Method and system for intelligent detection and repair of security defects in medical system source code

Abstract

The application provides a medical system source code security defect intelligent detection and repair method and system, relates to the technical field of medical information security, and comprises the following steps: constructing a code dependency graph, analyzing a node association mode to determine a key node, performing bidirectional tracing and context semantic analysis to detect security defects, extracting a local topology structure to generate a repair sequence, identifying dependency conflicts, control flow loops and analysis conflict propagation chains, applying a graph cut algorithm to reconstruct dependency relationships, realizing intelligent repair of code security defects, improving the security of medical system source code, reducing vulnerability risks, and protecting patient data security.

Description

Technical Field

[0001] This invention relates to the field of technology, and in particular to a method and system for intelligent detection and repair of security defects in the source code of a medical system. Background Technology

[0002] With the rapid development of medical informatization and the widespread application of various medical systems, medical information systems are becoming increasingly complex, and the security vulnerabilities in their source code are also increasing accordingly. The security of the source code of medical systems is crucial to ensuring the security of patient data and the reliability of medical services. Once security vulnerabilities are exploited, they may lead to serious consequences such as the leakage of sensitive medical data, system malfunction, or malicious control.

[0003] Traditional security testing of medical system source code mainly relies on manual auditing and static analysis tools, which match potential security issues through preset rule bases. However, this approach is clearly insufficient when dealing with complex code logic and multi-module interactions. Modern medical systems often contain a large number of third-party components and complex data processing flows, making the detection and remediation of security vulnerabilities even more difficult.

[0004] Existing security defect detection technologies still suffer from several drawbacks. They lack a deep understanding of code semantics and execution context, leading to numerous false positives and false negatives. They are unable to accurately identify security defects in complex interactive environments, effectively analyze security risks in complex dependencies, and lack targeted analysis capabilities for potential risks in medical-specific business logic and sensitive data processing procedures. They are also unable to form a complete risk propagation path tracing system and lack a comprehensive assessment of new security risks and system compatibility issues that may be introduced after remediation. Consequently, they cannot guarantee the effectiveness of remediation and the overall security of the system. Summary of the Invention

[0005] This invention provides a method and system for intelligent detection and repair of security defects in the source code of a medical system, which can at least solve some of the problems existing in the prior art.

[0006] A first aspect of this invention provides a method for intelligent detection and repair of security defects in the source code of a medical system, comprising: The source code files of the medical system are obtained and semantic parsing is performed based on the abstract syntax structure parsing rules to determine the code logic dependencies and construct a code dependency graph. The association patterns between nodes in the code dependency graph are analyzed and a set of key nodes is determined. For each node in the set of key nodes, bidirectional tracing and contextual semantic analysis are performed along the predecessor and successor paths corresponding to the current node in the code dependency graph to determine the security defect triggering conditions and generate defect detection results. Based on the defect detection results, the location of the defect node is determined and the corresponding local topology is extracted. An initial repair sequence corresponding to the local topology is generated based on the semantic reasoning mechanism, and the code dependency graph is repaired to obtain an optimized dependency graph. In the optimized dependency graph, newly added dependency conflict nodes and newly added control flow loops are identified and the set of affected nodes is determined. The upstream dependency path and downstream influence path corresponding to each node in the set of affected nodes are extracted from the optimized dependency graph, and the complete conflict propagation chain is determined. The complete conflict propagation chain is analyzed and key cutting nodes are identified by graph cut algorithm, and dependency reconstruction operation is generated. The dependency reconstruction operation is applied to the optimized dependency graph to obtain the optimal dependency graph and execute the code modification instructions.

[0007] In one alternative implementation, The process involves obtaining the source code files of the medical system and performing semantic analysis based on abstract syntactic structure parsing rules to determine code logical dependencies and construct a code dependency graph, including: Lexical and syntactic analysis are performed on the source code file of the medical system to generate an abstract syntax tree, and a symbol table is constructed based on the abstract syntax tree. The abstract syntax tree is traversed using a depth-first traversal algorithm. The current access node is obtained and its semantic type is identified to determine the node type. The scope is resolved according to the symbol table, and the declaration node corresponding to the variable reference in the current access node is determined. Based on the declaration node, the data flow path is traced back in the abstract syntax tree to locate the variable assignment source node. The code dependency graph is initialized, and a data dependency edge from the assignment source node to the current access node is established in the code dependency graph. Determine whether the node type of the currently accessed node is a function call type. If so, locate the definition node of the called function in the abstract syntax tree based on inter-procedural analysis technology, extract the parameter list and return statement node of the called function based on the definition node, and establish inter-procedural dependency edges. Determine whether the node type of the currently accessed node is a control flow type. If so, extract the corresponding conditional expression and parse the variable references in the conditional expression. Based on the variable references, establish control flow dependency edges. Repeatedly access and build edges to obtain the completed code dependency graph.

[0008] In one alternative implementation, The association patterns between nodes in the code dependency graph are analyzed to determine a set of key nodes. For each node in the set of key nodes, bidirectional tracing and contextual semantic analysis are performed along the predecessor and successor paths corresponding to the current node in the code dependency graph to determine the security defect triggering conditions and generate defect detection results, including: The code dependency graph is traversed to extract the connection edges between nodes and construct a node adjacency matrix. The eigenvector centrality of the node adjacency matrix is ​​calculated to obtain the centrality score of each node and candidate nodes are determined. The semantic labels of the candidate nodes are extracted, and candidate nodes that are semantically labeled as receiving external data or accessing sensitive resources are constructed as key nodes to build a set of key nodes. The random node in the set of key nodes is taken as the current node, and the external input node is identified by reverse path search in the code dependency graph. The taint source tracing chain is constructed based on the data dependency edge in the propagation path from the external input node to the current node. The sensitive operation node is identified by forward path search along the outgoing edge direction of the current node. The condition node corresponding to the control flow dependency edge is extracted in the propagation path between the current node and the sensitive operation node to construct the condition constraint chain and determine the output influence range. The taint source tracing chain and the condition constraint chain are merged and analyzed to determine whether a complete propagation link is formed. If so, the judgment expression of the condition node is extracted from the condition constraint chain and solved in reverse to determine the path reachability constraint condition and construct the security defect trigger condition. The current node, the corresponding complete propagation link and the security defect trigger condition are encapsulated to obtain the defect detection result.

[0009] In one alternative implementation, Based on the defect detection results, the location of the defect node is determined and the corresponding local topology is extracted. An initial repair sequence corresponding to the local topology is generated based on a semantic reasoning mechanism, and the code dependency graph is repaired to obtain an optimized dependency graph, including: The defect node identifier is parsed from the defect detection results and the defect node is located in the code dependency graph based on the defect node identifier. The local topology is obtained by performing subgraph extraction within a controlled range with the current defect node as the anchor point and identifying the typical defect pattern corresponding to the current defect node through graph isomorphism calculation. The semantic annotation of each node in the local topology is extracted and converted into a semantic vector. The topological features corresponding to the typical defect pattern are concatenated with the semantic vector, and logical reasoning is performed to determine the root cause of the defect. The defect impact path is extracted from the defect root cause. According to the pre-acquired security defect triggering conditions, the matching repair scheme is retrieved from the preset repair strategy library to determine the repair operation primitive. The path coverage of the repair operation primitive to the defect impact path is calculated, and the repair intervention point is marked in the local topology based on the path coverage. An initial repair sequence is generated based on the repair intervention point and the repair operation primitive. The initial repair sequence is subjected to symbolic verification and graph completeness verification. If both pass, the initial repair sequence is marked as a compliant sequence, and the node attribute is rewritten or the edge relationship is reconstructed based on the compliant sequence to obtain an optimized dependency graph.

[0010] In one alternative implementation, In the optimized dependency graph, newly added dependency conflict nodes and newly added control flow loops are identified, and the set of affected nodes is determined, including: Incremental topology analysis is performed on the optimized dependency graph to identify new dependency edges and extract semantic annotations of source nodes and target nodes in the new dependency edges. The data generation time is determined based on the semantic annotations of the source nodes, and the data consumption time is inferred based on the semantic annotations of the target nodes. It is determined whether the data generation time is later than the data consumption time and the time-inverted dependency edges are identified. The source nodes are extracted from the time-inverted dependency edges and marked as new dependency conflict nodes. The control flow edges in the optimized dependency graph are extracted and a control flow subgraph is constructed. Strongly connected components are identified in the control flow subgraph and basic loops are extracted through loop refinement decomposition. If the basic loop does not exist in the code dependency graph, the basic loop is marked as a new control flow loop and the covered nodes are extracted as the loop influence domain. Starting from the newly added dependency conflict node, a bidirectional reachability analysis is performed in the optimized dependency graph to determine the forward reachable node and the backward reachable node and perform a union operation to obtain the conflict propagation domain. The corresponding variable modification operations are extracted for the nodes in the loop influence domain and it is determined whether they affect the loop exit condition. If they do, the current node is marked as the loop critical node. The intersection operation of the loop influence domain and the conflict propagation domain is performed to obtain the overlapping affected nodes. The loop critical nodes and the overlapping affected nodes are merged and removed to obtain the set of affected nodes.

