A software security detection method based on deep learning

Abstract

The application discloses a kind of software security detection methods based on deep learning, comprising the following steps: S1, obtain the abstract syntax tree of type of acceptance;S2, form security state statement tree set;S3, security state statement tree set is input into improved ASTNN model, obtain the security state representation in tree;S4, by checking constraint backfill layer, the security state slot position that exists covering acceptance relationship is concatenated as constraint covering chain;S5, by checking constraint backfill layer to constraint covering chain executes checking constraint backfill, constraint state is reversely written into security state slot position, and configuration backfill correction state;S6, by cross-statement risk recursion layer forms risk trigger response;S7, back positioning result is merged into risk correlation position, and configuration risk level, form software security detection result.The application improves cross-statement software security risk identification and positioning accuracy by improving ASTNN model.

Description

Technical Field

[0001] This invention relates to the field of software security testing technology, and in particular to a software security testing method based on deep learning. Background Technology

[0002] As software scales and call relationships become increasingly complex, security risks such as missing permission checks, incomplete boundary checks, insufficient null value restrictions, and misuse of sensitive interfaces in source code become more difficult to detect through manual review. Existing static rule-based detection methods mainly rely on keyword, rule template, and dangerous function matching. While simple to implement, these methods have limited ability to identify variable passing, function calls, return values, and cross-statement risk continuation, leading to false positives and false negatives. Deep learning-based code detection methods can learn syntactic structure features, but traditional ASTNN models typically compress statement trees into ordinary statement vectors. Validation constraints, variable values, and risk triggering relationships can easily become mixed during vector compression, making it difficult to accurately determine whether validation covers risk objects, whether validation objects have deviated from their intended path, and the location of risk triggers.

[0003] Therefore, how to provide a deep learning-based software security detection method is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] One objective of this invention is to propose a deep learning-based software security detection method. This invention preserves both the syntactic structure and execution relationships in the source code by performing statement boundary convergence and connection index configuration on the abstract syntax tree. Furthermore, it folds the source connection structure, constraint constraint structure, and sensitive trigger structure into different security state slots, avoiding the loss of relationships caused by mixing variable connection, validation constraints, and risk triggers into ordinary statement vectors in traditional deep learning code detection. Based on this, this invention forms a constraint coverage chain through constraint coverage, explicitly expressing whether security constraints such as boundary validation, permission validation, and null value restrictions cover the corresponding risk object. Through validation constraint backfeeding, same-object coverage, object misalignment, and uncovered connection are transformed into risk reduction state, constraint misalignment state, and risk continuation state, respectively, thus distinguishing between risks that have been effectively constrained, risks where the validation object has deviated, and risks that lack constraint coverage and need to be passed on. Through cross-statement risk recursion and connection index back-location, the final detection result can provide the risk source location, validation deviation location, trigger location, and risk level, improving the accuracy and interpretability of software security risk identification in cross-statement, cross-branch, and cross-function call scenarios.

[0005] A software security detection method based on deep learning according to an embodiment of the present invention includes the following steps:

[0006] S1. Perform syntax parsing and statement boundary closure on the source code of the software to be tested, and configure the abstract syntax tree nodes obtained by parsing with the continuation index according to the execution order of the code to form a continuation abstract syntax tree;

[0007] S2. The statement tree is split along the statement boundaries of the continuation abstract syntax tree, and the safe syntax structure within the statement tree is folded into the safe state slot to form a set of safe state statement trees.

[0008] S3. Input the set of secure stateful statement trees into the improved ASTNN model. The improved ASTNN model includes an in-tree security coding layer, a check constraint backfeeding layer, and a cross-statement risk recursion layer. Perform syntax subordinate level compression on the secure state slots in the secure stateful statement trees through the in-tree security coding layer to form an in-tree secure state representation.

[0009] S4. By verifying the constraint recharge layer, perform constraint coverage hooking on the safety state slots in the tree safety state representation according to the acceptance index, and connect the safety state slots with coverage acceptance relationship into a constraint coverage chain.

[0010] S5. Perform constraint verification backfeed on the constraint coverage chain through the constraint backfeed layer, write the constraint state in the constraint coverage chain back to the corresponding safety state slot, and configure the backfeed correction state according to the backfeed coverage situation.

[0011] S6. By following the order of the security state tree set along the cross-statement risk recursion layer, cross-statement state recursion is performed on the backfeed correction state, and the recursion result is pushed into the corresponding risk response slot to form a risk trigger response.

[0012] S7. Locate the source code of the software to be tested by following the index carried by the risk trigger response, merge the back-location results into risk-related locations, configure the risk level according to the risk response status, and form the software security detection result.

[0013] Optionally, S1 specifically includes:

[0014] S11. Perform lexical segmentation and syntax parsing on the source code of the software to be tested, mapping the function bodies, branch blocks, loop blocks and statement boundaries in the source code to abstract syntax tree nodes;

[0015] S12. Using the statement boundary as the aggregation criterion, merge the abstract syntax tree nodes belonging to the same statement into a statement node group, and retain the syntax hierarchy of each abstract syntax tree node in the statement node group.

[0016] S13. Arrange the statement node groups in advance according to the code execution sequence in the source code, and configure breakpoints for branch entry, loop entry, call entry and return exit respectively;

[0017] S14. Embed the breakpoint position between adjacent statement node groups and configure the breakpoint position with a breakpoint index.

[0018] S15. Attach the successor index to the corresponding abstract syntax tree node to form a successor abstract syntax tree.

[0019] Optionally, S2 specifically includes:

[0020] S21. Cut cross-statement syntax connections along the statement boundaries in the continuation abstract syntax tree, retain the abstract syntax tree nodes belonging to the same statement boundary as independent statement trees, and retain the continuation index corresponding to each statement tree.

[0021] S22. Perform safe syntax classification on the syntax nodes in each statement tree, and classify the syntax nodes corresponding to data source, variable assignment, parameter passing and return into the source-acceptance structure.

[0022] S23. Incorporate the syntax nodes corresponding to conditional statements, boundary comparisons, permission checks, type restrictions, and null value restrictions into the constraint constraint structure.

[0023] S24. Incorporate the syntax nodes corresponding to sensitive interface calls, resource access, memory operations, external command execution, and exception exits into the sensitive trigger structure.

[0024] S25. Configure safe state slots in each statement tree, fold source acceptance structures into acceptance slots, constraint limiting structures into constraint slots, and sensitive trigger structures into trigger slots, and retain the syntax node positions and acceptance indexes in the acceptance slots, constraint slots, and trigger slots to form a set of safe state-based statement trees.

[0025] Optionally, S3 specifically includes:

[0026] S31. Perform a syntactic hierarchical decomposition on each secure state statement tree in the secure state statement tree set, divide the syntax nodes into leaf node layer, expression node layer, control node layer, call node layer and statement root node layer, and configure syntax subordinate inheritance bits between adjacent node layers.

[0027] S32. Attach the security status slot to the syntax subordinate acceptor along with the corresponding syntax node, and retain the slot type, node affiliation, and acceptor index in the corresponding syntax subordinate acceptor.

[0028] S33. Perform same-level grouping for the receiving slots, constraint slots and trigger slots within the same node layer. Fold the safety state slots belonging to the same parent node into the corresponding parent node's syntax subordinate receiving slot, and perform parent layer folding in the order of leaf node layer, expression node layer, control node layer, call node layer to statement root node layer.

[0029] S34. At the root node of the statement, the receiving slot, constraint slot and trigger slot after being folded in layer by layer are placed side by side, and the slot type, node affiliation and receiving index are retained to form a safe state representation within the tree.

[0030] Optionally, S4 specifically includes:

[0031] S41. The verification constraint recharge layer performs slot grouping on the safety state slots in the tree safety state representation according to the slot type label, divides the safety state slots into constraint slots, acceptance slots and trigger slots, and performs acceptance-preceding arrangement on the constraint slots, acceptance slots and trigger slots according to the acceptance index reserved bit.

[0032] S42. Using the constraint slot as the starting point for coverage, scan the acceptance slots located in the same statement tree or adjacent acceptance statement trees along the result of the previous acceptance arrangement, and mark the coverage object corresponding to the constraint slot according to the node ownership mark and the acceptance index reserved bit.

[0033] S43. Connect constraint slots and accepting slots with the same covering object to the same object. Connect constraint slots and accepting slots with different covering objects but with variable accepting, object passing or call result accepting relationship in a staggered manner. Configure an uncovered accepting mark for accepting slots that lack constraint slot accepting.

[0034] S44. Continue scanning along the reserved bits of the acceptance index to find trigger slots that have an execution acceptance relationship with the acceptance slots. Arrange the constraint slots, acceptance slots, and trigger slots into a coverage path according to the constraint formation direction, variable acceptance direction, and trigger execution direction.

[0035] S45. Add the retainer index reserved bit to the cross-statement tree connection position in the coverage path, and place the same object attachment result, misaligned attachment result and uncovered retainer mark in the corresponding coverage path to form a constraint coverage chain.

[0036] Optionally, S5 specifically includes:

[0037] S51. Verify the constraint recharge layer and perform recharge partitioning on the same object hooking results, misaligned hooking results and uncovered acceptance marks in the constraint coverage chain. Enter the constraint slot position into the recharge source area and the acceptance slot position and trigger slot position into the recharge receiving area.

[0038] S52. Push the constraint state into the constraint slot in the reverse direction along the coverage path corresponding to the same object's attachment result, overlay the constraint state onto the risk acceptance state in the acceptance slot, and rewrite the risk acceptance state covered by the constraint state into the risk reduction state.

[0039] S53. Encapsulate the receiving slot carrying the risk reduction status with the trigger slot in the same coverage path, and configure the covered trigger mark in the trigger slot.

