A code detection method, device, equipment, medium and product based on code cloning

Abstract

This invention provides a code detection method, apparatus, device, medium, and product based on code cloning, relating to the field of data processing technology. The method includes: performing cluster analysis on security alert code fragments in the original security alert set output by a white-box testing tool to obtain multiple code cluster sets; obtaining prompt word templates corresponding to each code cluster set; inputting each code cluster set and its corresponding prompt word templates into a pre-constructed large language model, so that the large language model performs code detection on each code cluster set based on the prompt word templates, obtaining code detection results corresponding to each code cluster set output by the large language model; and constructing a code vulnerability report based on the code detection results corresponding to each code cluster set. This invention improves the overall efficiency of code detection.

Description

Technical Field

[0002] The embodiments of the present invention relate to the field of data processing technology, and more specifically, the embodiments of the present invention relate to a code detection method, apparatus, device, medium and product based on code cloning. Background Technology

[0004] In Java enterprise project development, code quality assurance is one of the key factors for project success, and code inspection is an important means of ensuring code quality. Code inspection aims to discover defects, security vulnerabilities, violations of coding standards, and other issues in the code, thereby helping developers to fix them in a timely manner and improve the reliability, stability, and security of the software.

[0005] As software projects grow in scale and complexity, developers may modify, copy, and reuse existing code to meet new business needs or optimize existing functions. These situations can easily lead to a large number of similar code snippets, i.e., code cloning.

[0006] Traditional code inspection methods primarily focus on examining the syntax rules, logical structure, and specific known defect patterns of the code line by line or function by function. However, when detecting similar code snippets, these methods often can only perform independent inspections on individual code snippets, failing to quickly identify similar code snippets with similar characteristics but distributed in different locations, resulting in low code inspection efficiency. Summary of the Invention

[0008] In this context, embodiments of the present invention aim to provide a code detection method, apparatus, device, medium, and product based on code cloning, which can improve code detection efficiency.

[0009] In a first aspect of the present invention, a code detection method based on code cloning is provided, comprising:

[0010] Cluster analysis is performed on the security alert code fragments in the original security alert set output by the white-box testing tool to obtain multiple code cluster sets; wherein, the original security alert set contains multiple security alert code fragments, each code cluster set corresponds to a code type, and the code types of any two code cluster sets are different, and the code type is a fully reusable type, a parameterized reusable type, a structural reusable type, or a semantic reusable type;

[0011] Obtain the prompt word templates corresponding to each code cluster set;

[0012] Each code cluster set and its corresponding prompt word template are input into a pre-built large language model, so that the large language model performs code detection on each code cluster set based on the prompt word template, and obtains the code detection results corresponding to each code cluster set output by the large language model.

[0013] A code vulnerability report is constructed based on the code detection results corresponding to each code cluster set.

[0014] In one embodiment of this implementation, the clustering analysis of security alert code fragments in the original security alert set output by the white-box testing tool to obtain multiple code cluster sets specifically includes:

[0015] Multiple pairs of security alert code fragments are determined from the raw security alert set output by the white-box testing tool; wherein each security alert code fragment in the raw security alert set is combined with other security alert code fragments in the raw security alert set to form a security alert code fragment pair;

[0016] Perform code similarity detection on each pair of security alarm code snippets to determine the code type of each pair of security alarm code snippets;

[0017] Based on the code type of each pair of security alarm code fragments, cluster analysis is performed on the security alarm code fragments to obtain multiple code cluster sets.

[0018] In one embodiment of this implementation, code similarity detection is performed on a pair of target security alert code fragments to determine the code type of the target security alert code fragment pair, specifically including:

[0019] Obtain the first security alert code fragment and the second security alert code fragment from the target security alert code fragment pair;

[0020] The first security alarm code segment and the second security alarm code segment are preprocessed respectively to obtain the first standard code segment and the second standard code segment;

[0021] Hash calculations are performed on the first standard code segment and the second standard code segment respectively to obtain the first hash value of the first standard code segment and the second hash value of the second standard code segment;

[0022] If the first hash value and the second hash value are equal, then the code type of the target security alarm code fragment pair is determined to be the fully reused type.

[0023] In one embodiment of this method, if the first hash value and the second hash value are not equal, the method further includes:

[0024] Replace the identifiers in the first standard code snippet and the second standard code snippet with predetermined placeholders to obtain the first placeholder code snippet and the second placeholder code snippet;

[0025] Hash calculations are performed on the first placeholder code segment and the second placeholder code segment respectively to obtain the third hash value of the first placeholder code segment and the fourth hash value of the second placeholder code segment;

[0026] If the third hash value and the fourth hash value are equal, then the code type of the target security alarm code fragment pair is determined to be the parameterized reuse type.

[0027] In one embodiment of this method, if the third hash value and the fourth hash value are not equal, the method further includes:

[0028] The first placeholder code fragment and the second placeholder code fragment are parsed using a syntax tree parser to obtain a first syntax tree for the first placeholder code fragment and a second syntax tree for the second placeholder code fragment;

[0029] Perform a post-order traversal on the first syntax tree and the second syntax tree respectively to obtain the first structural signature string of the first syntax tree and the second structural signature string of the second syntax tree;

[0030] The first structure signature string and the second structure signature string are processed using a message digest algorithm to obtain the first structure hash value of the first structure signature string and the second structure hash value of the second structure signature string.