[0011] In one alternative implementation, Extracting the upstream dependency path and downstream influence path corresponding to each node in the set of affected nodes from the optimized dependency graph and determining the complete conflict propagation chain, the graph cut algorithm is used to analyze the complete conflict propagation chain, identify key cutting nodes, and generate dependency reconstruction operations, including: For each node in the set of affected nodes, in the optimized dependency graph, starting from the current node, a complete path sequence from the current node to the data source is determined to obtain the upstream dependency path. Starting from the current node, a complete path sequence from the current node to the data endpoint is determined to obtain the downstream influence path. The upstream dependency path and the downstream influence path are concatenated to obtain a complete conflict propagation chain. The data flow and dependency strength of each edge in the complete conflict propagation chain are calculated and each edge is assigned an edge weight. A weighted subgraph is constructed based on the edge weights and minimum cut calculation is performed to obtain a cut set. The cut edges are extracted from the cut set and mapped to the optimized dependency graph. The source node and target node corresponding to the cut edge are determined. The middleness value and proximity value of the source node and the target node in the complete conflict propagation chain are calculated and weighted to obtain the severing efficiency. The node with the highest severing efficiency is selected as the key severing node. The incoming and outgoing edges of the key severing node are determined. The flow features corresponding to the incoming and outgoing edges are extracted respectively, and decoupling analysis is performed based on the flow features. According to the decoupling analysis results, it is determined whether there is an alternative path between the incoming and outgoing edges. If there is, an edge deletion instruction is generated. If not, a node splitting instruction is generated. The edge deletion instruction and the node splitting instruction are combined to obtain the dependency reconstruction operation.

[0012] In one alternative implementation, Applying the dependency refactoring operation to the optimized dependency graph to obtain the optimal dependency graph and executing code modification instructions includes: The dependency reconstruction operation is parsed and edge deletion instructions and node splitting instructions are extracted. For the edge deletion instructions, the corresponding edge is located in the optimized dependency graph and the edge is removed. For the node splitting instructions, the corresponding node is located in the optimized dependency graph and decomposed into multiple child nodes. The edge removal and node decomposition are repeated until the dependency reconstruction operation is completed, and the optimal dependency graph is obtained. The nodes in the optimal dependency graph are traversed, and the semantic information and dependency relationship corresponding to each node are extracted to generate the corresponding code statement structure. The optimal dependency graph and the optimized dependency graph are compared to identify the difference nodes. The code semantic structure corresponding to the difference nodes is extracted and mapped to the code modification instructions. The medical system source code file is modified based on the code modification instructions.

[0013] A second aspect of this invention provides an intelligent detection and repair system for security flaws in medical system source code, comprising: The graph construction module is used to obtain the source code files of the medical system and perform semantic parsing based on the abstract syntactic structure parsing rules to determine the code logical dependencies and construct a code dependency graph. The defect detection module is used to analyze the association patterns between nodes in the code dependency graph and determine the set of key nodes. For each node in the set of key nodes, bidirectional tracing and contextual semantic analysis are performed along the predecessor and successor paths corresponding to the current node in the code dependency graph to determine the security defect triggering conditions and generate defect detection results. The repair and optimization module is used to determine the location of the defect node and extract the corresponding local topology based on the defect detection result, generate the initial repair sequence corresponding to the local topology based on the semantic reasoning mechanism, and repair the code dependency graph to obtain an optimized dependency graph. In the optimized dependency graph, newly added dependency conflict nodes and newly added control flow loops are identified and the set of affected nodes is determined. The conflict resolution module is used to extract the upstream dependency path and downstream influence path corresponding to each node in the set of affected nodes in the optimized dependency graph and determine the complete conflict propagation chain. It analyzes the complete conflict propagation chain using a graph cut algorithm to identify key cutting nodes and generate dependency reconstruction operations. The dependency reconstruction operations are applied to the optimized dependency graph to obtain the optimal dependency graph and execute code modification instructions.

[0014] A third aspect of the present invention provides an electronic device, comprising: A processor and a memory for storing processor-executable instructions, wherein the processor is configured to invoke instructions stored in the memory to perform the aforementioned method.

[0015] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0016] In this invention, by constructing a code dependency graph to analyze the source code of a medical system, precise location and intelligent detection of security defects are achieved. This effectively identifies security risks in the code, improving the accuracy and coverage of security defect detection. By employing bidirectional tracing and contextual semantic analysis techniques, combined with local topological structure analysis of defective nodes, a deep understanding of the code logic can be achieved, generating targeted remediation solutions. This solves the problem that traditional methods cannot handle complex dependency relationships, improving the quality and applicability of remediation solutions. By identifying key cutoff nodes and refactoring dependencies, automatic identification and resolution of new problems added during the remediation process are achieved, ensuring that no new security vulnerabilities are introduced during the remediation process, and significantly improving the overall security and reliability of the medical system. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating the intelligent detection and repair method for security defects in the source code of a medical system according to an embodiment of the present invention. Figure 2 This is a flowchart illustrating the dependency graph optimization process of the intelligent detection and repair method for security defects in the source code of a medical system according to an embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0020] Figure 1 This is a flowchart illustrating the intelligent detection and repair method for security defects in the source code of a medical system according to an embodiment of the present invention. Figure 1 As shown, the method includes: The source code files of the medical system are obtained and semantic parsing is performed based on the abstract syntax structure parsing rules to determine the code logic dependencies and construct a code dependency graph. The association patterns between nodes in the code dependency graph are analyzed and a set of key nodes is determined. For each node in the set of key nodes, bidirectional tracing and contextual semantic analysis are performed along the predecessor and successor paths corresponding to the current node in the code dependency graph to determine the security defect triggering conditions and generate defect detection results. Based on the defect detection results, the location of the defect node is determined and the corresponding local topology is extracted. An initial repair sequence corresponding to the local topology is generated based on the semantic reasoning mechanism, and the code dependency graph is repaired to obtain an optimized dependency graph. In the optimized dependency graph, newly added dependency conflict nodes and newly added control flow loops are identified and the set of affected nodes is determined. The upstream dependency path and downstream influence path corresponding to each node in the set of affected nodes are extracted from the optimized dependency graph, and the complete conflict propagation chain is determined. The complete conflict propagation chain is analyzed and key cutting nodes are identified by graph cut algorithm, and dependency reconstruction operation is generated. The dependency reconstruction operation is applied to the optimized dependency graph to obtain the optimal dependency graph and execute the code modification instructions.

[0021] In one alternative implementation, The process involves obtaining the source code files of the medical system and performing semantic analysis based on abstract syntactic structure parsing rules to determine code logical dependencies and construct a code dependency graph, including: Lexical and syntactic analysis are performed on the source code file of the medical system to generate an abstract syntax tree, and a symbol table is constructed based on the abstract syntax tree. The abstract syntax tree is traversed using a depth-first traversal algorithm. The current access node is obtained and its semantic type is identified to determine the node type. The scope is resolved according to the symbol table, and the declaration node corresponding to the variable reference in the current access node is determined. Based on the declaration node, the data flow path is traced back in the abstract syntax tree to locate the variable assignment source node. The code dependency graph is initialized, and a data dependency edge from the assignment source node to the current access node is established in the code dependency graph. Determine whether the node type of the currently accessed node is a function call type. If so, locate the definition node of the called function in the abstract syntax tree based on inter-procedural analysis technology, extract the parameter list and return statement node of the called function based on the definition node, and establish inter-procedural dependency edges. Determine whether the node type of the currently accessed node is a control flow type. If so, extract the corresponding conditional expression and parse the variable references in the conditional expression. Based on the variable references, establish control flow dependency edges. Repeatedly access and build edges to obtain the completed code dependency graph.

[0022] Lexical and syntactic analysis are performed on the source code files of a medical system. Taking the user login module of a hospital's patient information management system as an example, which includes patient data access control logic, lexical analysis scans the character stream in the source code file to identify lexical units such as keywords, identifiers, operators, and delimiters. For the login verification code snippet `boolean isValid = validateCredentials(username, password)`, lexical analysis identifies "boolean" as the type keyword, "isValid", "username", and "password" as identifiers, and "validateCredentials" as the function name. Syntactic analysis organizes the lexical units into a hierarchical abstract syntax tree according to the syntax rules of the programming language. For the aforementioned code snippet, the syntax analysis constructs an assignment statement node, with variable declaration nodes on the left and function call nodes on the right.

