Software security vulnerability detection method based on static analysis and runtime tracking

Abstract

The application discloses a software security vulnerability detection method based on static analysis and runtime tracking, and relates to the technical field of vulnerability detection, and comprises the following steps: collecting content change conditions of external input data corresponding to different time slices, and constructing continuous semantic mapping records based on semantic differences of the same external input data presented in each time slice; gradually associating and calibrating semantic states of the same external input data corresponding to each time slice according to the continuous semantic mapping records, embedding the semantic state of the previous time slice into the semantic state of the next time slice for progressive comparison, and forming a semantic continuity relationship throughout the propagation process. By establishing the semantic continuity relationship and the dynamic semantic migration track, the application realizes traceability of the semantic change position and mode; and based on the incremental semantic evolution path, synchronous labeling and dynamic updating are performed, and vulnerability determination is performed based on the execution stage semantics, so that the detection accuracy and reliability are improved.

Description

Technical Field

[0001] This invention relates to the field of vulnerability detection technology, specifically to a software security vulnerability detection method based on static analysis and runtime tracing. Background Technology

[0002] Software security vulnerabilities typically refer to defects, omissions, or improper implementations in software design, coding, configuration, interface calls, access control, data processing, or operational mechanisms. Such issues can lead to security risks such as unauthorized access, malicious exploitation, data leakage, privilege escalation, service interruption, code injection, or tampering with control flows under specific conditions. Software security vulnerability detection based on static analysis and runtime tracing refers to a process that, without relying solely on a single detection method, involves two aspects. First, static analysis is performed on source code, binary files, control flow, data flow, function call relationships, and variable propagation paths to identify potential vulnerabilities such as buffer overflows, null pointer dereferences, unauthorized access, dangerous function calls, and missing input validation. Second, runtime tracing is performed during actual software operation, examining program execution paths, memory access behavior, system call processes, exception triggering situations, user input propagation processes, and sensitive operation contexts to identify dynamic risks that are difficult to accurately assess during static analysis. The combination of these two approaches allows for the location of potential vulnerabilities at the overall program structure level and the verification of whether vulnerabilities are actually triggered, their triggering conditions, and their scope of impact at the level of actual execution behavior, thereby improving the accuracy, completeness, and practicality of software security vulnerability detection.

[0003] The existing technology has the following shortcomings: During the propagation of input data, external input data undergoes multiple rounds of cache refresh and intermediate state rewriting in the propagation chain. During this process, the data content structure gradually undergoes compression and semantic folding, causing the same data to present different semantic expressions at different time slices. In the static analysis phase, when making security judgments based on the initial data form, it is easy to identify it as safe input. However, in the actual operation phase, the data, after being cached and evolved, may be re-parsed into dangerous content with instructional attributes or control meanings, causing the original security judgment to fail and triggering hidden vulnerabilities, resulting in a discrepancy between the detection results and the actual execution behavior.

[0004] The information disclosed in the background section is only intended to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this invention is to provide a software security vulnerability detection method based on static analysis and runtime tracing to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a software security vulnerability detection method based on static analysis and runtime tracing, comprising the following steps: To investigate the propagation process of external input data after it enters the program, the changes in the content of the external input data at different time slices are collected, and a continuous semantic mapping record is constructed based on the semantic differences of the same external input data in each time slice, so as to characterize the semantic evolution trajectory of the external input data in the propagation link. Based on the continuous semantic mapping record, the semantic state of the same external input data in each time slice is progressively associated and labeled. The semantic state of the previous time slice is embedded into the semantic state of the next time slice for progressive comparison, forming a semantic succession relationship that runs through the propagation process. Based on semantic continuity, the semantic turning points of external input data in the process of time are marked, and the corresponding semantic transformation direction and change magnitude are recorded each time a semantic shift occurs, so as to obtain a dynamic semantic migration trajectory describing the semantic change process. By using dynamic semantic migration trajectory, the semantic content corresponding to the initial time slice is backtracked and aligned with the semantic state in subsequent time slices. During the alignment process, the implicit change nodes in the semantic evolution path are restored to obtain the incremental semantic evolution path. Based on the incremental semantic evolution path, the current semantic state of external input data is synchronously labeled at key time slice locations, and the semantic state is continuously updated during program execution. Security vulnerabilities are determined based on the semantic state during the execution phase.

[0007] Before runtime tracing, static analysis is performed on the program to be tested to identify external input sources, variable propagation relationships, sensitive execution interfaces and their candidate propagation paths, generating a static candidate risk propagation graph and a static semantic baseline. External input sources include at least network request parameters, form input, interface messages, configuration file input, command line parameters and file read content, and sensitive execution interfaces include at least database execution interfaces, command execution interfaces, script interpretation interfaces, template rendering interfaces, file access interfaces and deserialization entry points. The static semantic baseline is used to characterize the initial category, constraints and expected destination of the input fragment in the program structure before runtime splicing, rewriting and recoding occur.

[0008] Preferably, a continuous semantic mapping record is constructed based on the semantic differences presented by the same external input data in each time slice, including: Using the moment when external input data is received as the initial time slice, the processing behavior involving external input data during program execution is divided into multiple time slices. A unique identifier is assigned to the external input data, and the content presentation, processing operation type, execution location and context information corresponding to each time slice are recorded to form a time-seriesd set of content changes. By combining the time-series content change set, semantic expression state extraction is performed on the external input data content of each time slice, the semantic expression state is bound to the time slice, and the semantic change content between adjacent time slices is marked to construct a semantic expression sequence; By using semantic expression sequences, the semantic expression states of each time slice are sequentially connected, the semantic change types and corresponding content changes are recorded, and a continuous semantic mapping record is formed. By integrating continuous semantic mapping records, the semantic expression states of all time slices are linked together, and the location and content changes of semantic changes are recorded, forming the semantic evolution trajectory of external input data in the propagation link.

[0009] Preferably, semantic expression state extraction includes: combining the context information recorded in each time slice in the time-series content change set, performing semantic expression division on the external input data content, distinguishing the external input data into ordinary text content, control field content and executable statement fragments, binding the corresponding semantic expression state to the time slice, and recording the specific content involved in the semantic changes between adjacent time slices.

[0010] Preferably, the semantic state of the previous time slice is embedded into the semantic state of the next time slice for progressive comparison to form a semantic succession relationship, including: The continuous semantic mapping records are sequentially expanded, the semantic state content corresponding to each time slice is extracted and the position index is retained, and adjacent time slices are paired to form a time slice pairing set, and the semantic state correspondence is established in chronological order. For the time slice pairing set, perform association marking processing, completely copy the semantic state of the previous time slice and embed it into the starting position of the semantic state of the next time slice, add semantic source identifier and retain boundary identifier, forming a combined structure that includes the transmitted semantic content and its own semantic content; Based on the association calibration results, continuous transmission processing is performed, the semantic state of the current time slice is copied as a whole and embedded into the semantic state of the next time slice, the semantic source identifier and boundary identifier are continued, and a semantic embedding chain covering all time slices is constructed. By combining semantic embedding chains for hierarchical annotation, multi-level semantic segments are divided according to the semantic embedding order and labeled with corresponding time slice numbers. The semantic states of each time slice are uniformly integrated to form a semantic continuity relationship that runs through the propagation process.

