Long code vulnerability repair system, method, terminal and storage medium based on structure perception and vulnerability guidance

Abstract

The application relates to the computer technical field, and discloses a long code vulnerability repair system and method based on structure perception and vulnerability guidance, a terminal and a storage medium, which can improve the accuracy of long code vulnerability repair. The system comprises a code acquisition module, a structure modeling module, an encoder structure perception enhancement module and a vulnerability guidance decoding module, wherein the code acquisition module is used for acquiring a long code to be repaired and a repair mark; the structure modeling module is used for determining a vulnerability dependency sequence based on a control flow, a data flow and a control dependency relationship of the long code to be repaired; the encoder structure perception enhancement module is used for performing feature enhancement processing on the long code to be repaired by using multiple encoders to obtain a global feature vector; and the vulnerability guidance decoding module is used for performing vulnerability focusing and repair processing on the repair mark, the global feature vector and the vulnerability dependency sequence by using multiple decoders to obtain target repair code corresponding to the long code to be repaired.

Description

Technical Field

[0001] This application relates to the field of computer technology. More specifically, this application relates to a long code vulnerability remediation system, method, terminal, and storage medium based on structure awareness and vulnerability guidance. Background Technology

[0002] Existing code vulnerability remediation systems typically include a truncation module and a repair module. The truncation module is used to forcibly truncate long code exceeding the window length using header or tail truncation to obtain the truncated code block. The repair module is used to repair the truncated code block to obtain the repaired code. However, remediating real-world vulnerabilities often relies on long-distance information across statements and code blocks. For example, fixing a buffer overflow vulnerability requires understanding the variable definition at the beginning of a function, the assignment path in the middle, and how the vulnerability point is used. When this critical dependency information is outside the truncation area, the system will directly fail to understand the root cause of the vulnerability, generating incorrect patching and thus incorrect repaired code. This reduces the accuracy of long code vulnerability remediation.

[0003] Furthermore, existing code vulnerability remediation systems utilize the Transformer's self-attention mechanism when patching long code vulnerabilities. However, due to the presence of numerous redundant code segments unrelated to the vulnerability within long code snippets, this Transformer self-attention mechanism suffers from attention dilution when processing long sequences. Attention dilution occurs when attention is scattered by a large amount of noise, making it impossible to accurately focus on the vulnerable code region. While existing systems attempt to guide the system's attention by marking the location of vulnerable lines, this linear sequence-based guidance method does not consider the inherent structural dependencies within the code. When the vulnerability's dependency paths are distributed at distant sequence locations, a fixed range of guidance cannot cover the complete context required for remediation, failing to fundamentally solve the attention dilution problem. Consequently, the remediation accuracy remains low, failing to meet the needs of practical applications. Summary of the Invention

[0004] The purpose of this application is to provide a long code vulnerability remediation system, method, terminal, and storage medium based on structure awareness and vulnerability guidance, which can improve the accuracy of long code vulnerability remediation. This application is mainly achieved through the following technical solutions: A first aspect of this application provides a long code vulnerability remediation system based on structure awareness and vulnerability guidance, including a code acquisition module, a structure modeling module, an encoder structure awareness enhancement module, and a vulnerability guidance decoding module, wherein... The code acquisition module is used to acquire the long code to be repaired and the repair marker; The structural modeling module is used to determine the vulnerability dependency sequence based on the control flow, data flow, and control dependencies of the long code to be repaired. The encoder structure awareness enhancement module is used to perform feature enhancement processing on the long code to be repaired using multiple encoders to obtain a global feature vector. The vulnerability-guided decoding module is used to perform vulnerability focusing and repair processing on the repair marker, the global feature vector, and the vulnerability dependency sequence using multiple decoders to obtain the target repair code corresponding to the long code to be repaired.

[0005] According to one embodiment of this application, the structural modeling module includes a graph construction module, a directional slicing module, and a vulnerability dependency sequence composition module, wherein, The graph construction module is used to perform dependency graph construction processing on the control flow, data flow and control dependencies of the long code to be repaired, and obtain the target dependency graph. The targeted slicing module is used to slice the target dependency graph using a differentiated targeted slicing strategy to obtain a target subgraph; The vulnerability dependency sequence construction module is used to map the vulnerability dependency distance of each node in the target subgraph to a token-level vulnerability dependency distance vector aligned with the token sequence by character range matching, and to construct the vulnerability dependency sequence from all token-level vulnerability dependency distance vectors.