[0023] After generating the abstract syntax tree, a symbol table is constructed to record various identifiers and their attribute information in the program. The symbol table is implemented using a hash table, where the key is the identifier name and the value is information such as the identifier's type, scope, and declaration location. In the patient information management system, the symbol table records information such as "username" being a string variable with a local scope, declared on line 45 of the LoginController.java file; and "validateCredentials" being a function that returns a boolean value, defined on line 78 of the AuthenticationService.java file.

[0024] The abstract syntax tree is traversed using a depth-first traversal algorithm, starting from the entry function of the login module. When the control flow statement if(isValid){accessPatientRecords(userId);} is encountered, the current access node is obtained and identified as a control flow node. Subsequently, the access condition expression "isValid" is identified as a variable reference node.

[0025] For nodes containing variable references, scope resolution is performed based on the symbol table to determine the declaration node corresponding to the variable reference. In this embodiment, the declaration position of the "isValid" variable is located a few lines before the current function. After determining the declaration node, the data flow path is traced back in the abstract syntax tree to locate the node from which the variable's value is assigned. Tracing the "isValid" variable reveals that its value originates from the return value of the "validateCredentials" function.

[0026] After completing variable reference analysis, the code dependency graph was initialized, and data dependency edges were established in the graph from the "validateCredentials" function call node to the "isValid" variable reference node. This indicates that the login validation result directly affects subsequent patient record access control.

[0027] Subsequently, the "validateCredentials" node was determined to be a function call type. Using inter-procedural analysis techniques, the definition node of the called function was located, finding the function definition in the AuthenticationService.java file. Analysis of the function's internal implementation revealed that it uses a simple string comparison for password verification: `return storedPassword.equals(password)`. After locating the function definition node, extract the parameter list and return statement node of the called function. For the "validateCredentials" function, extract its parameters "username", "password" and return value type "boolean" to establish inter-process dependency edges in the code dependency graph from the function call point in the login controller to the function definition in the authentication service, establish parameter mapping edges from actual parameters to formal parameters, and establish return value dependency edges from the return statement to the call point.

[0028] Determine if the "if(isValid)" node is a control flow type, extract the conditional expression "isValid", and parse the variable references within it. Based on these variable references, establish a control flow dependency edge from "isValid" to "accessPatientRecords(userId)" within the conditional statement block, indicating that patient records can only be accessed after successful authentication.

[0029] Continuing with the depth-first traversal, when the "accessPatientRecords" function call node is reached, inter-process analysis is performed again. The function is located in the PatientDataService.java file, and its implementation is: public void accessPatientRecords(String userId){User user=userRepository.findById(userId); if(user!=null){List <patientrecord>records=patientRecordRepository.findAll();displayRecords(records);}} Analysis of the aforementioned functions revealed a serious access control flaw: the system directly accesses all patient records after obtaining the user's information without performing permission level checks. Code dependency graph analysis showed that while the system implemented login verification, it lacked user role-based access control when retrieving patient records, allowing any logged-in user to access all patient data.

[0030] The depth-first traversal continues processing the "displayRecords" function call. Through inter-process analysis, it was discovered that the aforementioned function directly sends patient records to the front-end for display, including sensitive medical diagnostic information and personal identification information, and the data is not encrypted during transmission: public void displayRecords(List <patientrecord>The code establishes data dependency edges in the code dependency graph, from database query results to data display functions, thus fully tracing the flow path of sensitive data.

[0031] In this embodiment, by introducing inter-process analysis into the dependency graph construction process and establishing cross-function parameter and return value dependency edges at function call points, the actual data transmission paths and side effect relationships between functions can be revealed, significantly enhancing the ability to trace cross-process data flow. Parsing conditional expressions and establishing control flow dependency edges ensures that the constructed code dependency graph contains both data dependency and control dependency information, supporting more refined analysis of data reachability and sensitive data flow under conditional constraints. This more accurately reflects the actual execution semantics, reduces misjudgments of unreachable paths, and helps improve the accuracy of static detection and reduce the cost of manual review.

[0032] In one alternative implementation, The association patterns between nodes in the code dependency graph are analyzed to determine a set of key nodes. For each node in the set of key nodes, bidirectional tracing and contextual semantic analysis are performed along the predecessor and successor paths corresponding to the current node in the code dependency graph to determine the security defect triggering conditions and generate defect detection results, including: The code dependency graph is traversed to extract the connection edges between nodes and construct a node adjacency matrix. The eigenvector centrality of the node adjacency matrix is ​​calculated to obtain the centrality score of each node and candidate nodes are determined. The semantic labels of the candidate nodes are extracted, and candidate nodes that are semantically labeled as receiving external data or accessing sensitive resources are constructed as key nodes to build a set of key nodes. The random node in the set of key nodes is taken as the current node, and the external input node is identified by reverse path search in the code dependency graph. The taint source tracing chain is constructed based on the data dependency edge in the propagation path from the external input node to the current node. The sensitive operation node is identified by forward path search along the outgoing edge direction of the current node. The condition node corresponding to the control flow dependency edge is extracted in the propagation path between the current node and the sensitive operation node to construct the condition constraint chain and determine the output influence range. The taint source tracing chain and the condition constraint chain are merged and analyzed to determine whether a complete propagation link is formed. If so, the judgment expression of the condition node is extracted from the condition constraint chain and solved in reverse to determine the path reachability constraint condition and construct the security defect trigger condition. The current node, the corresponding complete propagation link and the security defect trigger condition are encapsulated to obtain the defect detection result.

[0033] After constructing the code dependency graph, the graph structure needs to be traversed to extract the connecting edges between nodes and construct a node adjacency matrix. The adjacency matrix is ​​represented by a two-dimensional array of size n×n, where n is the total number of nodes in the graph. The element value aij in the matrix indicates whether there is an edge from node i to node j; if it exists, it is assigned a value of 1, and if it does not exist, it is assigned a value of 0. For the code dependency graph of the medical system login module, the generated adjacency matrix contains the data dependency relationship from the credential verification function call node to the verification result variable node, as well as the control flow dependency relationship from the verification result variable to the patient record access function call.

[0034] After constructing the adjacency matrix, eigenvector centrality is calculated to obtain the centrality score of each node. The eigenvector centrality calculation employs a power-law iteration method, iteratively calculating the principal eigenvectors of the adjacency matrix, initializing the centrality score of each node to 1, and then iteratively updating. In each iteration, the new score of a node equals the sum of the scores of its connected nodes, and the scores are normalized after each iteration. The calculation results for the medical system code dependency graph show that the centrality score of the validation outcome variable node is 0.72, the score of the access patient record function node is 0.68, and the score of the display record function node is 0.65, indicating that the validation outcome variable occupies a core position in the entire dependency relationship and has a significant impact on the behavior of the medical system.

[0035] Candidate nodes are determined based on centrality scores. For example, nodes with scores exceeding a preset threshold of 0.6 are selected as candidates. In the aforementioned medical system example, the validation result variable, the function for accessing patient records, and the function for displaying records are all selected as candidate nodes. Semantic annotations are extracted from the candidate nodes. In the medical system, semantic annotations include information such as node type, data operation type, and resource access type. The semantic annotation for the validation result variable is "control variable," the semantic annotation for the function for accessing patient records is "accessing sensitive resources: patient medical records," and the semantic annotation for the function for displaying records is "data outsourcing: front-end display." Candidate nodes semantically labeled as receiving external data or accessing sensitive resources are selected as key nodes, forming a set of key nodes. In the aforementioned example, the function for accessing patient records and the function for displaying records are identified as key nodes.

[0036] The "Access Patient Records" function node is randomly selected from the set of key nodes as the current node. A reverse path search is performed along the incoming edges in the code dependency graph to identify external input nodes. The reverse search uses a depth-first traversal algorithm, starting from the current node and traversing back to the source nodes corresponding to all its incoming edges. The search results show that the input sources of the current node include verification result variables and user identifier parameters. Further backtracking reveals that the user identifier comes from the login request input parameters, belonging to an external input node. Based on the data dependency edges in the propagation path from the external input node to the current node, a taint source tracing chain is constructed. In the example, the tracing chain is "Login Request Parameters → Username / Password Variables → Verification Credential Function → Verification Result Variables → Access Patient Records Function", indicating that the external input data, after authentication, affects access to patient records. An input context for the current node is generated, containing the data source received by the current node and the transformation operations along its propagation path. The input context records the complete path of the user identifier parameter after login verification to the Access Patient Records function.

