Method and apparatus for detecting privacy information of code snippet, and electronic device

Abstract

The application relates to the technical field of computer software security, and discloses a method and device for detecting private information in a code segment and an electronic device, wherein the method comprises the following steps: performing word segmentation processing and static analysis on a code segment to be detected to obtain a context hidden state sequence and a lightweight structure correlation matrix; a post-mask attention layer is superimposed on the context hidden state sequence, and the lightweight structure correlation matrix is used as a graph structure mask to obtain a graph-aware hidden state sequence; a long-range dependence-aware hidden state sequence is obtained according to the graph-aware hidden state sequence, and the graph-aware hidden state sequence and the long-range dependence-aware hidden state sequence are adaptively fused to obtain a fused hidden state sequence; and the fused hidden state sequence is subjected to pooling and classification processing to output a private information detection result of the code segment to be detected. The application can significantly improve the detection capability for complex risk scenarios under a segment-level detection framework, and realizes accurate detection of private information in a code segment.

Description

Technical Field

[0001] This application relates to the field of computer software security technology, such as a method, apparatus, and electronic device for detecting privacy information in code fragments. Background Technology

[0002] Currently, with the increasing reliance on third-party service interfaces, cloud platform resources, and automated deployment processes during software development, various sensitive credentials are widely used for identity authentication, resource access control, and inter-system interface calls. Sensitive credentials include API keys, access tokens, database passwords, JSON Web Tokens (JWT), OAuth tokens, and cloud service credentials. Due to ease of development or inadequate configuration management, sensitive credentials often appear in source code, configuration files, and runtime logs in hard-coded form, creating potential information leakage risks. Once such sensitive credentials are submitted to public version control systems, included in publicly released configuration files, or recorded in log files accessible to unauthorized users, they can lead to account hijacking, data breaches, and supply chain security incidents, posing serious security vulnerabilities. Therefore, how to accurately and efficiently perform automated detection of sensitive credentials in source code, configuration files, and log files has become a crucial technical issue in software supply chain security, compliance auditing, and continuous integration / continuous deployment processes.

[0003] Among related technologies, a method for automatically parsing privacy information in text is disclosed. This method involves segmenting the text to be parsed, using transfer learning and deep learning models to perform contextual encoding on word sequences, and predicting the privacy information category and location of each word through a classification layer, thereby achieving privacy information recognition in natural language text.

[0004] In the process of implementing the embodiments of this disclosure, at least the following problems were found in the related art: Unlike natural language text, code snippets have a unique code structure, making it difficult for related technologies to accurately identify private information within them.

[0005] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] To provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This summary is not intended as a general commentary, nor is it intended to identify key / important components or describe the scope of protection of these embodiments, but rather as a prelude to the detailed description that follows.

[0007] This disclosure provides a method, apparatus, and electronic device for detecting privacy information in code snippets, so as to accurately detect privacy information in code snippets.

[0008] In some embodiments, the method for detecting privacy information in code fragments includes: performing word segmentation and static analysis on the code fragment to be detected to obtain a contextual hidden state sequence and a lightweight structure association matrix; superimposing a post-graph mask attention layer on the contextual hidden state sequence, and using the lightweight structure association matrix as a graph structure mask to obtain a graph-aware hidden state sequence; obtaining a long-range dependency-aware hidden state sequence based on the graph-aware hidden state sequence, and adaptively fusing the graph-aware hidden state sequence and the long-range dependency-aware hidden state sequence to obtain a fused hidden state sequence; performing pooling and classification processing on the fused hidden state sequence, and outputting the privacy information detection result of the code fragment to be detected.

[0009] Optionally, the code segment to be detected is subjected to word segmentation and static analysis to obtain a contextual hidden state sequence and a lightweight structural association matrix, including: performing word segmentation on the code segment to be detected to obtain a word sequence, an attention mask, and a target mapping relationship between the words and the original code segmentation units; obtaining a contextual hidden state sequence based on the word sequence and the attention mask; performing lightweight static analysis on the code segment to be detected, and constructing a lightweight structural association matrix based on the target mapping relationship.

[0010] Optionally, the lightweight structural association matrix includes a lightweight data flow adjacency matrix; lightweight static analysis is performed on the code segment to be detected, and a lightweight structural association matrix is ​​constructed based on the target mapping relationship, including: identifying variable assignment statements and filtering sensitive identifiers in the code segment to be detected to obtain a set of target identifiers; grouping the occurrence records of target identifiers in the code segment to be detected according to the target identifier names to obtain multiple identifier groups; constructing an original code segmentation unit-level edge set for each identifier group, and mapping the original code segmentation unit-level edge set to a target edge set according to the target mapping relationship; filling the target edge set into the initial lightweight data flow adjacency matrix to obtain the target lightweight data flow adjacency matrix.

[0011] Optionally, the graph-aware hidden state sequence includes one or more post-graph mask attention layers, where the hidden state input of the first layer is the context hidden state sequence, and the hidden state input of the next layer is the hidden state output of the previous layer. A post-graph mask attention layer is superimposed on the context hidden state sequence, and a lightweight structured correlation matrix is ​​used as the graph structure mask to obtain the graph-aware hidden state sequence. This includes: performing a linear transformation on the hidden state input of the current post-graph mask attention layer to obtain a query matrix, a key matrix, and a value matrix, and dividing the query matrix, key matrix, and value matrix into one or more attention heads; calculating an attention score for each attention head. The attention scores are then processed by graph structure masking based on the lightweight structure correlation matrix and then normalized to obtain the attention weights under graph structure constraints. The value matrix is ​​weighted and summed based on the attention weights, and the multi-head attention aggregation results are merged and projected, as well as residual connection and layer normalization processing, to obtain the graph-aware hidden state output by the current post-graph mask attention layer. The graph-aware hidden state output by the current post-graph mask attention layer is used as the hidden state input of the next post-graph mask attention layer until the graph-aware hidden states output by all post-graph mask attention layers are obtained, resulting in a graph-aware hidden state sequence.

[0012] Optionally, the graph-aware hidden state sequence is processed through one or more sequence modeling submodules. The hidden state input of the first layer is the graph-aware hidden state sequence, and the hidden state input of the next layer is the hidden state output of the previous layer. Based on the graph-aware hidden state sequence, a long-range dependency-aware hidden state sequence is obtained, including: performing layer normalization and one-dimensional convolution processing on the hidden state input of the current sequence modeling submodule to obtain local context features; performing sequence scanning along the forward and backward directions of the code segment to be detected based on the local context features to obtain bidirectional long-range dependency representations; determining the first gating coefficient based on the local context features and the bidirectional long-range dependency representations, and performing weighted fusion of the local context features and the bidirectional long-range dependencies based on the first gating coefficients to obtain a gated fusion representation; mapping the gated fusion representation to the same feature dimension as the hidden state input of the current sequence modeling submodule, and adding the mapping result to the residual of the hidden state input of the current sequence modeling submodule to obtain the hidden state output of the current sequence modeling submodule; wherein, the hidden state output of the last sequence modeling submodule is used as the long-range dependency-aware hidden state sequence.

[0013] Optionally, adaptive fusion of the graph-aware hidden state sequence and the long-range dependency-aware hidden state sequence is performed to obtain a fused hidden state sequence, including: concatenating the graph-aware hidden state sequence and the long-range dependency-aware hidden state sequence along the feature dimension to obtain a concatenated hidden state sequence; determining a second gating coefficient based on the concatenated hidden state sequence, and performing weighted fusion of the graph-aware hidden state sequence and the long-range dependency-aware hidden state sequence based on the second gating coefficient to obtain an intermediate fused hidden state sequence; and normalizing the intermediate fused hidden state sequence to obtain the fused hidden state sequence.

[0014] Optionally, the fused hidden state sequence is pooled and classified to output the privacy information detection result of the code fragment to be detected, including: pooling the fused hidden state sequence to obtain a code fragment-level representation vector; regularizing the code fragment-level representation vector and determining a classification score vector based on the regularized code fragment-level representation vector; determining the privacy information detection result based on the classification score vector; wherein the privacy information detection result includes whether the code fragment to be detected has sensitive credential risk or not; if the code fragment to be detected has sensitive credential risk, risk information is generated and a security alarm is triggered; the risk information includes at least one of the following: code fragment source, file path, code line range, predicted label, risk category, confidence level, candidate hit position, posterior probability distribution of each category, or remediation suggestion.

[0015] Optionally, the method for detecting privacy information in code snippets further includes: constructing a code snippet privacy information detection model; the input of the code snippet privacy information detection model is the code snippet to be detected, and the output is the privacy information detection result of the code snippet to be detected; wherein, the training dataset of the code snippet privacy information detection model is constructed as follows: obtaining code data with sensitive credential annotation information; extracting context code snippets according to the location of the sensitive credential to generate positive samples; wherein, setting one or more window offsets according to the location of the sensitive credential annotation to generate positive samples with different context locations; extracting context code snippets from locations that do not contain sensitive credential annotations to generate negative samples; wherein, the location of the negative sample is greater than the location of the sensitive credential annotation by a safe distance; writing the positive samples and negative samples into a snippet-level classification dataset, and dividing the snippet-level classification dataset into a training set and a validation set according to a preset ratio; wherein, during the training process of the code snippet privacy information detection model, at least one of the following is employed: hierarchical learning rate strategy, optimizer, learning rate scheduling, gradient accumulation, gradient pruning, or early stopping strategy.

[0016] In some embodiments, the apparatus for detecting privacy information in code fragments includes a processor and a memory storing program instructions, the processor being configured to perform the method for detecting privacy information in code fragments as described above when the program instructions are executed.

[0017] In some embodiments, the electronic device includes: an electronic device body; and the means for detecting privacy information of code fragments as described above, which is installed on the electronic device body.