[0006] According to one embodiment of this application, when the plurality of encoders includes a first encoder and a second encoder, the encoder structure perception enhancement module includes a first structure perception enhancement module and a second structure perception enhancement module, wherein... The first structure-aware enhancement module is used to perform feature enhancement processing on the long code to be repaired using the first encoder to obtain a first feature vector to be processed; The second structure-aware enhancement module is used to perform feature enhancement processing on the first feature vector to be processed using the second encoder to obtain the global feature vector.

[0007] According to one embodiment of this application, the first structure-aware enhancement module includes a first attention feature extraction module, a first feature fusion and feature normalization module, and a first feature enhancement submodule, wherein... The first attention feature extraction module is used to perform attention feature extraction processing on the long code to be repaired using the first multi-head self-attention layer of the first encoder to obtain a second feature vector to be processed; The first feature fusion and feature standardization module is used to perform feature fusion and feature standardization on the second feature vector to be processed and the long code to be repaired using the first residual connection and normalization layer of the first encoder to obtain a third feature vector to be processed. The first feature enhancement submodule is used to perform feature enhancement processing on the third feature vector to be processed using the first feedforward network layer of the first encoder to obtain the first feature vector to be processed.

[0008] According to one embodiment of this application, when the plurality of decoders includes a first decoder and a second decoder, the vulnerability boot decoding module includes a first vulnerability repair module and a second vulnerability repair module, wherein, The first vulnerability repair module is used to perform vulnerability focusing and repair processing on the repair marker, the global feature vector and the vulnerability dependency sequence using the first decoder to obtain the code to be improved; The second vulnerability repair module is used to perform vulnerability focusing and repair processing on the code to be improved, the global feature vector and the vulnerability dependency sequence using the second decoder, so as to obtain the target repair code corresponding to the long code to be repaired.

[0009] According to one embodiment of this application, the first vulnerability repair module includes a second attention feature extraction module, a second feature fusion and feature standardization module, a first cross-attention module, a third feature fusion and feature standardization module, and a second feature enhancement submodule, wherein... The second attention feature extraction module is used to perform attention feature extraction processing on the repair marker using the second multi-head self-attention layer of the first decoder to obtain a fourth feature vector to be processed; The second feature fusion and feature standardization module is used to perform feature fusion and feature standardization on the fourth feature vector to be processed and the repair mark using the second residual connection and normalization layer of the first decoder to obtain the fifth feature vector to be processed; The first cross-attention module is used to perform vulnerability focusing and repair processing on the fifth feature vector to be processed, the global feature vector and the vulnerability dependency sequence using the first multi-head cross-attention layer of the first decoder, to obtain the sixth feature vector to be processed; The third feature fusion and feature standardization module is used to perform feature fusion and feature standardization on the sixth and fifth feature vectors to be processed using the third residual connection and normalization layer of the first decoder to obtain the seventh feature vector to be processed. The second feature enhancement submodule is used to perform feature enhancement processing on the seventh feature vector to be processed using the second feedforward network layer of the first decoder to obtain the code to be improved.

[0010] According to one embodiment of this application, the encoder structure awareness enhancement module further includes a third structure awareness enhancement module, which is used to perform vulnerability dependency strength prediction processing on the vulnerability dependency sequence using a vulnerability dependency strength predictor to obtain a target vulnerability dependency strength label corresponding to each element in the vulnerability dependency sequence.

[0011] A second aspect of this application provides a long code vulnerability remediation method based on structure awareness and vulnerability guidance, comprising: Get the long code to be repaired and the repair markers; The vulnerability dependency sequence is determined based on the control flow, data flow, and control dependencies of the long code to be repaired; Multiple encoders are used to perform feature enhancement processing on the long code to be repaired to obtain a global feature vector; Multiple decoders are used to perform vulnerability focusing and repair processing on the repair marker, the global feature vector, and the vulnerability dependency sequence to obtain the target repair code corresponding to the long code to be repaired.