[0037] A forward path search is performed along the outgoing edges of the current node, using a breadth-first search algorithm to visit all target nodes corresponding to its outgoing edges. The search results identify the sensitive operation node "Display Record Function," which sends sensitive patient medical data to the front end for display. In the propagation path from the current node to the sensitive operation node, condition nodes corresponding to control flow dependency edges are extracted. No additional condition nodes were found in the previous example, indicating that once the patient record access function is called, the display record operation will be executed unconditionally. A condition constraint chain is constructed based on the condition nodes, and the output impact range is determined. In this embodiment, due to the lack of condition constraints, the condition constraint chain is empty, and the output impact range includes the complete medical records of all patients.

[0038] The taint source tracing chain and condition constraint chain are merged and analyzed to determine whether a complete propagation path has been formed. A complete propagation path refers to the complete path from the external input node through the current node to the sensitive operation node. In the example, a complete propagation path is formed: "login request parameters → verification result variable → access patient record function → display record function". The judgment expressions of the condition nodes are extracted from the condition constraint chain and solved in reverse to determine the path reachability constraints. Since the condition constraint chain in the example is empty, the constraint obtained by inverse solution is only "verification result is true", that is, as long as the user passes login verification, they can access all patient records and display sensitive medical data. The security flaw trigger condition is constructed as "any user successfully logs into the system". The current node, the corresponding complete propagation path, and the security flaw trigger condition are encapsulated to obtain the flaw detection result.

[0039] In this embodiment, by introducing centrality analysis into the code dependency graph and combining it with semantic annotation to filter key nodes, high-risk locations that may involve external data input and access to sensitive resources can be identified more efficiently. This significantly improves the accuracy and coverage of key point location, reduces interference from irrelevant nodes, and enhances the focus of subsequent analysis. By performing bidirectional path search on key nodes in both reverse and forward directions, the actual execution logic of potential defect triggering scenarios can be more comprehensively reflected, reducing the probability of false positives and false negatives and improving the credibility of detection results. After the propagation link is formed, the judgment expression of the condition node is solved in reverse, transforming the combination logic of complex conditions into directly interpretable path reachability constraints. This automatically constructs clear security defect triggering conditions, greatly improving the efficiency of problem location and the targeted nature of remediation.

[0040] In one alternative implementation, Based on the defect detection results, the location of the defect node is determined and the corresponding local topology is extracted. An initial repair sequence corresponding to the local topology is generated based on a semantic reasoning mechanism, and the code dependency graph is repaired to obtain an optimized dependency graph, including: The defect node identifier is parsed from the defect detection results and the defect node is located in the code dependency graph based on the defect node identifier. The local topology is obtained by performing subgraph extraction within a controlled range with the current defect node as the anchor point and identifying the typical defect pattern corresponding to the current defect node through graph isomorphism calculation. The semantic annotation of each node in the local topology is extracted and converted into a semantic vector. The topological features corresponding to the typical defect pattern are concatenated with the semantic vector, and logical reasoning is performed to determine the root cause of the defect. The defect impact path is extracted from the defect root cause. According to the pre-acquired security defect triggering conditions, the matching repair scheme is retrieved from the preset repair strategy library to determine the repair operation primitive. The path coverage of the repair operation primitive to the defect impact path is calculated, and the repair intervention point is marked in the local topology based on the path coverage. An initial repair sequence is generated based on the repair intervention point and the repair operation primitive. The initial repair sequence is subjected to symbolic verification and graph completeness verification. If both pass, the initial repair sequence is marked as a compliant sequence, and the node attribute is rewritten or the edge relationship is reconstructed based on the compliant sequence to obtain an optimized dependency graph.

[0041] The defect node identifier is parsed from the defect detection results, and a unique identifier for each node is extracted. For a medical system access control defect, the parsed defect node identifier is "accessPatientRecords", which points to the patient record access function. Based on this identifier, the defect node is located in the code dependency graph. The node position is found through the graph indexing mechanism, and the node for accessing patient records in the PatientDataService.java file is located.

[0042] Using the current defect node as the anchor point, a controlled subgraph extraction is performed to obtain the local topology. The subgraph extraction employs a finite-step hop algorithm, starting from the defect node and traversing three hops forward and three hops backward to extract associated nodes and edges. In the aforementioned medical system example, the extracted local topology includes verification result variable nodes, defect nodes, display record function nodes, and their interconnecting edges, forming a small connected subgraph. Typical defect patterns corresponding to the current defect node are identified through graph isomorphism computation, and the VF2 graph matching algorithm is used to compare the local topology with a predefined defect pattern library. The calculation results show that the current local topology has a similarity of 0.92 with the "missing permission check" defect pattern. This defect pattern is characterized by the lack of user role-based permission verification before sensitive operations.

[0043] Semantic annotations for each node in the local topology are extracted and converted into semantic vectors. Node semantic annotations include information such as function purpose, parameter type, and return value type. The semantic annotation for the function accessing patient records is "Sensitive resource access: patient medical data; Parameter: user identifier; No permission to check". A pre-trained word embedding model is used to convert the text annotations into 200-dimensional semantic vectors, with each dimension representing the strength of a specific semantic feature. The converted semantic vectors form a dense representation in the semantic space, capturing the semantic attributes of the nodes. Topological features corresponding to typical defect patterns are concatenated with the semantic vectors. The topological features include graph structure attributes such as node degree distribution, centrality index, and edge type statistics, forming a joint feature representation.

[0044] Logical reasoning is used to determine the root cause of the defect, and a rule-based reasoning engine is employed to analyze the cascading results of features. For the aforementioned healthcare system example, the reasoning results show that the root cause is "the lack of a user role-based permission check mechanism before accessing sensitive patient medical data, resulting in any authenticated user being able to access all patient data, violating the principle of least privilege and data isolation requirements." The defect impact path is extracted from the root cause, identifying the propagation chain from the root cause node to potential impact nodes. In the example, the defect impact path is "verify result variable → access patient record function → display record function → front-end data display," indicating that this defect can lead to the leakage of sensitive patient medical data.

[0045] Based on pre-obtained security flaw trigger conditions, matching remediation solutions are retrieved from a pre-defined remediation policy library. For the trigger condition "any user successfully logs into the system," the matching remediation policy retrieved is "implement role-based access control," which includes the corresponding remediation template and parameter configuration. Remediation operation primitives are determined; these are the basic operational units of the remediation policy, including node insertion, edge relationship modification, and conditional statement enhancement. In the example, the determined remediation operation primitives are "insert user role check condition node" and "add data filtering operation." The path coverage of the remediation operation primitives on the flaw-affected paths is calculated. Coverage is calculated based on the proportion of paths that the remediation operation can block or control. The path coverage in the aforementioned example reaches 0.87, indicating that the remediation operation can effectively control most paths in the data access flow.

[0046] Based on path coverage, repair intervention points are identified in the local topology, selecting locations that maximize path coverage. In the aforementioned medical system example, the identified repair intervention point is located at the entry point of the function accessing patient records, i.e., between the verification result variable and the access function. An initial repair sequence is generated based on the repair intervention point and repair operation primitives. This repair sequence is a set of ordered code modification instructions. The generated initial repair sequence contains four instructions: obtaining the current user object, extracting user role attributes, setting access filter conditions based on role type, and querying patient records based on the filter conditions.

[0047] Symbolic execution verification is performed on the initial repair sequence. This simulates the code execution process using abstract interpretation techniques to check whether the repaired code logic meets expected behavior. The symbolic execution engine simulates scenarios where different user roles access patient records. For example, it verifies that doctors can only access data of patients under their care, nurses can only access patient vital sign data during their shifts, and administrators can only access non-medical diagnostic information. Graph completeness verification is then performed to ensure that the repair sequence does not disrupt the structural integrity of the code dependency graph. Completeness verification confirms that the repair will not introduce new dependency issues or break existing functionality through node reachability analysis and edge consistency checks.

[0048] After all verifications pass, the initial repair sequence is marked as a compliant sequence. Based on the compliant sequence, the node attributes or edge relationships of the code dependency graph are rewritten or reconstructed to obtain an optimized dependency graph. Specific modifications include: adding a security attribute marker to the node accessing the patient record function to indicate that access control has been implemented for this node; adding a filtering marker to the data dependency edge between the node and the display record function to indicate that the data flow has been filtered; and adding a control dependency edge from user role attributes to access filtering conditions to establish a relationship between roles and data access scope.

