System and method for detecting null pointer references based on code semantic analysis
Patent Information
- Application Number
- CN202510236295.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-02-28
- Publication Date
- 2026-10-13
AI Technical Summary
但是，这种动态检测的方法需要在每次指针使用前插入额外的代码，这可能会显著降低程序的执行效率
[0020]检测结果生成模块，用于响应于所述语义相似度小于预设阈值，确定所述第一待检测指针存在空指针引用的概率超过预设风险阈值。
Smart Images
Figure CN122902990A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of intelligent detection, and more specifically, to a null pointer reference detection system and method based on code semantic analysis. Background Technology
[0002] In the development of modern computer systems and application software, pointers are widely used to access system resources and data. However, with the increasing complexity of software, this complex operation also brings new challenges—the null pointer reference problem. A null pointer reference occurs when a program attempts to access a pointer that does not point to any valid resource or data. When a null pointer reference occurs during software runtime, it can cause unpredictable program behavior and may even be exploited by malicious attackers to control the user's system resources and data, leading to a series of security risks and privacy leaks.
[0003] However, traditional null pointer reference detection methods perform some basic static analysis during the compilation phase, such as checking pointer initialization to ensure that pointers are correctly initialized before use. In addition to the compiler's built-in functions, there are dedicated static analysis tools (such as Coverity, Fortify, and SonarQube) that can detect potential null pointer references through in-depth code analysis without executing the code. This static analysis approach often struggles to comprehensively consider all possible execution paths and contexts, especially when dealing with complex application logic and polymorphism, and may miss some potential null pointer references.
[0004] Furthermore, some existing dynamic detection methods insert additional checking code at runtime, performing a null check before each pointer usage. These methods are typically implemented by modifying the compiler or using specific runtime libraries. However, this dynamic detection approach requires inserting extra code before each pointer use, which can significantly reduce program execution efficiency. Simultaneously, this approach is not sensitive enough to control flow information and may still miss some potential null pointer reference problems when there is complex control logic within the software.
[0005] Therefore, an optimized null pointer reference detection scheme is desired. Summary of the Invention
[0006] To address the aforementioned technical problems, this application is proposed. Embodiments of this application provide a null pointer reference detection system and method based on code semantic analysis. It collects the source code to be detected and introduces data processing and semantic understanding algorithms based on artificial intelligence and code semantic analysis in the backend to perform semantic analysis on three parts of the source code, thereby extracting the semantics of the code portion before the pointer, the semantics of the code portion after the pointer, and the semantics of the pointer to be detected. Then, the semantics of the code portion before and after the pointer are used to infer the semantics of the pointer content, and semantic similarity calculation is performed between this and the semantics of the pointer to be detected to determine whether the pointer to be detected carries the risk of a null pointer reference. In this way, code semantic analysis technology can be used to achieve more intelligent null pointer reference detection. Compared with traditional detection methods, this intelligent semantic code semantic analysis method helps improve the accuracy of null pointer reference detection and reduces the false positive rate, thereby improving the stability and security of the entire system.
[0007] According to one aspect of this application, a method for detecting null pointer references based on code semantic analysis is provided, comprising:
[0008] Obtain the source code to be tested;
[0009] Extract the first pointer to be detected from the source code to be detected, and divide the source code to be detected into a code part before the pointer and a code part after the pointer based on the position of the first pointer in the source code to be detected;
[0010] The code portion before the pointer is subjected to forward coding of code semantics to obtain the semantic coding features of the code portion before the pointer, and the code portion after the pointer is subjected to backward coding of code semantics to obtain the semantic coding features of the code portion after the pointer;
[0011] The semantic encoding features of the code portion before the pointer and the semantic encoding features of the code portion after the pointer are combined based on common features to obtain a joint semantic representation of the code portion before and after the pointer;
[0012] After performing reasonable pointer semantic reasoning based on the semantic joint representation of the code parts before and after the pointer, the semantic reasoning features of the obtained pointer content are compared and analyzed with the first pointer to be detected to obtain semantic similarity.
[0013] In response to the semantic similarity being less than a preset threshold, it is determined that the probability of the first pointer to be detected having a null pointer reference exceeds a preset risk threshold.
[0014] According to another aspect of this application, a null pointer reference detection system based on code semantic analysis is provided, comprising:
[0015] The source code acquisition module is used to acquire the source code to be inspected.
[0016] The source code to be detected differentiation module is used to extract a first pointer to be detected from the source code to be detected, and divide the source code to be detected into a code part before the pointer and a code part after the pointer based on the position of the first pointer in the source code to be detected;
[0017] The semantic encoding module is used to perform forward coding of the code portion before the pointer to obtain the semantic encoding features of the code portion before the pointer, and to perform backward coding of the code portion after the pointer to obtain the semantic encoding features of the code portion after the pointer;
[0018] The semantic feature joint module is used to perform semantic feature joint based on common features on the semantic encoding features of the code part before the pointer and the semantic encoding features of the code part after the pointer to obtain a semantic joint representation of the code parts before and after the pointer;
[0019] The semantic feature comparison and analysis module is used to perform reasonable pointer semantic reasoning based on the semantic joint representation of the code parts before and after the pointer, and then perform semantic feature comparison and analysis between the obtained pointer content semantic reasoning features and the first pointer to be detected to obtain semantic similarity.
[0020] The detection result generation module is used to determine, in response to the semantic similarity being less than a preset threshold, that the probability of the first pointer to be detected having a null pointer reference exceeds a preset risk threshold.