[0018] The method, apparatus, and electronic device for detecting privacy information in code fragments provided in this disclosure can achieve the following technical effects: In this embodiment, by performing word segmentation and static analysis on the code fragment to be detected, a contextual hidden state sequence and a lightweight structural association matrix are obtained. Then, a post-graph mask attention layer is superimposed on the contextual hidden state sequence, using the lightweight structural association matrix as the graph structure mask. This enables explicit modeling of structural information such as variable definitions and usage relationships, key-value pair structures, etc., within the code fragment without modifying the model structure or relying on a complete compilation environment, thereby obtaining a graph-aware hidden state sequence. Simultaneously, by obtaining a long-range dependency-aware hidden state sequence and adaptively fusing the graph-aware hidden state sequence and the long-range dependency-aware hidden state sequence, the detection capability for complex risk scenarios such as indirect variable references and cross-statement credential associations is significantly improved within the fragment-level detection framework. Furthermore, the false positive rate for secure fragments such as sample data and environment variable readings is effectively reduced, thereby achieving accurate detection of privacy information in the code fragment.

[0019] The above general description and the description below are exemplary and illustrative only and are not intended to limit this application. Attached Figure Description

[0020] One or more embodiments are illustrated by way of example with reference to the accompanying drawings. These illustrations and drawings do not constitute a limitation on the embodiments. Elements having the same reference numerals in the drawings are shown as similar elements. The drawings are not to be scaled. And wherein: Figure 1 This is a schematic diagram of a method for detecting privacy information in code fragments provided in an embodiment of this disclosure; Figure 2 This is a schematic diagram of another method for detecting privacy information in code fragments provided in an embodiment of this disclosure; Figure 3 This is a schematic diagram of a method for constructing a lightweight structural association matrix provided in an embodiment of this disclosure; Figure 4 This is a schematic diagram of a method for obtaining a graph-aware hidden state sequence provided in an embodiment of this disclosure; Figure 5 This is a schematic diagram of an apparatus for detecting privacy information in code fragments provided in an embodiment of this disclosure; Figure 6 This is a schematic diagram of another apparatus for detecting privacy information in code fragments provided in an embodiment of this disclosure. Detailed Implementation

[0021] To provide a more detailed understanding of the features and technical content of the embodiments of this disclosure, the implementation of the embodiments of this disclosure will be described in detail below with reference to the accompanying drawings. The accompanying drawings are for illustrative purposes only and are not intended to limit the embodiments of this disclosure. In the following technical description, for ease of explanation, several details are used to provide a full understanding of the disclosed embodiments. However, one or more embodiments may still be implemented without these details. In other cases, well-known structures and devices may be simplified in their depiction to simplify the drawings.

[0022] The terms "first," "second," etc., used in the technical solutions described in this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this disclosure described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion.

[0023] Unless otherwise stated, the term "multiple" means two or more.

[0024] In this embodiment of the disclosure, the character " / " indicates that the objects before and after it are in an "or" relationship. For example, A / B means: A or B.

[0025] The term "and / or" describes an association between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or A and B.

[0026] The term "correspondence" can refer to an association or binding relationship. The correspondence between A and B means that there is an association or binding relationship between A and B.

[0027] Combination Figure 1 As shown, this disclosure provides a method for detecting privacy information in code snippets. The execution subject of this method can be a processor, and the method includes: S101, the processor performs word segmentation and static analysis on the code fragment to be detected, and obtains the contextual hidden state sequence and lightweight structure association matrix.

[0028] S102, the processor superimposes a post-graph mask attention layer on the contextual hidden state sequence and uses a lightweight structured correlation matrix as the graph structure mask to obtain the graph-aware hidden state sequence.

[0029] S103, the processor obtains the long-range dependency perception hidden state sequence based on the graph perception hidden state sequence, and adaptively fuses the graph perception hidden state sequence and the long-range dependency perception hidden state sequence to obtain the fused hidden state sequence.

[0030] S104, the processor performs pooling and classification processing on the fused hidden state sequence, and outputs the privacy information detection results of the code fragment to be detected.

[0031] In this embodiment, by performing word segmentation and static analysis on the code fragment to be detected, a contextual hidden state sequence and a lightweight structural association matrix are obtained. Then, a post-graph mask attention layer is superimposed on the contextual hidden state sequence, using the lightweight structural association matrix as the graph structure mask. This enables explicit modeling of structural information such as variable definitions and usage relationships, key-value pair structures, etc., within the code fragment without modifying the model structure or relying on a complete compilation environment, thereby obtaining a graph-aware hidden state sequence. Simultaneously, by obtaining a long-range dependency-aware hidden state sequence and adaptively fusing the graph-aware hidden state sequence and the long-range dependency-aware hidden state sequence, the detection capability for complex risk scenarios such as indirect variable references and cross-statement credential associations is significantly improved within the fragment-level detection framework. Furthermore, the false positive rate for secure fragments such as sample data and environment variable readings is effectively reduced, thereby achieving accurate detection of privacy information in the code fragment.

[0032] Optionally, privacy information includes sensitive credentials.

[0033] Optionally, the code segment to be detected is subjected to word segmentation and static analysis to obtain a contextual hidden state sequence and a lightweight structural association matrix, including: performing word segmentation on the code segment to be detected to obtain a word sequence, an attention mask, and a target mapping relationship between the words and the original code segmentation units; obtaining a contextual hidden state sequence based on the word sequence and the attention mask; performing lightweight static analysis on the code segment to be detected, and constructing a lightweight structural association matrix based on the target mapping relationship.

[0034] Combination Figure 2 As shown in the embodiments of this disclosure, another method for detecting privacy information in code snippets is provided, including: S201, the processor performs word segmentation on the code segment to be detected, and obtains the word sequence, attention mask, and target mapping relationship between the words and the original code segmentation units.

[0035] S202, the processor obtains the contextual hidden state sequence based on the word sequence and the attention mask.

[0036] S203, the processor performs lightweight static analysis on the code fragment to be detected and constructs a lightweight structural correlation matrix based on the target mapping relationship.

[0037] S204, the processor superimposes a post-graph mask attention layer on the contextual hidden state sequence and uses a lightweight structured correlation matrix as the graph structure mask to obtain the graph-aware hidden state sequence.

[0038] S205, the processor obtains the long-range dependency perception hidden state sequence based on the graph perception hidden state sequence, and adaptively fuses the graph perception hidden state sequence and the long-range dependency perception hidden state sequence to obtain the fused hidden state sequence.

[0039] S206, the processor performs pooling and classification processing on the fused hidden state sequence, and outputs the privacy information detection results of the code fragment to be detected.

[0040] In this embodiment, by introducing a target mapping relationship between sub-words and the original code segmentation units, the natural structure of the code can be aligned with the model's sub-word input space, ensuring the accuracy of the lightweight structural association matrix. Simultaneously, by employing a sub-word segmentation scheme and a lightweight static analysis process, the dependence on the compilation environment and syntax parsing is significantly reduced while ensuring the extraction of key structural information such as variable definitions and usages and key-value pairs.

[0041] Optionally, the code snippet or code text to be detected can be obtained through a computer device. The code snippet or code text to be detected can come from code snippets input by the user, or from source code files, configuration files, environment variable files, script files, or log files in the local file system, version control repository, continuous integration / continuous deployment pipeline environment, container file system, or log storage directory.

[0042] Optionally, the code snippet detection modes include single-snippet detection mode and batch scanning mode. In single-snippet detection mode, the computer device receives code text input by the user, or reads a portion of the content from a user-specified file as the code snippet to be detected. In batch scanning mode, the computer device can traverse files in the target directory that meet preset conditions and sequentially read the content of the corresponding files as the code snippets to be detected.

[0043] Optionally, when the length of the text to be read exceeds the preset maximum input length, at least one of the following methods can be used to generate one or more code fragments to be detected: truncation, segmentation, sliding window, function boundary splitting, configuration block splitting, or log block splitting. This avoids sensitive credentials located at the end of long files from being missed due to simple truncation, improving the engineering applicability in batch scanning scenarios.

[0044] Optionally, code snippet detection can be performed using a code snippet privacy information detection model. To maintain consistency with the model training and validation process, a single piece of text or the content of a single file can be read as a model input and truncated by a word segmenter according to a preset maximum length.

[0045] Optionally, the code segment to be detected is subjected to word segmentation, including: using a word segmenter that matches the pre-trained code language model to perform word segmentation on the code segment to be detected. The word segmenter can be a byte pair encoding word segmenter, a WordPiece word segmenter, a SentencePiece word segmenter, or other word segmenters that can be used in conjunction with the pre-trained code language model.

[0046] Optionally, the sub-word sequence includes a sub-word token sequence, which represents the token number sequence of the code segment to be detected, with a maximum length of L; when the actual number of tokens is greater than L, it is truncated, and when the actual number of tokens is less than L, it is padded to L.

[0047] Optionally, an attention mask is used to identify whether each position in the word sequence is a valid token, and its length is L; where a value of 1 represents a real token, and a value of 0 represents a padding position. The attention mask can shield the padding positions from the influence of context encoding, sequence modeling, and classification results.

[0048] Optionally, the target mapping relationship between sub-words and original code segmentation units is used to represent the index of the original code segmentation unit corresponding to each sub-word token. The original code segmentation unit can be obtained through whitespace segmentation, punctuation segmentation, operator segmentation, lexical rule segmentation, or other code segmentation methods. The target mapping relationship is used in subsequent steps to align the lightweight data stream associations at the original code segmentation unit level to the sub-word token level.

[0049] In one specific embodiment, the tokenizer uses an AutoTokenizer corresponding to a pre-trained code language model and performs truncation, fixed-length padding, and tensor quantization on the code segment to be detected. The target mapping relationship between the sub-word token and the original code segmentation unit can be represented by the word_ids returned by the tokenizer. The preset maximum length L can be 256. The above-mentioned tokenizer type, maximum length, and mapping method are only examples in specific embodiments and do not constitute a limitation on the scope of protection.

