate the risky process (e.g., "abnormal variable dependencies in the permission configuration process") based on process relevance and core quantitative indicators, and trace back the characteristic data of that process (e.g., variable definition-usage link), achieving a closed loop of "circuit breaker-source tracing-rectification." This solves the pain points of "slow source tracing and inaccurate location" after a risk occurs in classified environments.

[0025] In one embodiment of the present invention, a control flow graph is generated, execution flow features are extracted, and the execution flow features are extracted based on the syntax features of the code to analyze the execution logic complexity of the code, including the following steps: Compiler front-end tools (such as Clang, JavaParser, ANTLR) parse the source code into an AST (Abstract Syntax Tree), where each node represents a syntax element. Node types include: operator nodes, variable / constant nodes, function / method nodes, and type declaration nodes. Syntactic features are extracted based on node type, hierarchical relationship, and parent-child node association degree of the abstract syntax tree. Node weights and hierarchical decay coefficients are defined, and the complexity of the syntactic structure is calculated as a syntactic feature of the code. The formula for calculating the complexity of the syntactic structure is as follows:

[0026] Where Vna is the complexity of the syntax structure, ni is the i-th node of the AST, i∈(0,1,…,n), and n is the total number of nodes in the AST; ωt(ni) is the node type weight. In this embodiment, loop nodes for / while and conditional nodes if / else are assigned higher values, ranging from ωt∈[0.8,1.0]; ordinary statement nodes assign lower values, ranging from ωt∈[0.2,0.5], as specified by the code specification for classified software; L(ni) is the level of node ni in the AST, with the root node level set to 1; α is the level decay coefficient, α∈(0,1), taking α=0.9 for classified scenarios and α=0.6 for non-classified scenarios; et(ni) is the one-hot encoding vector of the node type, with its dimension determined by the total number of node types in the code syntax.

[0027] In one embodiment of the present invention, a control flow graph is generated, execution flow features are extracted, and logic enhancement features are extracted based on the syntax features of the code to analyze the execution logic complexity of the code, including the following steps: The code is divided into continuous basic blocks, and the basic blocks are connected according to jump instructions (such as goto, break, function calls) to form a directed graph, thus constructing the CFG control flow graph; basic blocks that process classified data (such as encryption, decryption, key operations) are marked in the CFG control flow graph, and classified branches are marked. Use static analysis tools (such as LLVM, Soot) to automatically generate CFG, or manually build simplified models (such as for key functions).

[0028] Extract the number of edges, links, and branches from the CFG control flow graph as execution flow features; where: the number of edges is the total number of control flow transitions in the CFG control flow graph, the number of links is the number of loop structures in the CFG control flow graph, and the number of branches is the number of condition judgments in the CFG control flow graph; extract key features as execution flow features. Extract the logical enhancement features of classified basic blocks, including: classified basic block path length: the number of edges of the shortest path from the entry point to the classified basic block; classified code density: the complexity of VAST for calculating the syntax structure of the corresponding code in the classified basic block; and classified code ratio: the ratio of classified code in the classified basic block to the total amount of code. Based on the execution flow characteristics of the extracted CFG control flow graph and the logic enhancement characteristics of the classified basic blocks, the execution logic complexity of the code is analyzed, and the formula is:

[0029] Where Vnf represents the execution logic complexity of the code; E represents the actual number of edges in the CFG control flow graph, and Es represents the average number of edges in the CFG control flow graph of similar classified software; C represents the number of links in the CFG control flow graph, and Cs represents the average number of links in the CFG control flow graph of similar classified software; B represents the number of conditional branches in the CFG control flow graph, and Bs represents the average number of branches in the CFG control flow graph of similar classified software; D represents the complexity of the syntax structure of the code corresponding to the CFG control flow graph, and Ds represents the average complexity of the syntax structure of the code of similar classified software; ωE, ωC, ωB, and ωD are feature weights. In this embodiment, the number of loop links and the number of conditional branches have a greater impact on anomalies in classified scenarios, so ωC=ωB=0.35 and ωE=ωD=0.15 are taken. All features are normalized to eliminate dimensional differences and adapt to formula input.

[0030] In this embodiment, node types are categorized as follows: Operator nodes, such as +, =, if, for, etc., reflect the code's operations and logical control.

[0031] Variable / constant node: Identifies how data is stored and transmitted.

[0032] Function / method nodes: reflect the degree of code modularity.

[0033] Type declaration nodes: such as class and struct definitions, reflect the data structure design.