[0011] Preferably, when performing association labeling processing on the time slice pairing set, the semantic state of the previous time slice is inserted into the starting position of the semantic state of the next time slice according to the original semantic expression order, and semantic source identification information is added at the insertion position. At the same time, a boundary marker is retained between the inserted content and the original semantic content of the next time slice to distinguish the semantic information from different time slice sources.

[0012] Preferably, the direction and magnitude of semantic transformation are recorded and a dynamic semantic migration trajectory is generated, including: Expand the continuous semantic mapping record corresponding to the semantic succession relationship, read the semantic state of each time slice and construct time slice pairs, split the inherited semantic part and the newly added semantic part in the semantic state of the next time slice, locate the semantic change position by aligning segment by segment and bind the time slice number. Perform identification processing on the semantic change location, extract the semantic content before and after the change in the corresponding time slice pair, record the start and end positions of the change, and form a semantic transition node identification record; By combining semantic transition node identifiers with detailed descriptions, new, deleted and replaced content is marked character by character, the direction of semantic transformation is recorded and the magnitude of change is quantified, and semantic change description information is generated. By aggregating semantic change descriptions to form a continuous connection path, connecting each semantic turning point in chronological order, and integrating time position, semantics before change, semantics after change, semantic transformation direction and magnitude, a dynamic semantic migration trajectory is constructed.

[0013] Preferably, the semantic change description information generation process includes: comparing the semantic content before and after the change corresponding to the semantic turning point character by character, marking the added content, deleted content and replaced content, recording the change segments according to the order of character appearance, and recording the semantic conversion direction and change magnitude information in combination with the time slice number corresponding to the semantic turning point.

[0014] Preferably, the reverse backtracking alignment and restoration of latent change nodes to form an incremental semantic evolution path includes: Perform dynamic semantic migration trajectory reverse rearrangement processing, read the semantic state of each time slice one by one and extract the semantic transformation direction and change magnitude information synchronously, divide the semantic source fragments and establish semantic backtracking relationship, and generate reverse semantic association sequence; The reverse semantic association sequence expansion mapping process is adopted. The semantic content of the initial time slice is used as the reference starting point. The semantic state of each time slice is segmented and the corresponding semantic fragments are identified. The unmatched semantic fragments are used as potential change fragments to trace the source step by step, and the change process is recorded to form hidden change nodes. By integrating implicit change nodes and semantic transition nodes, connecting semantic states in chronological order, and recording the semantic content before change, the semantic content after change, the direction of semantic transformation, and the magnitude of change, an incremental semantic evolution path covering all time slices is constructed.

[0015] Preferably, the semantic state update and security vulnerability determination during the execution phase include: Traverse each time slice in the incremental semantic evolution path, filter time slices containing semantic turning points and implicit change points, extract the corresponding semantic states and arrange semantic fragments in order of source time slice number, record source information and position number, and form semantic annotation entries. Embed semantic annotation entries into the corresponding time slice position during program execution, read the semantic record corresponding to the time slice and copy the semantic state of the previous time slice, append the newly added semantic content of the current time slice, and attach the time slice number and position sequence number to form the updated semantic state; Organize and update all semantic fragments in the semantic state, group them according to the source time slice number and mark the corresponding position index, and establish a mapping relationship between the current time slice semantic state and the corresponding semantic record in the incremental semantic evolution path; Extract semantic fragments from the current time slice semantic state, sort them by source time slice number and position index, identify semantic fragments containing control expression content and instruction execution meaning, reconstruct the evolution process by combining semantic evolution path, and perform security vulnerability determination.

[0016] Preferably, extracting semantic segments from the current time slice semantic state and performing security vulnerability determination includes: sorting the semantic segments by source time slice number and position index, marking the semantic segments containing control expression content and instruction execution meaning, and combining the corresponding semantic change records in the incremental semantic evolution path to unfold the formation process of the semantic segments segment by segment, and completing the security vulnerability determination based on the semantic state of the execution stage.

[0017] Preferably, static analysis includes: analyzing the program's control flow graph, data flow graph, function call graph, and variable definition-use chain; identifying network request parameters, form inputs, command line parameters, configuration file content, and file read content as external input sources; and identifying database execution interfaces, command execution interfaces, script interpretation interfaces, template rendering interfaces, file access interfaces, and deserialization entry points as sensitive execution interfaces.

[0018] Preferably, semantic expression state extraction includes: dividing the input content into multiple candidate segments according to preset lexical boundaries, and calculating the ordinary text score, control field score, and executable statement segment score by combining the variable type, function name, concatenation position, target interface type, and adjacent symbol information of the current time slice; when the maximum score is not less than the classification threshold θ1, the candidate segment is marked as the corresponding category.

[0019] Preferably, semantic transformation directions include transformation from plain text to control fields, transformation from plain text to executable statement fragments, transformation from control fields to executable statement fragments, transformation to enhance the internal structure of executable statement fragments, semantically preserving format rewriting transformation, and cleanup / constraint enhancement transformation.

[0020] Preferably, the change magnitude M is calculated by weighting the proportion of character-level edit distance, the proportion of lexical unit change, the category change weight, and the context sensitivity change weight, and is divided into mild change, moderate change, and severe change according to a preset threshold.

[0021] Preferably, the identification of latent change nodes includes: taking the final state segment entering the sensitive execution interface as the backtracking starting point, calculating the combined matching score Q for the candidate segments of the preceding time slice, and identifying the preceding change node as a latent change node when Q is not less than the preset matching threshold θ3 and the preceding segment is not marked as a high-risk node in the forward phase.

[0022] Preferably, the security vulnerability determination adopts a combination of rule matching and risk scoring to determine whether the external input fragment meets the category requirements, risk enhancement direction requirements, sensitive execution interface reach requirements, cleanup missing requirements, and path contribution requirements. When the comprehensive risk score R is not less than the vulnerability determination threshold θ6, the corresponding vulnerability detection result is output.

[0023] The technical effects and advantages provided by the present invention in the above technical solution are as follows: This invention continuously collects the content changes of external input data in different time slices and constructs a continuous semantic mapping record by combining semantic differences. It depicts the semantic evolution trajectory of input data in the propagation link from the time dimension, thereby avoiding the semantic bias problem caused by judging based solely on the initial data form. This enables the detection process to cover the multi-stage changes of input data in the propagation process and improves the ability to perceive potential risk semantics.

[0024] This invention constructs semantic continuity relationships and further forms dynamic semantic migration trajectories, pinpoints semantic turning points, and records the direction and magnitude of semantic transformation. This allows for the identification of the specific location and manner of semantic changes in input data during propagation, making the semantic change process traceable and thereby enhancing the ability to locate hidden semantic risks.

[0025] This invention aligns the incremental semantic evolution path by backtracking and performing semantic state synchronization annotation at key time slice positions. The semantic state is continuously updated during program execution, and the semantic state of the execution phase is used as the basis for security vulnerability judgment. This ensures that the detection results are consistent with the actual execution semantics, reduces the judgment error caused by semantic offset, and improves the accuracy and reliability of vulnerability detection results. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0027] Figure 1 This is a flowchart of the method for detecting software security vulnerabilities based on static analysis and runtime tracing according to the present invention. Detailed Implementation

[0028] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that the description of this disclosure will be more complete and fully convey the concept of the exemplary embodiments to those skilled in the art.