[0050] Optionally, obtaining the contextual hidden state sequence based on the word sequence and attention mask includes: inputting the word sequence and attention mask into a pre-trained code language model, having the pre-trained code language model perform contextual semantic encoding on the code fragment to be detected, and obtaining the contextual hidden state sequence output by the encoding layer of the pre-trained code language model.

[0051] Optionally, the pre-trained code language model can be a code pre-trained model based on the Transformer encoder architecture, or it can be any other code representation learning model capable of outputting token-level contextual representations. This embodiment can obtain the contextual semantic representation of the code fragment to be detected without changing the structure of the basic pre-trained code language model.

[0052] In one specific embodiment, the pre-trained code language model may be CodeBERT, GraphCodeBERT, CodeT5, or other pre-trained models suitable for code representation learning. The specific model types described above are merely illustrative and do not constitute a limitation on the scope of protection.

[0053] Optionally, the contextual hidden state sequence includes a token-level contextual hidden state sequence. The token-level contextual hidden state sequence can be the hidden state sequence of the output of the last layer of the pre-trained code language model, or it can be the hidden state sequence obtained by fusing the outputs of one or more coding layers.

[0054] Alternatively, the context hidden state sequence H can be represented by the following formula:

[0055] Where B represents the batch size, L represents the maximum length of the sub-word token sequence, and d represents the hidden state dimension.

[0056] Optionally, each position vector in the contextual hidden state sequence corresponds to a token in the input sub-word token sequence, used to characterize the semantic features of that token in the code context. Semantic features include code keywords, variable names, configuration keys, string literals, assignment statements, function calls, and semantic associations between adjacent code contexts.

[0057] Optionally, the contextual hidden state sequence serves as the input basis for the subsequent post-graph mask attention module. In subsequent steps, the contextual hidden state sequence and the lightweight structure association matrix are jointly input into the post-graph mask attention module to obtain the graph-aware hidden state sequence.

[0058] In one specific embodiment, a pre-trained code language model can be loaded using `AutoModel.from_pretrained()`, and its last layer `last_hidden_state` can be used as the context hidden state sequence. For example, when the maximum sequence length L is 256 and the hidden state dimension d is 768, the tensor shape of the context hidden state sequence can be [B, 256, 768]. The above loading method, sequence length, and hidden state dimension are merely examples in a specific implementation and do not constitute a limitation on the scope of protection.

[0059] Optionally, the lightweight structured association matrix includes a lightweight data flow adjacency matrix. The lightweight data flow adjacency matrix can be dynamically constructed based on multi-language code pattern rules, sensitive identifier identification, assignment symbol identification, key-value pair identification, and the occurrence relationship of the same target identifier. It is suitable for engineering scanning scenarios such as source code, configuration files, environment variable files, script files, log files, and multi-language mixed code repositories.

[0060] Optionally, lightweight static analysis is performed on the code segment to be detected, and a lightweight structural association matrix is ​​constructed based on the target mapping relationship. This includes: identifying variable assignment statements and filtering sensitive identifiers in the code segment to be detected to obtain a set of target identifiers; grouping the occurrence records of target identifiers in the code segment to be detected according to the target identifier names to obtain multiple identifier groups; constructing an original code segmentation unit-level edge set for each identifier group, and mapping the original code segmentation unit-level edge set to the target edge set according to the target mapping relationship; and filling the target edge set into the initial lightweight data stream adjacency matrix to obtain the target lightweight data stream adjacency matrix.

[0061] Combination Figure 3 As shown, this disclosure provides a method for constructing a lightweight structural association matrix, including: S301, the processor performs variable assignment statement recognition and sensitive identifier filtering on the code segment to be detected, and obtains a set of target identifiers.

[0062] S302, the processor groups the occurrence records of the target identifier in the code segment to be detected according to the target identifier name, and obtains multiple identifier groups.

[0063] S303, the processor constructs a set of edges at the level of the original code segmentation unit for each identifier group, and maps the set of edges at the level of the original code segmentation unit to the set of target edges according to the target mapping relationship.

[0064] S304, the processor fills the target edge set into the initial lightweight data stream adjacency matrix to obtain the target lightweight data stream adjacency matrix.

[0065] In this embodiment, sensitive identifier filtering allows structural modeling to focus on target identifiers highly relevant to privacy risks, avoiding interference from irrelevant variable relationships. Constructing a target edge set fully characterizes the flow path of privacy information within the code snippet, effectively improving the detection capability for indirectly referenced privacy information. Grouping the original code's word segmentation unit-level edge set by identifier name and transforming the edge set based on target mapping relationships solves the problem of association breaks caused by discontinuous code structures and sub-word segmentation, ensuring the accuracy of graph structure information. The resulting lightweight data flow adjacency matrix, as a task-customized sparse mask, significantly reduces computational overhead while improving the targeting of model feature aggregation.

[0066] Optionally, a lightweight structural association matrix is ​​used to transform candidate structural relationships related to credential risk assessment within the code fragment to be detected into sparse structural constraints that can be utilized by a learnable model. That is, sensitive keywords, assignment symbols, key-value pair structures, and the occurrence of the same identifier are only used to determine possible association edges between tokens and do not directly determine the final classification result. Based on the variable definitions, variable assignments, variable usages, key-value pair structures, sensitive identifiers, and the multiple occurrences of the same target identifier in the code fragment to be detected, a token-level lightweight structural association matrix for sensitive credential detection tasks can be constructed. The lightweight structural association matrix is ​​used to characterize candidate structural relationships related to credential risk assessment within the code fragment to be detected, including relationships between definitions and usages, relationships between usages, key-value relationships, and token self-loop relationships.

[0067] Optionally, variable assignment statement identification and sensitive identifier filtering are performed on the code segment to be detected, including: scanning the code segment to be detected based on multi-language code pattern rules to identify candidate identifiers; candidate identifiers include candidate variable names, constant names, or configuration key names; and filtering the candidate identifiers for sensitive identifiers to obtain a set of target identifiers.

[0068] Optionally, multilingual code pattern rules can be used to identify at least one of the following syntax forms: Python-style assignment statements; variable declaration statements in JavaScript or TypeScript introduced by const, let, or var; short variable declaration statements in Go; type declaration assignment statements in Java or C#; all-caps constant assignment statements; key-value pair statements in JSON, YAML, TOML, or environment variable files; and configuration item declaration statements in script files or configuration files.

[0069] Optionally, sensitive identifier filtering is used to retain identifiers or configuration keys that are highly likely to be associated with sensitive credentials.

[0070] Optionally, a candidate identifier may be retained as the target identifier if it meets at least one of the following conditions: the candidate identifier contains at least one keyword from a preset set of sensitive keywords, which includes at least one of key, secret, token, password, passwd, pwd, api, credential, auth, jwt, oauth, aws, github, access, private, and cert; the candidate identifier conforms to a preset naming rule for sensitive configuration items; the candidate identifier conforms to an all-uppercase constant naming style and has a length greater than or equal to a preset threshold; and the candidate identifier has a length greater than or equal to the preset threshold and is not purely numeric.

[0071] Optionally, the occurrence record of the target identifier in the code segment to be detected is determined as follows: Scan the sequence of original code segmentation units to determine the occurrence position and role type of the target identifier in the code segment. For any original code segmentation unit, if it matches an identifier in the target identifier set, then based on whether there is an assignment symbol, declaration assignment structure, or key-value pair structure near the original code segmentation unit, determine whether the position is a definition position, assignment position, configuration key position, or usage position, and record the identifier name, occurrence position, role type, and corresponding original code segmentation unit index.

[0072] In a specific embodiment, if an assignment operator or key-value separator appears within a preset range after the original code segmentation unit, the original code segmentation unit is recorded as a definition position, assignment position, or configuration key position; if the original code segmentation unit belongs to the target identifier set but does not meet the above conditions, the original code segmentation unit is recorded as a usage position. Assignment operators and key-value separators may include: =, :=, +=, -=, :, or equivalent symbols in other languages.

[0073] Optionally, occurrence records can be grouped as follows: for multiple occurrence records corresponding to the same target identifier, they are grouped into the same identifier group. This is to facilitate the subsequent construction of lightweight structural association edges corresponding to that target identifier.

[0074] Optionally, the edge set at the tokenization unit level of the original code includes at least one of the following edges: definition-use edges, use-use edges, key-value association edges, and self-loop edges. Definition-use edges connect the definition location, assignment location, or configuration key location of a target identifier to its use location, representing the association between the definition and use of the same target identifier in the code snippet. Use-use edges connect multiple use locations of the same target identifier, representing the association between the occurrence of the same target identifier in different code locations. Key-value association edges connect the configuration key location to its corresponding value location, representing the structural association in configuration items or key-value pairs. Self-loop edges connect each valid token to itself, preserving the semantic features of each token.

[0075] In one specific embodiment, the definition and use edge, use and use edge, and key and value association edge can be bidirectional edges, or they can be set as unidirectional edges or weighted edges according to specific task requirements.

[0076] Optionally, according to the target mapping relationship, the set of edges at the original code segmentation unit level is mapped to the set of target edges, including: for any original code segmentation unit level edge (w_p, w_q), the one or more sub-word token positions corresponding to w_p and the one or more sub-word token positions corresponding to w_q are determined according to the target mapping relationship, and the token positions corresponding to the two are connected in pairs to obtain token-level lightweight structure association edges.

