Vulnerability detection model training methods, devices, electronic equipment, and storage media

Abstract

This disclosure proposes a method, apparatus, electronic device, and storage medium for training a vulnerability detection model, including: acquiring a training sample set and an initial vulnerability detection model to be trained; constructing a sub-PDG graph of the entry function of the code to be identified; constructing a candidate IPDG graph of the code to be identified based on the sub-PDG graph; labeling the vulnerability data to be identified into the corresponding nodes in the candidate IPDG graph to generate a target IPDG graph; generating target vector data and inputting the target vector data into the initial vulnerability detection model for training to generate a target vulnerability detection model. Thus, through a closed-loop process of "structured analysis + precise labeling + graph neural network learning," high-precision, interpretable, and automated detection of code vulnerabilities is achieved, solving problems such as high false positive rates, weak generalization ability, and reliance on manual rules in traditional methods. Furthermore, the icon annotation mechanism based on taint analysis provides clear path evidence for the model's prediction results.

Description

Technical Field

[0001] This disclosure relates to the field of web security vulnerability detection technology, and in particular to a vulnerability detection model training method, apparatus, electronic device and storage medium. Background Technology

[0002] With the rapid development of World Wide Web (WEB) applications, security vulnerabilities have become increasingly serious. Security risks such as Structured Query Language (SQL) injection, Cross-Site Scripting (XSS), and file inclusion vulnerabilities pose significant risks to systems and users. Existing vulnerability detection methods are mainly divided into the following categories: (1) Rule-matching detection methods, which use predefined static rule bases (such as regular expressions and syntax patterns) to perform string or syntax structure matching scans on target code. (2) Dynamic analysis methods, which use dynamic runtime environments to simulate attack processes to detect vulnerabilities. This method can better deal with dynamic vulnerabilities, but it is costly and may be limited by test coverage. (3) Traditional machine learning methods, which use feature extraction and classification algorithms to detect vulnerabilities. Summary of the Invention

[0003] This disclosure aims to at least partially address one of the technical problems in the related art.

[0004] Therefore, one objective of this disclosure is to propose a method for training a vulnerability detection model.

[0005] The second objective of this disclosure is to propose a vulnerability detection model training device.

[0006] The third objective of this disclosure is to propose an electronic device.

[0007] The fourth objective of this disclosure is to provide a non-transitory computer-readable storage medium.

[0008] The fifth objective of this disclosure is to provide a computer program product.

[0009] To achieve the above objectives, a first aspect of this disclosure proposes a vulnerability detection model training method, comprising: acquiring a training sample set and an initial vulnerability detection model to be trained, wherein the training sample set includes at least one code to be identified, and the code to be identified includes at least one entry function; for any code to be identified, constructing a sub-PDG graph of the entry function of the code to be identified, and performing taint analysis on the code to be identified to determine the vulnerability data to be identified; constructing a candidate IPDG graph of the code to be identified based on the sub-PDG graph; labeling the vulnerability data to be identified in the corresponding nodes of the candidate IPDG graph to generate a target IPDG graph; vectorizing the target IPDG graph to generate target vector data, and inputting the target vector data into the initial vulnerability detection model for training, repeating the above steps of constructing the PDG graph of the entry function of the code to be identified and subsequent steps for any code to be identified until the training termination condition is met, thereby generating a target vulnerability detection model.

[0010] According to one embodiment of this disclosure, constructing a candidate IPDG graph for the code to be identified based on the subPDG graph includes: recursively traversing and extracting function call nodes corresponding to all non-library functions in the subPDG graph based on the subPDG graph of the entry function, and obtaining the local PDG graph of each non-library function; and constructing the candidate IPDG graph based on the subPDG graph and the local PDG graph.

[0011] According to one embodiment of this disclosure, constructing the candidate IPDG graph based on the sub-PDG graph and the local PDG graph includes: determining function call relationships based on the code to be identified; and combining the sub-PDG graph and the local PDG graph based on the function call relationships to generate the candidate IPDG graph.

[0012] According to one embodiment of this disclosure, the step of vectorizing the target IPDG graph to generate target vector data includes: encoding the code corresponding to any target node in the target IPDG graph to generate a semantic vector of the target node; and generating context features of the target node based on the context information of the target node, wherein the semantic vector includes the function name, variable name, and statement semantics of the target node; converting the target IPDG graph into target structure data; and generating the target vector data based on the target structure data, the semantic vector, and the context features.

[0013] According to one embodiment of this disclosure, the step of inputting the target vector data into an initial vulnerability detection model for training includes: inputting the target vector data into the initial vulnerability detection model to output a vulnerability detection result; and training the initial vulnerability detection model based on the vulnerability detection result and the vulnerability data to be identified.