[0021] Compared with existing technologies, this application provides a null pointer reference detection system and method based on code semantic analysis. It collects the source code to be detected and introduces data processing and semantic understanding algorithms based on artificial intelligence and code semantic analysis in the backend to perform semantic analysis on three parts of the source code, thereby extracting the semantics of the code before the pointer, the semantics of the code after the pointer, and the semantics of the pointer to be detected. Then, the semantics of the code before and after the pointer are used to infer the semantics of the pointer content, and semantic similarity calculation is performed between this and the semantics of the pointer to be detected to determine whether the pointer to be detected poses a risk of null pointer reference. In this way, code semantic analysis technology can be used to achieve more intelligent null pointer reference detection. Compared with traditional detection methods, this intelligent semantic code analysis method helps improve the accuracy of null pointer reference detection and reduces the false positive rate, thereby improving the stability and security of the entire system. Attached Figure Description
[0022] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.
[0023] Figure 1 This is a flowchart of a null pointer reference detection method based on code semantic analysis according to an embodiment of this application;
[0024] Figure 2 This is a schematic diagram of the data flow of a null pointer reference detection method based on code semantic analysis according to an embodiment of this application;
[0025] Figure 3 This is a flowchart of sub-step S4 of the null pointer reference detection method based on code semantic analysis according to an embodiment of this application;
[0026] Figure 4 This is a block diagram of a null pointer reference detection system based on code semantic analysis according to an embodiment of this application. Detailed Implementation
[0027] Hereinafter, exemplary embodiments according to this application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments of this application. It should be understood that this application is not limited to the exemplary embodiments described herein.
[0028] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.
[0029] While this application makes various references to certain modules of the systems according to embodiments of this application, any number of different modules can be used and run on user terminals and / or servers. The modules described are merely illustrative, and different aspects of the systems and methods may use different modules.
[0030] Flowcharts are used in this application to illustrate the operations performed by the system according to embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, various steps can be processed in reverse order or simultaneously as needed. Furthermore, other operations can be added to these processes, or one or more steps can be removed from them.
[0031] Hereinafter, exemplary embodiments according to this application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments of this application. It should be understood that this application is not limited to the exemplary embodiments described herein.
[0032] Traditional null pointer reference detection methods perform basic static analysis during the compilation phase, such as checking pointer initialization to ensure it's correctly initialized before use. Besides compiler-provided functionality, dedicated static analysis tools (like Coverity, Fortify, and SonarQube) can detect potential null pointer references through in-depth code analysis without execution. However, this static analysis approach often struggles to comprehensively consider all possible execution paths and contexts, especially with complex application logic and polymorphism, potentially missing some null pointer references. Furthermore, some dynamic detection methods insert additional checking code at runtime, performing a non-null check before each pointer use. These methods typically involve modifying the compiler or using specific runtime libraries. However, this dynamic approach requires additional code before each pointer use, which can significantly reduce program efficiency. Additionally, this method is not sensitive enough to control flow information, and may still miss potential null pointer references when complex control logic exists within the software.
[0033] To address the aforementioned technical problems, this application proposes a null pointer reference detection method based on code semantic analysis, which can detect null pointers by collecting and semantically analyzing the source code to be detected.
[0034] Specifically, the technical solution of this application proposes a method for detecting null pointer references based on code semantic analysis. Figure 1 This is a flowchart of a null pointer reference detection method based on code semantic analysis according to an embodiment of this application. Figure 2 This is a schematic diagram of the data flow of a null pointer reference detection method based on code semantic analysis according to an embodiment of this application. Figure 1 and Figure 2As shown, the null pointer reference detection method based on code semantic analysis according to an embodiment of this application includes the following steps: S1, obtaining the source code to be detected; S2, extracting a first pointer to be detected from the source code to be detected, and dividing the source code to be detected into a code part before the pointer and a code part after the pointer based on the position of the first pointer in the source code to be detected; S3, performing forward coding of the code part before the pointer to obtain semantic coding features of the code part before the pointer, and performing backward coding of the code part after the pointer to obtain semantic coding features of the code part after the pointer; S4, performing semantic feature combination based on common features on the semantic coding features of the code part before the pointer and the semantic coding features of the code part after the pointer to obtain a semantic joint representation of the code parts before and after the pointer; S5, performing reasonable pointer semantic reasoning based on the semantic joint representation of the code parts before and after the pointer, and then performing semantic feature comparison analysis between the obtained pointer content semantic reasoning features and the first pointer to be detected to obtain semantic similarity; S6, in response to the semantic similarity being less than a preset threshold, determining that the probability of the first pointer to be detected having a null pointer reference exceeds a preset risk threshold.
[0035] Specifically, S1 and S2 involve acquiring the source code to be detected, extracting a first pointer to be detected from the source code, and dividing the source code into a pre-pointer code portion and a post-pointer code portion based on the position of the first pointer within the source code. It should be understood that the core of null pointer reference detection lies in identifying pointer variables that may point to unallocated memory addresses. Therefore, it is necessary to extract the first pointer to be detected from the source code. Then, by segmenting the source code according to the pointer's position, the system can focus more on the behavior of pointer variables within their context, especially the state changes before and after pointer variable assignment. This is crucial for understanding the pointer's lifecycle and its potential null pointer reference risks. Furthermore, by locating the pointer variable, unnecessary global searches of the entire source code can be avoided, improving detection efficiency.