[0031] If the first structure hash value and the second structure hash value are equal, then the code type of the target security alarm code fragment pair is determined to be the structure reuse type.

[0032] In one embodiment of this method, if the first structure hash value and the second structure hash value are not equal, the method further includes:

[0033] The first security alarm code fragment and the second security alarm code fragment are input into a preset code language model to obtain the first semantic feature vector of the first security alarm code fragment and the second semantic feature vector of the second security alarm code fragment output by the code language model.

[0034] Determine the similarity between the first semantic feature vector and the second semantic feature vector;

[0035] If the similarity is greater than a preset threshold, then the code type of the target security alarm code fragment pair is determined to be the semantic reuse type.

[0036] In a second aspect of the present invention, a code detection device based on code cloning is provided, comprising:

[0037] The analysis unit is used to perform cluster analysis on the security alert code fragments in the original security alert set output by the white-box testing tool to obtain multiple code cluster sets; wherein, the original security alert set contains multiple security alert code fragments, each code cluster set corresponds to a code type, and the code types of any two code cluster sets are different, and the code type is a fully reusable type, a parameterized reusable type, a structural reusable type, or a semantic reusable type;

[0038] The acquisition unit is used to acquire the prompt word templates corresponding to each code cluster set;

[0039] The input unit is used to input each code cluster set and the prompt word template corresponding to each code cluster set into the pre-constructed large language model, so that the large language model performs code detection on each code cluster set based on the prompt word template, and obtains the code detection results corresponding to each code cluster set output by the large language model.

[0040] The building unit is used to construct code vulnerability reports based on the code detection results corresponding to each code cluster set.

[0041] In a third aspect of the present invention, a computing device is provided, the computing device comprising: at least one processor, a memory, and an input / output unit; wherein the memory is used to store a computer program, and the processor is used to invoke the computer program stored in the memory to execute the method described in any one aspect.

[0042] In a fourth aspect of the present invention, a computer-readable storage medium is provided, comprising instructions which, when executed on a computer, cause the computer to perform the method described in any one of the first aspects.

[0043] In a fifth aspect of the present invention, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the method described in any one of the first aspects.

[0044] According to embodiments of the present invention, a code detection method, apparatus, device, medium, and product based on code cloning, cluster analysis is performed on the original security alert code fragments output by white-box testing tools. Similar codes are grouped into sets corresponding to different code types, avoiding repeated detection of a large number of similar codes and reducing unnecessary computation. Hint word templates corresponding to each code cluster set are obtained, and targeted detection is performed based on these templates using a large language model, making the detection process more directional and accurate, and enabling rapid location of code problems. Finally, a code vulnerability report is constructed based on the detection results. The entire process is orderly, from code classification to accurate detection to report generation, with each step working closely together, greatly shortening the review time. This invention, based on existing large amounts of vulnerability detection results, helps code reviewers and vulnerability verifiers improve review efficiency. Attached Figure Description

[0046] The above and other objects, features, and advantages of exemplary embodiments of the present invention will become readily apparent from the following detailed description taken in conjunction with the accompanying drawings. Several embodiments of the invention are illustrated in the drawings by way of example, not limitation, in which:

[0047] Figure 1 This is a flowchart illustrating a code detection method based on code cloning provided in an embodiment of the present invention.

[0048] Figure 2 This is a schematic diagram of the structure of a code detection device based on code cloning provided in an embodiment of the present invention;

[0049] Figure 3 A schematic diagram of the structure of a medium according to an embodiment of the present invention is shown.

[0050] Figure 4 A schematic diagram of the structure of a computing device according to an embodiment of the present invention is shown.

[0051] In the accompanying drawings, the same or corresponding reference numerals indicate the same or corresponding parts. Detailed Implementation

[0053] The principles and spirit of the invention will now be described with reference to several exemplary embodiments. It should be understood that these embodiments are given merely to enable those skilled in the art to better understand and implement the invention, and are not intended to limit the scope of the invention in any way. Rather, these embodiments are provided to make this disclosure more thorough and complete, and to fully convey the scope of this disclosure to those skilled in the art.

[0054] Those skilled in the art will recognize that embodiments of the present invention can be implemented as a system, apparatus, device, method, or computer program product. Therefore, this disclosure can be specifically implemented in the following forms: entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0055] According to embodiments of the present invention, a code detection method, apparatus, device, medium, and product based on code cloning are proposed.

[0056] It should be noted that the number of any elements in the accompanying drawings is for illustrative purposes only and not as a limitation, and any naming is for distinction only and has no limiting meaning.

[0057] The principles and spirit of the present invention will be explained in detail below with reference to several representative embodiments.

[0058] The following is for reference. Figure 1 , Figure 1 This is a schematic flowchart illustrating a code detection method based on code cloning according to an embodiment of the present invention. It should be noted that the embodiments of the present invention can be applied to any applicable scenario.