[0014] According to one embodiment of this disclosure, training the initial vulnerability detection model based on the detected vulnerability results and the vulnerability data to be identified includes: calculating the loss value of the initial vulnerability detection model based on the detected vulnerability results and the vulnerability data to be identified; and adjusting the model parameters of the initial vulnerability detection model based on the loss value.

[0015] According to one embodiment of this disclosure, the training termination condition is: the loss value is less than a loss value threshold; or, the training time reaches a training time threshold; or, the number of training iterations reaches a training iterations threshold.

[0016] According to one embodiment of this disclosure, performing taint analysis on the code to be identified to determine the vulnerability data to be identified includes: obtaining preset detection rules; and performing vulnerability detection on the code to be identified based on the detection rules to determine the vulnerability data to be identified.

[0017] According to one embodiment of this disclosure, after obtaining the training sample set, the method further includes: extracting variable data and method name data from any code to be identified in the training sample set; performing clustering processing on the variable data and the method name data respectively to generate at least one corresponding cluster; revising the variable data under the same cluster to the same variable name, and revising the method name data under the same cluster to the method name.

[0018] To achieve the above objectives, a second aspect of this disclosure provides a vulnerability detection model training apparatus, comprising: an acquisition module for acquiring a training sample set and an initial vulnerability detection model to be trained, wherein the training sample set includes at least one code to be identified, and the code to be identified includes at least one entry function; a generation module for constructing a sub-PDG graph of the entry function of any code to be identified, and performing taint analysis on the code to be identified to determine the vulnerability data to be identified; a construction module for constructing a candidate IPDG graph of the code to be identified based on the sub-PDG graph; an annotation module for annotating the vulnerability data to be identified to corresponding nodes in the candidate IPDG graph to generate a target IPDG graph; and a training module for vectorizing the target IPDG graph to generate target vector data, and inputting the target vector data into the initial vulnerability detection model for training, repeating the above steps of constructing the PDG graph of the entry function of any code to be identified and subsequent steps until the training termination condition is met, thereby generating a target vulnerability detection model.

[0019] To achieve the above objectives, a third aspect of this disclosure provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to implement the vulnerability detection model training method as described in the first aspect of this disclosure.

[0020] To achieve the above objectives, a fourth aspect of this disclosure provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to implement the vulnerability detection model training method as described in the first aspect of this disclosure.

[0021] To achieve the above objectives, a fifth aspect of this disclosure provides a computer program product, including a computer program that, when executed by a processor, is used to implement the vulnerability detection model training method as described in the first aspect of this disclosure.

[0022] Thus, through a closed-loop process of "structured analysis + precise annotation + graph neural network learning", high-precision, interpretable and automated detection of code vulnerabilities is achieved, solving the problems of high false alarm rate, weak generalization ability and reliance on manual rules in traditional methods. At the same time, the icon annotation mechanism based on taint analysis gives the model prediction results a clear path basis. Attached Figure Description

[0023] Figure 1 This is a schematic diagram of a vulnerability detection model training method according to one embodiment of the present disclosure; Figure 2 This is a schematic diagram of another vulnerability detection model training method according to one embodiment of the present disclosure; Figure 3 This is a schematic diagram of another vulnerability detection model training method according to one embodiment of the present disclosure; Figure 4 This is a schematic diagram of another vulnerability detection model training method according to one embodiment of the present disclosure; Figure 5 This is a schematic diagram of another vulnerability detection model training method according to one embodiment of the present disclosure; Figure 6 This is a schematic diagram of another vulnerability detection model training method according to one embodiment of the present disclosure; Figure 7 This is a schematic diagram of a vulnerability detection process disclosed herein; Figure 8 This is a schematic diagram of a vulnerability detection model training device according to one embodiment of the present disclosure; Figure 9 This is a schematic diagram of an electronic device according to one embodiment of the present disclosure. Detailed Implementation

[0024] Embodiments of this disclosure are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this disclosure, and should not be construed as limiting this disclosure.

[0025] The acquisition, storage, use, and processing of data in this disclosed technical solution all comply with the relevant provisions of relevant laws and regulations.

[0026] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0027] Current rule-matching detection methods have the following drawbacks: Static rule coverage blind spots: The existing rule base has insufficient coverage of new types of vulnerabilities (such as logic vulnerabilities), and there is a lag in the response to zero-day vulnerability detection.

[0028] Lack of semantic understanding: Traditional methods cannot parse the contextual semantic relationships of code, resulting in a high false positive rate.

[0029] Dynamic analysis methods have the following drawbacks: Path coverage deficiency: Dynamic analysis has insufficient path coverage in complex web applications, resulting in blind spots in detection.

[0030] Excessive environmental dependence: Dynamic detection is excessively sensitive to the configuration of the operating environment, resulting in a significant decrease in cross-platform detection accuracy.

[0031] Traditional machine learning methods have the following drawbacks: Bottlenecks in feature engineering: Manual feature engineering is time-consuming and has poor interpretability. In traditional methods, most of the development time is spent on feature engineering, and the quality of features directly affects model performance.