[0036] Specifically, in step S3, forward encoding of the code portion before the pointer is performed to obtain semantic encoding features of the code portion before the pointer, and backward encoding of the code portion after the pointer is performed to obtain semantic encoding features of the code portion after the pointer. In a specific example of this application, the code portion before the pointer is input into a code semantic analyzer based on a forward LSTM model to obtain a semantic encoding vector of the code portion before the pointer as the semantic encoding features of the code portion before the pointer; and the code portion after the pointer is input into a code semantic analyzer based on a backward LSTM model to obtain a semantic encoding vector of the code portion after the pointer as the semantic encoding features of the code portion after the pointer. It should be understood that the code semantic analyzer based on the forward LSTM model processes line by line from the beginning of the source code to be detected, gradually building context information. In this way, it can capture the context information before the pointer is used, including variable declaration, initialization, assignment, and other operations. This information is very important for understanding the state of the pointer. The code semantic analyzer based on the backward LSTM model processes in reverse from the end of the code, gradually building context information. In this way, it can capture contextual information after pointer usage, including subsequent pointer uses, conditional statements, loop structures, etc. This information helps to understand the behavior and impact of the pointer in subsequent code. This two-way information extraction and fusion can more accurately understand the semantics of pointers, thereby more effectively inferring reasonable pointer semantics for null pointer reference detection.
[0037] Specifically, in step S4, the semantic encoding features of the code portion before and after the pointer are combined based on common features to obtain a joint semantic representation of the code portions before and after the pointer. This is because the semantic encoding vector of the code portion before the pointer contains contextual information before the pointer's use, while the semantic encoding vector of the code portion after the pointer contains contextual information after the pointer's use. Forward LSTM and backward LSTM models capture forward and backward semantic information of the source code from different directions, and the information they provide may be complementary. For example, forward LSTM may capture the pointer's initialization process, while backward LSTM may capture the pointer's subsequent usage. By fusing these two parts of information, the state and behavior of the pointer throughout the code segment can be understood more comprehensively, thus enabling a more accurate determination of whether the pointer is null. However, traditional feature fusion methods may ignore these unique semantic key implicit correlation features of the code portions before and after the pointer, resulting in incomplete feature representations. Furthermore, the semantic features of the forward and backward parts of the source code may be misaligned, which will further affect the effect of feature fusion. Therefore, to improve the accuracy of subsequent null pointer reference risk detection, the common semantic features of the code before and after the pointer in the source code can be used as a basis to compensate and optimize the semantic encoding vectors of the code before and after the pointer. Based on this, in the technical solution of this application, the semantic encoding features of the code before and after the pointer are further combined based on common features to obtain the joint semantic representation of the code before and after the pointer.
[0038] Specifically, the semantic feature fusion method based on common features can compensate and fuse features in the semantic representation of the code before and after the pointer in the source code. It extracts common features between the semantic encoding vectors of the code before and after the pointer, and uses these as a basis to compensate for unique information in the implicit correlation features between the semantics of the code before and after the pointer, thereby achieving a richer and more comprehensive feature representation. This not only preserves the common semantic information of the code before and after the pointer, but also effectively supplements the unique information in the semantics of the code before and after the pointer in the source code, thus improving the effect of feature fusion, enhancing the performance of the machine learning model, and providing a basis for subsequent null pointer reference detection.
[0039] Specifically, the steps for semantic feature jointing based on common features for the semantic encoding features of the code portion before and after the pointer include: First, extracting common features from the semantic encoding features of the code portion before and after the pointer to obtain common features between the semantic features of the code portions before and after the pointer. Specifically, the semantic encoding vectors of the code portion before and after the pointer are input into a common feature extraction network to obtain a common feature representation vector between the semantic features of the code portions before and after the pointer, which serves as the common feature between the semantic features of the code portions before and after the pointer. That is, through the common feature extraction network, a neural network architecture, such as a fully connected layer, is used to learn the common features and intrinsic relationships between the semantic encoding vectors of the code portion before and after the pointer. These common features reflect some basic rules and patterns between the semantic features of the code portions before and after the pointer. Preserving common information helps ensure the consistency of the final feature representation, avoids decision bias caused by missing features, and provides a foundation for subsequent feature compensation and null pointer reference detection tasks.
[0040] The specific process of inputting the semantic encoding vector of the code before the pointer and the semantic encoding vector of the code after the pointer into the common feature extraction network includes: calculating the positional sum between the semantic encoding vector of the code before the pointer and the semantic encoding vector of the code after the pointer to obtain the semantic association fusion feature vector of the code before and after the pointer; multiplying the semantic association fusion feature vector of the code before and after the pointer with the modulation weight matrix and then adding it positionally with the modulation bias vector; and inputting the obtained modulated semantic association fusion feature vector of the code before and after the pointer into the tanh function for activation processing to obtain the common feature representation vector between the semantic features of the code before and after the pointer.
[0041] Next, the semantic information compensation for the semantic encoding features of the code portion before the pointer and the semantic encoding features of the code portion after the pointer, relative to the common features between the semantic features of the code portions before and after the pointer, is calculated to obtain fine-grained compensation features for the semantic information of the code portion before and after the pointer. Specifically, in the technical solution of this application, the semantic encoding vector of the code portion before the pointer, the semantic encoding vector of the code portion after the pointer, and the vector representing the common features between the semantic features of the code portions before and after the pointer are first input into a vector probabilistic unit based on the Sigmoid function. The Sigmoid function is an activation function that maps real values to the (0,1) interval. In this step, the Sigmoid function normalizes each feature vector, converting the feature values at each position in each feature vector into probabilistic form, thereby better measuring the importance of the features. That is, by using the Sigmoid function to probabilize the feature vectors, the probabilistic feature vectors can more intuitively reflect which semantic association features between the code portions before and after the pointer are significant and which are secondary, helping to more comprehensively describe the association patterns between the semantics of the code portions before and after the pointer. Then, considering that the semantic composition of the code before and after the pointer may differ in different scenarios during null pointer detection, and each semantic combination has its unique information, a fine-grained compensation vector for the semantic information of the code before the pointer is further calculated by retrieving the common feature representation vector between the probabilistic semantic features of the code before and after the pointer. This process identifies information unique to the semantic encoding vector of the code before the pointer, beyond the common features, by calculating the difference between the two probabilistic feature vectors. This information can help with subsequent null pointer reference detection tasks. Simultaneously, a fine-grained compensation vector for the semantic information of the code after the pointer is calculated by retrieving the semantic encoding vector of the code after the pointer, relative to the common feature representation vector between the semantic features of the code before and after the pointer. Similar to the former, the goal is to identify information in the semantic encoding vector of the code after the pointer that is not fully covered by the common features. In this way, it can be ensured that as much implicit and unique information about the semantic relationships between the code before and after the pointer in different scenarios is retained during the final feature fusion process, improving the model's generalization and application capabilities.