[0059] Figure 1 The flowchart of a code detection method based on code cloning provided in an embodiment of the present invention, shown below, includes:

[0060] Step 101: Perform cluster analysis on the security alert code snippets in the original security alert set output by the white-box testing tool to obtain multiple code cluster sets.

[0061] In this embodiment of the application, the original security alarm set contains multiple security alarm code fragments, each code cluster set corresponds to a code type, and the code types of any two code cluster sets are different. The code type is a fully reusable type, a parameterized reusable type, a structural reusable type, or a semantic reusable type.

[0062] In this embodiment of the application, the security alarm code snippet can be a Java code snippet, and this embodiment of the application does not limit it.

[0063] In this application's embodiments, "complete reuse" refers to the reuse of code snippets where, apart from whitespace characters, comment content, and formatting, the remaining code content is completely identical. This type of reuse typically stems from direct copy-paste operations, with identical code structure and security attributes.

[0064] Parameterized reuse refers to reuse behavior that replaces only identifiers such as variable names, function names, and class names while maintaining complete consistency in the core code structure. This type of reuse preserves the control flow and data flow pattern of the original code, but the surface characteristics change.

[0065] Structural reuse refers to code that maintains a high degree of similarity in overall control structure, function call order, and business logic flow, but involves the addition, deletion, modification, or reordering of local statements. This type of reuse preserves the core code framework, but the detailed implementation varies.

[0066] Semantic reuse refers to the reuse behavior of different code snippets that achieve the same functionality but use drastically different implementation methods or algorithmic structures. Examples include using loop structures instead of recursion, or using mapping tables instead of multi-branch selection statements.

[0067] As an optional implementation, step 101 involves performing cluster analysis on the security alert code snippets in the original security alert set output by the white-box testing tool to obtain multiple code cluster sets. This can be achieved through methods such as:

[0068] Multiple pairs of security alert code fragments are determined from the raw security alert set output by the white-box testing tool; wherein each security alert code fragment in the raw security alert set is combined with other security alert code fragments in the raw security alert set to form a security alert code fragment pair;

[0069] Perform code similarity detection on each pair of security alarm code snippets to determine the code type of each pair of security alarm code snippets;

[0070] Based on the code type of each pair of security alarm code fragments, cluster analysis is performed on the security alarm code fragments to obtain multiple code cluster sets.

[0071] This implementation method first identifies multiple pairs of security alert code snippets to comprehensively cover all code snippet combinations and avoid omissions. Next, code similarity detection is performed on each pair to accurately determine the code type, providing a reliable basis for subsequent clustering. Finally, based on code type clustering, similar codes are grouped together, presenting issues of the same code type in a concentrated manner. This allows for the application of appropriate strategies to different cluster sets during subsequent detection, reducing redundant work, quickly locating vulnerabilities, and effectively improving the overall effectiveness of code detection.

[0072] Optionally, the method for performing code similarity detection on a pair of target security alert code snippets to determine the code type of the target security alert code snippets may include:

[0073] Obtain the first security alert code fragment and the second security alert code fragment from the target security alert code fragment pair;

[0074] The first security alarm code segment and the second security alarm code segment are preprocessed respectively to obtain the first standard code segment and the second standard code segment;

[0075] Hash calculations are performed on the first standard code segment and the second standard code segment respectively to obtain the first hash value of the first standard code segment and the second hash value of the second standard code segment;

[0076] If the first hash value and the second hash value are equal, then the code type of the target security alarm code fragment pair is determined to be the fully reused type.

[0077] This implementation method first extracts two segments from the target code segment pair, then preprocesses them into standard code segments to eliminate formatting and other interference factors, ensuring the accuracy of subsequent detection. Next, hash calculation is performed, utilizing the uniqueness of hash values ​​to quickly determine if the two code segments are identical. If the hash values ​​are equal, they are directly identified as fully reused, a simple and efficient process. This detection method can quickly and accurately identify fully reused code, reducing unnecessary complex analysis and providing a reliable foundation for subsequent code clustering and vulnerability detection, effectively improving overall code detection efficiency.

[0078] In this embodiment of the application, the method for preprocessing the first security alarm code fragment / second security alarm code fragment may be as follows:

[0079] Remove comments and blank lines from the first security alert code snippet / second security alert code snippet, standardize the indentation format of the first security alert code snippet / second security alert code snippet, and compress consecutive whitespace characters in the first security alert code snippet / second security alert code snippet into a single space to obtain the first standard code snippet / second standard code snippet.

[0080] Optionally, if the first hash value and the second hash value are not equal, the following steps can also be performed:

[0081] Replace the identifiers in the first standard code snippet and the second standard code snippet with predetermined placeholders to obtain the first placeholder code snippet and the second placeholder code snippet;

[0082] Hash calculations are performed on the first placeholder code segment and the second placeholder code segment respectively to obtain the third hash value of the first placeholder code segment and the fourth hash value of the second placeholder code segment;

[0083] If the third hash value and the fourth hash value are equal, then the code type of the target security alarm code fragment pair is determined to be the parameterized reuse type.