[0040] S54. Perform object deviation calibration on the coverage path corresponding to the misaligned attachment result. Based on the inconsistency between the constraint slot object identifier and the receiving slot object identifier, overlay the constraint state onto the receiving slot corresponding to the deviation object, and configure the constraint misalignment state between the receiving slot and the trigger slot.

[0041] S55. For the acceptance slots corresponding to the uncovered acceptance marks, retain the risk acceptance status, arrange the acceptance slots with the retained risk acceptance status adjacent to the corresponding trigger slots, and configure the risk continuation status.

[0042] S56. Slots carrying risk reduction status, slots with configuration constraint misalignment status, and slots with configuration risk continuation status are assigned to the backfill correction status, and the accepting index retention bit and trigger slot ownership flag are retained in the backfill correction status.

[0043] Optionally, the step of classifying slots carrying risk reduction status, slots with configuration constraint misalignment status, and slots with configuration risk continuation status into the recharge correction status, and retaining the accepting index reserve bit and trigger slot ownership flag in the recharge correction status, specifically includes:

[0044] Perform coverage source fixed bit configuration on the accepting slot with risk reduction status, write the object identifier, constraint type and accepting index reserved bit of the constraint slot into the coverage source fixed bit of the accepting slot, and split the risk accepting status in the accepting slot into covered risk status and residual risk status.

[0045] For covered risk states, risk reduction states are overlaid; for residual risk states, the original risk acceptance direction is retained; and the covered risk states, residual risk states, and coverage source are fixedly encapsulated into a risk reduction slot group.

[0046] For the receiving slot with misaligned configuration constraints, perform deviation from source fixed bit configuration, write the inconsistency between the constraint slot object identifier and the receiving slot object identifier into the deviation from source fixed bit, and arrange the constraint status in the adjacent constraint bit of the receiving slot.

[0047] Insert a misaligned receiving slot between the trigger slot and the receiving slot, encapsulate the side constraint slot, the offset source fixed slot and the misaligned receiving slot into a constraint misaligned slot group, and retain the original trigger state in the trigger slot;

[0048] For the slots with configured risk continuation status, perform the configuration of the uncovered source fixed bit, write the acceptance index range, acceptance object identifier and trigger slot ownership mark of the missing constraint slot into the uncovered source fixed bit, and arrange the risk acceptance status in the risk continuation bit before the trigger slot;

[0049] The uncovered source fixed bit, risk continuation bit and corresponding trigger slot are encapsulated into a risk continuation slot group;

[0050] According to the order of the reserved bits of the accepting index, the risk reduction slot group, the constraint misalignment slot group, and the risk continuation slot group are written into the same backflow correction state, and the accepting index reserved bits and the trigger slot ownership flag are retained in the backflow correction state.

[0051] Optionally, S6 specifically includes:

[0052] S61. The cross-statement risk recursion layer performs a pre-arrangement of the risk reduction slot group, constraint misalignment slot group and risk continuation slot group in the backflow correction state, and divides the state recursion interval by the pre-arrangement bit of the pre-arrangement index and the trigger slot ownership flag.

[0053] S62. Configure a recursive shielding mark for the risk reduction slot group, place the recursive shielding mark in the corresponding state recursive interval, and rewrite the state of the downstream recursive channel corresponding to the risk reduction slot group to the closed state.

[0054] S63. Perform a succession arrangement on the risk continuation slot group, and arrange the risk continuation status segment by segment along the succession index reserved bits between adjacent statement trees to the trigger slots in the same state recursion interval.

[0055] S64. Perform offset stacking on the constraint misalignment slot group, arrange the constraint misalignment state and the trigger slot in the same state recursion interval adjacent to each other, and retain the misalignment source mark at the trigger slot.

[0056] S65. When the risk continuation state or constraint misalignment state reaches the trigger slot's assigned position, the reaching state is pushed into the risk response slot corresponding to the trigger slot, and the risk response slot and the accepting index reserved bit are encapsulated in the same position to form a risk trigger response.

[0057] Optionally, S7 specifically includes:

[0058] S71. Perform on-site decomposition on the risk response slot and the reserved position of the acceptance index in the risk trigger response, mark the acceptance index corresponding to the risk continuation state as the risk source index, mark the acceptance index corresponding to the constraint misalignment state as the verification deviation index, and mark the acceptance index corresponding to the trigger slot attribution mark as the trigger position index.

[0059] S72. Paste the risk source index, verification deviation index and trigger position index back to the corresponding abstract syntax tree nodes in the continuation abstract syntax tree, and merge the pasted nodes in the same statement tree into statement-level risk fragments along the statement boundary.

[0060] S73. Perform interval merging on adjacent statement-level risk segments, merge statement-level risk segments with continuous successor indexes into risk-related intervals, and configure call association flags for risk-related intervals formed by cross-function call succession.

[0061] S74. Perform state overlay on the risk response status within the risk association interval, and push the risk continuation status, constraint misalignment status and trigger slot attribution mark into the risk source slot, verification gap slot and trigger position slot respectively to obtain the risk association position;

[0062] S75. Perform level labeling on risk-related locations. When a risk-related location contains a risk source slot, a verification gap slot, and a trigger location slot, configure it as a high-risk level. When a risk-related location contains a verification gap slot and a trigger location slot, configure it as a medium-risk level. When a risk-related location contains only a trigger location slot, configure it as a low-risk level.

[0063] S76. Encapsulate the risk-related location, call-related markers, and risk level into software security detection results.

[0064] The beneficial effects of this invention are:

[0065] This invention does not directly compress the statement tree into ordinary statement vectors. Instead, it retains variable acceptance, verification limits, and sensitive triggering information through acceptance slots, constraint slots, and trigger slots. Furthermore, it constructs a constraint coverage chain, which can clearly express whether security constraints such as boundary verification, permission verification, and null value restriction truly cover risk objects, thereby reducing misjudgments caused by semantic mixing in traditional deep learning code detection.

[0066] This invention transforms same-object attachment, misaligned attachment, and uncovered acceptance into risk reduction state, constraint misalignment state, and risk continuation state respectively by verifying constraint backfeeding. This enables the detection process to not only determine "whether there is a risk", but also to identify whether the verification object has deviated, whether the risk lacks effective constraints, and whether the risk needs to be further deduced across statements, thereby improving the risk identification accuracy in complex call and parameter passing scenarios.

[0067] This invention continuously retains the inheritance index in the inheritance-type abstract syntax tree, security state slots, backfill correction states, and risk trigger responses, enabling the final detection results to locate the risk source, verification deviation, and trigger position, and form a risk association interval. Compared with models that only output risk classification results, it is easier to locate software security defects formed across statements, branches, and function calls. Attached Figure Description

[0068] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0069] Figure 1 This is a flowchart of a deep learning-based software security detection method proposed in this invention;

[0070] Figure 2 This is a schematic diagram of the improved ASTNN model structure of a deep learning-based software security detection method proposed in this invention.

[0071] Figure 3 This diagram illustrates the verification constraint backfeeding and cross-statement risk recursion of a deep learning-based software security detection method proposed in this invention. Detailed Implementation

[0072] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0073] refer to Figures 1-3 A software security detection method based on deep learning includes the following steps:

[0074] S1. Perform syntax parsing and statement boundary closure on the source code of the software to be tested, and configure the abstract syntax tree nodes obtained by parsing with the continuation index according to the execution order of the code to form a continuation abstract syntax tree;

[0075] S2. The statement tree is split along the statement boundaries of the continuation abstract syntax tree, and the safe syntax structure within the statement tree is folded into the safe state slot to form a set of safe state statement trees.

[0076] S3. Input the set of secure stateful statement trees into the improved ASTNN model. The improved ASTNN model includes an in-tree security coding layer, a check constraint backfeeding layer, and a cross-statement risk recursion layer. The in-tree security coding layer performs syntax hierarchical compression on the security state slots in the secure stateful statement trees to form an in-tree security state representation.

[0077] S4. By verifying the constraint recharge layer, perform constraint coverage hooking on the safety state slots in the tree safety state representation according to the acceptance index, and connect the safety state slots with coverage acceptance relationship into a constraint coverage chain.

[0078] S5. Perform constraint verification backfeed on the constraint coverage chain through the constraint backfeed layer, write the constraint state in the constraint coverage chain back to the corresponding safety state slot, and configure the backfeed correction state according to the backfeed coverage situation.

[0079] S6. By following the order of the security state tree set along the cross-statement risk recursion layer, cross-statement state recursion is performed on the backfeed correction state, and the recursion result is pushed into the corresponding risk response slot to form a risk trigger response.

[0080] S7. Locate the source code of the software to be tested by following the index carried by the risk trigger response, merge the back-location results into risk-related locations, configure the risk level according to the risk response status, and form the software security detection result.

[0081] In this embodiment, S1 specifically includes:

[0082] S11. Perform lexical segmentation and syntax parsing on the source code of the software to be tested, mapping the function bodies, branch blocks, loop blocks and statement boundaries in the source code to abstract syntax tree nodes;

[0083] S12. Using the statement boundary as the aggregation criterion, merge the abstract syntax tree nodes belonging to the same statement into a statement node group, and retain the syntax hierarchy of each abstract syntax tree node in the statement node group.

[0084] S13. Arrange the statement node groups in advance according to the code execution sequence in the source code, and configure breakpoints for branch entry, loop entry, call entry and return exit respectively;

[0085] S14. Embed the breakpoint position between adjacent statement node groups and configure the breakpoint position with a breakpoint index.

[0086] S15. Attach the successor index to the corresponding abstract syntax tree node to form a successor abstract syntax tree.