[0049] In this embodiment, by extracting subgraphs from defect nodes based on defect detection results and combining them with graph isomorphism recognition of typical defect patterns, the structured context in which the defect exists can be quickly located while maintaining local semantic integrity. This significantly improves the efficiency and accuracy of defect type classification, helps to accurately lock problem patterns in complex code structures and reduce mismatches. By concatenating the topological features of defect patterns with node semantic vectors and performing logical reasoning, the root cause of the defect can be automatically deduced from multi-dimensional cross-information, revealing the true mechanism of defect generation more deeply, making root cause location more accurate and more interpretable. Further, the defect impact path is extracted from the defect root cause, and a repair solution is automatically matched from the repair strategy library based on trigger conditions. This makes the repair process targeted and automatable, improving the accuracy of repair solution selection and the degree of automation of the repair process, and reducing repair deviations caused by insufficient human experience.

[0050] In one alternative implementation, In the optimized dependency graph, newly added dependency conflict nodes and newly added control flow loops are identified, and the set of affected nodes is determined, including: Incremental topology analysis is performed on the optimized dependency graph to identify new dependency edges and extract semantic annotations of source nodes and target nodes in the new dependency edges. The data generation time is determined based on the semantic annotations of the source nodes, and the data consumption time is inferred based on the semantic annotations of the target nodes. It is determined whether the data generation time is later than the data consumption time and the time-inverted dependency edges are identified. The source nodes are extracted from the time-inverted dependency edges and marked as new dependency conflict nodes. The control flow edges in the optimized dependency graph are extracted and a control flow subgraph is constructed. Strongly connected components are identified in the control flow subgraph and basic loops are extracted through loop refinement decomposition. If the basic loop does not exist in the code dependency graph, the basic loop is marked as a new control flow loop and the covered nodes are extracted as the loop influence domain. Starting from the newly added dependency conflict node, a bidirectional reachability analysis is performed in the optimized dependency graph to determine the forward reachable node and the backward reachable node and perform a union operation to obtain the conflict propagation domain. The corresponding variable modification operations are extracted for the nodes in the loop influence domain and it is determined whether they affect the loop exit condition. If they do, the current node is marked as the loop critical node. The intersection operation of the loop influence domain and the conflict propagation domain is performed to obtain the overlapping affected nodes. The loop critical nodes and the overlapping affected nodes are merged and removed to obtain the set of affected nodes.

[0051] Incremental topology analysis was performed on the optimized dependency graph. By comparing the structural differences between the original and optimized dependency graphs, newly added dependency edges were identified. In the aforementioned example, the newly added dependency edges included control dependency edges from user role nodes to access filter condition nodes, and data dependency edges from access filter condition nodes to patient record query nodes. Semantic annotations were extracted for the source and target nodes in the newly added dependency edges. The semantic annotation for user role nodes was "User attribute: Role identifier; Read time: Immediately after login". The semantic annotation for access filter condition nodes was "Conditional expression: Role judgment; Execution time: Before patient data access". The semantic annotation for patient record query nodes was "Data query: With conditional filtering; Execution time: Before display".

[0052] The data generation time is determined based on the semantic annotation of the source node, and the time attribute field in the semantic annotation is parsed. The data generation time of the user role node is "immediately after login", and the data generation time of the access filter condition node is "before patient data access". The data consumption time is inferred based on the semantic annotation of the target node. The data consumption time of the access filter condition node is "before patient data access", and the data consumption time of the patient record query node is "before display". It is determined whether the data generation time is later than the data consumption time by comparing the order relationship of the time attributes. In this embodiment, the temporal relationship between the nodes is correct, and no temporally reversed dependency edges are found. If temporally reversed dependency edges exist, such as the case where medical equipment configuration is consumed before generation, the source node needs to be extracted and marked as a newly added dependency conflict node.

[0053] Control flow edges are extracted from the dependency graph and a control flow subgraph is constructed. These edges represent branching and jumping relationships in the program execution path. In the aforementioned medical system example, control flow edges include conditional execution edges from verifying result variables to accessing patient record functions, and branching control edges from user role determination to different data query paths. Strongly connected components are identified in the control flow subgraph, and a depth-first search using the Tarjan algorithm is employed to identify loop structures. One strongly connected component is detected in the example, corresponding to a loop structure in the patient data traversal display. Basic loops are extracted through loop refinement decomposition, breaking down complex loops into indivisible basic loop structures. The extracted basic loop is "get patient record → traverse record → format data → send to frontend → get next record". Compared with the original code dependency graph, this basic loop already exists in the original graph and is therefore not marked as a new control flow loop.

[0054] In other healthcare system repair cases, if a new control flow loop is detected, such as "obtain user role → determine role permissions → filter data according to permissions → record access logs → check quotas → obtain user role", this loop is marked as a new control flow loop, and the covered nodes are extracted as the loop's influence domain. The loop's influence domain includes user role nodes, permission determination nodes, data filtering nodes, access log nodes, and quota check nodes. Starting from the newly added dependency conflict node, bidirectional reachability analysis is performed in the optimized dependency graph. Since no dependency conflict node was detected in this example, the repair intervention point is used as the starting node for analysis. Forward reachability analysis uses breadth-first search, traversing along the graph edges to determine all nodes that can be affected by the starting node. The determined forward reachable nodes include patient record query nodes, data filtering nodes, and display record function nodes. Backward reachability analysis traverses along the graph edges in the reverse direction to determine all nodes that can affect the starting node, including validation result variable nodes and user role nodes. Perform a union operation on the forward reachable nodes and the backward reachable nodes to obtain the conflict propagation domain, which includes all nodes that are directly or indirectly related to the starting node.

[0055] For nodes in the loop's influence domain, extract corresponding variable modification operations and analyze the nodes' read and write behavior. Check that the quota node modifies the user access count variable and the data filtering node modifies the visible record set variable. Determine whether these variable modification operations affect the loop exit condition by using static analysis to determine the relationship between the variables and the loop condition expression. Check that the quota node's variable modification does not affect the loop exit condition, while the data filtering node's modification affects the size of the visible record set, thus affecting the number of loop iterations; therefore, the data filtering node is marked as a critical loop node. Perform an intersection operation between the loop's influence domain and the conflict propagation domain to obtain overlapping affected nodes. In the current medical system example, overlapping affected nodes include user role nodes, permission judgment nodes, and data filtering nodes. Merge and deduplicate the critical loop nodes and overlapping affected nodes to obtain a set of affected nodes, including data filtering nodes, user role nodes, and permission judgment nodes.

[0056] During the source code security vulnerability repair process, incremental topology analysis can effectively assess the impact of repair operations on the code structure and promptly identify potential dependency conflicts and control flow changes. For the security repair of the prescription generation module, incremental analysis revealed new data dependency edges from the patient health status node to the drug dosage calculation node, and control dependency edges from the drug maximum dosage limit node to the dosage comparison function. These modifications added patient health status checks and dosage cap control to the prescription generation process, effectively preventing the risk of overdose. The analysis did not find any time-inverted dependency edges, but it detected a new control flow loop: "Read patient record → Check medication history → Determine drug interactions → Update medication recommendations → Record medication decisions → Read patient record".

[0057] In this embodiment, by performing incremental topology analysis on the optimized dependency graph and focusing on identifying newly added dependency edges, rapid perception of changes in the updated graph structure is achieved, significantly reducing computational overhead and improving timeliness. Control flow edges are extracted and control flow subgraphs are constructed. By identifying strongly connected components and performing loop refinement decomposition, newly added loop structures can be automatically discovered. This effectively identifies implicit loops introduced by dependency reconstruction, improving the coverage of control flow integrity verification. By extracting nodes covered by newly added control flow loops to form loop influence domains, and combining this with bidirectional reachability analysis of newly added dependency conflict nodes to obtain conflict propagation domains, the composite risks caused by data dependency anomalies and control flow changes can be captured simultaneously. This helps to identify structural defects that may lead to performance degradation, infinite loops, or unreachable logic in advance.

[0058] Figure 2 This is a flowchart illustrating the dependency graph optimization process of the intelligent detection and repair method for security defects in the source code of a medical system according to an embodiment of the present invention.

[0059] In one alternative implementation, Extracting the upstream dependency path and downstream influence path corresponding to each node in the set of affected nodes from the optimized dependency graph and determining the complete conflict propagation chain, the graph cut algorithm is used to analyze the complete conflict propagation chain, identify key cutting nodes, and generate dependency reconstruction operations, including: For each node in the set of affected nodes, in the optimized dependency graph, starting from the current node, a complete path sequence from the current node to the data source is determined to obtain the upstream dependency path. Starting from the current node, a complete path sequence from the current node to the data endpoint is determined to obtain the downstream influence path. The upstream dependency path and the downstream influence path are concatenated to obtain a complete conflict propagation chain. The data flow and dependency strength of each edge in the complete conflict propagation chain are calculated and each edge is assigned an edge weight. A weighted subgraph is constructed based on the edge weights and minimum cut calculation is performed to obtain a cut set. The cut edges are extracted from the cut set and mapped to the optimized dependency graph. The source node and target node corresponding to the cut edge are determined. The middleness value and proximity value of the source node and the target node in the complete conflict propagation chain are calculated and weighted to obtain the severing efficiency. The node with the highest severing efficiency is selected as the key severing node. The incoming and outgoing edges of the key severing node are determined. The flow features corresponding to the incoming and outgoing edges are extracted respectively, and decoupling analysis is performed based on the flow features. According to the decoupling analysis results, it is determined whether there is an alternative path between the incoming and outgoing edges. If there is, an edge deletion instruction is generated. If not, a node splitting instruction is generated. The edge deletion instruction and the node splitting instruction are combined to obtain the dependency reconstruction operation.