[0084] In this implementation, when the first and second hash values ​​are not equal, a predefined placeholder is used to replace the identifier. This masks the differences caused by different identifiers, focusing on the essence of the code structure. The placeholder code fragment is then hashed again; if the third and fourth hash values ​​are equal, it can be determined to be a parameterized reuse type. This process accurately identifies the reuse relationship of code with the same structure but different parameters, avoiding misjudgments and making code type identification more comprehensive and accurate. This provides a more refined basis for subsequent code clustering and vulnerability detection, effectively improving the reliability and efficiency of code detection.

[0085] Optionally, if the third hash value and the fourth hash value are not equal, the following steps may also be performed:

[0086] The first placeholder code fragment and the second placeholder code fragment are parsed using a syntax tree parser to obtain a first syntax tree for the first placeholder code fragment and a second syntax tree for the second placeholder code fragment;

[0087] Perform a post-order traversal on the first syntax tree and the second syntax tree respectively to obtain the first structural signature string of the first syntax tree and the second structural signature string of the second syntax tree;

[0088] The first structure signature string and the second structure signature string are processed using a message digest algorithm to obtain the first structure hash value of the first structure signature string and the second structure hash value of the second structure signature string.

[0089] If the first structure hash value and the second structure hash value are equal, then the code type of the target security alarm code fragment pair is determined to be the structure reuse type.

[0090] In this implementation, when the third and fourth hash values ​​are unequal, a syntax tree parser is used to convert the code into a syntax tree. A post-order traversal generates a structure signature string, which is then processed by a message digest algorithm to obtain the structure hash value. This process deeply analyzes the code structure, effectively identifying code that is syntactically identical but differs in parameters and some details, accurately classifying it as a structure reuse type. It avoids the limitations of relying solely on simple hash value judgments, making code type identification more comprehensive and detailed. This provides solid support for subsequent accurate clustering and vulnerability detection, significantly improving the quality and efficiency of code detection.

[0091] Optionally, if the hash value of the first structure and the hash value of the second structure are not equal, the following steps can also be performed:

[0092] The first security alarm code fragment and the second security alarm code fragment are input into a preset code language model to obtain the first semantic feature vector of the first security alarm code fragment and the second semantic feature vector of the second security alarm code fragment output by the code language model.

[0093] Determine the similarity between the first semantic feature vector and the second semantic feature vector;

[0094] If the similarity is greater than a preset threshold, then the code type of the target security alarm code fragment pair is determined to be the semantic reuse type.

[0095] In this implementation, when the hash values ​​of the first and second structures are not equal, semantic feature vectors are extracted using a pre-defined code language model, allowing for deeper analysis of semantic information. By determining the similarity between the two semantic feature vectors and comparing them to a preset threshold, code that is semantically similar but structurally or parameterically different can be accurately identified and classified as semantic reuse type. This process overcomes the limitations of judging solely from code form, enriching the dimensions for judging code reuse types from a semantic perspective, making code detection more comprehensive and accurate, and improving the reliability of code vulnerability detection.

[0096] In this embodiment, the pre-defined code language model can be CodeBERT, which adopts the RoBERTa architecture and is pre-trained on a large-scale bimodal corpus (containing natural language documents and corresponding program code) through a hybrid objective function, deeply integrating the lexical, syntactic, and semantic information of the code. Using the model's built-in tokenizer, lexical analysis is performed on the source code text, decomposing identifiers, operators, keywords, etc., in the code into sub-word sequences existing in the CodeBERT model's vocabulary. These segmented sub-word sequences can then be input into the Transformer encoder in the CodeBERT model. Through multi-layer processing using the model's word embedding and self-attention mechanisms, a feature vector sequence of the same length as the input sequence, incorporating global contextual information, is generated. The vector corresponding to the sequence's start marker is taken as the first semantic feature vector of the first security alert code fragment and the second semantic feature vector of the second security alert code fragment.

[0097] In this embodiment of the application, the method for determining the similarity between the first semantic feature vector and the second semantic feature vector may include:

[0098] The first semantic feature vector is pooled and normalized to obtain the target first semantic feature vector;

[0099] The second semantic feature vector is pooled and normalized to obtain the target second semantic feature vector;

[0100] The cosine similarity between the first semantic feature vector and the second semantic feature vector of the target is calculated.

[0101] The cosine similarity is determined as the similarity between the first semantic feature vector and the second semantic feature vector.

[0102] Among them, cosine similarity The calculation formula can be:

[0103]

[0104] Where A represents the first semantic feature vector, B represents the second semantic feature vector, and ||2 represents the L2 norm of the vector.

[0105] Step 102: Obtain the prompt word templates corresponding to each code cluster set.

[0106] In this embodiment of the application, the prompt word template corresponding to the fully reusable code cluster set can be: the key requirement is to analyze a single representative sample and confirm that the conclusion applies to all instances in the group;

[0107] The prompt word template corresponding to the code cluster set of parameterized reuse type can be: to guide the model to focus on identifying common vulnerability patterns that are not affected by parameter changes;

[0108] The prompt word template corresponding to the code cluster set of the structure reuse type can be: Require a difference impact assessment and analyze the substantial impact of code modifications on security;

[0109] The prompt word template corresponding to the code cluster set of semantic reuse type can be: emphasizing functional equivalence verification and finding the same vulnerability semantics in different implementations.