[0034] Key features include: Edge count: The total number of control flow transfers in CFG, reflecting the frequency of code execution paths.

[0035] Loop count: The number of loop structures in CFG, reflecting the logic of repeated code execution.

[0036] Number of branches: The number of conditional statements (such as if-else, switch), reflecting the diversity of logic.

[0037] In one embodiment of the present invention, based on the execution flow characteristics and variable dependency data of the control flow graph, the characteristics of the definition and usage relationship of variables are analyzed, including the following steps: Based on the execution flow characteristics of the control flow graph, a breadth-first search (BFS) or a depth-first search (DFS) is performed starting from the variable. The dependency graph between all reachable nodes is extracted using code analysis tools to obtain the number of dependent nodes of the variable. Use code analysis tools (such as SonarQube and CodeQL) to parse the abstract syntax tree (AST) and extract the dependencies between variables.

[0038] The AST (Abstract Strategy) is used to identify the location of variable definition (e.g., global variables outside function bodies and local variables inside function bodies). A scope tree is used to record the visibility of variables in nested code blocks. The globals and locals functions are used to obtain the variable scope dictionary and the effective scope range of the variables. Data flow analysis is used to trace the path of variable definition and usage. Topological sorting is used to detect dependency loops in the dependency graph between nodes (such as service A calling service B, and service B calling back service A). Exception logs are captured at runtime (such as null pointer exceptions and scope out-of-bounds errors), and the number of abnormal variable usages is counted. Analyze the characteristics of the relationship between variable definition and usage based on the number of dependent nodes, the effective scope of the variable, and the number of times the variable is used abnormally:

[0039] Where Vng is the correlation coefficient between the definition and use of the variable, K(j) is the number of dependent nodes of the j-th variable, m is the number of valid variables in the code, and Ks is the average number of dependent nodes of variables in classified software of the same type; Seff is the effective scope of the variable, and Total is the total scope of the variable declaration; Uab is the number of abnormal uses of the variable, and Utotal is the total number of uses of the variable; ωK, ωS, and ωU are feature weights. Abnormal use of variables in classified scenarios is the core risk point, so ωU=0.5, ωK=0.3, and ωS=0.2 are taken.

[0040] In one embodiment of the present invention, a weighted fusion of the syntactic features of the code, the execution logic complexity of the code, and the features of the definition and use of variables is performed through an attention mechanism to generate a final structured fusion vector of the code, including the following steps: The three single-dimensional feature vectors are weighted and fused using an attention mechanism to automatically learn the contribution of each dimension to anomaly detection, generating the final structured code fusion vector. VFUS = βAST * Vna + βCFG * Vnf + βDDG * Vng; where VFUS is the code structure fusion vector, βAST, βCFG, and βDDG are attention weights calculated using the Softmax function, satisfying βAST + βCFG + βDDG = 1; Vna is the complexity of the syntax structure; Vnf is the execution logic complexity of the code; and Vng is the correlation coefficient between the definition and use of variables.

[0041] In this embodiment, the attention weights are calculated using the Softmax function, which is obtained by training on a set of abnormal samples of classified software. The formula is: β=Softmax(W*[Vna⊕Vnf⊕Vng]+b), where W is the weight matrix, b is the bias term, and ⊕ is the vector concatenation operation.

[0042] In one embodiment of the present invention, based on the final code structure fusion vector, the entropy weight method is used to determine the index weights, the comprehensive quality index is analyzed, and the quality development trend is quantified by combining a time series prediction algorithm, including the following steps: Based on the final structured fusion vector of the code, the entropy weight method is used to determine the index weights, and the overall quality index is calculated: ; Where Q(t) is the overall quality index; qk(t) is the normalized value of the k-th data indicator in the code structure fusion vector at time t, qk(t)∈[0,1], and a higher value indicates better quality in that dimension; k∈(0,1,…,K), K is the total number of data indicators in the code structure fusion vector; wk is the entropy weight of the k-th data indicator, calculated from historical data, and the formula is: ; Hk is the information entropy of the k-th data indicator, Pkh is the normalized value of the h-th sample of the k-th data indicator in the historical data, h∈(0,1,…,H), and H is the total number of samples of the k-th data indicator in the historical data. An early warning is issued when the overall quality index Q(t) is less than a preset threshold; In this embodiment, Q(t)∈[0,1], Q(t)≥0.8 is excellent, 0.6≤Q(t)<0.8 is acceptable, Q(t)<0.6 is a warning, and Q(t)<0.4 is a severe warning; An LSTM time-series prediction model is trained using the quality composite index sequence of historical data. The trained LSTM time-series prediction model is then used to predict the quality index for the next τ time steps based on the detected quality composite index sequence {Q(1),Q(2),…,Q(t)}.