[0060] For each node in the affected node set, the complete path sequence from the current node to the data source is determined in the optimized dependency graph, starting from the current node. Taking the data filtering node in the medical system as an example, by traversing the dependency graph in reverse, the upstream dependency path from the data filtering node to the user role node is determined, which includes "data filtering node → role judgment node → user role node". This upstream dependency path indicates that the data filtering operation depends on user role information, forming the basis of data security control. Starting from the current node, the complete path sequence from the current node to the data endpoint is determined to obtain the downstream impact path. The downstream impact path of the data filtering node is "data filtering node → patient record query node → record formatting node → front-end display node". This downstream impact path indicates that the data filtering operation affects the patient record content ultimately displayed to the user.

[0061] The complete conflict propagation chain is obtained by concatenating the upstream dependency path and the downstream influence path. For the data filtering node, the complete conflict propagation chain is "User Role Node → Role Judgment Node → Data Filtering Node → Patient Record Query Node → Record Formatting Node → Front-end Display Node". The complete conflict propagation chain describes the complete data flow from user role information to the final displayed result. The data flow and dependency strength of each edge in the complete conflict propagation chain are calculated. The data flow is estimated through static code analysis, statistically analyzing the size of the data object and its flow frequency. The dependency strength is quantified by call frequency and data coupling. For example, the edge weight from the user role node to the role judgment node is 0.8, indicating a high dependency; the edge weight from the data filtering node to the patient record query node is 0.9, indicating an extremely high dependency; and the edge weight from the record formatting node to the front-end display node is 0.5, indicating a moderate dependency.

[0062] A weighted subgraph is constructed based on edge weights, and minimum cut calculation is performed. The Ford-Fulkerson algorithm is used to calculate the minimum cut from the data source to the data endpoint, finding the minimum set of edges to be removed to cut the data flow. In the aforementioned medical system example, the calculated cut set contains two edges: "role judgment node → data filtering node" and "data filtering node → patient record query node". The cut edges are extracted from the cut set and mapped to the optimization dependency graph to determine the source and target nodes corresponding to the cut edges. The source node of the first cut edge is the role judgment node, and the target node is the data filtering node; the source node of the second cut edge is the data filtering node, and the target node is the patient record query node.

[0063] The median and proximity values ​​of the source and target nodes in the complete conflict propagation chain are calculated. The median value measures the degree to which a node acts as a bridge in the network, calculated as the proportion of shortest paths passing through the node with the median value to the total number of shortest paths. The median value of the data filter node is 0.8, indicating that the node is in a core position in the data flow. The proximity value measures the average distance between the node and other nodes, reflecting the efficiency of information propagation. The proximity value of the data filter node is 0.75, indicating that the node can efficiently connect upstream and downstream components. The median and proximity values ​​are weighted and fused to obtain the cutoff efficiency, with a weight ratio of 0.6 for median value and 0.4 for proximity value. This weighting can be adjusted according to actual needs. The calculation results show that the cutoff efficiency of the data filter node is 0.78, higher than other nodes; therefore, the data filter node is selected as the key cutoff node.

[0064] Identify the inbound and outbound edges of key cutoff nodes. Inbound edges of data filtering nodes are dependency edges from role judgment nodes to data filtering nodes, carrying role judgment result information; outbound edges are dependency edges from data filtering nodes to patient record query nodes, carrying filtering condition information. Extract the flow features corresponding to the inbound and outbound edges respectively. The inbound flow feature is "judgment result: Boolean type; control flow type; frequency: per access", and the outbound flow feature is "filtering condition: string array; data flow type; frequency: per query". Perform decoupling analysis based on the flow features to evaluate whether the dependency relationship between inbound and outbound edges can be achieved through other methods. The analysis shows that the role judgment result can be converted into a query condition string without having to go through the data filtering node.

[0065] Based on the decoupling analysis results, it is determined whether there are alternative paths between the incoming and outgoing edges. In the medical system, it was found that an alternative path could be created directly from the role judgment node to the patient record query node, bypassing the data filtering node and simplifying the data flow structure. Since an alternative path exists, an edge deletion instruction is generated: "Delete the dependent edge from the data filtering node to the patient record query node," and a new instruction is added: "Create a direct dependent edge from the role judgment node to the patient record query node." If no alternative path exists, a node splitting instruction is generated. For example, for the drug compatibility check node, analysis shows that it simultaneously handles two unrelated functions: drug compatibility checking and dosage calculation, which cannot be decoupled through an alternative path. Therefore, a node splitting instruction is generated: "Split the drug compatibility check node into a drug compatibility check node and a dosage calculation node."

[0066] Combining edge deletion and node splitting instructions yields dependency refactoring operations. In the aforementioned healthcare system example, the generated dependency refactoring operations include: "deleting the data filtering node and its related dependency edges; creating a direct dependency edge from the role judgment node to the patient record query node; modifying the patient record query function interface to directly receive the role judgment result as a query parameter." These dependency refactoring operations are automatically converted into specific code modification instructions using static code analysis tools, including function signature changes, parameter passing adjustments, and intermediate function removal.

[0067] In this embodiment, by constructing upstream dependency paths and downstream impact paths for the affected node set and splicing them into a complete conflict propagation chain, the complete propagation process of data from source to destination can be presented at the link level, significantly improving the coverage of the conflict propagation range. This ensures that the identification of risk links is more comprehensive and accurate, without omitting important intermediate nodes or key dependencies. By calculating the data flow and dependency strength of each edge in the propagation chain and assigning weights, and then performing minimum cut operation on the weighted subgraph to identify cut sets, the most critical breakpoints can be automatically located. This allows for finding the dependency breakpoint with the minimum cost in a globally optimal sense, making conflict elimination more accurate and less costly. At the same time, it avoids the risk of system function damage caused by mistakenly deleting key dependencies. The cut edges in the cut set are mapped back to the optimized dependency graph, and their source and target nodes are extracted. Then, by combining the betweenness value and proximity value to construct a comprehensive cut-off efficiency, the structural importance of nodes in the propagation chain can be accurately evaluated. This allows for more accurate identification of nodes that truly play a key role in blocking the propagation chain, improving the pertinence and effectiveness of the repair strategy.

[0068] In one alternative implementation, Applying the dependency refactoring operation to the optimized dependency graph to obtain the optimal dependency graph and executing code modification instructions includes: The dependency reconstruction operation is parsed and edge deletion instructions and node splitting instructions are extracted. For the edge deletion instructions, the corresponding edge is located in the optimized dependency graph and the edge is removed. For the node splitting instructions, the corresponding node is located in the optimized dependency graph and decomposed into multiple child nodes. The edge removal and node decomposition are repeated until the dependency reconstruction operation is completed, and the optimal dependency graph is obtained. The nodes in the optimal dependency graph are traversed, and the semantic information and dependency relationship corresponding to each node are extracted to generate the corresponding code statement structure. The optimal dependency graph and the optimized dependency graph are compared to identify the difference nodes. The code semantic structure corresponding to the difference nodes is extracted and mapped to the code modification instructions. The medical system source code file is modified based on the code modification instructions.

[0069] The dependency refactoring operation is parsed and edge deletion instructions and node splitting instructions are extracted. The dependency refactoring operation consists of a series of atomic operations. Taking the patient data access control module in the aforementioned medical system as an example, the extracted edge deletion instructions include "delete the dependency edge from the data filter node to the patient record query node" and "delete the dependency edge from the role judgment node to the data filter node"; the node splitting instruction is "split the data filter node into a permission filter node and a data range filter node".

[0070] For edge deletion instructions, the corresponding edge is located in the optimized dependency graph and its removal is performed. The edge to be deleted is located using its identifier or a combination of the source and target nodes. In the patient data access control module, the dependency edge from the data filter node to the patient record query node is located; this edge identifier is "edge_filter_to_query_157". The edge removal operation is performed, deleting the edge object from the graph data structure and updating the outgoing and incoming edge sets of the relevant nodes. After edge removal, the outgoing edge set of the data filter node no longer contains the edge to the patient record query node, and the incoming edge set of the patient record query node is also updated accordingly, severing the direct dependency between the data filter node and the patient record query node.