[0032] Insufficient capture of cross-process dependencies: Traditional RNN models lack explicit structure awareness. RNNs process code as plain text sequences and cannot utilize the structured information of code graphs, making it difficult to trace data flow paths across functions.

[0033] To address the aforementioned shortcomings, this application proposes a vulnerability detection method based on Graph Neural Networks (GNNs) to improve the coverage and accuracy of vulnerability detection. The core improvements are as follows: Introducing code graph representation: By constructing an enhanced end-to-end program dependency graph (IPDG), combined with data flow analysis, control flow analysis, and taint flow propagation, we can accurately model code execution semantics.

[0034] GNN structured modeling: Utilize GNN to capture data flow dependencies across functions and processes, improving the ability to detect complex vulnerability patterns.

[0035] Cross-platform generalization capability: The model incorporates various environment configuration data during training to improve the cross-platform adaptability of vulnerability detection.

[0036] Figure 1 This is a schematic diagram of a vulnerability detection model training method according to one embodiment of the present disclosure, as shown below. Figure 1 As shown, the training method for this vulnerability detection model includes the following steps: S101, Obtain a training sample set and an initial vulnerability detection model to be trained. The training sample set includes at least one piece of code to be identified, and the code to be identified includes at least one entry function.

[0037] The vulnerability detection model training method of this application embodiment can be applied to the scenario of WEB security vulnerability detection. The execution subject of the vulnerability detection model training of this application embodiment can be the vulnerability detection model training device of this application embodiment, which can be installed on an electronic device.

[0038] It should be noted that there are various methods for obtaining the code to be identified in the training sample set, and no limitations are made here. For example, it can be obtained through open-source projects, vulnerability databases, etc.

[0039] In one possible implementation, after obtaining the code, positive and negative samples can be distinguished based on whether vulnerabilities exist in the code; that is, code with vulnerabilities is a negative sample, and code without vulnerabilities is a positive sample. In this embodiment of the disclosure, the detection focus and detection effect of the final generated target vulnerability detection model can be controlled by controlling the ratio and types of positive and negative samples.

[0040] It should be noted that the code to be identified in this embodiment may be a code in a single language or a code that spans multiple languages. No limitation is made here, and the specific limitation can be made according to the actual design needs.

[0041] The entry point function is the first function executed when a program starts; it is the "starting point" or "entry point" of the entire program. Starting from the entry point function, we can track how data flows, such as user input → whether it is validated → whether it leads to a vulnerability, etc.

[0042] It should be noted that the initial vulnerability detection model in this embodiment is a Graph Convolutional Network (GCN), a neural network model specifically designed for processing graph-structured data. In many practical problems, data naturally forms graph structures, such as users and relationships in social networks, atoms and bonds in molecular structures, and web page links. GCN learns node representations by directly defining convolution operations on the graph, thus enabling its application to various tasks such as node classification, edge prediction, clustering, and graph classification.

[0043] The GCN model in this embodiment implements the convolution operation (Graph Convolutional Network Convolution, GCNConv) in a two-layer graph convolutional network (graph convolutional layer): 1. GCNConv(input_dim, hidden_dim), Rectified Linear Unit (ReLU).

[0044] 2. GCNConv(hidden_dim,hidden_dim), ReLU activation.

[0045] Global mean pooling is applied to the nodes of the graph to obtain a graph-level representation. The fully connected layer maps the hidden layers to output_dim (for classification tasks).

[0046] S102, for any code to be identified, construct a sub-PDG graph of the entry function of the code to be identified, and perform taint analysis on the code to be identified to determine the vulnerability data to be identified in the code to be identified.

[0047] It's important to note that Program Dependency Graphs (PDGs) are crucial program representation models used in fields such as program analysis, software engineering, and vulnerability detection to describe the dependencies between statements in a program. They play a central role in static analysis, code optimization, and vulnerability detection.

[0048] A PDG (Directed Graph) is a graph used to represent data and control dependencies between all statements within a function (or a block of code). Nodes in a PDG represent statements or basic blocks of code, such as assignment statements, conditional statements, and function calls. Edges connecting nodes represent dependencies, which are divided into two categories: Data Dependence Edge.

[0049] Control Dependence Edge.

[0050] It should be noted that a sub-PDG refers to a program dependency graph that only covers the program dependency graph inside the entry function and does not include the complete IPDG across function calls.

[0051] Taint analysis is a security analysis technique used to track the flow of untrusted data within a program.

[0052] S103, Construct a candidate IPDG graph for the code to be identified based on the subPDG graph.

[0053] It should be noted that the Interprocedural Program Dependence Graph (IPDG) is an extension of the PDG. It not only includes dependencies within functions, but also crosses function boundaries, connecting the PDG graphs of the caller and the callee to form a global, cross-function dependency network.