[0042] The specific process of calculating the compensation semantic information of the semantic encoding features of the code before the pointer and the semantic encoding features of the code after the pointer relative to the common features between the semantic features of the code before and after the pointer includes: inputting the semantic encoding vector of the code before the pointer, the semantic encoding vector of the code after the pointer, and the representation vector of the common features between the semantic features of the code before and after the pointer into a vector probabilistic unit based on the Sigmoid function to obtain the probabilistic semantic encoding vector of the code before the pointer, the probabilistic semantic encoding vector of the code after the pointer, and the probabilistic representation vector of the common features between the semantic features of the code before and after the pointer; calculating the fine-grained compensation vector of the semantic information of the code before the pointer relative to the probabilistic semantic encoding vector of the code before the pointer as the fine-grained compensation feature of the semantic information of the code before the pointer; calculating the fine-grained compensation vector of the semantic information of the code after the pointer relative to the probabilistic semantic encoding vector of the code before and after the pointer as the fine-grained compensation feature of the semantic information of the code after the pointer.
[0043] More specifically, calculating the fine-grained compensation vector for the semantic information of the pre-pointing code portion relative to the common feature representation vector between the semantic features of the probabilistic pre-pointing code portion and the probabilistic pre-pointing code portion as the fine-grained compensation feature for the semantic information of the pre-pointing code portion includes: calculating the positional division between the probabilistic pre-pointing code portion semantic encoding vector and the common feature representation vector between the semantic features of the probabilistic pre-pointing code portion and the common feature representation vector between the semantic features of the pre-pointing code portion to obtain the interaction feature vector of the common semantic features of the pre-pointing code portion; calculating the base-2 logarithmic function value of the absolute value of each position feature value in the interaction feature vector of the common semantic features of the pre-pointing code portion, and multiplying the obtained interaction logarithmic representation vector of the common semantic features of the pre-pointing code portion with the probabilistic pre-pointing code portion semantic encoding vector by position to obtain the optimized representation vector of the semantic information of the pre-pointing code portion; calculating the natural exponential function value with the natural constant e as the base and the exponent of each position feature value in the optimized representation vector of the semantic information of the pre-pointing code portion, and then inputting the obtained feature vector into the softmax function for processing to obtain the fine-grained compensation vector of the semantic information of the pre-pointing code portion.
[0044] Furthermore, based on the fine-grained compensation features of the semantic information of the code portion before the pointer and the fine-grained compensation features of the semantic information of the code portion after the pointer, the semantic encoding features of the code portion before the pointer and the semantic encoding features of the code portion after the pointer are fused in a fine-grained compensation manner to obtain the joint semantic representation of the code portion before and after the pointer. In other words, in the technical solution of this application, the fine-grained compensation vector of the semantic information of the code portion before the pointer and the semantic encoding vector of the code portion before the pointer are input into the fine-grained compensation module to obtain the semantic fine-grained feature compensation vector of the code portion before the pointer; and the fine-grained compensation vector of the semantic information of the code portion after the pointer and the semantic encoding vector of the code portion after the pointer are input into the fine-grained compensation module to obtain the semantic fine-grained feature compensation vector of the code portion after the pointer. In particular, the fine-grained compensation module is usually a mechanism designed to strengthen or supplement specific features. Here, the module receives the original semantic encoding vectors of the code portion before and after the pointer and their corresponding compensation vectors, and adds the compensation vectors to the original feature vectors in a certain way, such as multiplication, thereby generating a new feature vector containing more detailed information. This ensures that the final feature representation retains both the common information between the two and contains unique information, ensuring the consistency and integrity of the final feature fusion, and providing a foundation for more accurate null pointer reference detection tasks in the future. Finally, the semantic fine-grained feature compensation vectors of the code portion before the pointer, the semantic fine-grained feature compensation vectors of the code portion after the pointer, and the common feature representation vectors between the semantic features of the code portions before and after the pointer are concatenated to obtain the joint semantic encoding vector of the code portions before and after the pointer, which serves as the joint semantic representation of the code portions before and after the pointer. This step creates a comprehensive feature representation by merging all compensated feature vectors. In particular, the concatenation operation may be a simple vector concatenation or a more complex fusion mechanism, such as an attention mechanism, to ensure that the final joint semantic representation of the code portions before and after the pointer retains both the common semantic features between the code portions before and after the pointer and includes the unique information from the two input feature vectors. By fusing the contextual information before and after the pointer and strengthening the common features, false positives and false negatives caused by insufficient contextual information can be reduced. For example, a pointer may have been checked for null before use, but then set to null after use. By fusing the information before and after, the state of the pointer can be determined more accurately, and the state and behavior of the pointer throughout the entire code segment can be better understood, thereby reducing false positives and false negatives.