[0071] For node splitting instructions, the corresponding node is located in the optimized dependency graph and decomposed into multiple child nodes. After locating the data filtering node, it is split according to its functional responsibility boundaries, creating two new nodes: an access control filtering node and a data range filtering node. These nodes inherit the semantic annotations related to access control and data range from the original data filtering node. The semantic annotation of the access control filtering node is "Filtering type: Access control; Execution stage: Before data access; Security level: High". The semantic annotation of the data range filtering node is "Filtering type: Data range limitation; Execution stage: During data query; Security level: Medium". The inbound and outbound edges of the data filtering node are reallocated. The inbound edge from the role judgment node to the data filtering node is redirected to the access control filtering node. The internal responsibility edges of the original data filtering node are connected to the corresponding child nodes.

[0072] The edge removal and node decomposition operations are repeated until the dependency reconstruction operation is completed, resulting in the optimal dependency graph. In the aforementioned medical system case, the dependency reconstruction operation was completed after three edge removal operations and one node splitting operation. In the optimal dependency graph, the dependency structure of the patient data access control module has changed significantly: the role judgment node is directly connected to the patient record query node, the permission filtering node only handles permission control logic, and the data range filtering node independently handles data range limitation logic, forming a clear separation of responsibilities structure.

[0073] The system iterates through the nodes in the optimal dependency graph, extracts the semantic information and dependencies for each node, and generates the corresponding code statement structure. For the role judgment node, its semantic information is extracted as follows: "Judgment type: role permission; Result type: boolean; Key operation: compare user role with resource access level". The dependency relationship is "Input: user role information; Output: permission judgment result; Direct impact: patient record query". Based on the above information, the code statement structure is generated as follows: "Determine whether the user role has permission to access patient records. If permission is granted, directly call the patient record query function and pass in the role level parameter". This is converted into a specific code snippet: "boolean hasPermission = checkUserRole(currentUser.getRole(), requiredAccessLevel); if (hasPermission) { patientRecords = queryPatientRecords(patientId, currentUser.getRole());}".

[0074] The optimal dependency graph and the optimized dependency graph are compared to identify discrepancy nodes. A graph structure comparison algorithm is used to identify changes in the node and edge sets. In the aforementioned medical system case, discrepancy nodes include: removed data filtering nodes, newly added permission filtering nodes and data range filtering nodes, role judgment nodes with changed connection relationships, and patient record query nodes. Discrepancy edges include removed data filtering-related edges and newly added direct dependency edges.

[0075] Extract the semantic structure of the code corresponding to the difference nodes and map the semantic structure to code modification instructions. For the removed data filtering node, its semantic structure is "function: filterPatientData; function: filter patient data according to user role; input: original patient data set and user role; output: filtered patient data set", which is mapped to the deletion instruction: "delete the filterPatientData function and its call". For the newly added direct dependency, the semantic structure is "function call: directly query patient records from role judgment; parameter passing: use role information as query parameters", which is mapped to the modification instruction: "modify the queryPatientRecords function signature, add the userRole parameter; implement role-based data filtering logic inside the function".

[0076] Modifications to the medical system's source code files are executed based on code modification instructions. The code modification process utilizes abstract syntax tree operations to achieve precise code transformation. Taking the patient record query function as an example, the original code contains a security flaw: "public List..." <patientrecord>queryPatientRecords(String patientId){List <patientrecord>The code snippet `allRecords=patientDao.getAllRecords(patientId); return filterPatientData(allRecords, currentUser.getRole());` places access control after data retrieval, which poses a risk of excessive exposure of sensitive data in memory.

[0077] After executing the modification command, the code becomes: "public List <patientrecord>The modified code moves permission checks forward, applying access conditions directly during the database query phase. This avoids the risk of unauthorized data being loaded into memory and resolves the security flaws in the original code.

[0078] In this embodiment, by parsing the dependency refactoring operation and executing edge deletion and node splitting according to instructions, the dependency adjustment process can be strictly implemented according to the optimal refactoring scheme obtained from the previous analysis. This ensures the controllability, consistency, and semantic correctness of dependency refactoring, avoids logical damage caused by accidental deletion of key dependencies or accidental decomposition of nodes, and thus significantly improves the reliability of dependency structure optimization. By iteratively executing edge removal and node decomposition until the operation is completed, the graph gradually approaches the structure with the least conflict and the optimal path. This ensures the stability of the structure at each step, greatly improving the safety and final quality of dependency optimization. By traversing the optimal dependency graph and extracting node semantics and dependency relationships to generate corresponding code statement structures, the graph-level structure can be accurately mapped back to the code level. This achieves a natural linkage between dependency structure optimization and source code repair, improves the feasibility of automatic repair, and reduces the cost required for manual understanding of the differences between graph structure and code semantics.

[0079] A second aspect of this invention provides an intelligent detection and repair system for security flaws in the source code of a medical system, comprising: The graph construction module is used to obtain the source code files of the medical system and perform semantic parsing based on the abstract syntactic structure parsing rules to determine the code logical dependencies and construct a code dependency graph. The defect detection module is used to analyze the association patterns between nodes in the code dependency graph and determine the set of key nodes. For each node in the set of key nodes, bidirectional tracing and contextual semantic analysis are performed along the predecessor and successor paths corresponding to the current node in the code dependency graph to determine the security defect triggering conditions and generate defect detection results. The repair and optimization module is used to determine the location of the defect node and extract the corresponding local topology based on the defect detection result, generate the initial repair sequence corresponding to the local topology based on the semantic reasoning mechanism, and repair the code dependency graph to obtain an optimized dependency graph. In the optimized dependency graph, newly added dependency conflict nodes and newly added control flow loops are identified and the set of affected nodes is determined. The conflict resolution module is used to extract the upstream dependency path and downstream influence path corresponding to each node in the set of affected nodes in the optimized dependency graph and determine the complete conflict propagation chain. It analyzes the complete conflict propagation chain using a graph cut algorithm to identify key cutting nodes and generate dependency reconstruction operations. The dependency reconstruction operations are applied to the optimized dependency graph to obtain the optimal dependency graph and execute code modification instructions.

[0080] A third aspect of the present invention provides an electronic device, comprising: A processor and a memory for storing processor-executable instructions, wherein the processor is configured to invoke instructions stored in the memory to perform the aforementioned method.

[0081] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0082] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.< / patientrecord> < / patientrecord> < / patientrecord> < / patientrecord> < / patientrecord>

Claims

1. A method for intelligent detection and repair of security defects in medical system source code, characterized in that, include: The source code files of the medical system are obtained and semantic parsing is performed based on the abstract syntactic structure parsing rules to determine the code logical dependencies and construct a code dependency graph. The association patterns between nodes in the code dependency graph are analyzed and a set of key nodes is determined. For each node in the set of key nodes, bidirectional tracing and contextual semantic analysis are performed along the predecessor and successor paths corresponding to the current node in the code dependency graph to determine the security defect triggering conditions and generate defect detection results. Based on the defect detection results, the location of the defect node is determined and the corresponding local topology is extracted. An initial repair sequence corresponding to the local topology is generated based on the semantic reasoning mechanism, and the code dependency graph is repaired to obtain an optimized dependency graph. In the optimized dependency graph, newly added dependency conflict nodes and newly added control flow loops are identified and the set of affected nodes is determined. Extract the upstream dependency path and downstream influence path corresponding to each node in the set of affected nodes in the optimized dependency graph and determine the complete conflict propagation chain. Analyze the complete conflict propagation chain using a graph cut algorithm, identify key cutting nodes and generate dependency reconstruction operations. Apply the dependency reconstruction operations to the optimized dependency graph to obtain the optimal dependency graph and execute it as a code modification instruction. Extracting the upstream dependency path and downstream influence path corresponding to each node in the set of affected nodes from the optimized dependency graph and determining the complete conflict propagation chain, the graph cut algorithm is used to analyze the complete conflict propagation chain, identify key cutting nodes, and generate dependency reconstruction operations, including: For each node in the set of affected nodes, in the optimized dependency graph, starting from the current node, a complete path sequence from the current node to the data source is determined to obtain the upstream dependency path. Starting from the current node, a complete path sequence from the current node to the data endpoint is determined to obtain the downstream influence path. The upstream dependency path and the downstream influence path are concatenated to obtain a complete conflict propagation chain. The data flow and dependency strength of each edge in the complete conflict propagation chain are calculated and each edge is assigned an edge weight. A weighted subgraph is constructed based on the edge weights and minimum cut calculation is performed to obtain a cut set. The cut edges are extracted from the cut set and mapped to the optimized dependency graph. The source node and target node corresponding to the cut edge are determined. The middleness value and proximity value of the source node and the target node in the complete conflict propagation chain are calculated and weighted to obtain the severing efficiency. The node with the highest severing efficiency is selected as the key severing node. The incoming and outgoing edges of the key severing node are determined. The flow features corresponding to the incoming and outgoing edges are extracted respectively, and decoupling analysis is performed based on the flow features. According to the decoupling analysis results, it is determined whether there is an alternative path between the incoming and outgoing edges. If there is, an edge deletion instruction is generated. If there is no alternative path, a node splitting instruction is generated. The edge deletion instruction and the node splitting instruction are combined to obtain the dependency reconstruction operation.

