Big model-based software intelligent detection system and method

Abstract

The application provides a large model-based software intelligent detection system and method, and relates to the technical field of software detection.The system comprises a function semantic segmentation module, a history scheme calling module, a topological graph construction module, a test attack chain construction module, a real-time behavior monitoring module and a repair scheme matching module.The function semantic segmentation module is used for function semantic segmentation.The history scheme calling module is used for calling historical schemes.The topological graph construction module is used for constructing a calling relationship directed topological graph.The test attack chain construction module is used for topological driving case splicing and constructing multiple targeted test attack chains.The real-time behavior monitoring module is used for real-time behavior monitoring in a dynamic test process and outputting multiple abnormal events.The repair scheme matching module is used for locating a vulnerability code line, matching a repair scheme and obtaining an injectable patch strategy.The application solves the technical problem that software detection in the prior art usually relies on manually set rules or simple template matching, is difficult to cope with complex business logic and system interaction, is prone to abnormal false positives or false negatives and results in poor software security.

Claims

1. A software-based intelligent detection system based on a large model, characterized in that: The system includes: The functional semantic segmentation module is used to perform functional semantic segmentation on the source code of the software to be tested, resulting in K functional modules and their corresponding K code segments; The historical scheme retrieval module is used to match and retrieve K historical test schemes from the historical vulnerability knowledge base by using the K functional modules and K code segments as two-dimensional search conditions. The topology graph construction module is used to abstract the K functional modules into K functional nodes by parsing the software requirements document and construct a directed topology graph of call relationships. The test attack chain construction module is used to construct multiple targeted test attack chains by splicing topology-driven test cases of the K historical test schemes, using the directed topology graph of the call relationship as the behavioral baseline. The test attack chain construction module is used to perform the following steps: Using the maximum call length of the preset topology chain as the enumeration termination condition, and the entry node and end node of the directed topology graph of the call relationship as the path start and end constraints, a node-by-node path extension enumeration is performed along the directed edge direction of the directed topology graph of the call relationship to generate multiple topology candidate chains. Based on the functional node composition of the multiple candidate topology chains, node-by-node matching is performed on the K historical test schemes to obtain multiple candidate scheme combinations; After splicing the data streams of the multiple candidate schemes according to the functional node call order of the multiple topology candidate chains, the call logic is adapted based on the topology edge call type attribute to generate multiple attack chains to be screened. Based on topological confidence, the multiple attack chains to be screened are combined with redundancy pruning to obtain the multiple targeted test attack chains. The real-time behavior monitoring module is used to perform real-time behavior monitoring on the software under test by deploying K lightweight probes in the K code segments during the dynamic testing process using the multiple targeted test attack chains, and output multiple abnormal events. The real-time behavior monitoring module is used to perform the following operation steps: A joint quantitative score is performed on the multiple sets of call frequencies and multiple sets of attack effectiveness of multiple historical test scheme combinations in the multiple targeted test attack chains to obtain multiple attack chain priority scores. Based on the priority scores of the multiple attack chains, the multiple targeted test attack chains are sorted non-dominatedly based on multi-target Pareto optimization to generate a Pareto optimal attack chain queue. Based on the Pareto optimal attack chain queue, the first P targeted test attack chains are sequentially called from the multiple targeted test attack chains to perform dynamic testing on the software under test. During the process, real-time behavior monitoring is performed by K lightweight probes deployed in the K code segments, and P abnormal events are output, where P≥K / 2. Based on the adjacent reproduction gain quantization results of the P abnormal events, progressive test branch pruning is performed on the remaining unexecuted targeted test attack chain to test and obtain the multiple abnormal events; The remediation scheme matching module is used to aggregate the multiple abnormal events, locate the vulnerable code line, and perform remediation scheme matching in the historical remediation database according to the functional semantics of the vulnerable code line to obtain an injectable patch strategy.

2. The software intelligent detection system based on a large model as described in claim 1, characterized in that, The real-time behavior monitoring module is used to perform the following operation steps: Standard scenario pre-testing was performed on the first targeted attack chain to obtain the standard behavior sequence. Then, node-level code segment behavior feature segmentation was performed to obtain Q node behavior baselines. The first test input data is assembled according to the functional node call order of the first targeted test attack chain; The first test input data is dynamically injected into the software under test to start dynamic testing. Then, Q lightweight probes are used to collect edge-level running behavior data of Q code segments to obtain Q actual running sequences. Based on the Q node behavior baselines, the Q actual running sequences are subjected to multi-dimensional deviation determination. After obtaining the Q node status labels, the attack link structure is aggregated to obtain the first abnormal event.

3. The software intelligent detection system based on a large model as described in claim 2, characterized in that, The real-time behavior monitoring module is used to perform the following operation steps: Based on the Q node behavior baselines, the Q actual running sequences are subjected to multi-dimensional deviation determination to obtain the Q node status labels; From the Q node status flags, select L functional nodes marked as abnormal, and extract the running context from the L actual running sequences corresponding to the L functional nodes to obtain the first running context information; The order in which the native functional nodes of the first targeted test attack chain are called is used as the first call path information; The L functional nodes are integrated into the first abnormal node information, and the first abnormal event is obtained by structurally aggregating the first abnormal node information, the first running context information, and the first call path information.