[0087] In the specific implementation process, the source code of the software to be tested is first lexically segmented and parsed. Function bodies, branch blocks, loop blocks, call statements, return statements, and ordinary execution statements are mapped to abstract syntax tree nodes, and the row and column positions and syntactic hierarchy of each abstract syntax tree node in the source code are preserved. Statement boundaries are determined based on statement terminators, code block boundaries, control statement boundaries, and the end position of function calls. Abstract syntax tree nodes belonging to the same statement boundary are merged into statement node groups, and the original parent-child hierarchy and syntactic hierarchy are preserved within the statement node group.

[0088] Statement nodes are arranged according to the execution order in the source code. Sequential statements are established with adjacent breakpoints based on their order of appearance. Branch statements have breakpoints at their conditional statements; loop statements have breakpoints at their loop condition and loop jump points; function call statements have breakpoints at their call points; and return statements have breakpoints at their return values. Breakpoints are embedded between adjacent statement nodes to indicate execution transitions, object passing, or result return relationships between statements.

[0089] Configure succession indexes for statement node groups and succession breakpoints. Each succession index includes at least a function identifier, statement order identifier, breakpoint type identifier, and path identifier. The succession index for a statement node group is used to locate the statement's position in the code execution order, while the succession index for a succession breakpoint is used to identify transitions formed by branches, loops, calls, or returns. After attaching the succession index to the corresponding abstract syntax tree (AST) node, the AST node carries both syntax hierarchy information and execution succession information, forming a succession-based abstract syntax tree.

[0090] In this embodiment, S2 specifically includes:

[0091] S21. Cut cross-statement syntax connections along the statement boundaries in the continuation abstract syntax tree, retain the abstract syntax tree nodes belonging to the same statement boundary as independent statement trees, and retain the continuation index corresponding to each statement tree.

[0092] S22. Perform safe syntax classification on the syntax nodes in each statement tree, and classify the syntax nodes corresponding to data source, variable assignment, parameter passing and return into the source-acceptance structure.

[0093] S23. Incorporate the syntax nodes corresponding to conditional statements, boundary comparisons, permission checks, type restrictions, and null value restrictions into the constraint constraint structure.

[0094] S24. Incorporate the syntax nodes corresponding to sensitive interface calls, resource access, memory operations, external command execution, and exception exits into the sensitive trigger structure.

[0095] S25. Configure safe state slots in each statement tree, fold source acceptance structures into acceptance slots, constraint limiting structures into constraint slots, and sensitive trigger structures into trigger slots, and retain the syntax node positions and acceptance indexes in the acceptance slots, constraint slots, and trigger slots to form a set of safe state-based statement trees.

[0096] In practice, the nodes of the abstract syntax tree are truncated along the defined statement boundaries in the successive abstract syntax tree. During truncating, only cross-statement connections between different statement node groups are severed; parent-child hierarchies and syntactic dependencies within the same statement node group are not deleted. Each independent statement tree retains its corresponding successor index, ensuring that the statement tree can still return to the original code execution successor position after being separated from the complete abstract syntax tree. For nested nodes in conditional statements, loop statements, and function call statements, truncating is performed according to the principle of prioritizing statement boundaries and preserving syntactic dependencies to avoid dismantling the safe syntactic structure within the same statement.

[0097] When performing safe syntax classification on syntax nodes within the statement tree, the classification is based on the syntax node type, the identifier carried by the node, the calling object, the operator, and the inheritance index. Nodes such as data input, external parameters, variable assignment, argument passing, return value reception, and object references are classified into the source inheritance structure; nodes such as conditional judgments, comparison operations, boundary restrictions, permission judgments, type conversion judgments, and null value judgments are classified into the constraint constraint structure; nodes such as sensitive interface calls, file or network resource access, memory read / write, external command execution, exception throwing, and exception exit are classified into the sensitive trigger structure. For the same syntax node that has both inheritance and trigger attributes, primary and secondary classification tags are retained in the corresponding statement tree. The primary classification is determined according to the actual execution action of the node, and the secondary classification is used to identify cross-slot relationships when constraint override is attached.

[0098] Within each statement tree, there are acceptor slots, constraint slots, and trigger slots. Acceptor slots contain the source object identifier, variable or parameter name, assignment direction, propagation direction, return acceptor position, and acceptor index. Constraint slots contain the constraint object identifier, constraint type, constraint direction, constraint scope, and syntax node position. Trigger slots contain the trigger object identifier, trigger type, call target, resource object, exception exit position, and acceptor index. After source acceptor structures are folded into acceptor slots, constraint-limited structures into constraint slots, and sensitive trigger structures into trigger slots, the statement tree transforms from a simple syntax structure into a secure stateful statement tree set carrying acceptor, constraint, and trigger relationships. This provides slotted processing objects for constraint overriding and constraint backfeedback verification.

[0099] In this embodiment, S3 specifically includes:

[0100] S31. Perform a syntactic hierarchical decomposition on each secure state statement tree in the secure state statement tree set, divide the syntax nodes into leaf node layer, expression node layer, control node layer, call node layer and statement root node layer, and configure syntax subordinate inheritance bits between adjacent node layers.

[0101] S32. Attach the security status slot to the syntax subordinate acceptor along with the corresponding syntax node, and retain the slot type, node affiliation, and acceptor index in the corresponding syntax subordinate acceptor.

[0102] S33. Perform same-level grouping for the receiving slots, constraint slots and trigger slots within the same node layer. Fold the safety state slots belonging to the same parent node into the corresponding parent node's syntax subordinate receiving slot, and perform parent layer folding in the order of leaf node layer, expression node layer, control node layer, call node layer to statement root node layer.

[0103] S34. At the root node of the statement, the receiving slot, constraint slot and trigger slot after being folded in layer by layer are placed side by side, and the slot type, node affiliation and receiving index are retained to form a safe state representation within the tree.

[0104] In the specific implementation process, the improved ASTNN model retains the basic framework of hierarchical encoding of the statement tree in this step of the traditional ASTNN model. Traditional ASTNN models typically compress each statement tree directly into a regular statement vector. This regular statement vector can represent the overall syntactic structure of the statement. However, in software security detection scenarios, variable inheritance, constraint limitations, and sensitive trigger information are easily mixed in the same vector compression process, making it difficult to determine whether a constraint covers its corresponding inheriting object, and also difficult to retain the syntactic origin relationship between constraint slots, inheriting slots, and triggering slots. To avoid the premature elimination of secure syntactic relationships during the statement tree encoding stage, this method transforms the traditional statement tree encoding process into an in-tree secure encoding layer, enabling the secure stateful statement tree to retain slot type, node affiliation, and inheriting index during hierarchical encoding.

[0105] The tree-level security coding layer consists of a syntax hierarchy expander, a slot acceptor, a hierarchy fallback calculator, and a root node placer. The syntax hierarchy expander reads syntax nodes, node affiliation markers, and acceptor indices from each secure stateful statement tree. It assigns variable names, constants, member objects, and parameter objects to leaf nodes; assignment expressions, comparison expressions, logical expressions, and type conversion expressions to expression nodes; conditional statements, loop statements, and exception statements to control nodes; function calls, interface accesses, resource accesses, and command executions to call nodes; and the final node corresponding to the complete statement is assigned to the statement root node. Syntax dependency acceptor bits are configured between adjacent node layers. These bits record the path relationship between lower-level syntax nodes and upper-level syntax nodes, allowing secure state slots to move upwards along the original syntax dependency path.

[0106] The slot acceptor representation attaches acceptor slots, constraint slots, and trigger slots to the syntax subordinate acceptor positions along with their corresponding syntax nodes, and retains the slot type, node affiliation, and acceptor index within the syntax subordinate acceptor positions. Acceptor slots retain the source object, variable acceptor direction, parameter passing direction, and return acceptor position; constraint slots retain the constraint object, constraint type, constraint direction, and constraint scope; trigger slots retain the trigger object, trigger type, call target, and trigger position. Through this slot acceptor representation, safety state slots already possess traceable syntax sources and execution acceptor positions before entering hierarchical compression.

[0107] The hierarchical folding calculator first performs same-level folding on accepting slots, constraint slots, and trigger slots belonging to the same parent node within the same node level. Then, it performs parent-level folding layer by layer in the order of leaf node level, expression node level, control node level, call node level, down to the statement root node level. During parent-level folding, the lower-level safety state slots are written into the syntax subordinate accepting position of the corresponding parent node, while preserving the differences in object identifiers, node affiliations, and accepting indexes between slots. This stage does not determine whether constraint slots cover trigger slots, nor does it perform reduction or continuation processing on risk states; it only completes the hierarchical compression and structural preservation of safety state slots within the statement tree.

[0108] The root node concatenation unit concatenates the inherited slots, constraint slots, and trigger slots at the root node of the statement, after layer-by-layer folding, and retains the slot type, node affiliation, object identifier, syntax node position, and inherited index to form an intra-tree safety state representation. This intra-tree safety state representation differs from the ordinary statement vector output by traditional ASTNN models. Ordinary statement vectors primarily represent the overall semantics of the statement, while the intra-tree safety state representation retains the source position, hierarchical affiliation, and execution inherited position of the safety state slots within the statement tree. Through this processing, the improved ASTNN model, while retaining the hierarchical encoding capabilities of the traditional ASTNN statement tree, preserves variable inherited, constraint constraints, and sensitive trigger information in a slot structure, providing a readable, structured input for constraint coverage and attachment.

[0109] In this embodiment, S4 specifically includes:

[0110] S41. The verification constraint recharge layer performs slot grouping on the safety state slots in the tree safety state representation according to the slot type label, divides the safety state slots into constraint slots, acceptance slots and trigger slots, and performs acceptance-preceding arrangement on the constraint slots, acceptance slots and trigger slots according to the acceptance index reserved bit.