[0029] This invention provides, for example Figure 1 The software security vulnerability detection method based on static analysis and runtime tracing, as shown, includes the following steps: Static analysis is performed on the program to be detected to construct a static candidate risk propagation graph and a static semantic baseline. Specifically: The control flow, data flow, call relationships, and variable definition-usage relationships of the program source code, bytecode, intermediate representation, or binary are analyzed to identify external input source nodes, propagation nodes, and sensitive execution interface nodes. Starting from the external input source node and ending at the sensitive execution interface node, candidate propagation paths that meet the taint propagation conditions are searched to form a static candidate risk propagation graph. At the same time, for each candidate propagation path, the expected data type, allowed character set, expected syntactic role, and target interface type to be entered for variables, object attributes, cache units, and intermediate string construction points are recorded to form a static semantic baseline.

[0030] During the runtime tracing phase, only input identifiers, propagation nodes, and sensitive execution interfaces located in the static candidate risk propagation graph are monitored to narrow the scope of runtime tracing. During semantic state extraction, semantic transformation direction determination, and vulnerability detection, the runtime semantic state of the current time slice is compared with the static semantic baseline. When the runtime semantic state deviates from the static semantic baseline and evolves towards a high-risk semantic direction, the deviation is used as evidence of risk enhancement in subsequent determinations.

[0031] The combination of static analysis and runtime tracing in this invention is specifically reflected in the following three aspects: Firstly, static analysis is used to pre-identify external input sources, candidate propagation paths, and sensitive execution interfaces, providing filtering results for runtime embedding locations; Secondly, the static semantic baseline obtained from static analysis is used to define the expected syntactic role and expected destination of each input segment in the program structure, while runtime tracking is used to identify whether the input segment deviates from the static semantic baseline during actual execution. Third, when determining vulnerabilities, both static candidate risk propagation graphs and runtime incremental semantic evolution paths are used. Only when external input propagates along the static candidate path and forms risk-enhanced semantics at runtime and reaches the sensitive execution interface is it determined to be a target vulnerability.

[0032] Step 1: For the propagation process of external input data after it enters the program, collect the changes in the content of the external input data in different time slices, and construct a continuous semantic mapping record based on the semantic differences of the same external input data in each time slice to characterize the semantic evolution trajectory of the external input data in the propagation link. The following steps are taken to construct a continuous semantic mapping record based on the semantic differences presented by the same external input data in different time slices: In the initial stage after external input data enters the program, the moment the external input data is received is taken as the initial time slice. Each processing action involving the external input data during program execution is divided into subsequent time slices, and a unique identifier is assigned to each external input data for association throughout the entire propagation process. In each time slice, the specific content representation of the external input data is recorded, including the string arrangement, character combination, and the type of processing operation involved in that time slice. At the same time, the execution position and context information corresponding to that time slice are also recorded, such as the processing stage of the data, the processing statements involved, and the specific location where the data is read or written. During the recording process, the external input data content in each time slice is arranged sequentially according to time order to form a continuous content change sequence, and a sequential association relationship is established between adjacent time slices. This allows each content change of the same external input data in the propagation link to be continuously tracked, thereby obtaining a complete time-series content change set. This set not only reflects the content changes of the external input data in different time slices but also retains the specific environmental information of each change.

[0033] After obtaining the time-series content change set, the semantic expression state of the external input data in each time slice is extracted based on the semantic differences presented by the same external input data in each time slice. During the extraction process, the meaning of the external input data in the current time slice is described by combining the context information recorded in the time slice. For example, it is distinguished that the data is presented as ordinary text content, as control field content, or as a statement fragment that can be executed in the current time slice. The semantic expression state is then bound to the corresponding time slice. After the semantic expression state of all time slices is extracted, the semantic expression states of each time slice are connected in chronological order to form a sequential relationship between adjacent time slices. At the same time, the specific content of semantic changes between adjacent time slices is marked, including what semantics have changed to what semantics, and the content changes involved in the transformation. In this way, a semantic expression sequence that runs through all time slices is formed. The semantic expression sequence clearly records the semantic differences presented by the same external input data in different time slices. Then, a continuous semantic mapping record is constructed on the basis of the semantic expression sequence. This continuous semantic mapping record not only contains the semantic expression state corresponding to each time slice, but also contains the specific change relationship of semantic differences between time slices.

[0034] To make semantic expression state extraction feasible, the content of the external input data in the current time slice is fragmented. The input content is divided into multiple candidate fragments according to preset lexical boundaries. Lexical boundaries include at least whitespace, delimiters, quotation marks, parentheses, operators, path delimiters, command connectors, database keyword boundaries, script tag boundaries, and function call boundaries. Furthermore, combined with the execution context information corresponding to the current time slice, a context feature vector is extracted for each candidate fragment. The context feature vector includes at least the following: The information includes the variable type of the fragment, the name of the function to which the fragment belongs, whether the fragment is located at a string concatenation position, whether the fragment flows to the query statement construction position, whether the fragment flows to the command execution interface, whether the fragment flows to the file path resolution position, and the information of adjacent symbols before and after the fragment.

[0035] Based on candidate fragments and context feature vectors, a score for ordinary text, a score for control fields, and a score for executable statement fragments are calculated for each candidate fragment. The score for ordinary text is calculated based on the proportion of natural language characters, the proportion of non-control keywords, and the weight of not entering a sensitive execution context. The score for control fields is calculated based on whether the fragment matches a preset set of control keywords, whether it is located in a parameter name / configuration item / protocol field, and whether it participates in the construction and calculation of flow control expressions. The score for executable statement fragments is calculated based on whether the fragment contains query statement keywords, command keywords, script syntax units, template expressions, function call structures, or whether it is located in the actual parameter position of an interpreted execution interface.

[0036] When a certain category score is the maximum of the three category scores and not less than the preset classification threshold θ1, the candidate fragment is marked as the corresponding category; when all three category scores are less than the classification threshold θ1, the candidate fragment is temporarily classified as ordinary text content; when the difference between the control field score and the executable statement fragment score is less than the fuzzy judgment threshold θ2, a secondary judgment is made in conjunction with the sensitive operation point type obtained in the static analysis stage: if the fragment flows to the query execution point, command execution point, template rendering point, or script interpretation point, it is preferentially marked as an executable statement fragment; otherwise, it is marked as control field content.

[0037] After classifying all candidate segments, the semantic expression state corresponding to the current time slice is generated. The semantic expression state includes at least the following: time slice number, input identifier, segment content, segment start and end positions, segment category, source time slice number, context label, and sensitivity label. The sensitivity label is divided into three levels: low sensitivity, medium sensitivity, and high sensitivity, according to whether the segment flows to a sensitive execution interface. These are used for subsequent semantic change quantification and vulnerability determination.

[0038] After forming a continuous semantic mapping record, all time slices in the record are integrated chronologically. Combining this with the established semantic differences between each pair of adjacent time slices, the semantic changes of external input data in the propagation chain are described segment by segment. During this process, starting from the semantic expression state corresponding to the initial time slice, the semantic expression state transitions sequentially to the semantic expression state of subsequent time slices. The location of the semantic change and the corresponding content changes are clearly recorded at each transition, ensuring that the semantic change path throughout the propagation process is completely connected, forming a continuous semantic evolution trajectory. This trajectory not only preserves the content changes of external input data in different time slices but also fully reflects the continuous semantic mapping record constructed based on the semantic differences presented by the same external input data in each time slice. This allows the semantic evolution trajectory to reflect the entire semantic change process of external input data from entering the program to each stage of the propagation chain, providing a semantic evolution basis consistent with the program execution process for subsequent software security vulnerability detection.