[0043] In one embodiment of the present invention, a decision intervention effect evaluation formula is constructed, and the change in the quality index after the decision is implemented is predicted based on the structured fusion vector of the code. At the same time, the decision effect early warning is realized based on the change, including the following steps: For the optimization decisions proposed by developers (in this embodiment, these include: optimizing loop code, fixing permission vulnerabilities, reducing memory usage, etc.), a quantitative formula for the effect of decision intervention is constructed to predict the change in the quality index after the implementation of the decision. The calculation formula is as follows: ; in, This refers to the change in the quality index after the decision is implemented. To determine the prediction quality index at time t+τ after implementing decision d, Let be the prediction quality index at time t+τ; wk is the entropy weight of the k-th data index. To determine the normalized change of the k-th indicator at time t+τ after implementing decision d, the result is calculated from the decision-indicator correlation matrix. , The correlation matrix between decisions and indicators (calibrated by experience in optimizing classified software), where γd is the coefficient of decision implementation strength (γd∈[0,1]). Early warning of decision-making effectiveness based on changes in quality indices after decision implementation: like A value >0.1 indicates a significant improvement in decision-making effectiveness, and implementation is recommended. If 0 < A value ≤0.1 indicates a slight improvement in decision-making effectiveness, and implementation is recommended. like If the value is ≤0, it is determined that the decision has no effect of improvement or decline, implementation is prohibited, and an early warning is issued for the decision.

[0044] In one embodiment of the present invention, core quantitative indicators are set for each release stage, the pass rate of each stage is analyzed, and the comprehensive risk index of the entire release process is calculated by combining the correlation and weight of each stage, and the overall risk in the release process is analyzed, including the following steps: Experts pre-determine the weights of security-related indicators for different classified scenarios, set core quantitative indicators for each step of the code structure fusion vector, and calculate the pass rate of each step as the basis for automated judgment. The formula is as follows: ; Where Pq is the pass rate of the process, and xkq is the actual value of the k-th indicator in the q-th process; k∈(0,1,…,K), and K is the total number of data indicators in the code structure fusion vector. For example, in the compilation and building process, the indicators are the number of compilation errors and warnings; in the testing and verification process, the indicators are the number of functional bugs, security vulnerabilities, and permission violations. The upper limit for compliance with classified information for the k-th indicator in the q-th stage is defined by the classified software release specifications, such as the number of security vulnerabilities. =0; ωkq is the weight of the k-th indicator in the classified scenario where the q-th stage is located. Based on the classified scenario where the q-th stage is located, the weights of security-related indicators for different classified scenarios are preset by experts. For example, the number of security vulnerabilities in the testing and verification stage ωkq=1, and the weights of other indicators are 0. In this embodiment, Pq≥0.8 indicates that the process is completely qualified, Pq<0.8 indicates that there is a problem in the process, and the lower the value, the more serious the problem.

[0045] Based on the pass rate index of each stage, combined with the stage correlation and stage weight, the comprehensive risk index of the entire process is calculated using the following formula: ; Among them, RP is the comprehensive risk index of the whole process, ωq is the weight of the q-th link, which is preset by experts according to the classified scenarios from high to low risk. In this embodiment, it is set as follows: for test verification ω2 = 0.4, for gray-scale deployment ω3 = 0.25, for full-scale release ω4 = 0.2, for compilation and construction ω1 = 0.1, for operation monitoring ω5 = 0.05; Pk is the qualification degree of the previous link, is the previous link, the product of the qualification degrees of each index, is the total number of indexes of the previous link, which is used to reflect the strong correlation of the release link (if the previous link is unqualified, the risk of subsequent links will be directly amplified); If the comprehensive risk index of the whole process is greater than the threshold, risk warning is carried out.

[0046] In this embodiment, RP ∈ [0, 1]. RP greater than 0.3 indicates a certain risk, and the greater RP is, the higher the release risk is.