[0045] The specific process of inputting the fine-grained compensation vector of the semantic information of the code before the pointer and the semantic encoding vector of the code before the pointer into the fine-grained compensation module includes: calculating the positional dot product between the fine-grained compensation vector of the semantic information of the code before the pointer and the semantic encoding vector of the code before the pointer to obtain the fine-grained feature compensation vector of the semantic information of the code before the pointer.
[0046] In summary, in the above embodiments, performing semantic feature combination based on common features on the semantic encoding features of the code portion before the pointer and the semantic encoding features of the code portion after the pointer to obtain a joint semantic representation of the code portion before and after the pointer includes: performing semantic feature combination based on common features on the semantic encoding features of the code portion before the pointer and the semantic encoding features of the code portion after the pointer using the following feature interaction formula to obtain a joint semantic representation of the code portion before and after the pointer; wherein, the feature interaction formula is:
[0047] V J =tanh(W VT (V1⊕V2)+b VT )
[0048] V a =sigmoid(V J )
[0049] V b =sigmoid(V1)
[0050] V c =sigmoid(V2)
[0051]
[0052] V 1b =V1⊙v ba
[0053] V 2c =V2⊙v ca
[0054] v f =concat[V J V 1b V 2c ]
[0055] Wherein, V1 and V2 are the semantic encoding vectors of the code portion before the pointer and the code portion after the pointer, respectively, W VT and b VT These are the modulation weight matrix and modulation bias vector, respectively, tanh(·) is the tanh function, and V J V is a vector representing the common semantic features between the code segments before and after the pointer, where sigmoid(·) is the sigmoid function. a V b and V c These are, respectively, the common feature representation vector between the semantic features of the code parts before and after the probabilistic pointer, the semantic encoding vector of the code part before the probabilistic pointer, and the semantic encoding vector of the code part after the probabilistic pointer. and These represent the common feature vectors between the semantic features of the code parts before and after the probabilistic pointer, the semantic encoding vector of the code part before the probabilistic pointer, and the feature values at each position in the semantic encoding vector of the code part after the probabilistic pointer, respectively. `log` is the logarithmic function value to the base 2, `exp(·)` is the natural exponential function value to the base e, and `softmax(·)` is the softmax function. ba v is a fine-grained compensation vector for the semantic information of the code portion before the pointer. ca This is a fine-grained compensation vector for the semantic information of the code portion following the pointer, ⊙ represents the positional dot product, and V 1b and V 2c These are the semantic fine-grained feature compensation vectors for the code portion before the pointer and the semantic fine-grained feature compensation vectors for the code portion after the pointer, respectively. `concat[·;·;·]` represents the concatenation operation. f This is a semantic joint encoding vector for the code portions before and after the pointer.
[0056] Specifically, in step S5, after performing reasonable pointer semantic reasoning based on the joint semantic representation of the pointer's code portions, the obtained pointer content semantic reasoning features are then compared and analyzed with the first pointer to be detected to obtain semantic similarity. In a specific example of this application, the joint semantic encoding vector of the pointer's code portions is input into a decoder-based reasonable pointer semantic reasoning engine to obtain a pointer content semantic reasoning encoding vector as the pointer content semantic reasoning feature; that is, the joint semantic interaction features of the pointer's forward and backward code portions are used for decoding regression to infer reasonable pointer content semantic feature information. Furthermore, semantic embedding encoding is performed on the first pointer to be detected to obtain a first pointer to be detected semantic encoding vector; the actual semantic implicit feature information of the first pointer to be detected is captured by semantic embedding encoding to obtain the first pointer to be detected semantic encoding vector; subsequently, the semantic similarity between the pointer content semantic reasoning encoding vector and the first pointer to be detected semantic encoding vector is calculated. Here, by calculating the semantic similarity between the pointer content semantic reasoning encoding vector and the first pointer to be detected semantic encoding vector, the similarity between the actual content semantics of the pointer to be detected and the reasonable pointer content reasoning semantics is compared, thereby determining whether the first pointer to be detected has the risk of null pointer reference.
[0057] When the semantic encoding vector of the code portion before the pointer and the semantic encoding vector of the code portion after the pointer represent the source code semantic encoding features of the source code relative to the first pointer to be detected, respectively, during feature-based compensation interactions using common features as masks, the joint semantic encoding vector of the code portion before and after the pointer will also have multi-dimensional code semantic feature mapping deviation compensation diversity under the source code semantic distribution difference, thus possessing feature interaction distribution diversity based on feature-based compensation interactions. Furthermore, when the joint semantic encoding vector of the code portion before and after the pointer is decoded and regressed by the decoder, without utilizing the prior information of the decoder, it is difficult to ensure the adaptability between the prior information and the feature interaction distribution diversity, thereby affecting the accuracy of the decoding result.
[0058] Preferably, in the process of obtaining the pointer content semantic inference encoding vector by passing the semantic joint encoding vector of the code parts before and after the pointer through a decoder-based reasonable pointer semantic inferencer, feature adaptation is performed on the semantic joint encoding vector of the code parts before and after the pointer, including:
[0059] Extract the decoding weight matrix from the decoder;
[0060] The semantic joint encoding vector of the code parts before and after the pointer is projected onto the feature space of the decoding weight matrix to obtain the semantic joint pseudo-decoding projection encoding feature vector of the code parts before and after the pointer.