[0039] Step 2: Based on the continuous semantic mapping record, the semantic state of the same external input data in each time slice is progressively associated and labeled. The semantic state of the previous time slice is embedded into the semantic state of the next time slice for progressive comparison, forming a semantic succession relationship that runs through the propagation process. The semantic state of the previous time slice is embedded into the semantic state of the next time slice for progressive comparison, forming a semantic continuity relationship that runs through the propagation process. The specific steps are as follows: Based on the established continuous semantic mapping record, each time slice recorded is processed sequentially according to time order. The semantic state of the same external input data corresponding to each time slice is extracted independently, and each time slice is assigned a consecutive number to ensure a clear sequential relationship between them. During the extraction process, the semantic state content corresponding to each time slice is preserved in complete text form, and the position index of the semantic state in the continuous semantic mapping record is recorded. Adjacent time slices are paired to form time slice pairs. For example, the first time slice and the second time slice form the first pair, the second time slice and the third time slice form the second pair, and so on, forming a pairing set covering all time slices. In this pairing set, each time slice pair contains the semantic state of the previous time slice and the semantic state of the next time slice, and a direct association is established through the position index. This allows the semantic state of the same external input data in different time slices to be read and matched group by group in chronological order, providing a continuous and complete processing object for subsequent progressive association and labeling.

[0040] After obtaining the time-slice pairing set, a stepwise association and labeling process is performed on each time-slice pair. During this process, for the semantic state of the preceding and following time-slice pairs, the semantic state of the preceding time-slice is completely copied and inserted into the starting position of the semantic state of the following time-slice, following the original semantic expression order. Simultaneously, semantic source identification information is added at the insertion position to indicate that this part of the semantic content originates from the preceding time-slice. After the insertion operation is completed, the original semantic state content of the following time-slice is arranged immediately after the inserted semantic content, so that the new semantic state content consists of two parts: the semantic content inherited from the preceding time-slice and the semantic content of the following time-slice itself. During the arrangement process, the order of the two parts is maintained, and a clear boundary marker is retained between the two parts to distinguish the semantic information from different time-slice sources. Through the above processing, the semantic state of the subsequent time slice in each time slice pair contains the semantic state of the previous time slice, thus forming a progressively embedded semantic expression. The processed result is then written back to the corresponding time slice position in the continuous semantic mapping record to complete the progressive association labeling.

[0041] After completing the stepwise association and labeling of all time slice pairs, all time slices in the continuous semantic mapping record are sequentially traversed again. During the traversal, the semantic content already embedded in the preceding semantic state in each time slice is passed on to the next. That is, all the semantic content contained in the current time slice is treated as a whole, copied and inserted into the starting position of the semantic state of the next time slice, and the semantic source identifier and boundary identifier are preserved in the aforementioned manner, so that the semantic embedding relationship continues to extend in the time dimension. In this process, the semantic state of the initial time slice is brought into all subsequent time slices through successive embedding. The subsequent time slices inherit the preceding semantic state and superimpose their own semantic content, so that the semantic state in each time slice contains all the semantic information from the initial time slice to the current time slice. After continuous traversal processing, a semantic embedding chain covering all time slices is formed. In this chain, the time slices are continuously connected through the embedding relationship, thus constructing a complete semantic inheritance path.

[0042] After forming the semantic embedding chain, the chain is organized and uniformly expressed. The semantic states of each time slice in the continuous semantic mapping record are arranged in chronological order. Based on the embedding relationship of semantic content in each time slice, the semantic state of each time slice is hierarchically labeled. The semantic content from different time slices is divided into multiple semantic segments according to their embedding order. At the same time, the corresponding time slice number is labeled on each semantic segment, so that the semantic state in any time slice can be traced back to all the historical semantic sources it contains. After completing the hierarchical labeling, the semantic states of each time slice and their hierarchical relationships are uniformly integrated to form a semantic succession relationship that runs through the propagation process. This semantic succession relationship not only reflects the step-by-step association and labeling process between the semantic states of the same external input data in each time slice, but also presents the continuation process of semantic information in the propagation link in a continuous structural form through the progressive comparison method of embedding the semantic state of the previous time slice into the semantic state of the next time slice. This provides a complete and consistent semantic succession basis for software security vulnerability detection.

[0043] Step 3: Based on the semantic continuity relationship, mark the semantic turning points of the external input data in the process of time progression, and record the corresponding semantic transformation direction and change magnitude when the semantic shift occurs, so as to obtain the dynamic semantic migration trajectory describing the semantic change process. Each time a semantic shift occurs, the corresponding semantic transformation direction and magnitude are recorded to obtain a dynamic semantic migration trajectory describing the semantic change process. The specific steps are as follows: Based on the established semantic continuity, all time slices in the continuous semantic mapping record are linearly expanded in chronological order. The semantic state of the same external input data at each time slice is read sequentially, and adjacent time slices are combined into time slice pairs. In each pair, the semantic state of the preceding and following time slices is presented simultaneously. Based on the semantic embeddings already recorded in the semantic continuity, the semantic parts inherited from the preceding time slice and the newly added semantic parts in the semantic state of the following time slice are separated. During the separation process, the semantic source identifier is used as the dividing criterion. Content marked as inherited in the semantic state of the following time slice is extracted separately and compared segment by segment with the semantic state of the preceding time slice. Content without inheritance identifiers is listed separately as newly added semantic parts. Through segment-by-segment comparison, each content fragment in the newly added semantic part is aligned with its corresponding position in the semantic state of the preceding time slice, thereby locating the specific position where the semantic content changes. Each changed position is bound to the corresponding time slice number, ensuring that each semantic change has a clear temporal and content position identifier.

[0044] After locating each semantic change point, each recorded semantic change point is further processed as a candidate semantic transition node. For each candidate semantic transition node, the relevant semantic content from the semantic state of the previous time slice and the semantic state of the next time slice is extracted and arranged side by side in the original order. During the arrangement process, the semantic content of the corresponding position in the semantic state of the previous time slice is marked as the pre-change semantic, and the semantic content of the corresponding position in the semantic state of the next time slice is marked as the post-change semantic. At the same time, the position range of the semantic change in the overall semantic expression is recorded, including the start position and the end position of the change. In this way, an independent identification record is established for each candidate semantic transition node, which contains the time slice number, the pre-change semantic content, the post-change semantic content, and the change position range. This completes the fixed-point identification of the semantic transition nodes of the external input data in the time process, so that all positions where semantic changes occur are completely recorded in the continuous semantic mapping record.

[0045] After the semantic transition nodes are identified, the specific manifestations of semantic changes are recorded around each semantic transition node. During the recording process, the semantic content before and after the change is compared character by character, with the semantic transition node as the center. Newly added characters, deleted characters, and replaced characters are identified separately, and the changed content is recorded in the order of character appearance. At the same time, the direction of semantic transformation is described based on the distribution of character changes in the overall semantic content. The process of semantic change from the original expression state to the new expression state is fully recorded, such as from ordinary text content to an expression form containing control meaning or from structured expression to an expression form that can participate in execution. The magnitude of change is described in detail, including the number of characters that changed, the proportion of changed characters in the overall content, and the length of the continuous segments involved in the change. This forms a detailed record of the direction and magnitude of semantic transformation corresponding to each semantic shift, and the record is written into the identification entry of the corresponding semantic transition node.