[0110] Step 103: Input each code cluster set and the prompt word template corresponding to each code cluster set into the pre-constructed large language model, so that the large language model performs code detection on each code cluster set based on the prompt word template, and obtains the code detection results corresponding to each code cluster set output by the large language model.

[0111] In this embodiment of the application, the core analysis engine can be the Qwen-32B large language model.

[0112] In this embodiment of the application, the code detection results may include the following: specific vulnerability type, the reason for the vulnerability, and confidence level.

[0113] Step 104: Construct a code vulnerability report based on the code detection results corresponding to each code cluster set.

[0114] In this embodiment, the overall confidence level of the code detection results can be calculated based on the confidence level in the code detection results. This allows for the generation of a code vulnerability report that includes the vulnerability type, the cause of the vulnerability, and the overall confidence level.

[0115] In this embodiment of the application, the formula for calculating the overall confidence level S can be:

[0116]

[0117] The credibility benchmark score can be assigned different values ​​based on the code type of the code cluster set. Please refer to Table 1 for details:

[0118] Table 1 Reliability Benchmark Table

[0119]

[0120] The confidence coefficient can be determined based on the confidence level in the code detection results. The confidence level in the code detection results can be high, medium, or low. The confidence coefficient corresponding to high confidence level can be 1.0, the confidence coefficient corresponding to medium confidence level can be 0.6, and the confidence coefficient corresponding to low confidence level can be 0.3.

[0121] In this embodiment, the value of S is in the range of [0,1], and the higher the value, the higher the credibility of the conclusion.

[0122] If S≥0.7, the overall confidence level can be high confidence, and the system decision suggestion can be automated batch operation;

[0123] If 0.4≤S<0.7, the overall confidence level can be medium confidence, and the system decision recommendation can be manual review or marked as "pending review".

[0124] If S < 0.4, the overall confidence level can be low, and the system decision recommendation can be that manual review is required and no automatic operation will be performed.

[0125] This invention enables seamless coordination between code classification, precise detection, and report generation, significantly shortening code detection time and improving overall efficiency while maintaining detection quality. Furthermore, it can quickly locate vulnerabilities, effectively enhancing the overall effectiveness of code detection. Moreover, it can rapidly and accurately identify fully reused code, reducing unnecessary complex analysis and providing a reliable foundation for subsequent code clustering and vulnerability detection, effectively improving overall code detection efficiency. Additionally, it can accurately identify reuse relationships in code with identical structures but different parameters, avoiding misjudgments and making code type identification more comprehensive and accurate. Furthermore, it avoids the limitations of relying solely on simple hash value judgments, making code type identification more comprehensive and detailed, providing solid support for subsequent accurate clustering and vulnerability detection, and significantly improving the quality and efficiency of code detection. Finally, it enriches the semantic dimensions of code reuse type judgment, making code detection more comprehensive and accurate, and improving the reliability of code vulnerability detection.

[0126] After introducing the method of exemplary embodiments of the present invention, the following references are made. Figure 2 An exemplary embodiment of the present invention provides a code detection device based on code cloning, the device comprising:

[0127] Analysis unit 201 is used to perform cluster analysis on the security alarm code fragments in the original security alarm set output by the white-box testing tool to obtain multiple code cluster sets; wherein, the original security alarm set contains multiple security alarm code fragments, each code cluster set corresponds to a code type, and the code types of any two code cluster sets are different, and the code type is a fully reusable type, a parameterized reusable type, a structural reusable type, or a semantic reusable type;

[0128] Unit 202 is used to obtain the prompt word templates corresponding to each code cluster set;

[0129] The input unit 203 is used to input each code cluster set and the prompt word template corresponding to each code cluster set into the pre-constructed large language model, so that the large language model performs code detection on each code cluster set based on the prompt word template, and obtains the code detection results corresponding to each code cluster set output by the large language model.

[0130] Construction unit 204 is used to construct code vulnerability reports based on the code detection results corresponding to each code cluster set.

[0131] As an optional implementation, the analysis unit 201 performs cluster analysis on the security alert code fragments in the original security alert set output by the white-box testing tool to obtain multiple code cluster sets. Specifically, this can be done as follows:

[0132] Multiple pairs of security alert code fragments are determined from the raw security alert set output by the white-box testing tool; wherein each security alert code fragment in the raw security alert set is combined with other security alert code fragments in the raw security alert set to form a security alert code fragment pair;

[0133] Perform code similarity detection on each pair of security alarm code snippets to determine the code type of each pair of security alarm code snippets;

[0134] Based on the code type of each pair of security alarm code fragments, cluster analysis is performed on the security alarm code fragments to obtain multiple code cluster sets.

[0135] This implementation method first identifies multiple pairs of security alert code snippets to comprehensively cover all code snippet combinations and avoid omissions. Next, code similarity detection is performed on each pair to accurately determine the code type, providing a reliable basis for subsequent clustering. Finally, based on code type clustering, similar codes are grouped together, presenting issues of the same code type in a concentrated manner. This allows for the application of appropriate strategies to different cluster sets during subsequent detection, reducing redundant work, quickly locating vulnerabilities, and effectively improving the overall effectiveness of code detection.