[0061] v p =M c v o
[0062] Among them, v o M represents the semantic joint encoding vector of the code portions before and after the pointer. c This represents the decoding weight matrix, v p This represents the semantic joint pseudo-decoding projection encoding feature vector of the code portions before and after the pointer;
[0063] Calculate the power function feature vector of the semantic joint pseudo-decoding projection coding feature vector of the code parts before and after the pointer to obtain the label-level projection coding feature vector of the semantic joint pseudo-decoding feature vector of the code parts before and after the pointer.
[0064] v l =exp(v p )
[0065] Among them, v l This represents the semantic joint pseudo-decoding label-level projection encoded feature vector of the code portions before and after the pointer;
[0066] Construct a pointer code semantic multidimensional clustering query space encoding matrix between the semantic joint pseudo-decoding label-level projection encoding feature vector of the code parts before and after the pointer and the semantic joint pseudo-decoding projection encoding feature vector of the code parts before and after the pointer;
[0067]
[0068] Where T represents the transpose operation. This represents matrix multiplication, where L represents the length of the semantically joint pseudo-decoding projection-encoded feature vector before and after the pointer, and M represents the length of the feature vector. c The pointer code semantics multidimensional clustered query space encoding matrix;
[0069] Calculate the logarithmic function feature matrix of the pointer code semantic multidimensional clustered query space encoding matrix to obtain the pointer code semantic multidimensional clustered query space smooth encoding matrix;
[0070]
[0071] Among them, M t The pointer code semantics multidimensional clustered query space smooth encoding matrix;
[0072] The semantic joint encoding vector of the code parts before and after the pointer is projected onto the feature space of the smooth encoding matrix of the multidimensional clustered query space of the pointer code semantics to obtain the pointer semantic decoding compensation encoding feature vector;
[0073] v b =M t v o
[0074] Among them, v b This represents the pointer semantic decoding compensation encoded feature vector;
[0075] The semantic joint encoding vector of the code before and after the pointer and the semantic decoding compensation encoding feature vector of the pointer are fused to obtain an optimized semantic joint encoding vector of the code before and after the pointer;
[0076] v opt =α·v b +β·v o
[0077] Where α and β represent weighted hyperparameters, v opt This represents the semantic joint encoding vector of the code portions before and after the optimized pointer.
[0078] Here, the set of normal vectors anchored to the decoding decision boundary based on the decoding decision knowledge inherent in the model guides the transformation of the original feature vectors towards a more discriminative direction, and a power-order enhancement function is used to significantly strengthen the correlation with the decoding label. Furthermore, a multi-dimensional clustered query smoothing space of the decoding features is constructed as a feature extraction container to capture compensating features that aid in decoding judgment, and the original decoding features are adaptively optimized by absorbing these compensating features. In this way, the optimized decoding features are more compatible with the free decoding label optimization of the decoder's intrinsic weight structure, improving the accuracy of the semantic joint encoding vector of the code parts before and after the pointer, which is obtained by the decoder-based reasonable pointer semantic inferencer. Thus, code semantic analysis technology can be used to achieve more intelligent null pointer reference detection. Compared with traditional detection methods, this intelligent semantic code semantic analysis method helps improve the accuracy of null pointer reference detection and reduces the false positive rate, thereby improving the stability and security of the entire system.
[0079] Specifically, in step S6, in response to the semantic similarity being less than a preset threshold, it is determined that the probability of the first pointer to be detected having a null pointer reference exceeds a preset risk threshold. In this way, code semantic analysis technology can be used to achieve more intelligent null pointer reference detection. Compared with traditional detection methods, this intelligent semantic code semantic analysis method helps improve the accuracy of null pointer reference detection and reduces the false positive rate, thereby improving the stability and security of the entire system.
[0080] In summary, the null pointer reference detection method based on code semantic analysis according to the embodiments of this application is explained. It collects the source code to be detected and introduces data processing and semantic understanding algorithms based on artificial intelligence and code semantic analysis in the backend to perform semantic analysis on three parts of the source code to be detected, thereby extracting the semantics of the code part before the pointer, the semantics of the code part after the pointer, and the semantics of the pointer to be detected. Then, the semantics of the code parts before and after the pointer are used to infer the semantics of the pointer content, and semantic similarity calculation is performed between this and the semantics of the pointer to be detected to determine whether the pointer to be detected poses a risk of null pointer reference. In this way, code semantic analysis technology can be used to achieve more intelligent null pointer reference detection. Compared with traditional detection methods, this intelligent semantic code semantic analysis method helps improve the accuracy of null pointer reference detection and reduces the false positive rate, thereby improving the stability and security of the entire system.
[0081] Furthermore, a null pointer reference detection system based on code semantic analysis is also provided.
[0082] Figure 4 This is a block diagram of a null pointer reference detection system based on code semantic analysis according to an embodiment of this application. Figure 4 As shown, the null pointer reference detection system 300 based on code semantic analysis according to an embodiment of this application includes: a source code acquisition module 310 for acquiring source code to be detected; a source code differentiation module 320 for extracting a first pointer to be detected from the source code to be detected and dividing the source code to be detected into a code part before the pointer and a code part after the pointer based on the position of the first pointer in the source code to be detected; and a semantic encoding module 330 for performing forward coding of the code part before the pointer to obtain semantic encoding features of the code part before the pointer and backward coding of the code part after the pointer to obtain semantic encoding features of the code part after the pointer. The system comprises: a semantic feature joint module 340, used to perform semantic feature joint based on common features on the semantic encoding features of the code part before the pointer and the semantic encoding features of the code part after the pointer to obtain a semantic joint representation of the code part before and after the pointer; a semantic feature comparison and analysis module 350, used to perform reasonable pointer semantic reasoning based on the semantic joint representation of the code part before and after the pointer, and then perform semantic feature comparison and analysis between the obtained pointer content semantic reasoning features and the first pointer to be detected to obtain semantic similarity; and a detection result generation module 360, used to determine that the probability of the first pointer to be detected having a null pointer reference exceeds a preset risk threshold in response to the semantic similarity being less than a preset threshold.