[0054] IPDG supports cross-function data flow tracing, which can analyze the complete path of "user input → through multiple layers of function calls → reaching the sensitive operation", and is a key structure for taint analysis and vulnerability detection.

[0055] In this embodiment of the disclosure, after obtaining the subPDG graph, the subPDG of the entry function can be used as the initial graph, and the subPDG graph can be connected according to the function call relationship to construct and generate a candidate IPDG graph.

[0056] S104, mark the vulnerability data to be identified into the corresponding nodes in the candidate IPDG graph to generate the target IPDG graph.

[0057] In this embodiment of the disclosure, nodes corresponding to candidate IPDG graphs are found based on the collected vulnerability data. For example, if a variable may be used for SQL injection attacks, all nodes involved in operations on that variable need to be found.

[0058] Label each found node and add information about the vulnerability. The label can include the following: Vulnerability type (such as SQL injection, buffer overflow, etc.), vulnerability severity, and related context information (such as call stack, variable value stream, etc.).

[0059] Establish dependencies: To better understand the scope of a vulnerability, it is necessary to establish dependencies between relevant nodes. For example, the data flow from the input point to the potentially dangerous operation.

[0060] Once the annotations are complete, a target IPDG map with vulnerability information is created. This map can not only show the location and impact of the vulnerability, but also support further analysis, such as risk assessment and remediation suggestion generation.

[0061] S105, the target IPDG graph is vectorized to generate target vector data, and the target vector data is input into the initial vulnerability detection model for training. The above steps are repeated for any code to be identified, constructing the PDG graph of the entry function of the code to be identified and subsequent steps, until the training termination condition is met, and the target vulnerability detection model is generated.

[0062] In this embodiment of the disclosure, vectorization processing converts graph-structured data into numerical vectors that can be processed by machine learning models, typically including: Node feature vectors, such as semantic embeddings of code statements generated using pre-trained models (like CodeBERT); Graph structure encoding, for example, preserving dependencies through adjacency matrices, edge indices, etc.; Output format, such as data objects conforming to GNN frameworks like PyTorch Geometric (Data(x, edge_index,y)).

[0063] In this embodiment of the disclosure, a training sample set and an initial vulnerability detection model to be trained are first obtained. The training sample set includes at least one piece of code to be identified, and the code to be identified includes at least one entry function. Then, for any piece of code to be identified, a sub-PDG graph of the entry function of the code to be identified is constructed, and taint analysis is performed on the code to be identified to determine the vulnerability data to be identified. Then, a candidate IPDG graph of the code to be identified is constructed based on the sub-PDG graph. Then, the vulnerability data to be identified is labeled into the corresponding nodes in the candidate IPDG graph to generate a target IPDG graph. Finally, the target IPDG graph is vectorized to generate target vector data, and the target vector data is input into the initial vulnerability detection model for training. The above steps of constructing the PDG graph of the entry function of the code to be identified and subsequent steps are repeated for any piece of code to be identified until the training termination condition is met and the target vulnerability detection model is generated. Thus, through a closed-loop process of "structured analysis + precise annotation + graph neural network learning", high-precision, interpretable and automated detection of code vulnerabilities is achieved, solving the problems of high false alarm rate, weak generalization ability and reliance on manual rules in traditional methods. At the same time, the icon annotation mechanism based on taint analysis gives the model prediction results a clear path basis.

[0064] In the above embodiments, a candidate IPDG graph for the code to be identified is constructed based on the sub-PDG graph. This can also be achieved through... Figure 2 To further explain, the method includes: S201, based on the sub-PDG graph of the entry function, recursively traverse and extract the function call nodes corresponding to all non-library functions in the sub-PDG graph, and obtain the local PDG graph of each non-library function.

[0065] It's important to note that non-library functions refer to functions defined within a program that are not provided by the programming language's standard library or external libraries. Examples include functions written by the user or implemented specifically within a project. These functions are written to meet specific application requirements and are used to perform specific operations or calculations.

[0066] The local PDG graph is the PDG graph of each non-library function itself.

[0067] It's important to note that recursive traversal solves problems by calling itself. This method is typically used to handle data with hierarchical or nested structures, such as trees and graphs. The core idea of ​​recursive traversal is to break down a large problem into several smaller problems, and then apply the same solution to each smaller problem until a basic situation is reached where no further recursive calls are needed.

[0068] In this embodiment of the disclosure, a list containing all library function names can be maintained. This list can be constructed by collecting the names of functions in standard library functions and third-party libraries. When traversing the subPDG graph, this list is used to filter out all library function call nodes, leaving only custom or project-defined function call nodes, which are non-library functions.

[0069] S202, construct candidate IPDG graphs based on sub-PDG graphs and local PDG graphs.