[0077] Optionally, the target edge set is filled into the initial lightweight data stream adjacency matrix, including: setting the initial lightweight data stream adjacency matrix as an identity matrix to preserve the token's own information; traversing the target edge set, for each token-level edge (t_a, t_b), setting the corresponding position A[t_a, t_b] in the adjacency matrix to 1. The initial lightweight data stream adjacency matrix has a size of L×L, where L represents the maximum length of the token sequence.

[0078] Optionally, the target lightweight data flow adjacency matrix is ​​represented as: A∈{0,1}^{L×L}. The values ​​of matrix elements A[i,j] are used to indicate whether there is a task-related lightweight structural association between the i-th token and the j-th token. The target lightweight data flow adjacency matrix serves as the graph structure mask for the subsequent post-graph mask attention layer, constraining the attention weights to be aggregated primarily among tokens corresponding to variable definition and usage associations, associations with the same target identifier, key-value associations, and self-loop relationships.

[0079] In a specific embodiment, the original code segmentation unit sequence can be obtained by splitting the code fragment to be detected according to whitespace characters using `text.split()`. Assignment operators can include =, :=, +=, and -=. The sensitive keyword set can include key, secret, token, password, passwd, pwd, api, credential, auth, jwt, oauth, aws, github, access, private, and cert. The lightweight data stream adjacency matrix can be represented as a binary matrix. The above segmentation method, symbol set, keyword set, and matrix value method are merely examples in a specific experimental embodiment and do not constitute a limitation on the scope of protection.

[0080] Optionally, the graph-aware hidden state sequence includes one or more post-graph mask attention layers, where the hidden state input of the first layer is the context hidden state sequence, and the hidden state input of the next layer is the hidden state output of the previous layer. A post-graph mask attention layer is superimposed on the context hidden state sequence, and a lightweight structured correlation matrix is ​​used as the graph structure mask to obtain the graph-aware hidden state sequence. This includes: performing a linear transformation on the hidden state input of the current post-graph mask attention layer to obtain a query matrix, a key matrix, and a value matrix, and dividing the query matrix, key matrix, and value matrix into one or more attention heads; calculating an attention score for each attention head. The attention scores are then processed by graph structure masking based on the lightweight structure correlation matrix and then normalized to obtain the attention weights under graph structure constraints. The value matrix is ​​weighted and summed based on the attention weights, and the multi-head attention aggregation results are merged and projected, as well as residual connection and layer normalization processing, to obtain the graph-aware hidden state output by the current post-graph mask attention layer. The graph-aware hidden state output by the current post-graph mask attention layer is used as the hidden state input of the next post-graph mask attention layer until the graph-aware hidden states output by all post-graph mask attention layers are obtained, resulting in a graph-aware hidden state sequence.

[0081] Combination Figure 4 As shown, this disclosure provides a method for obtaining a graph-aware hidden state sequence, including: S401, the processor performs a linear transformation on the hidden state input of the current post-image mask attention layer to obtain the query matrix, key matrix and value matrix, and divides the query matrix, key matrix and value matrix into one or more attention heads.

[0082] S402, the processor calculates the attention score for each attention head, performs graph structure masking on the attention score based on the lightweight structure correlation matrix, and then normalizes it to obtain the attention weight under graph structure constraints.

[0083] S403, the processor performs weighted summation of the value matrix according to the attention weights, merges and outputs the multi-head attention aggregation results, performs residual connection and layer normalization processing, and obtains the graph-aware hidden state output by the current post-graph mask attention layer.

[0084] S404, the processor determines whether the hidden state output of the preset number of layers has been completed. If yes, then execute S406; otherwise, execute S405.

[0085] S405, the processor takes the graph-aware hidden state output by the current post-graph mask attention layer as the hidden state input of the next post-graph mask attention layer, and executes S401.

[0086] S406, after obtaining the graph-aware hidden states output by all post-graph mask attention layers, the processor obtains the graph-aware hidden state sequence.

[0087] In this embodiment, a stacked post-graph mask attention layer architecture dynamically receives a lightweight structural association matrix as a graph structure mask in the downstream task stage, overcoming the limitation of fixed structural information. Utilizing a multi-head attention mechanism, multiple credential association patterns can be captured in parallel. Leveraging the propagation characteristics of deep networks, multi-hop reasoning and high-order semantic fusion of credential risk features on the graph structure are achieved. Simultaneously, residual connections and layer normalization ensure the training stability of the deep graph network. By transforming discrete static analysis rules into feature aggregation constraints on a continuous semantic space, an organic unity of rule priors and deep learning capabilities is achieved, significantly enhancing the ability to identify complex and concealed privacy information leakage patterns.

[0088] Optionally, the post-image mask attention layer is located outside the pre-trained code language model and participates in the fine-tuning and inference process as an independent trainable task module.

[0089] Optionally, the scaled dot product attention score S for each attention head is calculated according to the following formula:

[0090] Where Q is the query matrix, K is the key matrix, and d_k is the feature dimension of each attention head.

[0091] Optionally, the attention scores are processed by graph structure masking based on the lightweight structure association matrix, including: expanding or broadcasting the lightweight structure association matrix to a dimension that matches the attention scores; for positions where A[i,j]=0 in the lightweight structure association matrix, applying a mask to the corresponding attention scores S[i,j] so that the attention weights at these positions after subsequent Softmax normalization approach 0; and for positions where A[i,j]=1 in the lightweight structure association matrix, retaining the corresponding attention scores for normalization calculation.

[0092] Optionally, attention weights are primarily distributed between the associated tokens and self-loop tokens indicated by the lightweight data flow adjacency matrix.

[0093] Optionally, the graph-aware hidden state of the current post-graph mask attention layer output is obtained by performing weighted summation on the value matrix according to the attention weights, merging and projecting the multi-head attention aggregation results, and performing residual connection and layer normalization processing. This includes: performing weighted summation on the value matrix V according to the attention weights, merging and projecting the multi-head attention aggregation results to obtain the graph aggregation output; and performing residual connection and layer normalization processing on the graph aggregation output to obtain the graph-aware hidden state of the current post-graph mask attention layer output.

[0094] Optionally, the graph aggregation output represents the structure-aware features of each token obtained by aggregating its associated tokens and its own tokens.

[0095] Optionally, the proportion of the aggregated output of the learnable gating parameter control graph that incorporates the hidden state input is expressed as:

[0096]

[0097] Where g is the learnable gating parameter, H is the hidden state input of the current post-graph mask attention layer, H` is the hidden state output of the current post-graph mask attention layer, graph_out is the graph aggregation output, and LayerNorm represents layer normalization.

[0098] In one specific embodiment, the number of attention heads and the number of stacked layers in the post-image mask attention layer can be 2. Masking can be achieved by setting the attention score corresponding to the position A[i,j]=0 to -1e9. The learnable gating parameter g can be initialized to 0. The above-mentioned number of attention heads, number of stacked layers, mask values, and parameter initialization methods are merely examples in a specific embodiment and do not constitute a limitation on the scope of protection.

[0099] Optionally, the graph-aware hidden state sequence is processed through one or more sequence modeling submodules. The hidden state input of the first layer is the graph-aware hidden state sequence, and the hidden state input of the next layer is the hidden state output of the previous layer. Based on the graph-aware hidden state sequence, a long-range dependency-aware hidden state sequence is obtained, including: performing layer normalization and one-dimensional convolution processing on the hidden state input of the current sequence modeling submodule to obtain local context features; performing sequence scanning along the forward and backward directions of the code segment to be detected based on the local context features to obtain bidirectional long-range dependency representations; determining the first gating coefficient based on the local context features and the bidirectional long-range dependency representations, and performing weighted fusion of the local context features and the bidirectional long-range dependencies based on the first gating coefficients to obtain a gated fusion representation; mapping the gated fusion representation to the same feature dimension as the hidden state input of the current sequence modeling submodule, and adding the mapping result to the residual of the hidden state input of the current sequence modeling submodule to obtain the hidden state output of the current sequence modeling submodule; wherein, the hidden state output of the last sequence modeling submodule is used as the long-range dependency-aware hidden state sequence.

[0100] In this embodiment, through the cascaded architecture of the sequence modeling submodule, feature extraction is further deepened based on graph-aware hidden states. One-dimensional convolution is used to capture local grammatical patterns of the code segment to be detected, and bidirectional sequence scanning is used to capture long-range contextual dependencies spanning lines, functions, and even code blocks, thus compensating for the shortcomings of pure graph structure modeling in continuous semantic understanding. By introducing a gating fusion mechanism based on the dynamic generation of local features and long-range representations, the degree of attention to local grammatical details and global logical dependencies can be adaptively adjusted, effectively addressing the challenges brought by diverse code styles. Simultaneously, pre-layer normalization and residual connections ensure the stability of deep network training. This embodiment achieves a seamless transition from jump-structure associations to continuous sequence semantics, significantly improving the accuracy of identifying privacy information leakage risks under complex code logic.

[0101] Optionally, one or more sequence modeling submodules constitute a sequence modeling module. The sequence modeling module is used to supplement the modeling of contextual relationships, cross-line dependencies, and cross-statement associations in the token sequence based on the data flow structure features, thereby obtaining a long-range dependency-aware latent state sequence.

[0102] In one specific embodiment, the sequence modeling module consists of two Mamba-style sequence modeling sub-modules connected in series. The Mamba-style sequence modeling sub-modules are used to represent a long program sequence modeling structure that combines local convolutional feature extraction, bidirectional cyclic scanning, and gated fusion, and are not limited to using the original Mamba state-space model kernel.

[0103] Optionally, the hidden state input of the current sequence modeling submodule is subjected to layer normalization and one-dimensional convolution processing to obtain local context features, including: performing layer normalization on the hidden state input of the current sequence modeling submodule to obtain a normalized hidden state sequence; and performing one-dimensional convolution processing on the normalized hidden state sequence along the sequence dimension to obtain local context features.