[0083] As described above, the null pointer reference detection system 300 based on code semantic analysis according to the embodiments of this application can be implemented in various wireless terminals, such as servers with null pointer reference detection algorithms based on code semantic analysis. In one possible implementation, the null pointer reference detection system 300 based on code semantic analysis according to the embodiments of this application can be integrated into the wireless terminal as a software module and / or a hardware module. For example, the null pointer reference detection system 300 based on code semantic analysis can be a software module in the operating system of the wireless terminal, or it can be an application developed for the wireless terminal; of course, the null pointer reference detection system 300 based on code semantic analysis can also be one of many hardware modules of the wireless terminal.
[0084] Alternatively, in another example, the null pointer reference detection system 300 based on code semantic analysis and the wireless terminal can also be separate devices, and the null pointer reference detection system 300 based on code semantic analysis can be connected to the wireless terminal via wired and / or wireless networks, and transmit interactive information in accordance with an agreed data format.
[0085] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.
Claims
1. A method for detecting null pointer references based on code semantic analysis, characterized in that, include: Obtain the source code to be tested; Extract the first pointer to be detected from the source code to be detected, and divide the source code to be detected into a code part before the pointer and a code part after the pointer based on the position of the first pointer in the source code to be detected; The code portion before the pointer is subjected to forward coding of code semantics to obtain the semantic coding features of the code portion before the pointer, and the code portion after the pointer is subjected to backward coding of code semantics to obtain the semantic coding features of the code portion after the pointer; The semantic encoding features of the code portion before the pointer and the semantic encoding features of the code portion after the pointer are combined based on common features to obtain a joint semantic representation of the code portion before and after the pointer; After performing reasonable pointer semantic reasoning based on the semantic joint representation of the code parts before and after the pointer, the semantic reasoning features of the obtained pointer content are compared and analyzed with the first pointer to be detected to obtain semantic similarity. In response to the semantic similarity being less than a preset threshold, it is determined that the probability of the first pointer to be detected having a null pointer reference exceeds a preset risk threshold.
2. The method for detecting null pointer references based on code semantic analysis according to claim 1, characterized in that, Performing forward coding of the code portion before the pointer to obtain semantic coding features of the code portion before the pointer, and performing backward coding of the code portion after the pointer to obtain semantic coding features of the code portion after the pointer, including: The code portion before the pointer is input into a code semantic analyzer based on a forward LSTM model to obtain a semantic encoding vector of the code portion before the pointer, which is used as the semantic encoding feature of the code portion before the pointer. The code portion following the pointer is input into a code semantic analyzer based on a backward LSTM model to obtain a semantic encoding vector of the code portion following the pointer, which is used as the semantic encoding feature of the code portion following the pointer.
3. The method for detecting null pointer references based on code semantic analysis according to claim 2, characterized in that, The semantic features of the code portion before the pointer and the code portion after the pointer are combined based on common features to obtain a joint semantic representation of the code portions before and after the pointer, including: Common features are extracted from the semantic encoding features of the code portion before the pointer and the semantic encoding features of the code portion after the pointer to obtain the common features between the semantic features of the code portions before and after the pointer; Compensation semantic information is calculated for the semantic coding features of the code portion before the pointer and the semantic coding features of the code portion after the pointer relative to the common features between the semantic features of the code portions before and after the pointer, so as to obtain fine-grained compensation features for the semantic information of the code portion before the pointer and fine-grained compensation features for the semantic information of the code portion after the pointer. Based on the fine-grained compensation features of the semantic information of the code portion before the pointer and the code portion after the pointer, the semantic encoding features of the code portion before the pointer and the semantic encoding features of the code portion after the pointer are fused in a fine-grained compensation manner to obtain the joint semantic representation of the code portion before and after the pointer.
4. The method for detecting null pointer references based on code semantic analysis according to claim 3, characterized in that, Extracting common features from the semantic encoding features of the code portion before the pointer and the semantic encoding features of the code portion after the pointer to obtain common features between the semantic features of the code portions before and after the pointer includes: inputting the semantic encoding vectors of the code portion before the pointer and the code portion after the pointer into a common feature extraction network to obtain a common feature representation vector between the semantic features of the code portions before and after the pointer as the common features between the semantic features of the code portions before and after the pointer, including: Calculate the positional sum between the semantic encoding vector of the code portion before the pointer and the semantic encoding vector of the code portion after the pointer to obtain the semantic association fusion feature vector of the code portions before and after the pointer; The semantic association fusion feature vector of the code parts before and after the pointer is multiplied by the modulation weight matrix and then added to the modulation bias vector positionally. The resulting modulated semantic association fusion feature vector of the code parts before and after the pointer is input into the tanh function for activation processing to obtain the common feature representation vector between the semantic features of the code parts before and after the pointer.