[0070] In this embodiment of the disclosure, the function call relationship can be determined first based on the code to be identified, and then the sub-PDG graph and the local PDG graph can be combined based on the function call relationship to generate a candidate IPDG graph.

[0071] In one possible implementation, function call relationships can be analyzed based on the Abstract Syntax Tree (AST) or Control Flow Graph (CFG) of the code to be identified to construct a function call graph. Then, based on the sub-PDG graph of the entry function, combined with the local PDG graphs of each non-library function, and according to the function call relationships, parameter passing edges, return value edges, and control flow edges are established between the call point and the called function to perform graph structure fusion and generate a candidate IPDG graph covering cross-process dependencies.

[0072] In the above embodiments, the target IPDG graph is vectorized to generate target vector data, and can also be processed by... Figure 3 To further explain, the method includes: S301, for any target node in the target IPDG graph, encode the code corresponding to the target node to generate the semantic vector of the target node, and generate the context features of the target node based on the context information of the target node. The semantic vector includes the function name, variable name and statement semantics of the target node.

[0073] It should be noted that the target node is the node that needs to be analyzed, and it can be any node in the target IPDG graph.

[0074] Semantic vectors effectively capture the language-level meaning of code, avoiding reliance solely on string matching. Contextual features preserve the position and dependencies of nodes in the program structure. The node representation formed by the fusion of these two features combines semantic richness with structural sensitivity, significantly improving the accuracy and generalization ability of vulnerability detection models.

[0075] In this embodiment, a pre-trained language model (CodeBERT) can be used to generate semantic vectors for code snippets, capturing semantic information of symbols such as function names and variable names. Local contextual features of nodes can be extracted based on graph traversal algorithms.

[0076] Repeat the above process for all nodes in the target IPDG graph to generate their respective semantic vectors and contextual features, providing a foundation for the subsequent construction of graph-level vector data.

[0077] S302, convert the target IPDG graph into target structure data, and generate target vector data based on the target structure data, semantic vectors and contextual features.

[0078] It should be noted that target structured data refers to the transformation of raw data (in this scenario, an IPDG graph) into an organized data format that facilitates computation and analysis. For IPDG graphs, target structured data typically includes structured information such as node information, edge information, and the relationships between them.

[0079] The format of the target structured data is pre-designed and can be customized according to actual design needs or current language requirements; no limitations are imposed here. In practical applications, this structured information can be represented using data structures, such as adjacency matrices, adjacency lists, or stored directly as a graph, like in Python's networkx library. This facilitates the processing and analysis of this data, such as using graph algorithms to find specific patterns, detect vulnerabilities, and optimize code.

[0080] In this embodiment of the disclosure, target vector data is generated based on target structural data, semantic vectors, and contextual features. The semantic vectors and contextual features of each node in the target structural data can be fused together to form a comprehensive feature vector. Then, the processed graph is converted into a form suitable for input to a machine learning model to generate target vector data.

[0081] In the above embodiments, the target vector data is input into the initial vulnerability detection model for training, and can also be used... Figure 4 To further explain, the method includes: S401, input the target vector data into the initial vulnerability detection model to output the vulnerability detection results.

[0082] It should be noted that the vulnerability detection results are generated by the initial vulnerability detection model based on the target vector data.

[0083] S402, the initial vulnerability detection model is trained based on the vulnerability detection results and the vulnerability data to be identified.

[0084] In this embodiment of the disclosure, the loss value of the initial vulnerability detection model can be calculated first based on the vulnerability detection results and the vulnerability data to be identified, and then the model parameters of the initial vulnerability detection model can be adjusted based on the loss function.

[0085] It is understandable that model training is an iterative process. The model is trained by continuously adjusting the network parameters until the overall loss function value of the model is less than the preset value, or the overall loss function value of the model no longer changes or changes slowly, and the model converges, resulting in a well-trained model.

[0086] In this embodiment of the disclosure, the training termination condition may be that the loss function is less than the loss function threshold, or the training time reaches the training time threshold, or the number of training iterations reaches the training iterations threshold.

[0087] It should be noted that the loss function threshold, training time threshold, and training iteration threshold are critical values ​​for determining whether the current training can end. They are pre-designed and can be changed according to actual design needs. No restrictions are imposed here.

[0088] In this embodiment of the disclosure, the loss function for calculating the loss value may include a variety of functions, and no limitation is made here. For example, the F1-score may be evaluated on the test set after each round of training.

[0089] In the above embodiments, taint analysis is performed on the code to be identified to determine the vulnerability data to be identified in the code. This can also be achieved through... Figure 5 To further explain, the method includes: S501, obtain the preset detection rules.

[0090] In this embodiment of the disclosure, detection rules can be formulated for different types of vulnerabilities, including source points, sink points, and taint propagation methods, in order to obtain the taint propagation flow of all samples in the training set.

[0091] S502 performs vulnerability detection on the code to be identified based on detection rules in order to determine the vulnerability data to be identified in the code.