[0046] The semantic transformation direction is represented by a finite-state classification system, which includes at least the following six categories: D1: Convert plain text to control field; D2: Conversion of plain text into executable statement fragments; D3: Convert control fields into executable statement fragments; D4: Enhanced transformation of the internal structure of executable statement fragments; D5: Semantic Preservation Format Rewrite Conversion; D6: Purification / Constraint Enhancement Conversion.

[0047] Among them, D1 to D4 represent the direction of increased risk, D6 represents the direction of decreased risk, and D5 represents the neutral direction where the content structure changes but the risk level remains unchanged.

[0048] The criteria for determining the direction of semantic transformation include at least the following: changes in the category label and sensitivity label of the corresponding segments in the preceding and following time slices; whether new control keywords or execution syntax units are added; whether a higher-risk execution context is entered; and whether new concatenation operations on external input are added. When the category label of the corresponding segment in the following time slice changes from ordinary text to a control field, it is classified as D1; ​​when it changes from ordinary text or a control field to an executable statement segment, it is classified as D2 or D3 respectively; when the category remains unchanged but new bracket levels, quotation closure structures, logical connectors, command separators, or function call units are added, it is classified as D4; when only encoding conversion, escaping rewriting, or format regularization occurs without causing a change in sensitivity level, it is classified as D5; when the sensitivity level decreases after adding filtering, escaping, parameterized binding, or whitelist constraints, it is classified as D6.

[0049] The magnitude of change is calculated using a weighted quantization method, denoted as: M=α×Rchar+β×Rtoken+γ×Rtype+δ×Rctx Where Rchar represents the percentage of character-level edit distance, Rtoken represents the percentage of lexical unit changes, Rtype represents the weight of category changes, and Rctx represents the weight of context sensitivity changes; α, β, γ, and δ are preset weight coefficients, and α+β+γ+δ=1.

[0050] Character-level edit distance percentage Rchar = EditDist(Si, Sj) / MaxLen(Si, Sj); The percentage of lexical unit changes is Rtoken = DiffToken(Si, Sj) / MaxToken(Si, Sj); The category change weight Rtype is assigned a value based on the direction of the category change: 0.4 for control fields corresponding to ordinary text, 0.8 for executable statement fragments corresponding to ordinary text, 0.6 for executable statement fragments corresponding to control fields, and 0 or 0.2 for categories that remain unchanged. The context sensitivity change weight Rctx is assigned a value based on whether the fragment flows to the sensitive execution interface: 0.3 for medium sensitivity corresponding to low sensitivity, 0.6 for high sensitivity corresponding to medium sensitivity, 1.0 for high sensitivity corresponding to low sensitivity, and 0 for no sensitivity.

[0051] Semantic changes are classified according to the magnitude of change, M: slight change is defined as M < 0.30; moderate change is defined as M ≤ M < 0.60; and severe change is defined as M ≥ 0.60. Nodes belonging to D2, D3, or D4 with moderate or severe changes are marked as high-risk semantic inflection nodes for priority analysis in subsequent vulnerability assessment.

[0052] Each change record in the dynamic semantic migration trajectory includes at least: the previous time slice number, the next time slice number, the segment identifier before the change, the segment identifier after the change, the semantic transformation direction Dk, the change magnitude M, the change level, the change location range, and the context event identifier that triggered the change.

[0053] After recording the semantic transition direction and magnitude of all semantic transition nodes, all semantic transition nodes are integrated in chronological order. The record entries corresponding to each semantic transition node are arranged sequentially, and sequential connections are established between each semantic transition node based on the preceding and following relationships between time slices in the semantic succession relationship. During the connection process, the change result of the previous semantic transition node is linked with the change starting point of the next semantic transition node, so that the semantic change process forms a continuous chain in the time dimension. The time position, semantics before change, semantics after change, semantic transition direction, and magnitude of change of each semantic transition node in this chain are uniformly integrated into a continuous recording path, thereby obtaining a dynamic semantic migration trajectory that fully describes the semantic change process. This dynamic semantic migration trajectory covers all semantic changes of external input data from entering the program to each time slice of the propagation link, and maintains the continuous correlation of the semantic states before and after through the semantic succession relationship. It can provide semantic change basis consistent with the actual execution process for software security vulnerability detection.

[0054] Step 4: Use dynamic semantic migration trajectory to backtrack and align the semantic content corresponding to the initial time slice with the semantic state in subsequent time slices. In the alignment process, restore the implicit change nodes in the semantic evolution path to obtain the incremental semantic evolution path. The implicit change nodes in the semantic evolution path are restored during the alignment process to obtain the incremental semantic evolution path. The specific steps are as follows: Based on the established dynamic semantic migration trajectory, all time slices recorded in the trajectory are rearranged in reverse chronological order. The original time slice sequence, arranged chronologically, is transformed into a sequence that gradually regresses from the final time slice to the initial time slice. The semantic state of each time slice is read sequentially in the reverse sequence, while simultaneously reading the semantic transformation direction and magnitude information between the current time slice and its predecessor. During the reading process, all semantic content in the current time slice's semantic state is segmented according to its semantic source. The semantic parts inherited from the previous time slice and those newly added in the current time slice are identified separately. The newly added semantic parts are extracted segment by segment and mapped segment by segment to the corresponding content in the semantic state of the previous time slice. This segment-by-segment mapping establishes a semantic backtracking relationship from the current time slice to the previous time slice. In this semantic backtracking relationship, each segment of semantic content carries its corresponding semantic transformation direction and magnitude information. This allows not only the correspondence between semantic content to be restored during the reverse backtracking process, but also the source and process of each semantic change to be clearly identified, thus forming a reverse semantic association sequence covering all time slices.

[0055] After the reverse semantic association sequence is formed, the semantic content corresponding to the initial time slice is used as a unified reference starting point. The evolution path of this semantic content in subsequent time slices is unfolded and aligned layer by layer. During the alignment process, starting from the semantic content corresponding to the initial time slice, the semantic backtracking relationship established in the reverse semantic association sequence is mapped to the semantic state of each subsequent time slice in turn. In each time slice, all semantic content in the semantic state is decomposed according to the segmentation results formed in the previous step, and semantic fragments that directly correspond to the semantic content of the initial time slice are selected. At the same time, semantic fragments that do not correspond to the semantic content of the initial time slice are removed. Semantic fragments that form a direct correspondence with semantic content are recorded separately as potential change fragments. For these potential change fragments, the semantic transformation direction and change magnitude information recorded in the dynamic semantic migration trajectory are combined to trace their source step by step in reverse time, and their corresponding semantic content in the previous time slice is restored segment by segment. During the restoration process, the change records in each time slice are continuously supplemented, thereby gradually unfolding the semantic change path that was not directly identified in the forward propagation process, so that the source and evolution process of these potential change fragments in the time dimension are completely restored, thereby realizing the gradual identification and unfolding of hidden change nodes.

[0056] After completing the reverse backtracking alignment of all time slices, the implicit change nodes identified during the alignment process and the existing semantic transition nodes in the dynamic semantic migration trajectory are uniformly organized. Each change node is renumbered according to its corresponding time slice position, and its semantic content before the change, semantic content after the change, semantic transformation direction, and change magnitude are uniformly recorded. During the organization process, the semantic content corresponding to the initial time slice is used as the starting point of the semantic evolution path. The semantic states in subsequent time slices are sequentially connected according to the reverse backtracking alignment results. During the connection process, explicit semantic transition nodes and implicit change nodes are embedded into their corresponding positions in chronological order, so that each semantic change node in the entire path has complete contextual semantic information. This forms an incremental semantic evolution path that starts from the initial time slice, runs through all time slices, and covers all semantic change nodes. This semantic evolution path not only includes the semantic change process recorded in the dynamic semantic migration trajectory, but also includes the implicit change nodes restored through reverse backtracking alignment, so that the semantic change process of external input data in the propagation link can be presented in a continuous, complete, and traceable form.