[0104] In one specific embodiment, normalizing the hidden state sequence can improve the training stability of subsequent sequence modeling processes. One-dimensional convolution can employ depthwise separable one-dimensional convolution to reduce the number of parameters and computational complexity. The kernel width of the depthwise separable one-dimensional convolution is 4.

[0105] Optionally, the code segment to be detected is scanned along both the forward and reverse directions using a bidirectional sequence modeling layer.

[0106] Optionally, the bidirectional sequence modeling layer can employ bidirectional gated recurrent units, bidirectional long short-term memory networks, state-space sequence models, linear recurrent structures, or other network structures capable of modeling long-distance sequence dependencies.

[0107] In one specific embodiment, the bidirectional sequence modeling layer employs bidirectional gated loop units to capture remote associations between variable declarations, variable assignments, string literals, configuration items, and function calls from both forward and backward order of code snippets.

[0108] Optionally, determining the first gating coefficient based on local context features and bidirectional long-range dependency representation includes: concatenating the local context features and bidirectional long-range dependency representation along the feature dimension, and generating the first gating coefficient through linear transformation and sigmoid activation function.

[0109] In one specific embodiment, the first gating coefficient is a vector gating coefficient per token and per feature dimension, used to adjust the contribution ratio of local convolutional features and bidirectional long-range dependency representations at each token position and each hidden state dimension, respectively.

[0110] Optionally, mapping the gated fusion representation to the same feature dimension as the hidden state input of the current sequence modeling submodule includes: linearly projecting the gated fusion representation input to the output of the gated fusion representation to map the gated fusion representation to the same feature dimension as the hidden state input.

[0111] Optionally, the hidden state output of the current sequence modeling submodule can be represented as:

[0112]

[0113]

[0114]

[0115]

[0116]

[0117] Where X represents the hidden state input of the current sequence modeling submodule, X` represents the hidden state output of the current sequence modeling submodule, X_norm is the normalized hidden state sequence, X_conv is the local context feature, X_rnn is the bidirectional long-range dependency representation, X_fused is the gated fusion representation, W_s and b_s are the learnable parameters of the gated generation layer, and OutProj represents the output linear projection layer.

[0118] Optionally, the long-range dependency-aware hidden state sequence and the graph-aware hidden state sequence have the same sequence length and feature dimension, so that the subsequent gated weighted fusion module can perform position-by-position fusion of the two.

[0119] In one specific embodiment, if the hidden state input contains padding positions, the output of the sequence modeling module is masked according to the attention_mask, and the hidden state corresponding to the padding position is set to zero to reduce the impact of padding tokens on subsequent fusion and classification results.

[0120] Alternatively, the masking can be performed according to the following formula:

[0121] Where H_m is the sequence of long-range dependent sensing hidden states. Positions with a value of 1 represent valid tokens, while positions with a value of 0 represent padding positions.

[0122] In one specific embodiment, the sequence modeling module includes two sequence modeling sub-modules. Each sequence modeling sub-module includes a layer normalization layer, a depthwise separable one-dimensional convolutional layer, a bidirectional gated recurrent unit layer, a gated fusion layer, an output linear projection layer, and a residual connection structure. The sequence modeling module can also be implemented using a state-space sequence model, a bidirectional long short-term memory network, a gated recurrent network, a convolutional sequence model, or a combination thereof. The number of layers, convolutional kernel width, and bidirectional sequence modeling structure described above are merely illustrative examples and do not constitute a limitation on the scope of protection.

[0123] Optionally, adaptive fusion of the graph-aware hidden state sequence and the long-range dependency-aware hidden state sequence is performed to obtain a fused hidden state sequence, including: concatenating the graph-aware hidden state sequence and the long-range dependency-aware hidden state sequence along the feature dimension to obtain a concatenated hidden state sequence; determining a second gating coefficient based on the concatenated hidden state sequence, and performing weighted fusion of the graph-aware hidden state sequence and the long-range dependency-aware hidden state sequence based on the second gating coefficient to obtain an intermediate fused hidden state sequence; and normalizing the intermediate fused hidden state sequence to obtain the fused hidden state sequence.

[0124] In this embodiment, by introducing a second gating coefficient dynamically generated based on splicing features, adaptive weighted fusion of graph-aware hidden state sequences and long-range dependency-aware hidden state sequences is achieved. It can intelligently adjust the contribution weights of structural association evidence and long-range semantic evidence according to the specific context of the code segment to be detected, effectively solving the problems of false positives caused by the safe use of sensitive variable names and false negatives caused by the dangerous use of non-sensitive variable names in privacy information detection. Simultaneously, by establishing deep nonlinear interactions between heterogeneous features through splicing operations and utilizing layer normalization to ensure the numerical stability of the fused features, it achieves joint decision-making beyond single feature modalities, significantly improving the accuracy and robustness of privacy information detection in complex code scenarios.

[0125] Optionally, a gated weighted fusion module can adaptively fuse the graph-aware hidden state sequence and the long-range dependency-aware hidden state sequence to obtain a fused hidden state sequence. The graph-aware hidden state sequence is used to represent the structure-aware features obtained based on the lightweight data flow adjacency matrix constraint; the long-range dependency-aware hidden state sequence is used to represent the long-distance sequence context features in the code snippet. Through gated weighted fusion, the model can adaptively adjust the contribution ratio of structure-aware features and long-range sequence features in the final representation according to the content features of different code snippets.

[0126] In one specific embodiment, the graph-aware hidden state sequence H_g and the long-range dependency-aware hidden state sequence H_m are concatenated along the feature dimension to obtain the concatenated hidden state sequence [H_g‖H_m]; the concatenated hidden state sequence is input into the gating generation layer to generate the second gating coefficient gate; based on the second gating coefficient gate, H_g and H_m are weighted and fused to obtain the intermediate fused hidden state sequence; the intermediate fused hidden state sequence is normalized to obtain the fused hidden state sequence H_f.

[0127] Alternatively, the fused hidden state sequence can be represented by the following formula:

[0128]

[0129] Where W_f and b_f are the learnable parameters of the gated generation layer.

[0130] In one specific embodiment, the second gating coefficient can be a vector gating coefficient per token and per feature dimension. In other embodiments, the second gating coefficient can also be a per-token scalar gating coefficient, a global scalar gating coefficient, or other learnable fusion weights. The above gating coefficients are merely illustrative and do not constitute a limitation on the scope of protection.

[0131] Optionally, the gated weighted fusion module is optimized together with the pre-trained code language model, post-graph mask attention module, sequence modeling module, and classification module during model training. Through training, the gating coefficients can adaptively adjust the fusion ratio of graph-aware features and long program sequence features based on the strength of structural associations and contextual semantic features in the code snippet.

[0132] Optionally, the fused hidden state sequence is pooled and classified to output the privacy information detection result of the code fragment to be detected, including: pooling the fused hidden state sequence to obtain a code fragment-level representation vector; regularizing the code fragment-level representation vector and determining a classification score vector based on the regularized code fragment-level representation vector; determining the privacy information detection result based on the classification score vector; wherein the privacy information detection result includes whether the code fragment to be detected has sensitive credential risk or not; if the code fragment to be detected has sensitive credential risk, risk information is generated and a security alarm is triggered; the risk information includes at least one of the following: code fragment source, file path, code line range, predicted label, risk category, confidence level, candidate hit position, posterior probability distribution of each category, or remediation suggestion.

[0133] In this embodiment, by performing pooling processing on the fused hidden state sequence, semantic features are aggregated into macroscopic code fragment-level representation vectors, adapting to the engineering requirements of code security auditing at the fragment level. The decoupling design of regularization processing and classification score vectors improves the clarity and generalization ability of classification decision boundaries. By outputting multi-dimensional structured risk information including file paths, code line ranges, confidence levels, and remediation suggestions, not only is accurate positioning of sensitive credential risks achieved, but clear remediation guidance is also provided to developers, significantly reducing vulnerability remediation costs. Furthermore, the confidence-based hierarchical alerting mechanism allows enterprises to flexibly balance security and development efficiency. Combined with batch scanning and report generation capabilities, it constitutes a closed-loop security solution covering the entire process of detection, alerting, and logging.

[0134] Optionally, the code fragment-level representation vector is used to characterize the overall risk semantics of the code fragment to be detected.

[0135] In one specific embodiment, the pooling process can employ initial token pooling, mask mean pooling, max pooling, attention pooling, or other sequential pooling methods.

[0136] Optionally, the classification score vector is determined based on the regularized code snippet-level representation vector, including: inputting the regularized code snippet-level representation vector into the classification layer and outputting the classification score vector. The classification layer can be a fully connected linear classification layer, a multilayer perceptron classification layer, or other trainable classification modules suitable for classification tasks.

[0137] Optionally, determining the privacy information detection result based on the classification score vector includes: performing Softmax normalization on the classification score vector to obtain the posterior probability distribution of each category; determining the predicted label according to the category corresponding to the maximum posterior probability, and outputting the maximum posterior probability as the confidence level.

[0138] Optionally, the prediction label corresponding to the risk of sensitive credentials is SENSITIVE; the prediction label corresponding to the risk of not having sensitive credentials is SAFE.

[0139] In one specific embodiment, pooling is performed using initial token pooling, that is, the hidden state vector corresponding to the token at the beginning of the fused hidden state sequence is selected as the code fragment-level representation vector. Regularization is performed using Dropout. The classification layer is a fully connected linear classification layer with an output dimension of 2, corresponding to the SAFE and SENSITIVE categories respectively. The final predicted label can be obtained by performing an argmax operation on the Softmax posterior probability distribution. The pooling method, regularization method, classification layer structure, and number of categories described above are merely examples in a specific embodiment and do not constitute a limitation on the scope of protection.

[0140] Optionally, candidate hit locations, code line ranges, and repair suggestions can be generated based on the source of the input fragment, word segmentation mapping relationships, rule-assisted results, or project configuration, and are optional output information; they do not require the model to perform character-level or token-level named entity recognition.