[0092] In this embodiment of the disclosure, the static analysis tool can be set based on detection rules, and then the code to be identified can be scanned based on the static analysis tool to determine the vulnerability data to be identified in the code to be identified.

[0093] It's important to note that static analysis tools are software tools that analyze source code or compiled code without running the program. Their primary purpose is to detect potential errors, security vulnerabilities, performance issues, and coding style violations in the code. These tools uncover potential problems by analyzing the code's syntax structure, control flow, and data flow. Various static analysis tools can exist, and no specific limitations are made here.

[0094] Vulnerability detection of code to be identified based on detection rules can include the following process: (1) Identify the source of pollution. (2) Taint Propagation (3) Identify the sink and match the detection rules If the detection rules are triggered, a vulnerability is identified.

[0095] It should be noted that vulnerability data can include various types of information, such as vulnerability type, location of pollution source and sink, data flow path, and matching detection rules.

[0096] In the above embodiments, after obtaining the training sample set, the code to be recognized can be preprocessed, such as... Figure 6 As shown, the method includes: S601: For any code to be identified in the training sample set, extract the variable data and method name data from the code to be identified.

[0097] In this embodiment of the disclosure, in order to retain the actual semantic information such as variable names and method names in the code while reducing the offset caused by naming differences between different projects to the model training, it is necessary to standardize the naming of multiple projects that have the same function and meaning.

[0098] It should be noted that variable data refers to the names of variables defined and used in the program and their scope information, which are used for subsequent semantic analysis or feature vector construction.

[0099] Method name data refers to the names of all functions defined or called in the code, and is a key feature for identifying misuse and sensitive operations of the Application Programming Interface (API).

[0100] S602, perform clustering processing on the variable data and method name data respectively to generate at least one corresponding cluster.

[0101] In this embodiment of the disclosure, clustering algorithms can be used to cluster the variable data and method name data separately. Various clustering algorithms can be used, and no limitation is made here. For example, the clustering algorithm can be a similarity clustering algorithm, a K-Means clustering algorithm, a hierarchical clustering algorithm, etc.

[0102] In this embodiment of the disclosure, the variable data or method name data can be vectorized first, and then the vectorized names can be clustered to generate at least one cluster.

[0103] For example, vectorizing variable data: Use word embedding models (such as Word2Vec or pre-trained Code2Vec) to convert variable names into vector representations. For example: token → [0.82, -0.33, 0.51, ...] (100 dimensions) password → [0.79, -0.35, 0.49, ...] buffer → [0.12, 0.67, -0.44, ...] For each file, the average of all its variable name vectors is taken to obtain the "variable semantic vector" for that file.

[0104] Method name vectorization: The method name is also encoded using a word embedding model: login → [0.85, -0.30, 0.55, ...] encrypt → [0.80, -0.32, 0.53, ...] send → [0.15, 0.68, -0.42, ...] Calculate the average vector of method names for each file.

[0105] S603, revising variable data under the same cluster to the same variable name, and revising method name data under the same cluster to method name.

[0106] After clustering and analyzing the above names to obtain basic names (such as sql, query), and combining them with code structure, such as nested calls, the method names, variable names, etc. are renamed.

[0107] This allows datasets from different projects to have the same naming conventions without losing semantic information in the naming, thus improving the model's generalization ability.

[0108] Figure 7 This disclosure presents a flowchart illustrating a vulnerability detection process, such as... Figure 7 As shown, the method includes: S701, parses the code to be detected and constructs IPDG.

[0109] It should be noted that the parsing of the code to be detected and the construction of IPDG can be referred to the content in the above embodiments, and will not be repeated here.

[0110] S702, feature normalization of the code to be detected.

[0111] It should be noted that feature normalization of the code to be detected can be performed as described in the above embodiments, and will not be repeated here.

[0112] S703, vectorization of IPDG graphs.

[0113] It should be noted that the vectorization of IPDG graphs can be referred to the content in the above embodiments, and will not be repeated here.

[0114] S704 performs vulnerability detection.

[0115] The pre-trained target vulnerability detection model is loaded, and the IPDG vectorized data of the parsed code to be detected is input into the model. It should be noted that the target vulnerability detection model in this embodiment is... Figures 1-6 The vulnerability detection model was trained using the method described in this embodiment.

[0116] The target vulnerability detection model is used to detect whether the interface has any vulnerabilities.

[0117] Corresponding to the vulnerability detection model training methods provided in the above embodiments, an embodiment of this disclosure also provides a vulnerability detection model training device. Since the vulnerability detection model training device provided in this disclosure corresponds to the vulnerability detection model training methods provided in the above embodiments, the implementation methods of the above vulnerability detection model training methods are also applicable to the vulnerability detection model training device provided in this disclosure, and will not be described in detail in the following embodiments.