[0136] As an optional implementation, the analysis unit 201 performs code similarity detection on a pair of target security alarm code fragments to determine the code type of the target security alarm code fragment pair. Specifically, this can be achieved by:

[0137] Obtain the first security alert code fragment and the second security alert code fragment from the target security alert code fragment pair;

[0138] The first security alarm code segment and the second security alarm code segment are preprocessed respectively to obtain the first standard code segment and the second standard code segment;

[0139] Hash calculations are performed on the first standard code segment and the second standard code segment respectively to obtain the first hash value of the first standard code segment and the second hash value of the second standard code segment;

[0140] If the first hash value and the second hash value are equal, then the code type of the target security alarm code fragment pair is determined to be the fully reused type.

[0141] This implementation method first extracts two segments from the target code segment pair, then preprocesses them into standard code segments to eliminate formatting and other interference factors, ensuring the accuracy of subsequent detection. Next, hash calculation is performed, utilizing the uniqueness of hash values ​​to quickly determine if the two code segments are identical. If the hash values ​​are equal, they are directly identified as fully reused, a simple and efficient process. This detection method can quickly and accurately identify fully reused code, reducing unnecessary complex analysis and providing a reliable foundation for subsequent code clustering and vulnerability detection, effectively improving overall code detection efficiency.

[0142] As an optional implementation, the analysis unit 201 is also used for:

[0143] If the first hash value and the second hash value are not equal, replace the identifiers in the first standard code segment and the second standard code segment with predetermined placeholders to obtain the first placeholder code segment and the second placeholder code segment;

[0144] Hash calculations are performed on the first placeholder code segment and the second placeholder code segment respectively to obtain the third hash value of the first placeholder code segment and the fourth hash value of the second placeholder code segment;

[0145] If the third hash value and the fourth hash value are equal, then the code type of the target security alarm code fragment pair is determined to be the parameterized reuse type.

[0146] In this implementation, when the first and second hash values ​​are not equal, a predefined placeholder is used to replace the identifier. This masks the differences caused by different identifiers, focusing on the essence of the code structure. The placeholder code fragment is then hashed again; if the third and fourth hash values ​​are equal, it can be determined to be a parameterized reuse type. This process accurately identifies the reuse relationship of code with the same structure but different parameters, avoiding misjudgments and making code type identification more comprehensive and accurate. This provides a more refined basis for subsequent code clustering and vulnerability detection, effectively improving the reliability and efficiency of code detection.

[0147] As an optional implementation, the analysis unit 201 is also used for:

[0148] If the third hash value and the fourth hash value are not equal, the syntax tree parser is used to parse the first placeholder code segment and the second placeholder code segment to obtain the first syntax tree of the first placeholder code segment and the second syntax tree of the second placeholder code segment;

[0149] Perform a post-order traversal on the first syntax tree and the second syntax tree respectively to obtain the first structural signature string of the first syntax tree and the second structural signature string of the second syntax tree;

[0150] The first structure signature string and the second structure signature string are processed using a message digest algorithm to obtain the first structure hash value of the first structure signature string and the second structure hash value of the second structure signature string.

[0151] If the first structure hash value and the second structure hash value are equal, then the code type of the target security alarm code fragment pair is determined to be the structure reuse type.

[0152] In this implementation, when the third and fourth hash values ​​are unequal, a syntax tree parser is used to convert the code into a syntax tree. A post-order traversal generates a structure signature string, which is then processed by a message digest algorithm to obtain the structure hash value. This process deeply analyzes the code structure, effectively identifying code that is syntactically identical but differs in parameters and some details, accurately classifying it as a structure reuse type. It avoids the limitations of relying solely on simple hash value judgments, making code type identification more comprehensive and detailed. This provides solid support for subsequent accurate clustering and vulnerability detection, significantly improving the quality and efficiency of code detection.

[0153] As an optional implementation, the analysis unit 201 is also used for:

[0154] If the first structure hash value and the second structure hash value are not equal, the first security alarm code fragment and the second security alarm code fragment are input into a preset code language model to obtain the first semantic feature vector of the first security alarm code fragment and the second semantic feature vector of the second security alarm code fragment output by the code language model.

[0155] Determine the similarity between the first semantic feature vector and the second semantic feature vector;

[0156] If the similarity is greater than a preset threshold, then the code type of the target security alarm code fragment pair is determined to be the semantic reuse type.

[0157] In this implementation, when the hash values ​​of the first and second structures are not equal, semantic feature vectors are extracted using a pre-defined code language model, allowing for deeper analysis of semantic information. By determining the similarity between the two semantic feature vectors and comparing them to a preset threshold, code that is semantically similar but structurally or parameterically different can be accurately identified and classified as semantic reuse type. This process overcomes the limitations of judging solely from code form, enriching the dimensions for judging code reuse types from a semantic perspective, making code detection more comprehensive and accurate, and improving the reliability of code vulnerability detection.