[0012] A third aspect of this application provides a terminal device, including a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory to perform the steps of the long code vulnerability repair method based on structure awareness and vulnerability guidance provided in the second aspect of this application.

[0013] A fourth aspect of this application provides a computer-readable storage medium for storing a computer program that causes a computer to perform the steps of the long code vulnerability remediation method based on structure awareness and vulnerability guidance provided in the second aspect of this application.

[0014] The beneficial effects of the embodiments of this application include: The long code vulnerability remediation system based on structure awareness and vulnerability guidance designed in this application includes a code acquisition module, a structure modeling module, an encoder structure awareness enhancement module, and a vulnerability guidance decoding module. More specifically, the code acquisition module acquires the long code to be repaired and repair markers; the structure modeling module determines the vulnerability dependency sequence based on the control flow, data flow, and control dependencies of the long code to be repaired; the encoder structure awareness enhancement module uses multiple encoders to perform feature enhancement processing on the long code to be repaired to obtain a global feature vector; and the vulnerability guidance decoding module uses multiple decoders to perform vulnerability focusing and repair processing on the repair markers, the global feature vector, and the vulnerability dependency sequence to obtain the target repair code corresponding to the long code to be repaired. Compared with existing technologies, this application abandons the method of forced truncation at the head or tail, and designs a structure modeling module to determine the vulnerability dependency sequence based on control flow, data flow, and control dependencies, thereby achieving the goal of completely preserving the long-distance key dependency information of the vulnerability, avoiding the loss of key information from the root, and thus generating more accurate repaired code, improving the accuracy of long code vulnerability remediation. Furthermore, this application embodiment designs a vulnerability guidance decoding module to achieve vulnerability focusing and remediation processing. As a result, this application embodiment can accurately focus on the vulnerability area, solve the problem of distraction in long code, and thus improve the accuracy of long code vulnerability remediation. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of this application or the conventional technology, the drawings used in the description of the embodiments or the conventional technology will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a block diagram illustrating the principle of the long code vulnerability remediation system based on structure awareness and vulnerability guidance in some embodiments of this application; Figure 2 This is a framework reference diagram for some embodiments of the long code vulnerability remediation system based on structure awareness and vulnerability guidance of this application; Figure 3 The following is a framework reference diagram for the structure-aware and vulnerability-guided long code vulnerability remediation system of this application in some other embodiments; Figure 4 This is the target dependency graph of this application; Figure 5 This is a reference diagram showing the vulnerability context slices in this application; Figure 6 The token-level vulnerability in this application relies on distance labeling to construct a graph; Figure 7 The flowcharts for some embodiments of the long code vulnerability remediation method based on structure awareness and vulnerability guidance of this application are shown below; Figure 8 This is a schematic block diagram of the terminal device of this application in some embodiments. Detailed Implementation

[0017] To make the above-mentioned objectives, features, and advantages of this application more apparent and understandable, the specific embodiments of this application are described in detail below with reference to the accompanying drawings. Many specific details are set forth in the following description to provide a thorough understanding of this application. However, this application can be implemented in many other ways different from those described herein, and those skilled in the art can make similar modifications without departing from the spirit of this application. Therefore, this application is not limited to the specific embodiments disclosed below.

[0018] It should be noted that the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0019] The terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or illustration. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0020] The terms “comprising,” “including,” or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units that are expressly listed, but may include other steps or units that are not expressly listed or that are inherent to such process, method, product, or apparatus.

[0021] Unless otherwise defined, all technical and scientific terms used in this application have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The term "and / or" as used in this application includes any and all combinations of one or more of the associated listed items.

[0022] The specific embodiments of this application will be further described below with reference to the accompanying drawings.