[0057] Latent change nodes refer to: Content changes were detected during the forward time-slice comparison process. However, because the corresponding segment of the change had not yet entered the sensitive execution context in the current time slice, had not formed a clear control semantic label, or only manifested as intermediate rewriting such as encoding, encapsulation, reorganization, or cross-variable transfer, it was not marked as a high-risk semantic turning point. In subsequent time slices, after the segment finally flowed to the sensitive execution interface and exhibited executable semantics, it was possible to confirm the node that the intermediate change contributed to the formation of the final risk by tracing back.

[0058] The starting point for reverse backtracking is the final state segment that has been confirmed to have entered the sensitive execution interface at runtime. The sensitive execution interface includes at least the database query execution interface, command execution interface, script interpretation interface, template rendering interface, path parsing interface, and deserialization entry point. The final state segment is used as the target segment, and its source identifier, current position index, belonging object identifier, and current time slice number are read. Backtracking is then performed step by step along the semantic inheritance relationship and variable propagation relationship.

[0059] During the backtracking process, semantic matching is performed between the target segment and the candidate source segments of the previous time slice. The semantic matching is calculated using a combined matching score Q. Q=λ1×Qstr+λ2×Qtoken+λ3×Qsrc+λ4×Qctx Where Qstr represents string similarity, Qtoken represents lexical unit overlap, Qsrc represents source identifier consistency, and Qctx represents context continuity score; λ1, λ2, λ3, and λ4 are weight coefficients, and λ1+λ2+λ3+λ4=1.

[0060] When Q ≥ preset matching threshold θ3, the candidate segment of the previous time slice is determined as the source segment of the target segment; when multiple candidate segments meet the threshold, the segment with the largest Q value is selected as the main source segment, and the remaining segments are recorded as auxiliary source segments.

[0061] When the similarity in character content between the target segment and the candidate segment in the previous time slice is lower than the first similarity threshold θ4, but the sum of the source identifier consistency score and the context continuity score is not less than the second similarity threshold θ5, and the segment enters a more sensitive context in a subsequent time slice, the changed node is identified as a latent changed node. This case is used to cover situations where encoding conversion, escape rewriting, variable encapsulation, object attribute transfer, segment splicing and recombination, etc., result in significant differences in the character surface but continuous existence of risky semantics.

[0062] Therefore, the unique identification capability of reverse backtracking does not lie in discovering content changes that are not recorded at all in the forward phase, but in: re-evaluating the risk attribution of intermediate changes that have been recorded in the forward phase but have not been assigned high-risk attributes based on the final state sensitive execution context; thereby identifying nodes that were originally only recorded as general format changes or neutral structural changes as implicit change nodes that contribute to the final vulnerability triggering.

[0063] After identifying the latent change nodes, they are added to the semantic evolution path, along with the "latent node" identifier, the final target segment identifier, the backtracking matching score Q, the matching threshold judgment result, and the reason for risk escalation, which are used as path contribution evidence in subsequent vulnerability judgment.

[0064] Forward time-slice comparison can identify explicit content changes, but for segments that only exhibit format rewriting, encoding conversion, variable encapsulation, or cross-object movement between adjacent time slices, it is impossible to determine whether they belong to risk semantic changes related to vulnerabilities based solely on the local view of adjacent time slices. To address this, a reverse backtracking attribution mechanism based on the final state sensitive execution context is introduced to identify intermediate change nodes that were recorded in the forward phase but were not marked as high-risk, thus forming implicit change nodes.

[0065] Step 5: Based on the incremental semantic evolution path, the current semantic state of the external input data is synchronously labeled at key time slice locations, and the semantic state is continuously updated during program execution. Security vulnerabilities are determined based on the semantic state of the execution phase. The semantic state is continuously updated during program execution, and security vulnerability determination is based on the semantic state during the execution phase. The specific steps are as follows: For the constructed incremental semantic evolution path, all time slices within the path are traversed sequentially. During this traversal, each time slice is filtered based on the semantic turning points and implicit change nodes recorded in the incremental semantic evolution path. Time slices with semantic change records are marked as key time slices. In each key time slice, the corresponding semantic state content is read, and the semantic content is expanded according to the semantic embedding relationships recorded in the incremental semantic evolution path. All semantic fragments within the semantic state are arranged sequentially according to their source time slice numbers, with semantic fragments from the initial time slice placed first and newly added semantic fragments in the current time slice placed last. Each semantic fragment is also appended with a clear source time slice number and its position in the semantic evolution path, thus forming a semantic state expression result with temporal source information. After completing the semantic content organization, the semantic state content of the key time slice is bound to its corresponding time slice number, and a corresponding semantic annotation entry is written into the incremental semantic evolution path, ensuring that each key time slice forms an annotation record containing complete semantic content and source information.

[0066] After completing the synchronized annotation of the semantic state of key time slices, the semantic annotation entries corresponding to each key time slice are embedded into the corresponding time slice positions during program execution in chronological order. This ensures that the semantic annotation is consistent with the program execution process. During program execution, when external input data enters a new time slice, the semantic record corresponding to that time slice in the incremental semantic evolution path is read, and the semantic state of the current time slice is updated. During the update process, the semantic state content already formed in the previous time slice is copied to the current time slice as a whole, while maintaining the original arrangement order of semantic segments and the source time slice number. On this basis, the semantic content newly added in the current time slice is appended segment by segment to the end of the existing semantic state content, and the current time slice number and the corresponding position sequence number are appended to the new semantic content. This ensures that the updated semantic state always contains all semantic information from the initial time slice to the current time slice. By repeating the above update process in each time slice, the semantic state continues to extend during program execution and remains consistent with the semantic change records in the incremental semantic evolution path.

[0067] As the semantic state is continuously updated over time, the semantic state formed in each time slice is refined and organized. All semantic fragments within the semantic state are grouped according to their source time slice number. Semantic fragments with the same source time slice number are grouped together, and within each group, they are arranged according to their order of appearance in the semantic evolution path. Simultaneously, each semantic fragment is labeled with its corresponding position index in the incremental semantic evolution path. This ensures that the semantic state of the current time slice not only reflects all semantic content but also clearly defines the specific position of each semantic fragment within the entire semantic evolution path. After organization, a one-to-one correspondence is established between the semantic state of the current time slice and the semantic records of the corresponding time slices in the incremental semantic evolution path. This allows the current semantic state to be directly mapped to specific node positions in the semantic evolution path, thereby ensuring the continuity and consistency of the semantic state over time.

[0068] During runtime, instead of using the incremental semantic evolution path as a reference in advance, the incremental semantic evolution path is maintained for the currently observed time slice sequence. The incremental semantic evolution path includes the confirmed explicit change nodes, the identified implicit change nodes, and the corresponding segment source relationships between the initial time slice and the current time slice.

[0069] When the program continues to execute and generates new time slices, the semantic state in the new time slice is incrementally merged with the current incremental semantic evolution path. Only the newly added fragments, change direction, change magnitude and source relationship are updated, without requiring prior knowledge of future time slice information. When the target sensitive execution interface is detected to be called, the target request ends or the current propagation chain terminates, the incremental semantic evolution path is closed and sorted, and the incremental semantic evolution path corresponding to the current propagation chain is output.