[0158] This invention enables seamless coordination between code classification, precise detection, and report generation, significantly reducing review time. Building upon existing vulnerability detection results, it helps code reviewers and vulnerability verifiers improve review efficiency. Furthermore, it can quickly and accurately identify fully reused code, reducing unnecessary complex analysis and providing a reliable foundation for subsequent code clustering and vulnerability detection, effectively improving overall code detection efficiency. Additionally, it can accurately identify reuse relationships in code with identical structures but different parameters, avoiding misjudgments and making code type identification more comprehensive and accurate. Moreover, it avoids the limitations of relying solely on simple hash value judgments, making code type identification more comprehensive and detailed, providing solid support for subsequent accurate clustering and vulnerability detection, and significantly improving the quality and efficiency of code detection. Furthermore, it enriches the semantic dimensions of code reuse type judgment, making code detection more comprehensive and accurate, and improving the reliability of code vulnerability detection.

[0159] After introducing the methods and apparatus of exemplary embodiments of the present invention, the following references are made. Figure 3 A computer-readable storage medium according to exemplary embodiments of the present invention will be described, please refer to... Figure 3 The computer-readable storage medium shown is an optical disc 30, on which a computer program (i.e., a program product) is stored. When the computer program is run by a processor, it implements the steps described in the above method implementation, such as: performing cluster analysis on the security alert code fragments in the original security alert set output by the white-box testing tool to obtain multiple code cluster sets; wherein the original security alert set contains multiple security alert code fragments, each code cluster set corresponds to a code type, and the code types of any two code cluster sets are different, and the code type is a fully reusable type, a parameterized reusable type, a structural reusable type, or a semantic reusable type; obtaining the prompt word templates corresponding to each code cluster set; inputting each code cluster set and the prompt word templates corresponding to each code cluster set into a pre-built large language model, so that the large language model performs code detection on each code cluster set based on the prompt word templates, and obtains the code detection results corresponding to each code cluster set output by the large language model; constructing a code vulnerability report based on the code detection results corresponding to each code cluster set; the specific implementation of each step will not be repeated here.

[0160] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical and magnetic storage media, which will not be elaborated here.

[0161] After introducing the methods, apparatus, and media of exemplary embodiments of the present invention, the following references are made. Figure 4 A computing device for code detection based on code cloning, according to an exemplary embodiment of the present invention.

[0162] Figure 4 A block diagram is shown of an exemplary computing device 40 suitable for implementing embodiments of the present invention. The computing device 40 may be a computer system or a server. Figure 4 The computing device 40 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of the present invention.

[0163] like Figure 4 As shown, the components of computing device 40 may include, but are not limited to: one or more processors or processing units 401, system memory 402, and bus 403 connecting different system components (including system memory 402 and processing unit 401).

[0164] The computing device 40 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computing device 40, including volatile and non-volatile media, and removable and non-removable media.

[0165] System memory 402 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 4021 and / or cache memory 4022. Computing device 40 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, ROM 4023 may be used to read and write non-removable, non-volatile magnetic media (…). Figure 4 (Not shown in the image, usually referred to as "hard drive"). Although not shown in... Figure 4The diagram illustrates that disk drives for reading and writing to removable non-volatile disks (e.g., "floppy disks") and optical disc drives for reading and writing to removable non-volatile optical discs (e.g., CD-ROMs, DVD-ROMs, or other optical media) can be provided. In these cases, each drive can be connected to bus 403 via one or more data media interfaces. System memory 402 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the embodiments of the present invention.

[0166] A program / utility 4025 having a set (at least one) of program modules 4024 may be stored, for example, in system memory 402, and such program modules 4024 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment. Program modules 4024 typically perform the functions and / or methods described in the embodiments of the present invention.

[0167] The computing device 40 can also communicate with one or more external devices 404 (such as a keyboard, pointing device, display, etc.). This communication can be performed via the input / output (I / O) interface 405. Furthermore, the computing device 40 can also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 406. Figure 4 As shown, network adapter 406 communicates with other modules of computing device 40 (such as processing unit 401) via bus 403. It should be understood that, although... Figure 4 As not shown, it can be used in conjunction with computing device 40 with other hardware and / or software modules.

[0168] The processing unit 401 executes various functional applications and data processing by running programs stored in the system memory 402. For example, it performs cluster analysis on security alert code fragments in the original security alert set output by the white-box testing tool to obtain multiple code cluster sets. Each code cluster set corresponds to a code type, and the code types of any two code cluster sets are different. The code type can be a fully reusable type, a parameterized reusable type, a structural reusable type, or a semantic reusable type. It obtains prompt word templates corresponding to each code cluster set. It inputs each code cluster set and its corresponding prompt word templates into a pre-built large language model, so that the large language model performs code detection on each code cluster set based on the prompt word templates, obtaining the code detection results corresponding to each code cluster set output by the large language model. Finally, it constructs a code vulnerability report based on the code detection results corresponding to each code cluster set. The specific implementation methods of each step will not be repeated here. It should be noted that although several units / modules or sub-units / sub-modules of the code detection device based on code cloning have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the present invention, the features and functions of two or more units / modules described above can be embodied in one unit / module. Conversely, the features and functions of one unit / module described above can be further divided and embodied by multiple units / modules.