[0141] Optionally, in single-fragment detection mode, the computer device can output at least one of predicted labels, confidence levels, posterior probability distributions, or remediation suggestions. In batch scanning mode, the computer device can record the file path, fragment location, predicted labels, and confidence levels containing sensitive credentials risks, and generate structured scan results.

[0142] Optionally, if the code segment to be detected does not pose a risk of sensitive credentials, the computer device outputs a SAFE detection result; in batch scanning mode, the computer device continues to process subsequent code segments or subsequent code files until the detection of all objects to be detected is completed.

[0143] In one specific embodiment, the batch scanning mode can save the file path, predicted label, and confidence score of the SENSITIVE detection result as a JSON format scan report; the single-fragment detection mode can output the predicted label, confidence score, posterior probability distribution of each category, and remediation suggestions. The above report format and output fields are merely examples in specific embodiments and do not constitute a limitation on the scope of protection.

[0144] Optionally, the method for detecting privacy information in code snippets further includes: constructing a code snippet privacy information detection model; the input of the code snippet privacy information detection model is the code snippet to be detected, and the output is the privacy information detection result of the code snippet to be detected; wherein, the training dataset of the code snippet privacy information detection model is constructed as follows: obtaining code data with sensitive credential annotation information; extracting context code snippets according to the location of the sensitive credential to generate positive samples; wherein, setting one or more window offsets according to the location of the sensitive credential annotation to generate positive samples with different context locations; extracting context code snippets from locations that do not contain sensitive credential annotations to generate negative samples; wherein, the location of the negative sample is greater than the location of the sensitive credential annotation by a safe distance; writing the positive samples and negative samples into a snippet-level classification dataset, and dividing the snippet-level classification dataset into a training set and a validation set according to a preset ratio; wherein, during the training process of the code snippet privacy information detection model, at least one of the following is employed: hierarchical learning rate strategy, optimizer, learning rate scheduling, gradient accumulation, gradient pruning, or early stopping strategy.

[0145] In this embodiment, a specific training dataset construction strategy significantly improves the robustness and data quality of the model. Generating multi-position positive samples using window offsets forces the model to focus on credential ontology features rather than positional biases, enhancing its adaptability to long files and irregular code. Setting a safe distance between negative samples and sensitive labeled lines effectively reduces label noise and ensures the clarity of classification decision boundaries. During model training optimization, a hierarchical learning rate strategy is employed, preserving the general code semantic capabilities of the pre-trained model while accelerating the convergence of downstream task modules. Combined with gradient accumulation, gradient pruning, and early stopping strategies, the model's training stability and resource utilization efficiency are ensured under limited computing power.

[0146] Optionally, the code snippet privacy information detection model, through supervised training, can learn to distinguish between code snippets containing sensitive credentials risks and code snippets that do not detect sensitive credentials risks, based on the contextual semantic information, data flow structure information, and long-range dependency information of the code snippets.

[0147] Optionally, obtaining code data with sensitive credential annotation information includes: obtaining code data containing line-level annotations for sensitive credentials. Line-level annotations are used to indicate the line numbers in the code file that contain the actual sensitive credentials.

[0148] In one specific embodiment, the code data uses the publicly released code credential line-level annotation dataset CredData, and records with a GroundTruth value of true are selected as the sources of genuine credential annotations. For each genuine credential annotation record, its credential starting line number is used as the credential annotation line number.

[0149] In one specific embodiment, for each sensitive credential annotation record, its code file and the starting line number of the credential annotation are determined. Based on a preset set of window center offsets, one or more context windows are generated near the credential annotation line. Each context window covers several lines of code content before and after the offset center line, and is labeled as a positive sample. The window center offset set is {-10, 0, +10}, and each context window covers 25 lines of code content before and after the center line, ensuring that the credential annotation line remains within the generated context window range. Through this window offset method, the same credential annotation line can form training samples in different context positions, thereby improving the model's robustness to sensitive credentials appearing in different positions within a code segment.

[0150] In one specific embodiment, candidate regions at least M rows away from all sensitive credential annotation lines are selected from the same code file, and several code windows are randomly sampled from the candidate regions; the sampled code windows are labeled as negative samples. M is set to 30, and a maximum of 6 negative sample windows are sampled from each code file containing sensitive credential annotations. The random sampling process uses a fixed random seed of 42. By setting the minimum distance between the negative sample window and the known sensitive credential annotation lines, the probability of negative samples mistakenly containing real sensitive credentials can be reduced.

[0151] Optionally, it also includes deduplication or filtering of positive and negative samples.

[0152] In one specific embodiment, for multiple positive sample windows generated at different window center offsets for the same voucher label line, if their text content is exactly the same, only one positive sample window is retained. Samples in the positive and negative sample windows that do not meet the training requirements due to excessively short text after window truncation (e.g., sample windows with fewer than 5 words after word segmentation by whitespace characters) are filtered out. Deduplication is mainly used to reduce the impact of duplicate positive sample windows corresponding to the same voucher label line on the training process, while filtering is used to remove code snippets with insufficient information.

[0153] Optionally, in the fragment-level classification dataset, positive samples can retain their original fine-grained labels, including but not limited to PASSWORD, SECRET_KEY, API_KEY, OAUTH_TOKEN, and AWS_KEY; negative samples are labeled SAFE. During model training, the training script keeps the SAFE label as category 0 and uniformly maps all non-SAFE fine-grained labels to SENSITIVE category 1, thus constituting a fragment-level binary classification training task. Therefore, the dataset construction phase retains the fine-grained credential label information of positive samples, while the model training phase transforms credential fine-grained type identification into binary classification detection of whether a code fragment contains sensitive credential risk.

[0154] In one specific embodiment, a fixed random seed 42 is used to randomly shuffle all samples, and the training set and validation set are divided in a 9:1 ratio. The division method is ordinary random partitioning, not explicit hierarchical partitioning. The above partitioning ratio and random seed are merely example values ​​for this implementation and do not constitute a limitation on the scope of protection.

[0155] Optionally, the code snippet privacy information detection model is trained under supervision. During training, the word token sequence input_ids, attention mask attention_mask, and optional token-level data stream adjacency matrix adj_matrix corresponding to the snippet-level training samples are input into the model to obtain the classification score vector logits; the training loss is calculated based on logits and binary classification labels, and the model parameters are updated through backpropagation.

[0156] In one specific embodiment, the training loss employs cross-entropy loss with class weights and incorporates label smoothing with a smoothing coefficient of 0.1. The class weights are calculated and normalized based on the inverse ratio of the number of SAFE and SENSITIVE class samples in the training data to mitigate the impact of class imbalance on model training.

[0157] In one specific embodiment, the pre-trained code language model uses GraphCodeBERT, whose encoder includes 12 Transformer encoding layers. During training, the embedding layer and the bottom 0 to 5 encoding layers are frozen, and only the 6 to 11 encoding layers and the parameters of the task-specific modules are updated. The task-specific modules include a graph mask attention layer, a sequence modeling module, a gating fusion module, a layer normalization module, and a classification layer. By freezing the bottom encoding layers of the pre-trained code language model, the basic code representation capability of the pre-trained model can be preserved, and the training computational cost can be reduced. By updating the higher-level encoding layers and the task-specific modules, the model can be adapted to the code fragment sensitive credential detection task.

[0158] In one specific embodiment, the unfrozen pre-trained code language model encoding layer adopts a first learning rate of 2×10⁻⁶. -5 The task-specific module uses a second learning rate of 1×102. -4 Therefore, the learning rate of the task-specific module is 5 times that of the learning rate of the unfreezing layer of the pre-trained model, so that the task-specific module can adapt to the downstream detection task more quickly, while avoiding excessive parameter perturbation to the pre-trained encoding layer.

[0159] In one specific embodiment, the optimizer uses AdamW with a weight decay coefficient set to 0.01; the learning rate scheduling employs a combination of Linear Warmup and Cosine Annealing strategies; gradient accumulation is used during training to simulate a larger effective batch size under memory-constrained conditions; gradient pruning is performed before parameter updates, with the maximum gradient norm set to 1.0 to improve training stability. If the validation set Macro F1 score does not improve for three consecutive epochs, EarlyStopping is triggered, prematurely terminating the training process.

[0160] In one specific implementation, after each epoch, Macro F1 and Weighted F1 are calculated on the validation set, and a classification report is generated; Macro F1 is used as the main indicator for optimal model saving and early stopping judgment. When the Macro F1 of the current epoch is better than the historical best value, the current model parameters are saved as the optimal model parameter file best_model.pt.

[0161] By using the above-mentioned training dataset construction method and training optimization strategy, code credential line-level labeled data can be converted into code fragment samples suitable for fragment-level classification and binary classification training. Furthermore, by employing class weights, label smoothing, parameter freezing, hierarchical learning rates, learning rate scheduling, gradient accumulation, gradient pruning, and early stopping strategies, the model training stability and detection performance can be improved.

[0162] The code snippet privacy information detection model constructed through the above steps can be applied to practical security testing scenarios. The objects to be detected can include source code files, configuration files, environment variable files, script files, build files, log files, or other text files that may contain sensitive credentials. Application modes include at least one of single-snippet detection mode, batch file scanning mode, and optional rule detection mode. These application modes are applicable to scenarios such as single-snippet code detection, directory-level code repository scanning, configuration file auditing, log file inspection, and rule-assisted filtering, thereby achieving automatic identification and result recording of sensitive credential risks in code and related text files.