[0111] S42. Using the constraint slot as the starting point for coverage, scan the acceptance slots located in the same statement tree or adjacent acceptance statement trees along the result of the previous acceptance arrangement, and mark the coverage object corresponding to the constraint slot according to the node ownership mark and the acceptance index reserved bit.

[0112] S43. Connect constraint slots and accepting slots with the same covering object to the same object. Connect constraint slots and accepting slots with different covering objects but with variable accepting, object passing or call result accepting relationship in a staggered manner. Configure an uncovered accepting mark for accepting slots that lack constraint slot accepting.

[0113] S44. Continue scanning along the reserved bits of the acceptance index to find trigger slots that have an execution acceptance relationship with the acceptance slots. Arrange the constraint slots, acceptance slots, and trigger slots into a coverage path according to the constraint formation direction, variable acceptance direction, and trigger execution direction.

[0114] S45. Add the retainer index reserved bit to the cross-statement tree connection position in the coverage path, and place the same object attachment result, misaligned attachment result and uncovered retainer mark in the corresponding coverage path to form a constraint coverage chain.

[0115] In the specific implementation process, the constraint recharge layer is configured with a slot sequence extractor, a coverage object representative, a hook-and-splitter, a coverage chain assembler, a recharge partitioner, a same-object recharger, a misalignment calibrator, a continuation retainer, and a correction state assembler. The slot sequence extractor receives the safety state representation within the tree and organizes the arrangement order of the safety state slots; the coverage object representative receives the constraint slots and receiving slots and calibrates the coverage objects; the hook-and-splitter receives the coverage object calibration results and generates same-object hook-and-splitter results, misaligned hook-and-splitter results, or uncovered receiving marks; the coverage chain assembler receives the hook-and-splitter results and assembles the constraint coverage chain; the recharge partitioner, same-object recharger, misalignment calibrator, continuation retainer, and correction state assembler read the constraint coverage chain and form the recharge correction state during the constraint recharge process.

[0116] Traditional ASTNN models typically rely on implicit contextual relationships between statement vectors to express the semantics of code fragments after statement tree encoding. This makes it difficult to directly distinguish whether a certain validation constraint covers a certain receiving object, and also to identify constraint misalignments arising during variable passing, object passing, or call result reception. This method preserves receiving slots, constraint slots, and trigger slots in the tree-based safety state representation, thus enabling the validation constraint backfeeding layer to establish coverage relationships at the slot level. The processing goal at this stage is not to directly determine the risk level, but rather to organize the constraint slots, receiving slots, and trigger slots into a backward-traversable constraint coverage chain according to the receiving index, allowing the validation constraint backfeeding process to perform state backfeeding along the coverage path.

[0117] The slot sequence extractor reads the security state slots, slot type flags, node ownership flags, and reserved acceptance index bits from the security state representation within the tree, and performs slot grouping according to the slot type flags. Security state slots with conditional judgments, boundary comparisons, permission checks, type restrictions, and null value restrictions are assigned to constraint slots; security state slots with data source, variable assignment, parameter passing, return acceptance, and object passing information are assigned to acceptance slots; and security state slots with sensitive interface calls, resource access, memory operations, external command execution, and exception exit information are assigned to trigger slots. After completing slot grouping, the slot sequence extractor performs acceptance-pre-arrangement of constraint slots, acceptance slots, and trigger slots according to the reserved acceptance index bits, ensuring that the constraint formation position, object acceptance position, and risk trigger position enter the same slot sequence according to the code execution acceptance order.

[0118] The coverage object representation starts with the constraint slot and scans the acceptance slots within the same statement tree or adjacent acceptance statement trees along the preceding sorting results. The scan range is initially limited to the same statement tree; however, when there are branch entry, loop entry, call entry, or return exit corresponding to the acceptance index reserved bits between the statement tree containing the constraint slot and adjacent statement trees, the scan range is extended to the adjacent acceptance statement trees. The coverage object representation identifies the coverage object by combining the object identifier, node ownership flag, and acceptance index reserved bits. The object identifier includes variable identifier, array identifier, member object identifier, parameter identifier, return value identifier, interface identifier, or resource object identifier; the node ownership flag indicates that the constraint slot originates from boundary comparison, permission verification, type restriction, null value restriction, or condition judgment; the acceptance index reserved bits define the statement tree, execution path, and acceptance breakpoint location where the constraint slot is located.

[0119] The overriding object representation does not match solely based on object names, but simultaneously checks the object identifier, node affiliation flag, and inheritance index reserved bits. If variables with the same name appear in different branch paths, different function call paths, or different return targets, and the inheritance index reserved bits are inconsistent, then these variables with the same name are not directly identified as the same overriding object. For object name changes caused by parameter passing, return value reception, and object member access, if the inheritance index reserved bits can indicate the inheritance relationship of variable assignment, object passing, parameter passing, or call result, then it is reserved as a candidate overriding object and handed over to the attachment separator for further differentiation between same-object attachments and misaligned attachments.

[0120] The attachment patterner performs attachment patterning on the constraint slots and acceptor slots output by the overriding object representation. When the overriding object of the constraint slot is the same as the acceptor object carried by the acceptor slot, and both are on the same acceptor path or adjacent acceptor paths, the attachment patterner marks the constraint slot and acceptor slot as the same object attachment result. The same object attachment result means that the constraint slot can directly overridden the acceptor object in the acceptor slot. For example, the array object of the boundary comparison constraint is the same as the array access object, the pointer object of the null value judgment constraint is the same as the pointer dereference object, and the resource object of the permission verification constraint is the same as the resource access object.

[0121] When the overriding object of a constraint slot is inconsistent with the receiving object carried by a receiving slot, but there is a variable assignment, object passing, parameter passing, or call result inheritance relationship between them, the attachment splitter marks the constraint slot and the receiving slot as misaligned attachment results. A misaligned attachment result indicates that a constraint state has been formed, but the constraint object has deviated from the receiving object after variable transfer, parameter replacement, return reception, or member object expansion. For example, the constraint slot constrains an input parameter, and the receiving slot corresponds to a derived variable assigned from that input parameter; or the constraint slot constrains a function return object, and the receiving slot corresponds to a member access object after receiving the return object. In this case, the constraint relationship is not considered a direct overriding, but rather retained as a misaligned attachment result.

[0122] When no constraint slot is matched within the scanning range for a receiving slot, or when there is no object consistency relationship, variable assignment relationship, object passing relationship, parameter passing relationship, or call result receiving relationship between the matched constraint slot and the receiving slot, the attaching parting tool configures an uncovered receiving mark at that receiving slot. The uncovered receiving mark retains the receiving object identifier, the receiving index reserved bit, and the receiving slot's location, indicating that the receiving object lacks a suitable constraint slot within the current scanning range.

[0123] The overlay assembler continues scanning along the reserved bits of the acceptor index for trigger slots that have execution acceptor relationships with acceptor slots. Execution acceptor relationships between trigger slots and acceptor slots include syntactic dependencies within the same statement tree, as well as variable usage, object passing, parameter passing, call result reception, branch entry, or return acceptor relationships between adjacent statement trees. Upon finding a trigger slot, the overlay assembler arranges the constraint slots, acceptor slots, and trigger slots into an overlay path according to the constraint formation direction, variable acceptor direction, and trigger execution direction. The constraint formation direction indicates the direction in which the constraint slot imposes restrictions on the target object; the variable acceptor direction indicates the direction in which the acceptor object flows from the source location to the usage location; and the trigger execution direction indicates the direction in which sensitive calls, resource accesses, memory operations, external command execution, or exception exits occur in the code execution path.

[0124] The override chain assembler adds a reserved acceptor index to the cross-statement tree join positions in the override path. Cross-statement tree join positions include branch entry join positions, loop back join positions, function call join positions, and return exit join positions. Adding the reserved acceptor index ensures that the override path retains the source of cross-statement tree joins, preventing the same variable, resource object, or return value from being incorrectly merged in different execution paths. Subsequently, the override chain assembler places the same object join results, misaligned join results, and uncovered acceptor markers into the corresponding override path, forming a constraint override chain.

[0125] A constraint coverage chain includes at least the constraint slot identifier, the receiving slot identifier, the trigger slot identifier, the attachment type flag, the coverage object identifier, the receiving index reserved bit, and the cross-statement tree connection flag. The attachment type flag records whether the receiving object is attached to the same object, misaligned, or not covered; the coverage object identifier records the object actually restricted by the constraint slot; the receiving index reserved bit records the statement tree position traversed by the coverage chain and the receiving breakpoint position; and the cross-statement tree connection flag records whether the coverage chain traverses branches, loops, calls, or returns to the receiving object. Through this processing, the constraint backfeeding layer transforms the implicit statement context relationship in the traditional ASTNN model into a slot-level coverage chain relationship during the constraint coverage attachment stage, providing a reversibly traversable chain object for constraint backfeeding.

[0126] In this embodiment, S5 specifically includes:

[0127] S51. Verify the constraint recharge layer and perform recharge partitioning on the same object hooking results, misaligned hooking results and uncovered acceptance marks in the constraint coverage chain. Enter the constraint slot position into the recharge source area and the acceptance slot position and trigger slot position into the recharge receiving area.

[0128] S52. Push the constraint state into the constraint slot in the reverse direction along the coverage path corresponding to the same object's attachment result, overlay the constraint state onto the risk acceptance state in the acceptance slot, and rewrite the risk acceptance state covered by the constraint state into the risk reduction state.

[0129] S53. Encapsulate the receiving slot carrying the risk reduction status with the trigger slot in the same coverage path, and configure the covered trigger mark in the trigger slot.