2. The method according to claim 1, characterized in that, The process involves obtaining the source code files of the medical system and performing semantic analysis based on abstract syntactic structure parsing rules to determine code logical dependencies and construct a code dependency graph, including: Lexical and syntactic analysis are performed on the source code file of the medical system to generate an abstract syntax tree, and a symbol table is constructed based on the abstract syntax tree. The abstract syntax tree is traversed using a depth-first traversal algorithm. The current access node is obtained and its semantic type is identified to determine the node type. The scope is resolved according to the symbol table, and the declaration node corresponding to the variable reference in the current access node is determined. Based on the declaration node, the data flow path is traced back in the abstract syntax tree to locate the variable assignment source node. The code dependency graph is initialized, and a data dependency edge from the assignment source node to the current access node is established in the code dependency graph. Determine whether the node type of the currently accessed node is a function call type. If so, locate the definition node of the called function in the abstract syntax tree based on inter-procedural analysis technology, extract the parameter list and return statement node of the called function based on the definition node, and establish inter-procedural dependency edges. Determine whether the node type of the currently accessed node is a control flow type. If so, extract the corresponding conditional expression and parse the variable references in the conditional expression. Based on the variable references, establish control flow dependency edges. Repeatedly access and build edges to obtain the completed code dependency graph.

3. The method according to claim 1, characterized in that, The association patterns between nodes in the code dependency graph are analyzed to determine a set of key nodes. For each node in the set of key nodes, bidirectional tracing and contextual semantic analysis are performed along the predecessor and successor paths corresponding to the current node in the code dependency graph to determine the security defect triggering conditions and generate defect detection results, including: The code dependency graph is traversed to extract the connection edges between nodes and construct a node adjacency matrix. The eigenvector centrality of the node adjacency matrix is ​​calculated to obtain the centrality score of each node and candidate nodes are determined. The semantic labels of the candidate nodes are extracted, and candidate nodes that are semantically labeled as receiving external data or accessing sensitive resources are constructed as key nodes to build a set of key nodes. The random node in the set of key nodes is taken as the current node, and the external input node is identified by reverse path search in the code dependency graph. The taint source tracing chain is constructed based on the data dependency edge in the propagation path from the external input node to the current node. The sensitive operation node is identified by forward path search along the outgoing edge direction of the current node. The condition node corresponding to the control flow dependency edge is extracted in the propagation path between the current node and the sensitive operation node to construct the condition constraint chain and determine the output influence range. The taint source tracing chain and the condition constraint chain are merged and analyzed to determine whether a complete propagation link is formed. If so, the judgment expression of the condition node is extracted from the condition constraint chain and solved in reverse to determine the path reachability constraint condition and construct the security defect trigger condition. The current node, the corresponding complete propagation link and the security defect trigger condition are encapsulated to obtain the defect detection result.

4. The method according to claim 1, characterized in that, Based on the defect detection results, the location of the defect node is determined and the corresponding local topology is extracted. An initial repair sequence corresponding to the local topology is generated based on a semantic reasoning mechanism, and the code dependency graph is repaired to obtain an optimized dependency graph, including: The defect node identifier is parsed from the defect detection results and the defect node is located in the code dependency graph based on the defect node identifier. The local topology structure is obtained by performing subgraph extraction within a controlled range with the current defect node as the anchor point and identifying the typical defect pattern corresponding to the current defect node through graph isomorphism calculation. The semantic annotation of each node in the local topology structure is extracted and converted into a semantic vector. The topological features corresponding to the typical defect pattern are concatenated with the semantic vector, and logical reasoning is performed to determine the root cause of the defect. The defect impact path is extracted from the defect root cause. According to the pre-acquired security defect triggering conditions, the matching repair scheme is retrieved from the preset repair strategy library to determine the repair operation primitive. The path coverage of the repair operation primitive to the defect impact path is calculated, and the repair intervention point is marked in the local topology based on the path coverage. An initial repair sequence is generated based on the repair intervention point and the repair operation primitive. The initial repair sequence is subjected to symbolic verification and graph completeness verification. If both pass, the initial repair sequence is marked as a compliant sequence, and the node attribute is rewritten or the edge relationship is reconstructed based on the compliant sequence to obtain an optimized dependency graph.

5. The method according to claim 1, characterized in that, In the optimized dependency graph, newly added dependency conflict nodes and newly added control flow loops are identified, and the set of affected nodes is determined, including: Incremental topology analysis is performed on the optimized dependency graph to identify new dependency edges and extract semantic annotations of source nodes and target nodes in the new dependency edges. The data generation time is determined based on the semantic annotations of the source nodes, and the data consumption time is inferred based on the semantic annotations of the target nodes. It is determined whether the data generation time is later than the data consumption time and the time-inverted dependency edges are identified. The source nodes are extracted from the time-inverted dependency edges and marked as new dependency conflict nodes. The control flow edges in the optimized dependency graph are extracted and a control flow subgraph is constructed. Strongly connected components are identified in the control flow subgraph and basic loops are extracted through loop refinement decomposition. If the basic loop does not exist in the code dependency graph, the basic loop is marked as a new control flow loop and the covered nodes are extracted as the loop influence domain. Starting from the newly added dependency conflict node, a bidirectional reachability analysis is performed in the optimized dependency graph to determine the forward reachable node and the backward reachable node and perform a union operation to obtain the conflict propagation domain. The corresponding variable modification operations are extracted for the nodes in the loop influence domain and it is determined whether they affect the loop exit condition. If they do, the current node is marked as the loop critical node. The intersection operation of the loop influence domain and the conflict propagation domain is performed to obtain the overlapping affected nodes. The loop critical nodes and the overlapping affected nodes are merged and deduplicated to obtain the set of affected nodes.

6. The method according to claim 1, characterized in that, Applying the dependency refactoring operation to the optimized dependency graph to obtain the optimal dependency graph and executing it as a code modification instruction includes: The dependency reconstruction operation is parsed and edge deletion instructions and node splitting instructions are extracted. For the edge deletion instructions, the corresponding edge is located in the optimized dependency graph and the edge is removed. For the node splitting instructions, the corresponding node is located in the optimized dependency graph and decomposed into multiple child nodes. The edge removal and node decomposition are repeated until the dependency reconstruction operation is completed, and the optimal dependency graph is obtained. The nodes in the optimal dependency graph are traversed, and the semantic information and dependency relationship corresponding to each node are extracted to generate the corresponding code statement structure. The optimal dependency graph is compared with the optimized dependency graph to identify the difference nodes. The code semantic structure corresponding to the difference nodes is extracted and mapped to the code modification instructions. The medical system source code file is modified based on the code modification instructions.

7. A medical system source code security defect intelligent detection and repair system, used to implement the method of any one of claims 1-6, characterized in that, include: The graph construction module is used to obtain the source code files of the medical system and perform semantic parsing based on the abstract syntactic structure parsing rules to determine the code logical dependencies and construct a code dependency graph. The defect detection module is used to analyze the association patterns between nodes in the code dependency graph and determine the set of key nodes. For each node in the set of key nodes, bidirectional tracing and contextual semantic analysis are performed along the predecessor and successor paths corresponding to the current node in the code dependency graph to determine the security defect triggering conditions and generate defect detection results. The repair and optimization module is used to determine the location of the defect node and extract the corresponding local topology based on the defect detection result, generate the initial repair sequence corresponding to the local topology based on the semantic reasoning mechanism, and repair the code dependency graph to obtain an optimized dependency graph. In the optimized dependency graph, newly added dependency conflict nodes and newly added control flow loops are identified and the set of affected nodes is determined. The conflict resolution module is used to extract the upstream dependency path and downstream influence path corresponding to each node in the set of affected nodes in the optimized dependency graph and determine the complete conflict propagation chain. The complete conflict propagation chain is analyzed by a graph cut algorithm to identify key cutting nodes and generate dependency reconstruction operations. The dependency reconstruction operations are applied to the optimized dependency graph to obtain the optimal dependency graph and executed as code modification instructions.

8. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 6.

Images