[0070] Therefore, runtime semantic state updates adopt an incremental update mechanism, and the incremental semantic evolution path is only used as a review result after the operation ends or as a partial complete result for a closed propagation chain, thereby avoiding logical contradictions caused by pre-setting a complete path before the program ends.

[0071] After continuously updating and refining the semantic state, the semantic state during program execution is used as the basis for security vulnerability determination. In the specific determination process, all semantic fragments are extracted from the semantic state of the current time slice and sorted according to the source time slice number and position index. Semantic fragments containing control expressions, instruction execution meanings, and those that can affect the program execution flow are extracted one by one. The evolution process of these semantic fragments in the incremental semantic evolution path is then reconstructed segment by segment, for example, the entire process of evolving from ordinary text content in the initial time slice to expression content with control meaning. By unfolding this evolution process segment by segment, the determination process is directly based on the semantic state of the current execution stage. This ensures that the security vulnerability determination results reflect the true semantic expression of external input data during actual operation, avoiding biases caused by determinations based on the initial time slice semantic state, and providing a determination basis consistent with program execution behavior for software security vulnerability detection.

[0072] Security vulnerability identification is conducted using a combination of rule matching and risk scoring. The preset vulnerability types include at least: SQL injection vulnerabilities, operating system command injection vulnerabilities, script injection vulnerabilities, template injection vulnerabilities, path traversal vulnerabilities, and deserialization-related vulnerabilities. For each type of vulnerability, a corresponding set of sensitive execution interfaces, a set of dangerous semantic features, and a set of blocking conditions are configured.

[0073] The dangerous semantic features of SQL injection vulnerabilities include at least: query keyword fragments, logical connector fragments, condition concatenation fragments, comment truncation fragments, and external input directly participating in the construction of query statements; the dangerous semantic features of command injection vulnerabilities include at least: command keywords, command connectors, pipes, redirection operators, subcommand call structures, and external input flowing to the command execution interface; the dangerous semantic features of script or template injection vulnerabilities include at least: script tags, template expression boundaries, function call syntax, execution instruction fragments, and external input flowing to the interpretation or rendering interface; the dangerous semantic features of path traversal vulnerabilities include at least: directory rollback fragments, path concatenation fragments, unstandardized external path parameters, and their flow to the file access interface.

[0074] For each target time slice, extract the data fragments from the external input in the semantic state of the current time slice, and determine whether at least three of the following conditions are met simultaneously: C1: The fragment type is a control field or an executable statement fragment; C2: The fragment has risk enhancement directions D1, D2, D3 or D4 in the incremental semantic evolution path; C3: The fragment is currently flowing to the sensitive execution interface corresponding to the vulnerability type; C4: The fragment has not undergone parameterized binding, whitelist verification, fixed template replacement, or secure escaping; C5: The fragment contains at least one high-risk semantic turning point or implicit change point in the backtracking path; C6: The overall risk score of the fragment is not lower than the vulnerability assessment threshold θ6.

[0075] When the above conditions are met, the current propagation chain is identified as having a corresponding type of security vulnerability risk.

[0076] The overall risk score is recorded as follows: R=μ1×Rsink+μ2×Rsemantic+μ3×Rpath+μ4×Rsanitize Where Rsink represents the risk coefficient of the sensitive execution interface, Rsemantic represents the intensity of dangerous semantics in the current segment, Rpath represents the risk of path contribution, and Rsanitize represents the degree of purification deficiency; μ1, μ2, μ3, and μ4 are weight coefficients and their sum is 1.

[0077] Among them, Rsink is assigned a value based on the interface type, with the database execution interface, command execution interface, and script interpretation interface taking the higher value; Rsemantic is calculated based on the number of dangerous keywords, control syntax units, and execution structures; Rpath is calculated based on the number of high-risk nodes, the number of implicitly changed nodes, and the cumulative value of the change magnitude; Rsanitize is assigned a reverse value based on whether parameterization processing, whitelist filtering, and escaping processing exist.

[0078] When R≥θ6 and the target fragment has reached the sensitive execution interface of the corresponding vulnerability type, output "Vulnerability confirmed"; when R is in the warning interval θ7≤R<θ6, output "High risk pending confirmation"; when R<θ7, output "Vulnerability judgment threshold not reached"; where θ6 is the threshold for confirmed vulnerability, θ7 is the warning threshold, and θ6>θ7.

[0079] The output vulnerability assessment results should include at least the following: vulnerability type, associated input identifier, final state time slice number, corresponding sensitive execution interface, target segment that triggered the vulnerability, set of key semantic transition nodes, set of implicit change nodes, comprehensive risk score R, and suggested blocking location.

[0080] By incorporating vulnerability type, dangerous semantic features, sensitive execution interfaces, and cleanup status into a unified scoring and conditional judgment, security vulnerability judgment can no longer be based solely on abstract semantic descriptions, but rather on computable structured rules, thereby enabling those skilled in the art to implement the vulnerability detection process.

[0081] By continuously collecting data on the content changes of external input data across different time slices and constructing continuous semantic mapping records based on semantic differences, the semantic evolution trajectory of input data in the propagation chain is depicted from a temporal perspective. This avoids semantic bias caused by judging solely based on the initial data form, enabling the detection process to cover multi-stage changes in input data during propagation and improving the ability to perceive potential risk semantics. By constructing semantic continuity relationships and further forming dynamic semantic migration trajectories, semantic turning points are pinpointed and the direction and magnitude of semantic transformation are recorded. This clarifies the specific location and manner of semantic changes in input data during propagation, making the semantic change process traceable and improving the ability to locate hidden semantic risks. By backtracking and aligning the incremental semantic evolution path and performing semantic state synchronization annotation at key time slice locations, the semantic state is continuously updated during program execution. The semantic state of the execution phase is used as the basis for security vulnerability judgment, ensuring that the detection results are consistent with the actual execution semantics, reducing judgment errors caused by semantic offset, and improving the accuracy and reliability of vulnerability detection results.

[0082] The foregoing has only described certain exemplary embodiments of the present invention by way of illustration. Undoubtedly, those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the foregoing drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

Claims

1. A software security vulnerability detection method based on static analysis and runtime tracing, characterized in that, Includes the following steps: Static analysis is performed on the program to be detected to identify external input sources, candidate propagation nodes and sensitive execution interfaces. A static candidate risk propagation graph is constructed from the external input source to the sensitive execution interface, and the expected data type, expected syntactic role and target interface type of each candidate propagation node are recorded to form a static semantic baseline. During program execution, the external input sources, candidate propagation nodes and sensitive execution interfaces in the static candidate risk propagation graph are monitored by embedding points. The content changes of the same external input data in different time slices are collected, and the semantic expression state corresponding to each time slice is extracted by combining the static semantic baseline and the current execution context to construct a continuous semantic mapping record. Based on the continuous semantic mapping record, the semantic state of the same external input data in each time slice is progressively associated and labeled. The semantic state of the previous time slice is embedded into the semantic state of the next time slice for progressive comparison, forming a semantic succession relationship that runs through the propagation process. Based on semantic continuity, the semantic changes between adjacent time slices are determined by direction and quantified by magnitude, resulting in a dynamic semantic migration trajectory that includes the direction of semantic transformation, magnitude of change, and range of change location. Starting from the final state segment that enters the sensitive execution interface, reverse attribution is performed along the semantic inheritance relationship and variable propagation relationship. Risk reassessment is performed on intermediate change nodes that have been recorded in the forward stage but not marked as high risk, and latent change nodes are identified to form an incremental semantic evolution path. During program execution, the current time slice semantic state is continuously updated based on the currently generated incremental semantic evolution path, and the target vulnerability type is determined based on the category, semantic transformation direction, change magnitude, cleanup status, target sensitive execution interface, and static candidate risk propagation graph of the external input fragment. After the program finishes execution or the target propagation chain is closed, the incremental semantic evolution path and vulnerability detection results corresponding to the external input data are output.