[0023] refer to Figure 1 The diagram shown is a principle block diagram of a long code vulnerability remediation system based on structure awareness and vulnerability guidance, provided in the first aspect of an embodiment of this application. Figure 1 The long code vulnerability repair system 100 based on structure awareness and vulnerability guidance includes a code acquisition module 101, a structure modeling module 102, an encoder structure awareness enhancement module 103, and a vulnerability guidance decoding module 104. The code acquisition module 101 acquires the long code to be repaired and repair markers. The structure modeling module 102 determines the vulnerability dependency sequence based on the control flow, data flow, and control dependencies of the long code to be repaired. The encoder structure awareness enhancement module 103 uses multiple encoders to perform feature enhancement processing on the long code to be repaired to obtain a global feature vector. The vulnerability guidance decoding module 104 uses multiple decoders to perform vulnerability focusing and repair processing on the repair markers, the global feature vector, and the vulnerability dependency sequence to obtain the target repair code corresponding to the long code to be repaired.

[0024] The long code to be repaired is a long source code containing vulnerabilities and defects.

[0025] The repair markers are all the vulnerability locations in the long code to be repaired.

[0026] The vulnerability dependency sequence can be referenced. Figure 2 and Figure 3 The VDD (Vulnerability Dependency) sequence in the middle.

[0027] The global feature vector is a high-dimensional vector data that contains code syntax structure, semantic information, and program dependencies.

[0028] Compared with existing technologies, this application's embodiments, through the above implementation methods, abandon the method of forced truncation at the head or tail, and design a structural modeling module to determine the vulnerability dependency sequence based on control flow, data flow, and control dependencies. This achieves the goal of completely preserving the long-distance critical dependency information of the vulnerability, avoiding the loss of critical information from the root, thereby generating more accurate repaired code and improving the accuracy of long code vulnerability repair. Furthermore, this application's embodiments design a vulnerability guidance decoding module to achieve vulnerability focusing and repair processing. Therefore, this application's embodiments can accurately focus on the vulnerability area, solving the problem of distracted attention in long code, thereby improving the accuracy of long code vulnerability repair.

[0029] In some implementations, the structural modeling module includes a graph construction module, a directional slicing module, and a vulnerability dependency sequence construction module. The graph construction module performs dependency graph construction processing on the control flow, data flow, and control dependencies of the long code to be repaired to obtain a target dependency graph. The directional slicing module uses a differentiated directional slicing strategy to slice the target dependency graph to obtain a target subgraph. The vulnerability dependency sequence construction module maps the vulnerability dependency distance of each node in the target subgraph to a token-level vulnerability dependency distance vector aligned with the token sequence using character range matching, and constructs the vulnerability dependency sequence from all token-level vulnerability dependency distance vectors.

[0030] In other embodiments, this application may also use graph neural networks to directly model the code structure to replace the target dependency graph + vulnerability dependency sequence scheme.

[0031] Furthermore, the graph construction module includes a graph construction submodule and a fusion unit. The graph construction submodule is used to extract a control flow graph, a data dependency graph, and a control dependency graph after static parsing of the long code to be repaired. The fusion unit is used to fuse the control flow graph, the data dependency graph, and the control dependency graph to obtain the target dependency graph.

[0032] The nodes of the target dependency graph correspond to syntactic units such as expressions, statements, and variable declarations in the code. Each node is associated with a precise character range in the source code (i.e., the long code to be repaired). Edges include three types: data dependency edges (representing the relationship from variable definition to usage), control dependency edges (representing the relationship from conditional statements to execution blocks), and control flow edges (representing jump relationships in the program execution order). The target dependency graph can be referenced from... Figure 4 As shown.

[0033] Furthermore, the graph construction submodule includes a parsing unit, a control flow graph construction unit, a data dependency graph construction unit, and a control dependency graph construction unit.

[0034] The parsing unit is used to perform static parsing of the syntax structure of the long code to be repaired, and obtain an abstract syntax tree.

[0035] The control flow graph construction unit is used to traverse the abstract syntax tree, taking all branch, loop, and jump-type control statements with jump functions as target statements; using all target statements as dividing boundaries, the long code to be repaired is divided into multiple continuous and uninterrupted code blocks; the program jump execution logic corresponding to each code block is determined based on the terminal statement of each code block; the next code block corresponding to each code block is determined according to the program jump execution logic corresponding to each code block; control transfer associations are established between each code block and the next code block corresponding to each code block; and a control flow graph is constructed with each code block as a node and the control transfer associations as edges.