[0118] Figure 8 Figure 8 is a schematic diagram of a vulnerability detection model training device according to one embodiment of the present disclosure. As shown in Figure 8, the vulnerability detection model training device 800 includes: an acquisition module 810, a generation module 820, a construction module 830, an annotation module 840, and a training module 850.

[0119] The acquisition module 810 is used to acquire a training sample set and an initial vulnerability detection model to be trained. The training sample set includes at least one piece of code to be identified, and the code to be identified includes at least one entry function.

[0120] The generation module 820 is used to construct a sub-PDG graph of the entry function of any code to be identified, and to perform taint analysis on the code to be identified in order to determine the vulnerability data to be identified in the code.

[0121] Module 830 is used to construct a candidate IPDG graph for the code to be identified based on the subPDG graph.

[0122] The annotation module 840 is used to annotate the vulnerability data to be identified to the corresponding nodes in the candidate IPDG graph to generate the target IPDG graph.

[0123] The training module 850 is used to vectorize the target IPDG graph to generate target vector data, and input the target vector data into the initial vulnerability detection model for training. The above steps are repeated for any code to be identified, constructing the PDG graph of the entry function of the code to be identified and subsequent steps, until the training termination condition is met and the target vulnerability detection model is generated.

[0124] According to one embodiment of this disclosure, constructing a candidate IPDG graph for the code to be identified based on the subPDG graph includes: recursively traversing and extracting function call nodes corresponding to all non-library functions in the subPDG graph based on the subPDG graph of the entry function, and obtaining the local PDG graph of each non-library function; and constructing the candidate IPDG graph based on the subPDG graph and the local PDG graph.

[0125] According to one embodiment of this disclosure, constructing the candidate IPDG graph based on the sub-PDG graph and the local PDG graph includes: determining function call relationships based on the code to be identified; and combining the sub-PDG graph and the local PDG graph based on the function call relationships to generate the candidate IPDG graph.

[0126] According to one embodiment of this disclosure, the step of vectorizing the target IPDG graph to generate target vector data includes: encoding the code corresponding to any target node in the target IPDG graph to generate a semantic vector of the target node; and generating context features of the target node based on the context information of the target node, wherein the semantic vector includes the function name, variable name, and statement semantics of the target node; converting the target IPDG graph into target structure data; and generating the target vector data based on the target structure data, the semantic vector, and the context features.

[0127] According to one embodiment of this disclosure, the step of inputting the target vector data into an initial vulnerability detection model for training includes: inputting the target vector data into the initial vulnerability detection model to output a vulnerability detection result; and training the initial vulnerability detection model based on the vulnerability detection result and the vulnerability data to be identified.

[0128] According to one embodiment of this disclosure, training the initial vulnerability detection model based on the detected vulnerability results and the vulnerability data to be identified includes: calculating the loss value of the initial vulnerability detection model based on the detected vulnerability results and the vulnerability data to be identified; and adjusting the model parameters of the initial vulnerability detection model based on the loss value.

[0129] According to one embodiment of this disclosure, the training termination condition is: the loss value is less than a loss value threshold; or, the training time reaches a training time threshold; or, the number of training iterations reaches a training iterations threshold.

[0130] According to one embodiment of this disclosure, performing taint analysis on the code to be identified to determine the vulnerability data to be identified includes: obtaining preset detection rules; and performing vulnerability detection on the code to be identified based on the detection rules to determine the vulnerability data to be identified.

[0131] According to one embodiment of this disclosure, after obtaining the training sample set, the method further includes: extracting variable data and method name data from any code to be identified in the training sample set; performing clustering processing on the variable data and the method name data respectively to generate at least one corresponding cluster; revising the variable data under the same cluster to the same variable name, and revising the method name data under the same cluster to the method name.

[0132] Thus, through a closed-loop process of "structured analysis + precise annotation + graph neural network learning", high-precision, interpretable and automated detection of code vulnerabilities is achieved, solving the problems of high false alarm rate, weak generalization ability and reliance on manual rules in traditional methods. At the same time, the icon annotation mechanism based on taint analysis gives the model prediction results a clear path basis.

[0133] To implement the above embodiments, this disclosure also proposes an electronic device 900. Figure 9 This is a schematic diagram of an electronic device according to one embodiment of the present disclosure, such as... Figure 9 As shown, the electronic device 900 includes: a processor 901 and a memory 902 communicatively connected to the processor. The memory 902 stores instructions executable by at least one processor. The instructions are executed by at least one processor 901 to achieve the functions described in this disclosure. Figures 1-6 The vulnerability detection model training method of the embodiment.

[0134] To implement the above embodiments, this disclosure also proposes a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to perform as disclosed herein. Figures 1-6 The vulnerability detection model training method of the embodiment.

[0135] To implement the above embodiments, this disclosure also proposes a computer program product, including a computer program, which, when executed by a processor, implements the features of this disclosure. Figures 1-6 The vulnerability detection model training method of the embodiment.