[0047] In one embodiment of the present invention, based on the link qualification degree index and the release comprehensive risk index, hierarchical fusing of the release process is carried out. Immediately after fusing, traceability positioning is triggered to locate the risk link, including the following steps: Design hierarchical fusing rules, and based on the link qualification degree index and the release comprehensive risk index, automatic fusing of the release process is carried out. The hierarchical fusing rules are as follows: If Pq = 0 or RP > RPmax, immediately fuse and terminate the release; If 0 < Pq < Pqmin and RP > RPmid, suspend the release and rectify the problems; If Pq > Pqmin and RP ≤ RPmid, continue the release; Among them, Pq is the link qualification degree, RP is the comprehensive risk index of the whole process, Pqmin is the lower limit threshold of the link qualification degree (in classified scenarios, Pqmin = 0.9 is uniformly set); RPmax is the upper limit threshold of the release comprehensive risk index (in classified scenarios, RPmax = 0.6 is set); RPmid is the middle threshold of the release comprehensive risk index (in classified scenarios, RPmid = 0.3 is set); Immediately after fusing, trigger traceability analysis to locate the problem link.

[0048] In this embodiment, when triggering traceability analysis, through tools such as the log system and the process monitoring dashboard, locate the operation records, input data and associated parameters of the abnormal link.

[0049] In another embodiment of the present invention, a software abnormal behavior warning and intelligent traceability system for classified environments. This system realizes software abnormal behavior warning and intelligent traceability for classified environments by using the software abnormal behavior warning and intelligent traceability method as described above.

[0050] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A method for early warning and intelligent tracing of abnormal software behavior in classified environments, characterized in that: include: Based on the node type, hierarchical relationship, and parent-child node association degree of the abstract syntax tree, the syntactic features of the software code in the classified environment are extracted. Generate a control flow graph, extract execution flow features, and extract logic enhancement features based on the syntax features of the code to analyze the execution logic complexity of the code; Based on the execution flow characteristics and variable dependency data of the control flow graph, the relationship between variable definition and usage is analyzed. At the same time, the syntax characteristics of the code, the execution logic complexity of the code, and the relationship between variable definition and usage are weighted and fused through an attention mechanism to generate the final structured fusion vector of the code. Based on the final code structure fusion vector, the entropy weight method is used to determine the index weights, analyze the comprehensive quality index, and combine it with time series prediction algorithms to quantify the quality development trend. At the same time, a decision intervention effect evaluation formula is constructed, and based on the code structure fusion vector, the change in the quality index after the implementation of the decision is predicted. Based on the change, the decision effect early warning is realized. For each stage of the release process, core quantitative indicators are set, the pass rate of each stage is analyzed, and the comprehensive risk index of the entire release process is calculated by combining the correlation and weight of each stage, and the overall risk in the release process is analyzed. Based on the process qualification index and the comprehensive release risk index, a tiered circuit breaker is implemented for the release process. Once the circuit breaker is triggered, the source tracing and location are immediately established to pinpoint the risky process.

2. The method for early warning and intelligent tracing of abnormal software behavior in classified environments according to claim 1, characterized in that, Generate a control flow graph, extract execution flow features, and further extract execution flow features based on the syntax features of the code. Analyze the execution logic complexity of the code, including the following steps: The compiler front-end tool parses the source code into an Abstract Syntax Tree (AST), where each node represents a syntax element. Node types include: operator nodes, variable / constant nodes, function / method nodes, and type declaration nodes. Syntactic features are extracted based on node type, hierarchical relationship, and parent-child node association degree of the abstract syntax tree. Node weights and hierarchical decay coefficients are defined, and the complexity of the syntactic structure is calculated as a syntactic feature of the code. The formula for calculating the complexity of the syntactic structure is as follows: Where Vna is the complexity of the syntax structure, ni is the i-th node of the AST, i∈(0,1,…,n), and n is the total number of nodes in the AST; ωt(ni) is the node type weight, which is defined by the code specification for classified software; L(ni) is the level of node ni in the AST, with the root node level set to 1; α is the level decay coefficient, α∈(0,1), with α=0.9 for classified scenarios and α=0.6 for non-classified scenarios; et(ni) is the one-hot encoding vector of the node type, and its dimension is determined by the total number of node types in the code syntax.