[0036] The data dependency graph construction unit is used to traverse the abstract syntax tree and the control flow graph to determine the definition statements and reference statements of all variables. Using all definition statements and reference statements as nodes and the direction from the definition statement to the reference statement as the dependency variable, a data dependency graph is constructed.

[0037] The control dependency graph construction unit is used to traverse the abstract syntax tree and the control flow graph to determine all conditional statements and loop statements; all conditional statements, all loop statements, all statements controlled by conditional statements, and all statements controlled by loop statements are treated as nodes; the direction from each conditional statement to the statement controlled by each conditional statement is treated as an edge; and the direction from each loop statement to the statement controlled by each loop statement is also treated as an edge, thus forming a control dependency graph.

[0038] Furthermore, the differentiated targeted slicing strategy is as follows: among all nodes in the target dependency graph, identify one vulnerability triggering node, and refer to... Figure 5 As shown; taking the vulnerability triggering node as the center, bidirectional slicing is performed on data dependency edges; backward slicing is performed on control dependency edges; forward slicing is performed on control flow edges; only nodes whose shortest path distance to the vulnerability triggering node is within the range of a preset maximum structural distance threshold are retained; finally, the remaining unsliced ​​edges connected to the vulnerability triggering node are taken as target edges, and the nodes connected to the target edges are taken as target nodes. The vulnerability triggering node, all target edges, and all target nodes constitute the target subgraph.

[0039] In other embodiments, the present application can also use dynamic weighted filtering context rules instead of fixed preset maximum structural distance threshold slicing rules.

[0040] The preset maximum structural distance threshold can be any value from 2 to 5. In other embodiments, the specific value of the preset maximum structural distance threshold can be set by those skilled in the art according to actual needs.

[0041] It should be understood that the differentiated targeted slicing strategy can also track the source and scope of vulnerability-related data when performing bidirectional slicing on data-dependent edges; locate the preconditions on which the vulnerability execution depends when performing backward slicing on control-dependent edges; and track the potential impact paths that the vulnerability may cause when performing forward slicing on control flow edges.

[0042] Furthermore, the vulnerability dependency distance for each node refers to the shortest path length between each node and the node that triggered the vulnerability.

[0043] Furthermore, the step of mapping the vulnerability dependency distance of each node in the target subgraph to a token-level vulnerability dependency distance vector aligned with the token sequence through character range matching, and constructing the vulnerability dependency sequence from all token-level vulnerability dependency distance vectors, includes: for each token in the token sequence, taking all nodes in the target subgraph whose character range overlaps with each token as nodes to be processed, taking the minimum value among the vulnerability dependency distances corresponding to all nodes to be processed as the token-level vulnerability dependency distance vector corresponding to each token; for tokens that do not match any nodes, uniformly assigning a value equal to the preset maximum structural distance threshold plus 1. This process can be exemplified by referring to [reference needed]. Figure 6 As shown.

[0044] Furthermore, the token sequence is obtained by segmenting the long code to be repaired using a tokenizer. Each token in the token sequence is a word in the long code to be repaired.

[0045] Through the above implementation methods, the embodiments of this application abandon the traditional forced truncation method, construct a unified dependency graph (i.e., the target dependency graph) that integrates multi-dimensional structural information through static program analysis, and perform targeted context slicing based on the vulnerability location. While controlling the input length, all key dependency information related to the vulnerability is completely preserved, thus avoiding the loss of key information from the root.

[0046] In some implementations, reference Figure 3 As shown, when the plurality of encoders includes a first encoder and a second encoder, the encoder structure-aware enhancement module includes a first structure-aware enhancement module and a second structure-aware enhancement module. The first structure-aware enhancement module is used to perform feature enhancement processing on the long code to be repaired using the first encoder to obtain a first feature vector to be processed. The second structure-aware enhancement module is used to perform feature enhancement processing on the first feature vector to be processed using the second encoder to obtain the global feature vector.

[0047] In other embodiments, the specific number of the plurality of encoders can be set by those skilled in the art according to actual needs.