[0130] S54. Perform object deviation calibration on the coverage path corresponding to the misaligned attachment result. Based on the inconsistency between the constraint slot object identifier and the receiving slot object identifier, overlay the constraint state onto the receiving slot corresponding to the deviation object, and configure the constraint misalignment state between the receiving slot and the trigger slot.

[0131] S55. For the acceptance slots corresponding to the uncovered acceptance marks, retain the risk acceptance status, arrange the acceptance slots with the retained risk acceptance status adjacent to the corresponding trigger slots, and configure the risk continuation status.

[0132] S56. Slots carrying risk reduction status, slots with configuration constraint misalignment status, and slots with configuration risk continuation status are assigned to the backfill correction status, and the accepting index retention bit and trigger slot ownership flag are retained in the backfill correction status.

[0133] In practical implementation, traditional ASTNN models typically provide code risk assessments through sequence states or classification layers after obtaining statement vectors. However, they struggle to apply constraints such as boundary comparisons, permission checks, and null value restrictions to specific risk-bearing locations. This method, through constraint backfeeding, transforms the same-object attachment results, misaligned attachment results, and uncovered acceptance markers in the constraint coverage chain into risk reduction states, constraint misalignment states, and risk continuation states, respectively. This transforms the risk assessment object from ordinary statement vectors into traceable and recursive slot states.

[0134] The recharge partitioner reads the attachment type marker, constraint slot identifier, receiving slot identifier, and trigger slot identifier from the constraint coverage chain, and divides the recharge branches according to the same object attachment result, misaligned attachment result, and uncovered receiving mark. For coverage paths corresponding to the same object attachment result, the recharge partitioner places the constraint slot into the recharge source area and the receiving slot and trigger slot into the recharge receiving area; for coverage paths corresponding to misaligned attachment results, the constraint slot, the receiving slot where the object deviates, and the corresponding trigger slot are written into the misaligned recharge branch respectively; for coverage paths corresponding to uncovered receiving marks, the receiving slot lacking the constraint slot and the corresponding trigger slot are written into the continuation recharge branch. The recharge source area retains the constraint object identifier, constraint type, constraint range, constraint direction, and the receiving index where the constraint is located; the recharge receiving area retains the receiving object identifier, risk receiving status, trigger object identifier, trigger type, and trigger slot ownership marker.

[0135] The same-object reflow processor processes the coverage path corresponding to the same-object attachment result. If the same-object attachment result indicates that the covered object of the constraint slot is consistent with the received object of the receiving slot, then the constraint status in the constraint slot is read in the reverse direction of the coverage path, and the constraint status is pushed back into the corresponding receiving slot. Constraint status includes boundary restriction status, permission restriction status, type restriction status, null value restriction status, or return constraint status; risk receiving status includes pending access status, pending call status, pending transmission status, or pending return status. When the constraint object and the receiving object are consistent, and the constraint scope covers the usage scope of the receiving object, the same-object reflow processor rewrites the risk receiving status in the receiving slot to a risk reduction status, and retains the constraint source flag, constraint type, and receiving index reserved bit in the risk reduction status.

[0136] The same-object backflow mechanism encapsulates the accepting slot carrying the risk reduction status with the triggering slot in the same coverage path. This encapsulation does not merge the accepting and triggering slots; instead, it arranges them in a co-located structure at the same coverage path position, allowing the triggering slot to read the risk reduction status from the accepting slot. If the object used by the sensitive interface call, resource access, memory operation, external command execution, or exception exit corresponding to the triggering slot is consistent with the object in the accepting slot, a covered trigger flag is configured in the triggering slot. The covered trigger flag indicates that the accepting object corresponding to this trigger position has already obtained same-object constraint coverage and will no longer be passed on as an uncovered risk during cross-statement risk propagation.

[0137] The misalignment calibrator handles the coverage path corresponding to the misalignment connection result. The misalignment connection result indicates that the covering object of the constraint slot is inconsistent with the receiving object of the receiving slot, but there is a variable assignment, object passing, parameter passing, or call result inheritance relationship between them. The misalignment calibrator reads the inconsistency relationship between the constraint slot object identifier and the receiving slot object identifier, and determines the location where the object deviation occurs by combining the reserved bits of the inheritance index; the object deviation location includes the assignment location, parameter passing location, return receiving location, object member access location, or interface encapsulation location. After completing the object deviation calibration, the constraint state is overlaid next to the receiving slot corresponding to the deviation object, without directly rewriting the risk inheritance state to the risk reduction state.

[0138] The misalignment calibrator configures a constraint misalignment state between the receiving slot and the triggering slot. This state retains the constraint source marker, constraint slot object identifier, receiving slot object identifier, deviation from the receiving position, deviation type, and triggering slot attribution marker. The deviation type is determined based on the object's change method, including variable renaming deviation, parameter passing deviation, return receiving deviation, member access deviation, and interface encapsulation deviation. Through this constraint misalignment state, the validation constraint backfeeding layer avoids misjudging misaligned constraints as valid coverage, and does not directly discard existing constraint information. Instead, it preserves the deviation relationship between the validation object and the risk receiving object for continued propagation during the cross-statement risk recursion phase.

[0139] The continuation retainer handles coverage paths corresponding to uncovered acceptance markers. An uncovered acceptance marker indicates that no constraint slot was found within the corresponding scan range that can be attached to the same object or misaligned; therefore, no reduction is performed on the risk acceptance state in the acceptance slot. The continuation retainer preserves the original risk acceptance state of the acceptance slot and arranges the acceptance slots with preserved risk acceptance states adjacent to their corresponding trigger slots. During adjacent arrangement, the risk acceptance state is placed before the trigger slot, and the acceptance index reserve bit, acceptance object identifier, and trigger slot ownership marker are preserved, allowing the risk state to enter the cross-statement risk recursion along the code execution acceptance order.

[0140] The continuation retainer configures risk continuation states between the accepting slot and the triggering slot corresponding to the uncovered accepting mark. The risk continuation state records the accepting object of the missing constraint, the accepting scope of the missing constraint, the risk accepting direction, the accepting index reserve bit, and the triggering slot attribution mark. If the same accepting slot corresponds to multiple triggering slots, risk continuation states are configured separately for each triggering slot, and the risk continuation direction is distinguished by the triggering slot attribution mark. If multiple uncovered accepting marks point to the same triggering slot, multiple risk continuation states are retained according to the order of the accepting index reserve bits, preventing uncovered risks from different sources from being merged into a single state.

[0141] The corrected state assembler reads the risk reduction state formed by the object recharger, the constraint misalignment state formed by the misalignment calibrator, and the risk continuation state formed by the continuation retainer, and arranges them according to the acceptance index reserved bit. Slots carrying risk reduction states indicate that the constraint object is consistent with the accepting object and the risk acceptance state has been covered by the constraint; slots configuring constraint misalignment states indicate that the constraint exists but the constraint object deviates from the accepting object; slots configuring risk continuation states indicate that the accepting object lacks available constraint coverage. The corrected state assembler groups these three types of slots into the same recharge corrected state, and retains the acceptance index reserved bit and the trigger slot ownership flag in the recharge corrected state.

[0142] In this embodiment, slots carrying risk reduction status, slots with configuration constraint misalignment status, and slots with configuration risk continuation status are classified into the recharge correction status. The recharge correction status retains the inheriting index reserve bit and the trigger slot ownership flag, specifically including:

[0143] Perform coverage source fixed bit configuration on the accepting slot with risk reduction status, write the object identifier, constraint type and accepting index reserved bit of the constraint slot into the coverage source fixed bit of the accepting slot, and split the risk accepting status in the accepting slot into covered risk status and residual risk status.

[0144] For covered risk states, risk reduction states are overlaid; for residual risk states, the original risk acceptance direction is retained; and the covered risk states, residual risk states, and coverage source are fixedly encapsulated into a risk reduction slot group.

[0145] For the receiving slot with misaligned configuration constraints, perform deviation from source fixed bit configuration, write the inconsistency between the constraint slot object identifier and the receiving slot object identifier into the deviation from source fixed bit, and arrange the constraint status in the adjacent constraint bit of the receiving slot.

[0146] Insert a misaligned receiving slot between the trigger slot and the receiving slot, encapsulate the side constraint slot, the offset source fixed slot and the misaligned receiving slot into a constraint misaligned slot group, and retain the original trigger state in the trigger slot;

[0147] For the slots with configured risk continuation status, perform the configuration of the uncovered source fixed bit, write the acceptance index range, acceptance object identifier and trigger slot ownership mark of the missing constraint slot into the uncovered source fixed bit, and arrange the risk acceptance status in the risk continuation bit before the trigger slot;

[0148] The uncovered source fixed bit, risk continuation bit and corresponding trigger slot are encapsulated into a risk continuation slot group;

[0149] According to the order of the reserved bits of the accepting index, the risk reduction slot group, the constraint misalignment slot group, and the risk continuation slot group are written into the same backflow correction state, and the accepting index reserved bits and the trigger slot ownership flag are retained in the backflow correction state.

[0150] In practice, the backfeedback correction state is used to receive the backfeedback results of the validation constraints and serves as the input object for cross-statement risk recursion. The backfeedback correction state does not combine risk reduction, constraint misalignment, and risk continuation into a single risk score. Instead, it encapsulates these three types of states into risk reduction slot groups, constraint misalignment slot groups, and risk continuation slot groups, respectively. The risk reduction slot group indicates that the risk acceptance state in the receiving slot has been covered by the corresponding constraint state; the constraint misalignment slot group indicates that the constraint state exists, but there is a deviation between the constraint object and the receiving object; the risk continuation slot group indicates that the receiving slot lacks available constraint coverage, and the risk acceptance state needs to continue participating in cross-statement recursion.