[0169] In the description of this invention, it should be noted that the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0170] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0171] In the several embodiments provided by this invention, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the coupling or direct coupling or communication connection shown or discussed may be through some communication interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0172] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0173] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0174] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0175] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

[0176] Furthermore, although the operations of the method of the present invention are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0177] In one exemplary embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

Claims

1. A code detection method based on code cloning, characterized in that, The method includes: Cluster analysis is performed on the security alert code fragments in the original security alert set output by the white-box testing tool to obtain multiple code cluster sets; wherein, the original security alert set contains multiple security alert code fragments, each code cluster set corresponds to a code type, and the code types of any two code cluster sets are different, and the code type is a fully reusable type, a parameterized reusable type, a structural reusable type, or a semantic reusable type; Obtain the prompt word templates corresponding to each code cluster set; Each code cluster set and its corresponding prompt word template are input into a pre-built large language model, so that the large language model performs code detection on each code cluster set based on the prompt word template, and obtains the code detection results corresponding to each code cluster set output by the large language model. A code vulnerability report is constructed based on the code detection results corresponding to each code cluster set.

2. The code detection method based on code cloning according to claim 1, characterized in that, The clustering analysis of security alert code snippets in the raw security alert set output by the white-box testing tool yields multiple code cluster sets, specifically including: Multiple pairs of security alert code fragments are determined from the raw security alert set output by the white-box testing tool; wherein each security alert code fragment in the raw security alert set is combined with other security alert code fragments in the raw security alert set to form a security alert code fragment pair; Perform code similarity detection on each pair of security alarm code snippets to determine the code type of each pair of security alarm code snippets; Based on the code type of each pair of security alarm code fragments, cluster analysis is performed on the security alarm code fragments to obtain multiple code cluster sets.

3. The code detection method based on code cloning according to claim 2, characterized in that, Perform code similarity detection on a pair of target security alert code snippets to determine the code type of the target security alert code snippets, specifically including: Obtain the first security alert code fragment and the second security alert code fragment from the target security alert code fragment pair; The first security alarm code segment and the second security alarm code segment are preprocessed respectively to obtain the first standard code segment and the second standard code segment; Hash calculations are performed on the first standard code segment and the second standard code segment respectively to obtain the first hash value of the first standard code segment and the second hash value of the second standard code segment; If the first hash value and the second hash value are equal, then the code type of the target security alarm code fragment pair is determined to be the fully reused type.

4. The code detection method based on code cloning according to claim 3, characterized in that, If the first hash value and the second hash value are not equal, the method further includes: Replace the identifiers in the first standard code snippet and the second standard code snippet with predetermined placeholders to obtain the first placeholder code snippet and the second placeholder code snippet; Hash calculations are performed on the first placeholder code segment and the second placeholder code segment respectively to obtain the third hash value of the first placeholder code segment and the fourth hash value of the second placeholder code segment; If the third hash value and the fourth hash value are equal, then the code type of the target security alarm code fragment pair is determined to be the parameterized reuse type.

5. The code detection method based on code cloning according to claim 4, characterized in that, If the third hash value and the fourth hash value are not equal, the method further includes: The first placeholder code fragment and the second placeholder code fragment are parsed using a syntax tree parser to obtain a first syntax tree for the first placeholder code fragment and a second syntax tree for the second placeholder code fragment; Perform a post-order traversal on the first syntax tree and the second syntax tree respectively to obtain the first structural signature string of the first syntax tree and the second structural signature string of the second syntax tree; The first structure signature string and the second structure signature string are processed using a message digest algorithm to obtain the first structure hash value of the first structure signature string and the second structure hash value of the second structure signature string. If the first structure hash value and the second structure hash value are equal, then the code type of the target security alarm code fragment pair is determined to be the structure reuse type.

6. The code detection method based on code cloning according to claim 5, characterized in that, If the hash value of the first structure and the hash value of the second structure are not equal, the method further includes: The first security alarm code fragment and the second security alarm code fragment are input into a preset code language model to obtain the first semantic feature vector of the first security alarm code fragment and the second semantic feature vector of the second security alarm code fragment output by the code language model. Determine the similarity between the first semantic feature vector and the second semantic feature vector; If the similarity is greater than a preset threshold, then the code type of the target security alarm code fragment pair is determined to be the semantic reuse type.

7. A code detection device based on code cloning, characterized in that, The device includes: The analysis unit is used to perform cluster analysis on the security alert code fragments in the original security alert set output by the white-box testing tool to obtain multiple code cluster sets; wherein, the original security alert set contains multiple security alert code fragments, each code cluster set corresponds to a code type, and the code types of any two code cluster sets are different, and the code type is a fully reusable type, a parameterized reusable type, a structural reusable type, or a semantic reusable type; The acquisition unit is used to retrieve the prompt word templates corresponding to each code cluster set; The input unit is used to input each code cluster set and the prompt word template corresponding to each code cluster set into the pre-constructed large language model, so that the large language model performs code detection on each code cluster set based on the prompt word template, and obtains the code detection results corresponding to each code cluster set output by the large language model. The building unit is used to construct code vulnerability reports based on the code detection results corresponding to each code cluster set.

8. A computing device, characterized in that, The computing device includes: At least one processor, memory, and input / output unit; The memory is used to store computer programs, and the processor is used to call the computer programs stored in the memory to execute the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium comprising instructions, characterized in that, When it is run on a computer, it causes the computer to perform the method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1-6.

Images