[0136] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0137] This application is intended to provide an implementation scheme for users to selectively prevent the use or access to their personal information data. Specifically, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information is de-identified to protect user privacy.

[0138] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0139] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0140] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0141] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that contains, stores, communicates, propagates, or transmits programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0142] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0143] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0144] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0145] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A method for training a vulnerability detection model, characterized in that, include: Obtain a training sample set and an initial vulnerability detection model to be trained. The training sample set includes at least one piece of code to be identified, and the code to be identified includes at least one entry function. For any code to be identified, a sub-PDG graph of the entry function of the code to be identified is constructed, and taint analysis is performed on the code to be identified to determine the vulnerability data to be identified in the code to be identified; Construct a candidate IPDG graph for the code to be identified based on the subPDG graph; The vulnerability data to be identified is labeled into the corresponding nodes in the candidate IPDG graph to generate the target IPDG graph; The target IPDG graph is vectorized to generate target vector data, which is then input into the initial vulnerability detection model for training. The above steps are repeated for any code to be identified, constructing the PDG graph of the entry function of the code to be identified and subsequent steps, until the training termination condition is met, and the target vulnerability detection model is generated.

2. The method according to claim 1, characterized in that, The construction of the candidate IPDG graph for the code to be identified based on the sub-PDG graph includes: Based on the sub-PDG graph of the entry function, recursively traverse and extract the function call nodes corresponding to all non-library functions in the sub-PDG graph to obtain the local PDG graph of each non-library function. The candidate IPDG graph is constructed based on the sub-PDG graph and the local PDG graph.

3. The method according to claim 2, characterized in that, The construction of the candidate IPDG graph based on the sub-PDG graph and the local PDG graph includes: Determine function call relationships based on the code to be identified; The sub-PDG graph and the local PDG graph are combined based on the function call relationship to generate the candidate IPDG graph.

4. The method according to any one of claims 1-3, characterized in that, The step of vectorizing the target IPDG graph to generate target vector data includes: For any target node in the target IPDG graph, the code corresponding to the target node is encoded to generate the semantic vector of the target node, and the context features of the target node are generated based on the context information of the target node. The semantic vector includes the function name, variable name and statement semantics of the target node. The target IPDG graph is converted into target structure data, and the target vector data is generated based on the target structure data, the semantic vector, and the context features.

5. The method according to claim 1, characterized in that, The step of inputting the target vector data into the initial vulnerability detection model for training includes: The target vector data is input into the initial vulnerability detection model to output the vulnerability detection results; The initial vulnerability detection model is trained based on the detected vulnerability results and the vulnerability data to be identified.

6. The method according to claim 5, characterized in that, The step of training the initial vulnerability detection model based on the detected vulnerability results and the vulnerability data to be identified includes: The loss value of the initial vulnerability detection model is calculated based on the detected vulnerability results and the vulnerability data to be identified. The model parameters of the initial vulnerability detection model are adjusted based on the loss value.

7. The method according to claim 6, characterized in that, The training termination condition is: The loss value is less than the loss value threshold; or, The training time has reached the training time threshold; or, The number of training sessions has reached the training session threshold.

8. The method according to claim 1, characterized in that, The step of performing taint analysis on the code to be identified to determine the vulnerability data to be identified includes: Obtain the preset detection rules; Based on the detection rules, vulnerability detection is performed on the code to be identified in order to determine the vulnerability data to be identified in the code.

9. The method according to claim 1, characterized in that, After obtaining the training sample set, the process also includes: For any code to be identified in the training sample set, extract the variable data and method name data from the code to be identified; The variable data and the method name data are clustered separately to generate at least one corresponding cluster. Revise variable data within the same cluster to use the same variable name, and revise method name data within the same cluster to use the same method name.

10. A vulnerability detection model training device, characterized in that, include: The acquisition module is used to acquire a training sample set and an initial vulnerability detection model to be trained. The training sample set includes at least one piece of code to be identified, and the code to be identified includes at least one entry function. The generation module is used to construct a sub-PDG graph of the entry function of any code to be identified, and to perform taint analysis on the code to be identified in order to determine the vulnerability data to be identified in the code to be identified. The construction module is used to construct a candidate IPDG graph for the code to be identified based on the subPDG graph; The annotation module is used to annotate the vulnerability data to be identified to the corresponding nodes in the candidate IPDG graph to generate the target IPDG graph; The training module is used to vectorize the target IPDG graph to generate target vector data, and input the target vector data into the initial vulnerability detection model for training. The above steps are repeated for any code to be identified, constructing the PDG graph of the entry function of the code to be identified and subsequent steps, until the training termination condition is met and the target vulnerability detection model is generated.

11. An electronic device, characterized in that, Including memory and processor; The processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the method as described in any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-9.

Images