[0151] The covered source fixed bit, the deviation source fixed bit, and the uncovered source fixed bit are used to retain the source basis for the three types of states, respectively. The covered source fixed bit records the object identifier, constraint type, and inheriting index reserved bit of the constraint slot, enabling the risk reduction slot group to trace back to the corresponding constraint source; the deviation source fixed bit records the inconsistency relationship between the constraint slot object identifier and the inheriting slot object identifier, enabling the constraint misalignment slot group to retain the object deviation position; the uncovered source fixed bit records the inheriting index range, inheriting object identifier, and trigger slot attribution mark of the missing constraint slot, enabling the risk continuation slot group to retain the source range of the uncovered risk. For the case where the same inheriting slot corresponds to multiple constraint sources or multiple trigger slots, the corresponding fixed bits are retained separately according to the inheriting index reserved bit, and the states from different sources are not merged into a single record.

[0152] The backfeedback correction status is arranged according to the reserved position of the continuation index: risk reduction slot group, constraint misalignment slot group, and risk continuation slot group. This enables the cross-statement risk propagation layer to distinguish between covered risks, misalignment verification risks, and uncovered continuation risks. The risk reduction slot group participates in the propagation masking process, the constraint misalignment slot group participates in the deviation overlay process, and the risk continuation slot group participates in the continuation arrangement process. This ensures that the backfeedback results of verification constraints can stably enter the cross-statement risk propagation process.

[0153] In this embodiment, S6 specifically includes:

[0154] S61. The cross-statement risk recursion layer performs a pre-arrangement of the risk reduction slot group, constraint misalignment slot group and risk continuation slot group in the backflow correction state, and divides the state recursion interval by the pre-arrangement bit of the pre-arrangement index and the trigger slot ownership flag.

[0155] S62. Configure a recursive shielding mark for the risk reduction slot group, place the recursive shielding mark in the corresponding state recursive interval, and rewrite the state of the downstream recursive channel corresponding to the risk reduction slot group to the closed state.

[0156] S63. Perform a succession arrangement on the risk continuation slot group, and arrange the risk continuation status segment by segment along the succession index reserved bits between adjacent statement trees to the trigger slots in the same state recursion interval.

[0157] S64. Perform offset stacking on the constraint misalignment slot group, arrange the constraint misalignment state and the trigger slot in the same state recursion interval adjacent to each other, and retain the misalignment source mark at the trigger slot.

[0158] S65. When the risk continuation state or constraint misalignment state reaches the trigger slot's assigned position, the reaching state is pushed into the risk response slot corresponding to the trigger slot, and the risk response slot and the accepting index reserved bit are encapsulated in the same position to form a risk trigger response.

[0159] In the specific implementation process, the cross-statement risk recursion layer receives the backfeeding correction state and converts the risk reduction slot group, constraint misalignment slot group, and risk continuation slot group in the backfeeding correction state into risk trigger responses. Traditional ASTNN models typically update hidden states according to the statement order. Hidden states can express contextual semantics, but they cannot clearly distinguish between the three types of safe states: risks that have been covered by constraints, constraints that have deviated, and risks that lack constraint coverage. This method transforms the traditional cross-statement sequence modeling process into a cross-statement risk recursion layer, which allows the backfeeding correction state to be recursively pushed along the retained index position between statement trees in a directed manner. This prevents covered risks from continuing to spread and delivers constraint misalignment risks and uncovered continuation risks to the corresponding trigger slots.

[0160] The cross-statement risk recursion layer consists of a recursion interval constructor, a reduction shield, a continuation arranger, a misalignment stacker, and a risk response pusher. The recursion interval constructor reads the inherited index reserved bits, trigger slot ownership flags, and cross-statement tree connection flags from the risk reduction slot group, constraint misalignment slot group, and risk continuation slot group, and divides the state recursion intervals according to the same sequential statement segment, the same branch path, the same loop path, the same function call inherited path, or the same return inherited path. Different branch paths, different loop iteration flags, different call entry points, or different return exits correspond to different state recursion intervals; risk states in different execution paths are not directly merged.

[0161] The risk reduction shield handles risk reduction slot groups. A risk reduction slot group indicates that the corresponding risk acceptance state has been covered by constraints of the same object. Therefore, the risk reduction shield configures a recursion shield flag within the state recursion interval of the risk reduction slot group and rewrites the downstream recursion channel state corresponding to the risk reduction slot group to the closed state. After the downstream recursion channel state is closed, the risk reduction slot group will no longer be delivered to the trigger slot along the acceptance index reserved bits of adjacent statement trees, avoiding the repeated triggering of risks that have already been covered by boundary checks, permission checks, null value restrictions, or type restrictions in cross-statement recursion.

[0162] The continuation arranger processes risk continuation slot groups. A risk continuation slot group indicates that the receiving slot lacks available constraint coverage. Therefore, the continuation arranger arranges the risk continuation states segment by segment from the current statement tree to the trigger slots within the same state recursion interval, according to the order of the receiving index reserved bits. The recursion path can pass through adjacent sequential statements, branch entry positions, loop back jump positions, function call entry points, or return exit points. Each time a cross-statement tree connection position is passed, the risk continuation state retains the corresponding receiving index reserved bit, ensuring that the source of the risk can be located back in the final detection result. If the same risk continuation state reaches multiple trigger slots, multiple risk recursion branches are retained according to the trigger slot's ownership flag.

[0163] The misalignment overlay handles constraint misalignment slot groups. A constraint misalignment slot group indicates that a verification constraint exists, but there is a deviation between the constraint object and the receiving or triggering object; therefore, this state is not considered a valid risk reduction. The misalignment overlay arranges the constraint misalignment state adjacent to the trigger slots within the same state's recursive interval and retains a misalignment source marker at the trigger slot. The misalignment source marker records the constraint slot object identifier, the receiving slot object identifier, the deviation from the receiving position, and the receiving index reserved bit, enabling the final risk result to distinguish between two situations: a complete lack of verification constraints and a deviation of the verification object.

[0164] When a risk continuation state or constraint misalignment state reaches the trigger slot's assigned position, the risk response pusher pushes the arrival state into the corresponding risk response slot. The risk response slot must retain at least the risk state type, risk source inheritance index, verification deviation inheritance index, trigger slot assignment flag, and trigger position inheritance index. When a risk continuation state is pushed into a risk response slot, the risk response slot record does not cover the risk source; when a constraint misalignment state is pushed into a risk response slot, the risk response slot record records the verification deviation source. If both a risk continuation state and a constraint misalignment state arrive at the same trigger slot simultaneously, the two arrival states are retained side-by-side according to the inheritance index retention position, and are not merged into a single risk value.

[0165] The risk response pusher encapsulates the risk response slot with the reserved bit of the inheriting index in the same position to form a risk-triggered response. The risk-triggered response is not a regular classification vector, but a structured response result carrying the risk source, verification deviation, trigger position, and execution inheriting path. Through this cross-statement risk recursion processing, the ASTNN model is improved by transforming the traditional implicit context passing into a risk state recursion along the inheriting index while retaining the ability to model statement order. This allows the software security detection results to explain from which inheriting object the risk continues, at which verification position the deviation occurs, and at which trigger position the response is ultimately formed.

[0166] In the specific implementation process, the model parameters of the improved ASTNN model are obtained by training with source code samples labeled with security audits. The training samples include code snippets, risk type markers, risk level markers, risk source location markers, verification deviation location markers, trigger location markers, and slot status markers. The code snippets first undergo the construction of a continuation-type abstract syntax tree and a security-state statement tree according to this method, resulting in a set of security-state statement trees for training. The risk source location markers correspond to the risk continuation states formed by uncovered continuation, the verification deviation location markers correspond to the constraint misalignment states formed by misaligned attachments, and the trigger location markers correspond to sensitive calls, resource access, memory operations, external command execution, or abnormal exits. During training, the parameters of the tree-based security coding layer are updated jointly through the statement tree-level coding error and slot retention error, ensuring that the tree-based security state representation retains the slot type, node affiliation, and acceptance index. The parameters of the verification constraint backfeeding layer are updated through the slot state consistency error, ensuring that same-object attachment, misaligned attachment, and uncovered acceptance markers correspond to risk reduction state, constraint misalignment state, and risk continuation state, respectively. The parameters of the cross-statement risk recursion layer are updated through the risk location back-positioning error and risk level prediction error, ensuring that the risk source index, verification deviation index, and trigger position index in the risk trigger response are close to the manual audit annotations. The training termination condition is jointly determined by the validation set risk level identification results and risk location matching results. When the validation set F1 value increases by less than the set range for multiple consecutive rounds, or reaches the set number of training rounds, training stops and the model parameters are fixed. The set range and the set number of training rounds are determined by the training set size and validation set stability. In this implementation, the set range is 0.2 percentage points, and the set number of training rounds is 50 rounds.

[0167] In this embodiment, S7 specifically includes:

[0168] S71. Perform on-site decomposition on the risk response slot and the reserved position of the acceptance index in the risk trigger response, mark the acceptance index corresponding to the risk continuation state as the risk source index, mark the acceptance index corresponding to the constraint misalignment state as the verification deviation index, and mark the acceptance index corresponding to the trigger slot attribution mark as the trigger position index.

[0169] S72. Paste the risk source index, verification deviation index and trigger position index back to the corresponding abstract syntax tree nodes in the continuation abstract syntax tree, and merge the pasted nodes in the same statement tree into statement-level risk fragments along the statement boundary.

[0170] S73. Perform interval merging on adjacent statement-level risk segments, merge statement-level risk segments with continuous successor indexes into risk-related intervals, and configure call association flags for risk-related intervals formed by cross-function call succession.