5. The method for detecting null pointer references based on code semantic analysis according to claim 4, characterized in that, The semantic information compensation for the common features between the semantic features of the code portion before the pointer and the semantic features of the code portion after the pointer is calculated respectively relative to the semantic features of the code portions before and after the pointer to obtain fine-grained compensation features for the semantic information of the code portion before the pointer and the semantic information of the code portion after the pointer, including: The semantic encoding vector of the code part before the pointer, the semantic encoding vector of the code part after the pointer, and the common feature representation vector between the semantic features of the code parts before and after the pointer are input into a vector probabilistic unit based on the Sigmoid function to obtain the probabilistic semantic encoding vector of the code part before the pointer, the probabilistic semantic encoding vector of the code part after the pointer, and the probabilistic common feature representation vector between the semantic features of the code parts before and after the pointer; The fine-grained compensation vector of the semantic information of the code part before the pointer is calculated as the fine-grained compensation feature of the semantic information of the code part before the pointer, relative to the common feature representation vector between the semantic features of the code parts before and after the probabilistic pointer. The fine-grained compensation vector of semantic information of the code part after the probabilistic pointer is calculated as the common feature representation vector between the semantic features of the code parts before and after the probabilistic pointer and the code parts after the pointer.
6. The method for detecting null pointer references based on code semantic analysis according to claim 5, characterized in that, Calculating the fine-grained compensation vector of the semantic information of the code portion before the pointer, relative to the common feature representation vector between the semantic features of the code portions before and after the probabilistic pointer, as the fine-grained compensation feature of the semantic information of the code portion before the pointer, includes: Calculate the positional division between the semantic encoding vector of the code portion before the probabilistic pointer and the common feature representation vector between the semantic features of the code portions before and after the probabilistic pointer to obtain the interactive feature vector of the semantic common features of the code portion before the pointer; After calculating the base-2 logarithmic function value of the absolute value of the feature value at each position in the semantic common feature interaction feature vector of the pre-point code part, the obtained semantic common feature interaction logarithmic representation vector of the pre-point code part is multiplied positionally with the probabilistic pre-point code part semantic encoding vector to obtain the optimized representation vector of the semantic information of the pre-point code part. After calculating the natural exponential function value with the natural constant e as the base and the feature values of each position in the semantic information of the code part before the pointer as the power of the exponent, the obtained feature vector is then input into the softmax function for processing to obtain the fine-grained compensation vector of the semantic information of the code part before the pointer.
7. The method for detecting null pointer references based on code semantic analysis according to claim 6, characterized in that, Based on the fine-grained compensating features of the semantic information of the code portion before the pointer and the code portion after the pointer, a fine-grained compensating feature fusion is performed on the semantic encoding features of the code portion before the pointer and the semantic encoding features of the code portion after the pointer to obtain a joint semantic representation of the code portions before and after the pointer, including: The fine-grained compensation vector of the semantic information of the code before the pointer and the semantic encoding vector of the code before the pointer are input into the fine-grained compensation module to obtain the semantic fine-grained feature compensation vector of the code before the pointer. The fine-grained compensation vector of the semantic information of the code-after-pointer portion and the semantic encoding vector of the code-after-pointer portion are input into the fine-grained compensation module to obtain the semantic fine-grained feature compensation vector of the code-after-pointer portion. The semantic fine-grained feature compensation vector of the code part before the pointer, the semantic fine-grained feature compensation vector of the code part after the pointer, and the common feature representation vector between the semantic features of the code parts before and after the pointer are concatenated to obtain the semantic joint encoding vector of the code parts before and after the pointer, which is used as the semantic joint representation of the code parts before and after the pointer.
8. The method for detecting null pointer references based on code semantic analysis according to claim 7, characterized in that, The fine-grained compensation vector of the semantic information of the code before the pointer and the semantic encoding vector of the code before the pointer are input into the fine-grained compensation module to obtain the semantic fine-grained feature compensation vector of the code before the pointer, including: calculating the positional dot product between the semantic fine-grained compensation vector of the semantic information of the code before the pointer and the semantic encoding vector of the code before the pointer to obtain the semantic fine-grained feature compensation vector of the code before the pointer.
9. The method for detecting null pointer references based on code semantic analysis according to claim 8, characterized in that, After performing reasonable pointer semantic reasoning based on the joint semantic representation of the code before and after the pointer, the semantic reasoning features of the obtained pointer content are then compared and analyzed with the semantic features of the first pointer to be detected to obtain semantic similarity, including: The semantic joint encoding vector of the code parts before and after the pointer is input into a reasonable pointer semantic inferencer based on a decoder to obtain the pointer content semantic inference encoding vector as the pointer content semantic inference feature; The first pointer to be detected is semantically embedded and encoded to obtain the semantic encoding vector of the first pointer to be detected. Calculate the semantic similarity between the semantic inference encoding vector of the pointer content and the semantic encoding vector of the first pointer to be detected.
10. A null pointer reference detection system based on code semantic analysis, characterized in that, include: The source code acquisition module is used to acquire the source code to be inspected. The source code to be detected differentiation module is used to extract a first pointer to be detected from the source code to be detected, and divide the source code to be detected into a code part before the pointer and a code part after the pointer based on the position of the first pointer in the source code to be detected; The semantic encoding module is used to perform forward coding of the code portion before the pointer to obtain the semantic encoding features of the code portion before the pointer, and to perform backward coding of the code portion after the pointer to obtain the semantic encoding features of the code portion after the pointer; The semantic feature joint module is used to perform semantic feature joint based on common features on the semantic encoding features of the code part before the pointer and the semantic encoding features of the code part after the pointer to obtain a semantic joint representation of the code parts before and after the pointer; The semantic feature comparison and analysis module is used to perform reasonable pointer semantic reasoning based on the semantic joint representation of the code parts before and after the pointer, and then perform semantic feature comparison and analysis between the obtained pointer content semantic reasoning features and the first pointer to be detected to obtain semantic similarity. The detection result generation module is used to determine, in response to the semantic similarity being less than a preset threshold, that the probability of the first pointer to be detected having a null pointer reference exceeds a preset risk threshold.