[0048] Furthermore, the first structure-aware enhancement module includes a first attention feature extraction module, a first feature fusion and feature normalization module, and a first feature enhancement submodule. The first attention feature extraction module is used to perform attention feature extraction processing on the long code to be repaired using the first multi-head self-attention layer of the first encoder to obtain a second feature vector to be processed. The first feature fusion and feature normalization module is used to perform feature fusion and feature normalization processing on the second feature vector to be processed and the long code to be repaired using the first residual connection and normalization layer of the first encoder to obtain a third feature vector to be processed. The first feature enhancement submodule is used to perform feature enhancement processing on the third feature vector to be processed using the first feedforward network layer of the first encoder to obtain the first feature vector to be processed.

[0049] Furthermore, the second structure-aware enhancement module includes a third attention feature extraction module, a fourth feature fusion and feature normalization module, and a third feature enhancement submodule. The third attention feature extraction module is used to perform attention feature extraction processing on the first feature vector to be processed using the third multi-head self-attention layer of the second encoder to obtain an eighth feature vector to be processed. The fourth feature fusion and feature normalization module is used to perform feature fusion and feature normalization processing on the eighth feature vector to be processed and the long code to be repaired using the fourth residual connection and normalization layer of the second encoder to obtain a ninth feature vector to be processed. The third feature enhancement submodule is used to perform feature enhancement processing on the ninth feature vector to be processed using the third feedforward network layer of the second encoder to obtain the global feature vector.

[0050] In some implementations, reference Figure 3 As shown, when the plurality of decoders includes a first decoder and a second decoder, the vulnerability guidance decoding module includes a first vulnerability repair module and a second vulnerability repair module. The first vulnerability repair module is used to perform vulnerability focusing and repair processing on the repair marker, the global feature vector, and the vulnerability dependency sequence using the first decoder to obtain the code to be improved. The second vulnerability repair module is used to perform vulnerability focusing and repair processing on the code to be improved, the global feature vector, and the vulnerability dependency sequence using the second decoder to obtain the target repair code corresponding to the long code to be repaired.

[0051] In other embodiments, the specific number of the plurality of decoders can be set by those skilled in the art according to actual needs.

[0052] Further, the first vulnerability repair module includes a second attention feature extraction module, a second feature fusion and feature normalization module, a first cross-attention module, a third feature fusion and feature normalization module, and a second feature enhancement submodule. The second attention feature extraction module is used to perform attention feature extraction processing on the repair marker using the second multi-head self-attention layer of the first decoder to obtain a fourth feature vector to be processed. The second feature fusion and feature normalization module is used to perform feature fusion and feature normalization processing on the fourth feature vector to be processed and the repair marker using the second residual connection and normalization layer of the first decoder to obtain a fifth feature vector to be processed. The first cross-attention module is used to perform vulnerability focusing and repair processing on the fifth feature vector to be processed, the global feature vector, and the vulnerability dependency sequence using the first multi-head cross-attention layer of the first decoder, to obtain a sixth feature vector to be processed; the third feature fusion and feature normalization module is used to perform feature fusion and feature normalization processing on the sixth feature vector to be processed and the fifth feature vector to be processed using the third residual connection and normalization layer of the first decoder, to obtain a seventh feature vector to be processed; the second feature enhancement submodule is used to perform feature enhancement processing on the seventh feature vector to be processed using the second feedforward network layer of the first decoder, to obtain code to be improved.

[0053] Further, the second vulnerability remediation module includes a fourth attention feature extraction module, a fifth feature fusion and feature standardization module, a second cross-attention module, a sixth feature fusion and feature standardization module, and a fourth feature enhancement submodule. The fourth attention feature extraction module is used to perform attention feature extraction processing on the code to be improved using the fourth multi-head self-attention layer of the second decoder to obtain a tenth feature vector to be processed. The fifth feature fusion and feature standardization module is used to perform feature fusion and feature standardization processing on the tenth feature vector to be processed and the code to be improved using the fifth residual connection and normalization layer of the second decoder to obtain an eleventh feature vector to be processed. The second cross-attention module... The module is used to perform vulnerability focusing and repair processing on the eleventh feature vector to be processed, the global feature vector, and the vulnerability dependency sequence using the second multi-head cross-attention layer of the second decoder to obtain the twelfth feature vector to be processed; the sixth feature fusion and feature normalization module is used to perform feature fusion and feature normalization processing on the twelfth feature vector to be processed and the eleventh feature vector to be processed using the sixth residual connection and normalization layer of the second decoder to obtain the thirteenth feature vector to be processed; the fourth feature enhancement submodule is used to perform feature enhancement processing on the thirteenth feature vector to be processed using the fourth feedforward network layer of the second decoder to obtain the target repair code corresponding to the long code to be repaired.