[0171] S74. Perform state overlay on the risk response status within the risk association interval, and push the risk continuation status, constraint misalignment status and trigger slot attribution mark into the risk source slot, verification gap slot and trigger position slot respectively to obtain the risk association position;

[0172] S75. Perform level labeling on risk-related locations. When a risk-related location contains a risk source slot, a verification gap slot, and a trigger location slot, configure it as a high-risk level. When a risk-related location contains a verification gap slot and a trigger location slot, configure it as a medium-risk level. When a risk-related location contains only a trigger location slot, configure it as a low-risk level.

[0173] S76. Encapsulate the risk-related location, call-related markers, and risk level into software security detection results.

[0174] In the specific implementation process, the risk trigger response already carries the risk response slot and the reserved bit for the accepting index. This step first performs a parity-based decomposition on the risk response slot and the reserved bit for the accepting index, using the accepting index corresponding to the risk continuation state as the risk source index, the accepting index corresponding to the constraint misalignment state as the verification deviation index, and the accepting index corresponding to the trigger slot attribution mark as the trigger position index. These three types of indexes are used to locate the uncovered risk source, the deviation position of the verification object, and the sensitive trigger position, respectively, so that the risk trigger response can be pasted back into the source code structure.

[0175] Based on the function identifier, statement sequence identifier, breakpoint type identifier, and path identifier in the continuation index, the risk source index, verification deviation index, and trigger position index are respectively pasted back to the corresponding abstract syntax tree nodes in the continuation abstract syntax tree. Pasted nodes located within the same statement boundary are merged into statement-level risk fragments; adjacent statement-level risk fragments with continuous continuation indices are merged into risk association intervals; risk association intervals formed across function call entry points or return exit points are configured with call association markers to indicate that the risk chain passes through function calls or return continuation.

[0176] The risk response status within the risk association interval is overlaid, pushing the risk continuation status into the risk source slot, the constraint misalignment status into the verification gap slot, and the trigger slot attribution marker into the trigger position slot to obtain the risk association position. Then, the risk level is configured based on the slot combination in the risk association position: when the risk association position contains a risk source slot, a verification gap slot, and a trigger position slot simultaneously, it indicates that an uncovered risk source, verification object deviation, and a sensitive trigger position all exist simultaneously, and a high risk level is configured; when the risk association position contains a verification gap slot and a trigger position slot, it indicates that a verification deviation exists and has reached a sensitive trigger position, and a medium risk level is configured; when the risk association position only contains a trigger position slot, it indicates that only sensitive triggering behavior exists but a complete uncovered risk source or verification deviation chain has not been formed, and a low risk level is configured. Finally, the risk association position, the associated marker, and the configured risk level are encapsulated into a software security detection result.

[0177] Example 1: To verify the feasibility of this invention in practice, it was applied to the source code security detection scenario of an internal business platform of an enterprise. This business platform includes functional modules such as user permission management, order settlement, file upload, report export, and external interface calls. The code language is mainly Java, with a small number of C / C++ extension components. The project code size is approximately 386,000 lines, containing 2,148 source files and 17,620 function or method nodes. Traditional static rule detection methods mainly rely on dangerous function keywords, regular expressions, and fixed security rules for scanning. When detecting problems such as missing permission verification, deviation of verification objects after parameter passing, and unjudged return values, false positives are prone to occur. Although traditional ASTNN models can learn the statement tree structure, they usually compress the statement tree into ordinary statement vectors, resulting in unclear correspondence between variable inheritance, constraint limitation, and sensitive triggers, and insufficient risk location back-location capability.

[0178] In this embodiment, the source code of the software to be detected is first subjected to lexical segmentation and syntax parsing. Function bodies, branch blocks, loop blocks, call statements, and return statements are mapped to abstract syntax tree nodes, and the inheritance index is configured according to the code execution inheritance order to form an inheritance-type abstract syntax tree. Then, the statement tree is split along the statement boundary, and the source inheritance structure, constraint limit structure, and sensitive trigger structure are folded into the inheritance slot, constraint slot, and trigger slot, respectively, to form a set of security state-based statement trees. Next, the set of secure state-based statement trees is input into the improved ASTNN model. The in-tree security coding layer preserves the slot type, node affiliation, and inheritance index to form an in-tree security state representation. Then, the constraint backfeeding layer performs constraint coverage on constraint slots, inheritance slots, and trigger slots to form a constraint coverage chain. The constraint backfeeding is performed on the same object attachment, misaligned attachment, and uncovered inheritance markers to form a backfeeding correction state. Finally, the risk continuation state and constraint misalignment state are recursively pushed to the corresponding trigger slot through the cross-statement risk recursion layer to form a risk trigger response. The risk association position and risk level in the source code are then located based on the inheritance index.

[0179] To ensure the representativeness of the verification results, this embodiment selected 2200 functions or methods from the three most recent iterations of the business platform as detection samples. Among them, 436 samples were confirmed to have security risks through manual code auditing, and 1764 samples had no security risks. Security risk types included missing permission checks, missing null value restrictions, missing array boundary checks, unconstrained external command parameters, unvalidated file path parameters, unhandled abnormal return value branches, and misaligned pre-checks for sensitive interface calls. A comparison was made between the original static rule detection method, the traditional ASTNN detection method, and the method of this invention. The statistical results are shown in Table 1 below.

[0180] Table 1 Comparison of Software Security Testing Results

[0181] Original static rule detection method 86.82 72.48 65.02 68.55 61.73 Traditional ASTNN detection methods 91.14 82.11 78.95 80.50 69.84 Method of the present invention 96.45 93.12 89.43 91.24 88.76

[0182] As shown in Table 1, the method of this invention outperforms the original static rule detection method and the traditional ASTNN detection method in terms of accuracy, recall, precision, F1 score, and risk location matching rate. The original static rule detection method has some ability to identify explicit dangerous calls, but it is insufficient in identifying verification misalignments after parameter passing, abnormal exits after return acceptance, and cross-statement risk continuation, with a recall rate of only 72.48% and a risk location matching rate of 61.73%. The traditional ASTNN detection method improves code structure understanding through statement tree encoding, increasing accuracy to 91.45%. However, because the statement tree encoding result mainly represents ordinary statement vectors, the coverage relationship between security constraints and risk triggers is not explicitly preserved, and the risk location matching rate remains at 69.84%. The method of this invention uses a combination of inheriting abstract syntax trees, security state slots, constraint coverage chains, validation constraint backfeeding, and cross-statement risk recursion to enable the structured expression of relationships such as whether validation covers risk objects, whether validation objects have deviated, and whether uncovered risks continue to the trigger position. Therefore, the recall rate reaches 93.12%, the precision rate reaches 89.43%, and the risk position matching rate reaches 88.76%.

[0183] In this embodiment, accuracy represents the proportion of correctly identified samples out of all detected samples; recall represents the proportion of successfully detected real risk samples; precision represents the proportion of real risk samples among those identified as risky; the F1 score is used to comprehensively measure recall and precision; and the risk location matching rate represents the proportion of risk-related locations given by the detection results that are consistent with or located within the same statement-level risk segment by manual audit annotations. The detection results show that the method of this invention can not only determine whether a code segment has a security risk, but also provide the connection relationship between the risk source location, the verification deviation location, and the trigger location, exhibiting more stable risk location capabilities in scenarios such as cross-statement variable passing, function call inheritance, and return value processing.

[0184] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A software security detection method based on deep learning, characterized in that, Includes the following steps: S1. Perform syntax parsing and statement boundary closure on the source code of the software to be tested, and configure the abstract syntax tree nodes obtained by parsing with the continuation index according to the execution order of the code to form a continuation abstract syntax tree; S2. The statement tree is split along the statement boundaries of the continuation abstract syntax tree, and the safe syntax structure within the statement tree is folded into the safe state slot to form a set of safe state statement trees. S3. Input the set of secure stateful statement trees into the improved ASTNN model. The improved ASTNN model includes an in-tree security coding layer, a check constraint backfeeding layer, and a cross-statement risk recursion layer. Perform syntax subordinate level compression on the secure state slots in the secure stateful statement trees through the in-tree security coding layer to form an in-tree secure state representation. S4. By verifying the constraint recharge layer, perform constraint coverage hooking on the safety state slots in the tree safety state representation according to the acceptance index, and connect the safety state slots with coverage acceptance relationship into a constraint coverage chain. S5. Perform constraint verification backfeed on the constraint coverage chain through the constraint backfeed layer, write the constraint state in the constraint coverage chain back to the corresponding safety state slot, and configure the backfeed correction state according to the backfeed coverage situation. S6. By following the order of the security state tree set along the cross-statement risk recursion layer, cross-statement state recursion is performed on the backfeed correction state, and the recursion result is pushed into the corresponding risk response slot to form a risk trigger response. S7. Locate the source code of the software to be tested by following the index carried by the risk trigger response, merge the back-location results into risk-related locations, configure the risk level according to the risk response status, and form the software security detection result.

2. The software security detection method based on deep learning according to claim 1, characterized in that, S1 specifically includes: S11. Perform lexical segmentation and syntax parsing on the source code of the software to be tested, mapping the function bodies, branch blocks, loop blocks and statement boundaries in the source code to abstract syntax tree nodes; S12. Using the statement boundary as the aggregation criterion, merge the abstract syntax tree nodes belonging to the same statement into a statement node group, and retain the syntax hierarchy of each abstract syntax tree node in the statement node group. S13. Arrange the statement node groups in advance according to the code execution sequence in the source code, and configure breakpoints for branch entry, loop entry, call entry and return exit respectively; S14. Embed the breakpoint position between adjacent statement node groups and configure the breakpoint position with a breakpoint index. S15. Attach the successor index to the corresponding abstract syntax tree node to form a successor abstract syntax tree.