3. The software abnormal behavior early warning and intelligent tracing method for a secret-related environment according to claim 1, characterized in that, Generate a control flow graph, extract execution flow features, and extract logic enhancement features based on the code's syntax features. Analyze the execution logic complexity of the code, including the following steps: The code is divided into continuous basic blocks, and the basic blocks are connected according to jump instructions to form a directed graph, thus constructing a CFG control flow graph; basic blocks that process classified data are marked in the CFG control flow graph, and classified branches are marked. Extract the number of edges, links, and branches from the CFG control flow graph as execution flow features; where: the number of edges is the total number of control flow transitions in the CFG control flow graph, the number of links is the number of loop structures in the CFG control flow graph, and the number of branches is the number of condition judgments in the CFG control flow graph; extract key features as execution flow features. Extract the logical enhancement features of classified basic blocks, including: classified basic block path length: the number of edges of the shortest path from the entry point to the classified basic block; classified code density: the complexity of VAST for calculating the syntax structure of the corresponding code in the classified basic block; and classified code ratio: the ratio of classified code in the classified basic block to the total amount of code. Based on the execution flow characteristics of the extracted CFG control flow graph and the logic enhancement characteristics of the classified basic blocks, the execution logic complexity of the code is analyzed, and the formula is: Where Vnf represents the execution logic complexity of the code; E represents the actual number of edges in the CFG control flow graph, and Es represents the average number of edges in the CFG control flow graph of similar classified software; C represents the number of links in the CFG control flow graph, and Cs represents the average number of links in the CFG control flow graph of similar classified software; B represents the number of conditional branches in the CFG control flow graph, and Bs represents the average number of branches in the CFG control flow graph of similar classified software; D represents the complexity of the syntax structure of the code corresponding to the CFG control flow graph, and Ds represents the average complexity of the syntax structure of the code of similar classified software; ωE, ωC, ωB, and ωD are feature weights; all features are normalized.

4. The software abnormal behavior early warning and intelligent tracing method for a secret-related environment according to claim 1, characterized in that, Based on the execution flow characteristics and variable dependency data of the control flow graph, the relationship between variable definition and usage is analyzed, including the following steps: Based on the execution flow characteristics of the control flow graph, a breadth-first search (BFS) or a depth-first search (DFS) is performed starting from the variable. The dependency graph between all reachable nodes is extracted using code analysis tools to obtain the number of dependent nodes of the variable. The variable definition location is identified by AST parsing, the scope tree is used to record the visibility of variables in nested code blocks, and the scope dictionary of variables is obtained by the globals and locals functions to obtain the effective scope range of variables; By using data flow analysis to trace the paths of variable definition and usage, using topological sorting to detect dependency loops in the dependency graph between nodes, capturing exception logs at runtime, and counting the number of abnormal variable usages; Analyze the characteristics of the relationship between variable definition and usage based on the number of dependent nodes, the effective scope of the variable, and the number of times the variable is used abnormally: Where Vng is the correlation coefficient between the definition and use of the variable, K(j) is the number of dependent nodes of the j-th variable, m is the number of valid variables in the code, Ks is the average number of dependent nodes of variables in classified software of the same type; Seff is the effective scope of the variable, and Total is the total scope of the variable declaration; Uab is the number of abnormal uses of the variable, and Utotal is the total number of uses of the variable; ωK, ωS, and ωU are the feature weights.

5. The method of claim 1, wherein, The code's syntactic features, execution logic complexity, and variable definition and usage relationships are weighted and fused using an attention mechanism to generate the final structured fusion vector. This process includes the following steps: The three single-dimensional feature vectors are weighted and fused using an attention mechanism to automatically learn the contribution of each dimension to anomaly detection, generating the final structured code fusion vector. VFUS = βAST * Vna + βCFG * Vnf + βDDG * Vng; where VFUS is the code structure fusion vector, βAST, βCFG, and βDDG are attention weights calculated using the Softmax function, Vna is the complexity of the syntax structure, Vnf is the execution logic complexity of the code, and Vng is the correlation coefficient between the definition and use of variables.

6. The software abnormal behavior early warning and intelligent tracing method for a secret-related environment according to claim 1, characterized in that, Based on the final structured fusion vector of the code, the entropy weight method is used to determine the index weights, the comprehensive quality index is analyzed, and the quality development trend is quantified by combining time series prediction algorithms, including the following steps: According to the final code structured fusion vector, the entropy weight method is used to determine the index weight, and the quality comprehensive index is calculated: ; Where Q(t) is the overall quality index; qk(t) is the normalized value of the k-th data indicator in the code structure fusion vector at time t; k∈(0,1,…,K), K is the total number of data indicators in the code structure fusion vector; wk is the entropy weight of the k-th data indicator, calculated from historical data, and the formula is: ； Hk is the information entropy of the k-th data indicator, Pkh is the normalized value of the h-th sample of the k-th data indicator in the historical data, h∈(0,1,…,H), and H is the total number of samples of the k-th data indicator in the historical data. An early warning is issued when the overall quality index Q(t) is less than a preset threshold; An LSTM time-series prediction model is trained using the quality composite index sequence of historical data. The trained LSTM time-series prediction model is then used to predict the quality index for the next τ time steps based on the detected quality composite index sequence {Q(1),Q(2),…,Q(t)}.