[0163] Optionally, in single-fragment detection mode, the computer device receives a code fragment or text to be detected input by the user, and calls the aforementioned code fragment privacy information detection model to perform detection, outputting at least one of a predicted label, confidence score, or posterior probability distribution for each category. When the predicted label is SENSITIVE, the computer device can output a sensitive credential risk warning; when the predicted label is SAFE, the computer device can output a result indicating that no sensitive credential risk was detected. In an optional implementation, remediation suggestions can also be output according to the engineering configuration.

[0164] Optionally, in batch file scanning mode, the computer device receives the target directory path and traverses the files to be detected in the target directory according to preset file type conditions. The preset file type conditions may include file extension, file size, file encoding format, file path rules, or combinations thereof. For each file to be detected, the computer device can generate one or more code fragments to be detected based on the file content, and call the aforementioned code fragment privacy information detection model for detection respectively. When the detection result of any code fragment is SENSITIVE, the computer device can record the corresponding file or code fragment as a risk object. In an optional implementation, when the file length exceeds the preset maximum input length, at least one of the following methods can be used to generate the code fragments to be detected: truncation, segmentation, sliding window, function boundary splitting, configuration block splitting, or log block splitting.

[0165] Optionally, the computer device can also be configured with a rule detection module. This module can quickly filter content to be detected based on sensitive keywords, regular expressions, credential format rules, or entropy thresholds. The rule detection module can run independently or serve as a pre-filter for the code snippet privacy information detection model. When the pre-filtering method is enabled, the computer device can determine whether to invoke the code snippet privacy information detection model for further judgment based on rule hit results, file type, text length, or risk priority.

[0166] In one specific embodiment, after the detection is completed, the computer device can output the scan results. The scan results may include at least one of the following: scan status, risk file list, file path, code snippet location, predicted label, risk category, confidence level, posterior probability distribution of each category, or structured scan report path. When no sensitive credential risk is detected, the computer device can output a SAFE scan result or an empty risk list. Batch scan mode can write the file path, predicted label, and confidence level of the detected file as SENSITIVE into the risk file list and save it as a JSON format scan report. The above report format and output fields are only examples in specific embodiments and do not constitute a limitation on the scope of protection.

[0167] The method for detecting privacy information in code snippets provided in this disclosure is applicable to the detection of sensitive credentials at the code snippet level in source code, configuration files, environment variable files, script files, and log files. It can automatically determine whether a code snippet contains sensitive credential risks and output corresponding detection results without relying on a complete compiler, complete project dependencies, or large-scale re-pre-training. This method comprehensively utilizes code context semantics, credential scenario-related structural associations, and long-distance sequence dependencies. This disclosure can transform variable names, configuration keys, assignment symbols, sensitive identifiers, definition locations, usage locations, and key-value pair structures in code snippets into a token-level lightweight structural association representation suitable for model processing. This overcomes the shortcomings of pure rule scanning, which cannot utilize context semantics, and pure sequence models, which struggle to explicitly model variable associations. Furthermore, without changing the basic pre-trained code language model structure or re-performing large-scale pre-training, the aforementioned token-level lightweight structural association representation is injected into the downstream detection model using a post-graph mask attention approach, enabling the model to perform structure-aware feature aggregation between credential-related tokens. Finally, it can adaptively fuse the contextual semantic representation obtained from the pre-trained code language model, the structure-aware representation obtained from the post-graph mask attention, and the long-range dependency representation obtained from the sequence modeling module, thereby improving the model's ability to distinguish between hard-coded credentials, cross-statement reference credentials, configuration key-value pair credentials, and placeholders or secure reading methods.

[0168] In one specific embodiment, a fragment-level training sample is constructed using a publicly available code credential annotation dataset, and the samples are divided into a training set and a validation set according to a preset ratio. Specifically, the publicly available code credential annotation dataset can be the Samsung CredData dataset. During the training phase, the SAFE label is used as the first category, and non-SAFE fine-grained credential labels are uniformly mapped to the SENSITIVE category, thus forming a fragment-level binary classification detection task. In this experimental implementation, the validation set contains 2452 code fragment samples. The following detection results were obtained on the validation set: Macro F1=89.9%, Weighted F1=91.7%, Accuracy=92.0%, SENSITIVE class Precision=95%, SENSITIVE class Recall=93%, SAFE class F1=86%. The above experimental results show that the present embodiment has good overall detection performance in the code fragment sensitive credential detection task. Specifically, the SENSITIVE class Precision and Recall indicate that the embodiments of this disclosure have good identification capabilities for code fragments containing sensitive credentials risks; Macro F1 and Weighted F1 indicate that the embodiments of this disclosure have good comprehensive classification performance on different categories of samples. The inference process of the embodiments of this disclosure can run on computing devices with local acceleration capabilities and supports offline detection, thus facilitating its application in enterprise intranet code auditing, directory-level batch scanning, and continuous integration detection processes.

[0169] Combination Figure 5As shown, this disclosure provides an apparatus 500 for detecting privacy information in code fragments, including an input processing module 501, a context encoding module 502, a lightweight data stream construction module 503, a post-graph mask attention module 504, a sequence modeling module 505, a gating fusion module 506, and a classification output module 507. The input processing module 501 is configured to perform word segmentation on the code fragment to be detected, obtaining a word sequence, an attention mask, and a target mapping relationship between the words and the original code segmentation units. The context encoding module 502 is configured to obtain a contextual hidden state sequence based on the word sequence and the attention mask. The lightweight data stream construction module 503 is configured to perform lightweight static analysis on the code fragment to be detected and construct a lightweight structural association matrix based on the target mapping relationship. The post-graph mask attention module 504 is configured to superimpose a post-graph mask attention layer on the contextual hidden state sequence and use the lightweight structural association matrix as a graph structure mask to obtain a graph-aware hidden state sequence. The sequence modeling module 505 is configured to obtain a long-range dependency-aware hidden state sequence based on the graph-aware hidden state sequence. The gating fusion module 506 is configured to adaptively fuse the graph-aware hidden state sequence and the long-range dependency-aware hidden state sequence to obtain a fused hidden state sequence. The classification output module 507 is configured to perform pooling and classification processing on the fused hidden state sequence and output the privacy information detection results of the code fragment to be detected.

[0170] The apparatus for detecting privacy information in code fragments provided in this disclosure improves the adaptability of sensitive credential detection scenarios, enhances the ability to perceive credential-related code structural relationships, reduces reliance on complete program analysis and large-scale re-pre-training, improves detection capabilities in complex credential scenarios, enhances modeling capabilities for long-distance contextual dependencies, improves the fusion effect of structural features and sequence semantic features, and improves the usability of engineered security scanning. The detection targets of this apparatus are no longer limited to natural language text, but extend to sensitive credential detection in source code files, configuration files, environment variable files, script files, build files, and log files. By determining whether a code fragment contains sensitive credential risks through fragment-level classification, it reduces reliance on character-level or token-level fine-grained annotation, making it more suitable for engineering scenarios such as code auditing, CI / CD pipelines, and local batch scanning. Based on variable names, constant names, configuration keys, assignment symbols, sensitive identifiers, and the occurrence relationship of the same target identifier, the apparatus constructs a token-level lightweight data flow adjacency matrix, enabling the model to utilize task-related structural information such as variable definition-usage associations, the occurrence association of the same target identifier, and key-value associations. Compared to schemes that rely solely on linear token sequence modeling, this device better expresses the structural relationships within code snippets related to sensitive credential risks. It employs a lightweight static analysis approach to construct a lightweight data flow adjacency matrix relevant to the task, without relying on a complete compilation environment, complete project dependencies, or complete abstract syntax tree parsing. Simultaneously, the device uses this lightweight data flow adjacency matrix as input to a graph structure mask in a subsequent graph mask attention layer. This injects credential detection scenario-related structural information into the downstream detection model without altering the underlying pre-trained code language model structure, thereby reducing engineering deployment and model modification costs. Instead of modeling all variable relationships indiscriminately, the device filters target variables, constant names, or configuration keys based on sensitive identifiers such as key, secret, token, password, credential, auth, and jwt, and constructs lightweight relational edges around their definition locations, usage locations, and key-value structures. As a result, the model can focus more on code elements related to sensitive credential risks, reducing the interference of irrelevant variable relationships on the detection results. This device further introduces a sequence modeling module on top of graph-aware hidden state sequences to model cross-line, cross-statement, and long-distance context dependencies in code snippets. For scenarios where sensitive credentials are first assigned to variables and then encapsulated through referencing, parameter passing, concatenation, or configuration items to represent risk, this device can improve the model's ability to express the relationships between scattered code elements. The device uses a learnable gating fusion module to adaptively weight and fuse graph-aware features and long program sequence features.Therefore, the model can automatically adjust the contribution ratio of lightweight structural association information and contextual sequence semantic information in the final representation based on the content characteristics of different code fragments, thereby improving its adaptability to multiple languages, multiple file types, and various credential representation formats. The device supports application modes such as single-fragment detection, batch file scanning, and optional rule pre-screening, and can output predicted labels, risk categories, confidence levels, and structured scan results. Therefore, this device is suitable for scenarios such as code repository auditing, configuration file inspection, log file inspection, and continuous integration pipeline security checks.

[0171] Combination Figure 6 As shown, this disclosure provides another apparatus 600 for detecting privacy information in code fragments, including a processor 601 and a memory 602. Optionally, the apparatus may further include a communication interface 603 and a bus 604. The processor 601, communication interface 603, and memory 602 can communicate with each other via the bus 604. The communication interface 603 can be used for information transmission. The processor 601 can invoke logical instructions in the memory 602 to execute the method for detecting privacy information in code fragments described in the above embodiments.

[0172] Furthermore, the logic instructions in the aforementioned memory 602 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium.

[0173] The memory 602, as a computer-readable storage medium, can be used to store software programs and computer-executable programs, such as program instructions / modules corresponding to the methods in the embodiments of this disclosure. The processor 601 executes functional applications and data processing by running the program instructions / modules stored in the memory 602, that is, it implements the method for detecting privacy information in code fragments in the above embodiments.