3. The software security detection method based on deep learning according to claim 1, characterized in that, S2 specifically includes: S21. Cut cross-statement syntax connections along the statement boundaries in the continuation abstract syntax tree, retain the abstract syntax tree nodes belonging to the same statement boundary as independent statement trees, and retain the continuation index corresponding to each statement tree. S22. Perform safe syntax classification on the syntax nodes in each statement tree, and classify the syntax nodes corresponding to data source, variable assignment, parameter passing and return into the source-acceptance structure. S23. Incorporate the syntax nodes corresponding to conditional statements, boundary comparisons, permission checks, type restrictions, and null value restrictions into the constraint constraint structure. S24. Incorporate the syntax nodes corresponding to sensitive interface calls, resource access, memory operations, external command execution, and exception exits into the sensitive trigger structure. S25. Configure safe state slots in each statement tree, fold source acceptance structures into acceptance slots, constraint limiting structures into constraint slots, and sensitive trigger structures into trigger slots, and retain the syntax node positions and acceptance indexes in the acceptance slots, constraint slots, and trigger slots to form a set of safe state-based statement trees.

4. The software security detection method based on deep learning according to claim 1, characterized in that, S3 specifically includes: S31. Perform a syntactic hierarchical decomposition on each secure state statement tree in the secure state statement tree set, divide the syntax nodes into leaf node layer, expression node layer, control node layer, call node layer and statement root node layer, and configure syntax subordinate inheritance bits between adjacent node layers. S32. Attach the security status slot to the syntax subordinate acceptor along with the corresponding syntax node, and retain the slot type, node affiliation, and acceptor index in the corresponding syntax subordinate acceptor. S33. Perform same-level grouping for the receiving slots, constraint slots and trigger slots within the same node layer. Fold the safety state slots belonging to the same parent node into the corresponding parent node's syntax subordinate receiving slot, and perform parent layer folding in the order of leaf node layer, expression node layer, control node layer, call node layer to statement root node layer. S34. At the root node of the statement, the receiving slot, constraint slot and trigger slot after being folded in layer by layer are placed side by side, and the slot type, node affiliation and receiving index are retained to form a safe state representation within the tree.

5. The software security detection method based on deep learning according to claim 1, characterized in that, S4 specifically includes: S41. The verification constraint recharge layer performs slot grouping on the safety state slots in the tree safety state representation according to the slot type label, divides the safety state slots into constraint slots, acceptance slots and trigger slots, and performs acceptance-preceding arrangement on the constraint slots, acceptance slots and trigger slots according to the acceptance index reserved bit. S42. Using the constraint slot as the starting point for coverage, scan the acceptance slots located in the same statement tree or adjacent acceptance statement trees along the result of the previous acceptance arrangement, and mark the coverage object corresponding to the constraint slot according to the node ownership mark and the acceptance index reserved bit. S43. Connect constraint slots and accepting slots with the same covering object to the same object. Connect constraint slots and accepting slots with different covering objects but with variable accepting, object passing or call result accepting relationship in a staggered manner. Configure an uncovered accepting mark for accepting slots that lack constraint slot accepting. S44. Continue scanning along the reserved bits of the acceptance index to find trigger slots that have an execution acceptance relationship with the acceptance slots. Arrange the constraint slots, acceptance slots, and trigger slots into a coverage path according to the constraint formation direction, variable acceptance direction, and trigger execution direction. S45. Add the retainer index reserved bit to the cross-statement tree connection position in the coverage path, and place the same object attachment result, misaligned attachment result and uncovered retainer mark in the corresponding coverage path to form a constraint coverage chain.

6. The software security detection method based on deep learning according to claim 1, characterized in that, S5 specifically includes: S51. Verify the constraint recharge layer and perform recharge partitioning on the same object hooking results, misaligned hooking results and uncovered acceptance marks in the constraint coverage chain. Enter the constraint slot position into the recharge source area and the acceptance slot position and trigger slot position into the recharge receiving area. S52. Push the constraint state into the constraint slot in the reverse direction along the coverage path corresponding to the same object's attachment result, overlay the constraint state onto the risk acceptance state in the acceptance slot, and rewrite the risk acceptance state covered by the constraint state into the risk reduction state. S53. Encapsulate the receiving slot carrying the risk reduction status with the trigger slot in the same coverage path, and configure the covered trigger mark in the trigger slot. S54. Perform object deviation calibration on the coverage path corresponding to the misaligned attachment result. Based on the inconsistency between the constraint slot object identifier and the receiving slot object identifier, overlay the constraint state onto the receiving slot corresponding to the deviation object, and configure the constraint misalignment state between the receiving slot and the trigger slot. S55. For the acceptance slots corresponding to the uncovered acceptance marks, retain the risk acceptance status, arrange the acceptance slots with the retained risk acceptance status adjacent to the corresponding trigger slots, and configure the risk continuation status. S56. Slots carrying risk reduction status, slots with configuration constraint misalignment status, and slots with configuration risk continuation status are assigned to the backfill correction status, and the accepting index retention bit and trigger slot ownership flag are retained in the backfill correction status.

7. The software security detection method based on deep learning according to claim 6, characterized in that, The step of classifying slots carrying risk reduction status, slots with configuration constraint misalignment status, and slots with configuration risk continuation status into the recharge correction status, and retaining the inheriting index reserve bit and trigger slot ownership flag in the recharge correction status, specifically includes: Perform coverage source fixed bit configuration on the accepting slot with risk reduction status, write the object identifier, constraint type and accepting index reserved bit of the constraint slot into the coverage source fixed bit of the accepting slot, and split the risk accepting status in the accepting slot into covered risk status and residual risk status. For covered risk states, risk reduction states are overlaid; for residual risk states, the original risk acceptance direction is retained; and the covered risk states, residual risk states, and coverage source are fixedly encapsulated into a risk reduction slot group. For the receiving slot with misaligned configuration constraints, perform deviation from source fixed bit configuration, write the inconsistency between the constraint slot object identifier and the receiving slot object identifier into the deviation from source fixed bit, and arrange the constraint status in the adjacent constraint bit of the receiving slot. Insert a misaligned receiving slot between the trigger slot and the receiving slot, encapsulate the side constraint slot, the offset source fixed slot and the misaligned receiving slot into a constraint misaligned slot group, and retain the original trigger state in the trigger slot; For the slots with configured risk continuation status, perform the configuration of the uncovered source fixed bit, write the acceptance index range, acceptance object identifier and trigger slot ownership mark of the missing constraint slot into the uncovered source fixed bit, and arrange the risk acceptance status in the risk continuation bit before the trigger slot; The uncovered source fixed bit, risk continuation bit and corresponding trigger slot are encapsulated into a risk continuation slot group; According to the order of the reserved bits of the accepting index, the risk reduction slot group, the constraint misalignment slot group, and the risk continuation slot group are written into the same backflow correction state, and the accepting index reserved bits and the trigger slot ownership flag are retained in the backflow correction state.

8. The software security detection method based on deep learning according to claim 1, characterized in that, S6 specifically includes: S61. The cross-statement risk recursion layer performs a pre-arrangement of the risk reduction slot group, constraint misalignment slot group and risk continuation slot group in the backflow correction state, and divides the state recursion interval by the pre-arrangement bit of the pre-arrangement index and the trigger slot ownership flag. S62. Configure a recursive shielding mark for the risk reduction slot group, place the recursive shielding mark in the corresponding state recursive interval, and rewrite the state of the downstream recursive channel corresponding to the risk reduction slot group to the closed state. S63. Perform a succession arrangement on the risk continuation slot group, and arrange the risk continuation status segment by segment along the succession index reserved bits between adjacent statement trees to the trigger slots in the same state recursion interval. S64. Perform offset stacking on the constraint misalignment slot group, arrange the constraint misalignment state and the trigger slot in the same state recursion interval adjacent to each other, and retain the misalignment source mark at the trigger slot. S65. When the risk continuation state or constraint misalignment state reaches the trigger slot's assigned position, the reaching state is pushed into the risk response slot corresponding to the trigger slot, and the risk response slot and the accepting index reserved bit are encapsulated in the same position to form a risk trigger response.

9. The software security detection method based on deep learning according to claim 1, characterized in that, Specifically, S7 includes: S71. Perform on-site decomposition on the risk response slot and the reserved position of the acceptance index in the risk trigger response, mark the acceptance index corresponding to the risk continuation state as the risk source index, mark the acceptance index corresponding to the constraint misalignment state as the verification deviation index, and mark the acceptance index corresponding to the trigger slot attribution mark as the trigger position index. S72. Paste the risk source index, verification deviation index and trigger position index back to the corresponding abstract syntax tree nodes in the continuation abstract syntax tree, and merge the pasted nodes in the same statement tree into statement-level risk fragments along the statement boundary. S73. Perform interval merging on adjacent statement-level risk segments, merge statement-level risk segments with continuous successor indexes into risk-related intervals, and configure call association flags for risk-related intervals formed by cross-function call succession. S74. Perform state overlay on the risk response status within the risk association interval, and push the risk continuation status, constraint misalignment status and trigger slot attribution mark into the risk source slot, verification gap slot and trigger position slot respectively to obtain the risk association position; S75. Perform level labeling on risk-related locations. When a risk-related location contains a risk source slot, a verification gap slot, and a trigger location slot, configure it as a high-risk level. When a risk-related location contains a verification gap slot and a trigger location slot, configure it as a medium-risk level. When a risk-related location contains only a trigger location slot, configure it as a low-risk level. S76. Encapsulate the risk-related location, call-related markers, and risk level into software security detection results.

Images