2. The software security vulnerability detection method based on static analysis and runtime tracing according to claim 1, characterized in that, A continuous semantic mapping record is constructed based on the semantic differences presented by the same external input data in different time slices, including: Using the moment when external input data is received as the initial time slice, the processing behavior involving external input data during program execution is divided into multiple time slices. A unique identifier is assigned to the external input data, and the content presentation, processing operation type, execution location and context information corresponding to each time slice are recorded to form a time-seriesd set of content changes. By combining the time-series content change set, semantic expression state extraction is performed on the external input data content of each time slice, the semantic expression state is bound to the time slice, and the semantic change content between adjacent time slices is marked to construct a semantic expression sequence; By using semantic expression sequences, the semantic expression states of each time slice are sequentially connected, and the semantic change types and corresponding content changes are recorded to form a continuous semantic mapping record.

3. The software security vulnerability detection method based on static analysis and runtime tracing according to claim 2, characterized in that, Semantic expression state extraction includes: combining the context information of each time slice recorded in the time-series content change set, performing semantic expression division on the external input data content, distinguishing the external input data into ordinary text content, control field content, and executable statement fragments, binding the corresponding semantic expression state to the time slice, and recording the specific content involved in the semantic changes between adjacent time slices.

4. The software security vulnerability detection method based on static analysis and runtime tracing according to claim 2, characterized in that, The semantic state of the previous time slice is embedded into the semantic state of the next time slice for progressive comparison to form a semantic succession relationship, including: The continuous semantic mapping records are sequentially expanded, the semantic state content corresponding to each time slice is extracted and the position index is retained, and adjacent time slices are paired to form a time slice pairing set, and the semantic state correspondence is established in chronological order. For the time slice pairing set, perform association marking processing, completely copy the semantic state of the previous time slice and embed it into the starting position of the semantic state of the next time slice, add semantic source identifier and retain boundary identifier, forming a combined structure that includes the transmitted semantic content and its own semantic content; Based on the association calibration results, continuous transmission processing is performed, the semantic state of the current time slice is copied as a whole and embedded into the semantic state of the next time slice, the semantic source identifier and boundary identifier are continued, and a semantic embedding chain covering all time slices is constructed. By combining semantic embedding chains for hierarchical annotation, multi-level semantic segments are divided according to the semantic embedding order and labeled with corresponding time slice numbers. The semantic states of each time slice are uniformly integrated to form a semantic continuity relationship that runs through the propagation process.

5. The software security vulnerability detection method based on static analysis and runtime tracing according to claim 4, characterized in that, When performing association labeling processing on the time slice pairing set, the semantic state of the previous time slice is inserted into the starting position of the semantic state of the next time slice according to the original semantic expression order, and semantic source identification information is added at the insertion position. At the same time, a boundary marker is retained between the inserted content and the original semantic content of the next time slice to distinguish the semantic information from different time slice sources.

6. The software security vulnerability detection method based on static analysis and runtime tracing according to claim 4, characterized in that, The direction and magnitude of semantic transformation are recorded and a dynamic semantic migration trajectory is generated, including: Expand the continuous semantic mapping record corresponding to the semantic succession relationship, read the semantic state of each time slice and construct time slice pairs, split the inherited semantic part and the newly added semantic part in the semantic state of the next time slice, locate the semantic change position by aligning segment by segment and bind the time slice number. Perform identification processing on the semantic change location, extract the semantic content before and after the change in the corresponding time slice pair, record the start and end positions of the change, and form a semantic transition node identification record; By combining semantic transition node identifiers with detailed descriptions, new, deleted and replaced content is marked character by character, the direction of semantic transformation is recorded and the magnitude of change is quantified, and semantic change description information is generated. By aggregating semantic change descriptions to form a continuous connection path, connecting each semantic turning point in chronological order, and integrating time position, semantics before change, semantics after change, semantic transformation direction and magnitude, a dynamic semantic migration trajectory is constructed.

7. The software security vulnerability detection method based on static analysis and runtime tracing according to claim 6, characterized in that, The process of generating semantic change description information includes: comparing the semantic content before and after the change corresponding to the semantic transition node character by character, marking the added content, deleted content and replaced content, recording the change segments according to the order of character appearance, and recording the direction of semantic transformation and the magnitude of change information in combination with the time slice number corresponding to the semantic transition node.

8. The software security vulnerability detection method based on static analysis and runtime tracing according to claim 6, characterized in that, Backtracking and aligning implicitly changed nodes to form an incremental semantic evolution path includes: Perform dynamic semantic migration trajectory reverse rearrangement processing, read the semantic state of each time slice one by one and extract the semantic transformation direction and change magnitude information synchronously, divide the semantic source fragments and establish semantic backtracking relationship, and generate reverse semantic association sequence; The reverse semantic association sequence expansion mapping process is adopted. The semantic content of the initial time slice is used as the reference starting point. The semantic state of each time slice is segmented and the corresponding semantic fragments are identified. The unmatched semantic fragments are used as potential change fragments to trace the source step by step, and the change process is recorded to form hidden change nodes. By integrating implicit change nodes and semantic transition nodes, connecting semantic states in chronological order, and recording the semantic content before change, the semantic content after change, the direction of semantic transformation, and the magnitude of change, an incremental semantic evolution path covering all time slices is constructed.

9. The software security vulnerability detection method based on static analysis and runtime tracing according to claim 8, characterized in that, Semantic state updates and security vulnerability assessments during the execution phase include: Traverse each time slice in the incremental semantic evolution path, filter time slices containing semantic turning points and implicit change points, extract the corresponding semantic states and arrange semantic fragments in order of source time slice number, record source information and position number, and form semantic annotation entries. Embed semantic annotation entries into the corresponding time slice position during program execution, read the semantic record corresponding to the time slice and copy the semantic state of the previous time slice, append the newly added semantic content of the current time slice, and attach the time slice number and position sequence number to form the updated semantic state; Organize and update all semantic fragments in the semantic state, group them according to the source time slice number and mark the corresponding position index, and establish a mapping relationship between the current time slice semantic state and the corresponding semantic record in the incremental semantic evolution path; Extract semantic fragments from the current time slice semantic state, sort them by source time slice number and position index, identify semantic fragments containing control expression content and instruction execution meaning, reconstruct the evolution process by combining semantic evolution path, and perform security vulnerability determination.

10. The software security vulnerability detection method based on static analysis and runtime tracing according to claim 9, characterized in that, Extract semantic segments from the current time slice semantic state and perform security vulnerability determination, including: sorting the semantic segments by source time slice number and position index, marking the semantic segments containing control expression content and instruction execution meaning, and combining the corresponding semantic change records in the incremental semantic evolution path to unfold the formation process of the semantic segments segment by segment, and completing the security vulnerability determination based on the semantic state of the execution stage.

Images