[0174] The memory 602 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the terminal device. Furthermore, the memory 602 may include high-speed random access memory and may also include non-volatile memory.

[0175] This disclosure provides an electronic device, including: an electronic device body, and the aforementioned device for detecting privacy information in code fragments. The device for detecting privacy information in code fragments is installed in the electronic device body. The installation relationship described herein is not limited to placement inside the electronic device, but also includes installation connections with other components of the electronic device, including but not limited to physical connections, electrical connections, or signal transmission connections. Those skilled in the art will understand that the device for detecting privacy information in code fragments can be adapted to feasible electronic device bodies to achieve other feasible embodiments.

[0176] This disclosure provides a computer-readable storage medium storing computer-executable instructions configured to perform the method described above for detecting privacy information in code fragments.

[0177] The technical solutions of this disclosure can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes one or more instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in this disclosure. The aforementioned storage medium can be a non-transitory storage medium, including: a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and other media capable of storing program code.

[0178] The foregoing description and accompanying drawings fully illustrate embodiments of this disclosure to enable those skilled in the art to practice them. Other embodiments may include structural, logical, electrical, procedural, and other changes. The embodiments represent only possible variations. Individual components and functions are optional unless explicitly required, and the order of operation may vary. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. Moreover, the terminology used in this application is for describing embodiments only and is not intended to limit the technical solutions described herein. As used in the technical solutions described herein, the singular forms “a,” “an,” and “the” are intended to equally include the plural forms unless the context clearly indicates otherwise. Similarly, the term “and / or” as used herein refers to any and all possible combinations of one or more of the associated listed elements. Additionally, when used in this application, the term "comprise" and its variations "comprises" and / or "comprising" refer to the presence of stated features, integrals, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof. Without further limitations, an element defined by the phrase "comprises a..." does not exclude the presence of other identical elements in the process, method, or apparatus that includes said element. In this document, each embodiment may focus on the differences from other embodiments, and similar or identical parts between embodiments can be referred to mutually. For methods, products, etc., disclosed in the embodiments, if they correspond to the method section disclosed in the embodiments, the relevant parts can be referred to the description of the method section.

[0179] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments of this disclosure. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0180] The methods and products disclosed in the embodiments herein (including but not limited to devices and equipment) can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units may be merely a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to implement this embodiment according to actual needs. In addition, the functional units in the embodiments of this disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0181] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than that shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. In the descriptions corresponding to the flowcharts and block diagrams in the accompanying drawings, the operations or steps corresponding to different blocks may also occur in a different order than disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. Each block in a block diagram and / or flowchart, and combinations of blocks in a block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

Claims

1. A method for detecting privacy information in code snippets, characterized in that, include: The code fragment to be detected is segmented and statically analyzed to obtain the contextual hidden state sequence and lightweight structure association matrix. A post-graph mask attention layer is superimposed on the contextual hidden state sequence, and a lightweight structured correlation matrix is ​​used as the graph structure mask to obtain the graph-aware hidden state sequence. Based on the graph-aware hidden state sequence, the long-range dependency-aware hidden state sequence is obtained, and the graph-aware hidden state sequence and the long-range dependency-aware hidden state sequence are adaptively fused to obtain the fused hidden state sequence. The fused hidden state sequence is pooled and classified to output the privacy information detection results of the code fragment to be detected.

2. The method according to claim 1, characterized in that, The code snippet to be detected is segmented and statically analyzed to obtain the contextual hidden state sequence and lightweight structure association matrix, including: The code fragment to be detected is processed by word segmentation to obtain the word sequence, attention mask, and target mapping relationship between the words and the original code segmentation units; Based on the word sequence and attention mask, obtain the contextual hidden state sequence; Lightweight static analysis is performed on the code snippet to be detected, and a lightweight structural correlation matrix is ​​constructed based on the target mapping relationship.

3. The method according to claim 2, characterized in that, The lightweight structured association matrix includes a lightweight data flow adjacency matrix; Lightweight static analysis is performed on the code snippet to be detected, and a lightweight structural correlation matrix is ​​constructed based on the target mapping relationship, including: The code snippet to be detected is subjected to variable assignment statement identification and sensitive identifier filtering to obtain a set of target identifiers; Based on the target identifier name, the occurrence records of the target identifier in the code segment to be detected are grouped to obtain multiple identifier groups; For each identifier group, construct the original code segmentation unit level edge set, and map the original code segmentation unit level edge set to the target edge set according to the target mapping relationship; Fill the target edge set into the initial lightweight data flow adjacency matrix to obtain the target lightweight data flow adjacency matrix.

4. The method according to claim 1, characterized in that, The graph-aware hidden state sequence includes one or more post-graph mask attention layers. The hidden state input of the first layer is the context hidden state sequence, and the hidden state input of the next layer is the hidden state output of the previous layer. A post-graph mask attention layer is superimposed on the contextual hidden state sequence, and a lightweight structured correlation matrix is ​​used as the graph structure mask to obtain the graph-aware hidden state sequence, including: A linear transformation is performed on the hidden state input of the current post-image mask attention layer to obtain the query matrix, key matrix, and value matrix, and the query matrix, key matrix, and value matrix are divided into one or more attention heads; For each attention head, an attention score is calculated, and the attention score is then processed by graph structure masking based on the lightweight structure correlation matrix and then normalized to obtain the attention weights under graph structure constraints. The value matrix is ​​weighted and summed according to the attention weights, and the multi-head attention aggregation results are merged and projected, as well as residual connection and layer normalization processing, to obtain the graph-aware hidden state output by the current post-graph mask attention layer. The graph-aware hidden state output by the current post-graph mask attention layer is used as the hidden state input for the next post-graph mask attention layer. This process continues until all the graph-aware hidden states output by the post-graph mask attention layers are obtained, resulting in a graph-aware hidden state sequence.

5. The method according to claim 1, characterized in that, The graph-aware hidden state sequence is processed by one or more sequence modeling submodules. The hidden state input of the first layer is the graph-aware hidden state sequence, and the hidden state input of the next layer is the hidden state output of the previous layer. Based on the graph-aware hidden state sequence, the long-range dependency-aware hidden state sequence is obtained, including: The hidden state input of the current sequence modeling submodule is processed by layer normalization and one-dimensional convolution to obtain local context features; Based on local context features, the code segment to be detected is scanned sequentially along the forward and reverse directions to obtain a bidirectional long-range dependency representation. The first gating coefficient is determined based on the local context features and the bidirectional long-range dependency representation, and the local context features and the bidirectional long-range dependency are weighted and fused based on the first gating coefficient to obtain the gated fused representation; The gated fusion representation is mapped to the same feature dimension as the hidden state input of the current sequence modeling submodule, and the mapping result is added to the residual of the hidden state input of the current sequence modeling submodule to obtain the hidden state output of the current sequence modeling submodule. In this approach, the hidden state output of the last-layer sequence modeling submodule is used as the long-range dependency-aware hidden state sequence.

6. The method according to claim 1, characterized in that, Adaptive fusion of graph-aware hidden state sequences and long-range dependency-aware hidden state sequences yields a fused hidden state sequence, including: The graph-aware hidden state sequence and the long-range dependency-aware hidden state sequence are concatenated along the feature dimension to obtain the concatenated hidden state sequence. The second gating coefficient is determined based on the spliced ​​hidden state sequence, and the graph-aware hidden state sequence and the long-range dependency-aware hidden state sequence are weighted and fused based on the second gating coefficient to obtain the intermediate fused hidden state sequence. The intermediate fusion hidden state sequence is normalized to obtain the fusion hidden state sequence.

7. The method according to claim 1, characterized in that, The fused hidden state sequence is pooled and classified to output the privacy information detection results of the code fragment to be detected, including: The fused hidden state sequence is pooled to obtain a code fragment-level representation vector; The code snippet-level representation vector is regularized, and the classification score vector is determined based on the regularized code snippet-level representation vector. The privacy information detection result is determined based on the classification score vector; The privacy information detection results include whether the code segment to be detected has a risk of sensitive credentials or not; if the code segment to be detected has a risk of sensitive credentials, risk information is generated and a security alarm is triggered; the risk information includes at least one of the following: source of code segment, file path, code line range, predicted label, risk category, confidence level, candidate hit position, posterior probability distribution of each category or remediation suggestion.

8. The method according to any one of claims 1 to 7, characterized in that, Also includes: Construct a code snippet privacy information detection model; the input of the code snippet privacy information detection model is the code snippet to be detected, and the output is the privacy information detection result of the code snippet to be detected; the training dataset of the code snippet privacy information detection model is constructed as follows: Retrieve code data with sensitive credentials annotation information; The context code snippet is extracted based on the location of the sensitive credentials to generate positive samples; one or more window offsets are set according to the location of the sensitive credentials to generate positive samples with different context locations; Negative samples are generated by extracting context code snippets from locations that do not contain sensitive credential annotations; the location of the negative sample is greater than the safe distance from the location of the sensitive credential annotation. Positive and negative samples are written into the fragment-level classification dataset, and the fragment-level classification dataset is divided into training and validation sets according to a preset ratio. Among them, at least one of the following strategies is used in the training process of the code snippet privacy information detection model: hierarchical learning rate strategy, optimizer, learning rate scheduling, gradient accumulation, gradient pruning or early stopping strategy.

9. An apparatus for detecting privacy information in code fragments, comprising a processor and a memory storing program instructions, characterized in that, The processor is configured to, when executing the program instructions, perform the method for detecting privacy information in code fragments as described in any one of claims 1 to 8.

10. An electronic device, characterized in that, include: The electronic device itself; The apparatus for detecting privacy information in code fragments as described in claim 9 is installed on the electronic device itself.

Images