7. The method of claim 1, wherein the method further comprises: A formula for evaluating the effectiveness of decision intervention is constructed. Based on the structured fusion vector of the code, the change in the quality index after the implementation of the decision is predicted. At the same time, an early warning of the decision effect is achieved based on the change. The process includes the following steps: For the optimization decisions proposed by developers, a formula for quantifying the effect of decision intervention is constructed to predict the change in the quality index after the implementation of the decision. The calculation formula is as follows: ； in, This refers to the change in the quality index after the decision is implemented. To determine the prediction quality index at time t+τ after implementing decision d, Let be the prediction quality index at time t+τ; wk is the entropy weight of the k-th data index. To determine the normalized change of the k-th indicator at time t+τ after implementing decision d, the result is calculated from the decision-indicator correlation matrix. , γd is the correlation matrix between decisions and indicators, where γd is the coefficient of decision implementation intensity. Early warning of decision-making effectiveness based on changes in quality indices after decision implementation: If >0.1, it is determined that the decision effect is significantly improved, and implementation is recommended. If 0 < A value ≤0.1 indicates a slight improvement in decision-making effectiveness, and implementation is recommended. like If the value is ≤0, it is determined that the decision has no effect of improvement or decline, implementation is prohibited, and an early warning is issued for the decision.

8. The method for early warning and intelligent tracing of abnormal software behavior in classified environments according to claim 1, characterized in that, For each stage of the release process, core quantitative indicators are set, the pass rate of each stage is analyzed, and the comprehensive risk index of the entire release process is calculated by combining the correlation and weight of each stage. The overall risk of the release process is analyzed, including the following steps: Experts pre-determine the weights of security-related indicators for different classified scenarios, set core quantitative indicators for each step of the code structure fusion vector, and calculate the pass rate of each step as the basis for automated judgment. The formula is as follows: ； Where Pq is the pass rate of the process, xkq is the actual value of the k-th indicator in the q-th process; k∈(0,1,…,K), K is the total number of data indicators in the code structured fusion vector; ωkq represents the upper limit of confidentiality compliance for the k-th indicator in the q-th stage, as specified in the confidential software release specification; ωkq represents the weight of the k-th indicator in the confidentiality scenario in which the q-th stage is located. Based on the pass rate index of each stage, combined with the stage correlation and stage weight, the comprehensive risk index of the entire process is calculated using the following formula: ； Where RP is the overall risk index for the entire process, ωq is the weight of the q-th step, and Pk is the pass / fail rating of the preceding steps. This is the product of the pass rates of each indicator in the preceding steps. This represents the total number of indicators in the preceding stages; If the overall risk index of the entire process exceeds the threshold, a risk warning will be issued.

9. The method for early warning and intelligent tracing of abnormal software behavior in classified environments according to claim 1, characterized in that, Based on the link qualification index and the release comprehensive risk index, a hierarchical fuse of the release process is carried out. Immediately after the fuse is triggered, traceability positioning is initiated to locate the risk link, including the following steps: Design a hierarchical fuse rule. Based on the link qualification index and the release comprehensive risk index, an automated fuse of the release process is carried out. The hierarchical fuse rule is as follows: If Pq = 0 or RP > RPmax, immediately fuse and terminate the release; If 0 < Pq < Pimin and RP > RPmid, suspend the release and rectify the problems; If Pq > Pqmin and RP ≤ RPmid, continue the release; Where, Pq is the link qualification, RP is the comprehensive risk index of the whole process, Pqmin is the lower threshold of the link qualification; RPmax is the upper threshold of the release comprehensive risk index; RPmid is the middle threshold of the release comprehensive risk index; Immediately trigger traceability analysis after the fuse to locate the problem link.

10. A software anomaly behavior early warning and intelligent traceability system for classified environments, characterized in that: This system realizes the early warning of software abnormal behavior and intelligent traceability for the classified environment by using the method for early warning of software abnormal behavior and intelligent traceability for the classified environment described in any one of claims 1-9.

Images