4. The software intelligent detection system based on a large model as described in claim 3, characterized in that, The repair scheme matching module is used to perform the following operation steps: Extract multiple abnormal node information, multiple call path information, and multiple runtime context information from the multiple abnormal events respectively; Based on the multiple call path information, the multiple targeted test attack chains are associated to obtain an abnormal association chain; Following the original call order of the nodes in the abnormal association chain, the information of the multiple abnormal nodes is sequentially linked to restore the abnormal node chain; Multiple abnormal offsets are extracted from the multiple runtime context information mappings along the restored abnormal node link, and the vulnerability range is pruned layer by layer based on offset superposition to locate the vulnerable code line; Using the vulnerable code behavior center, extract the context-related code fragment, extract the functional semantic features of the vulnerable code line and the context-related code fragment, and generate a vulnerability functional semantic vector; The vulnerability functional semantic vector is input into the historical repair library for repair scheme matching to obtain the injectable patch strategy.

5. The software intelligent detection system based on a large model as described in claim 1, characterized in that, The historical scheme recall module is used to perform the following operations: The first code segment is represented by multimodal vectorization to construct the first functional semantic vector; Use the first functional module as the function retrieval key to locate the corresponding first functional domain sub-library in the historical vulnerability knowledge base. The first set of backup test schemes is obtained by performing hierarchical nearest neighbor matching in the first functional domain sub-library using the first functional semantic vector. Based on the call frequency and attack effectiveness of the first set of backup test schemes, the call priority is quantified, and the first historical test schemes are selected in descending order.

6. The software intelligent detection system based on a large model as described in claim 1, characterized in that, The topology graph construction module is used to perform the following operations: By parsing the software requirements document, multiple expected behavior rules for various functional interaction scenarios are obtained, forming a set of expected behavior rules; During the benchmark traversal test of the software under test based on the various functional interaction scenarios, the K lightweight probes are used to capture runtime call behavior and obtain multiple module call timing sequences. Based on the call sequence of the multiple modules, the rule matching degree of the multiple expected behavior rules is verified to obtain multiple call relationship confidence indicators; The K functional modules are abstracted into K functional nodes, and directed topological edges are constructed based on the multiple call relationship confidence indicators to generate the call relationship directed topological graph.

7. The software intelligent detection system based on a large model as described in claim 3, characterized in that, The multi-dimensional deviation determination includes data flow deviation determination, call timing deviation determination, and control flow deviation determination.

8. A software-based intelligent detection method based on a large model, characterized in that, The method, implemented according to any one of claims 1-7, comprises: The source code of the software to be tested is segmented into functional semantic segments to obtain K functional modules and their corresponding K code segments; Using the K functional modules and K code segments as two-dimensional search conditions, K historical test schemes are matched and invoked in the historical vulnerability knowledge base; By parsing the software requirements document, the K functional modules are abstracted into K functional nodes, and a directed topology graph of the calling relationship is constructed. Using the directed topology graph of the call relationship as the behavioral baseline, topology-driven test cases of the K historical test schemes are spliced ​​together to construct multiple targeted test attack chains; Specifically, using the directed topology graph of the call relationship as the behavioral baseline, topology-driven test cases from the K historical test schemes are spliced ​​together to construct multiple targeted test attack chains, including: Using the maximum call length of the preset topology chain as the enumeration termination condition, and the entry node and end node of the directed topology graph of the call relationship as the path start and end constraints, a node-by-node path extension enumeration is performed along the directed edge direction of the directed topology graph of the call relationship to generate multiple topology candidate chains. Based on the functional node composition of the multiple candidate topology chains, node-by-node matching is performed on the K historical test schemes to obtain multiple candidate scheme combinations; After splicing the data streams of the multiple candidate schemes according to the functional node call order of the multiple topology candidate chains, the call logic is adapted based on the topology edge call type attribute to generate multiple attack chains to be screened. Based on topological confidence, the multiple attack chains to be screened are combined with redundancy pruning to obtain the multiple targeted test attack chains. Using the aforementioned multiple targeted test attack chains, during the dynamic testing of the software under test, real-time behavior monitoring is performed using K lightweight probes deployed in the K code segments, and multiple abnormal events are output. This outputs multiple exception events, including: A joint quantitative score is performed on the multiple sets of call frequencies and multiple sets of attack effectiveness of multiple historical test scheme combinations in the multiple targeted test attack chains to obtain multiple attack chain priority scores. Based on the priority scores of the multiple attack chains, the multiple targeted test attack chains are sorted non-dominatedly based on multi-target Pareto optimization to generate a Pareto optimal attack chain queue. Based on the Pareto optimal attack chain queue, the first P targeted test attack chains are sequentially called from the multiple targeted test attack chains to perform dynamic testing on the software under test. During the process, real-time behavior monitoring is performed by K lightweight probes deployed in the K code segments, and P abnormal events are output, where P≥K / 2. Based on the adjacent reproduction gain quantization results of the P abnormal events, progressive test branch pruning is performed on the remaining unexecuted targeted test attack chain to test and obtain the multiple abnormal events; By aggregating the multiple abnormal events, the vulnerable code line is located, and based on the functional semantics of the vulnerable code line, a remediation plan is matched in the historical remediation database to obtain an injectable patch strategy.

Images