[0054] In this application embodiment, a structure-aware attention bias is introduced in the calculation of the multi-head cross-attention layer (i.e., the first multi-head cross-attention layer and the second multi-head cross-attention layer). The vulnerability dependency distance is used as the structured relative position to guide the decoder to actively focus on the vulnerability-related code region when generating the patch, so as to solve the problem of attention dispersion in long code.

[0055] More specifically, the multi-head cross-attention layer constructs a learnable bias embedding table struct_bias_table∈ ,in, yes Real numbers of dimension, It is the sequence length. It's the number of heads that attract attention. This represents the feature dimension of each bias vector; then, different vulnerability dependency distance values ​​(which can be understood as target vulnerability dependency strength labels) are mapped to corresponding attention biases. Compared to traditional methods, this design no longer relies on sequence distances between tokens, but instead uses program dependencies to guide the attention distribution, thus making the model more inclined to focus on vulnerability-related code regions during generation. For the decoder... Layer, First Each attention head, for decoding position With encoding position The attention score can be adjusted using the following formula: ; in, It is the first in the decoder Attention head, decoding position For encoding position Attention score; Decoder location , No. The query vector of the header; Encoder position , No. The key vector of the head; It is the scaling factor; The learnable bias value is obtained by looking up the struct_bias_table.

[0056] In some implementations, the decoder of this application generates candidate repair patches through beam search based on the adjusted attention score and outputs the optimal repair result (i.e., the target repair code). The structure-aware attention mechanism used in the embodiments of this application can overcome the limitations of traditional sequence relative position encoding, dynamically adjust the attention distribution according to the actual structural dependencies of the code, and enable the model to accurately capture long-distance vulnerability dependency information and generate semantically correct repair patches.

[0057] In some embodiments, the encoder structure awareness enhancement module further includes a third structure awareness enhancement module, which is used to perform vulnerability dependency strength prediction processing on the vulnerability dependency sequence using a vulnerability dependency strength predictor to obtain the target vulnerability dependency strength label corresponding to each element in the vulnerability dependency sequence.

[0058] The vulnerability dependency strength predictor can refer to Figure 2 and Figure 3 The VDS predictor in the code. The vulnerability dependency strength predictor can transform program structure information into supervisory signals, guiding the encoder to actively learn vulnerability-related structural features and improving the encoder's semantic understanding of long code.

[0059] Furthermore, the calculation formula for the step of using a vulnerability dependency strength predictor to perform vulnerability dependency strength prediction processing on the vulnerability dependency sequence to obtain the target vulnerability dependency strength label corresponding to each element in the vulnerability dependency sequence is as follows: ; in, It is the first in the vulnerability dependency sequence. Each element corresponds to a target vulnerability dependency strength tag; It is the base of the Gaussian kernel function; It is the Gaussian decay coefficient; It is the first in the vulnerability dependency sequence. The vulnerability dependency distance corresponding to each element; It is the preset maximum structural distance.

[0060] The target vulnerability dependency strength label takes values ​​in the range [0, 1]. It should be understood that the closer the vulnerability dependency distance is to the token, the higher its dependency strength value (i.e., the target vulnerability dependency strength label).

[0061] It should also be noted that the embodiments of this application adopt a multi-task joint training strategy, and the joint loss function is composed of a weighted average of the cross-entropy loss of the main task and the Smooth L1 loss of the auxiliary task. Through joint optimization, the encoder can actively focus on code regions closely related to vulnerability semantics while learning general code semantics, generating feature representations with greater vulnerability awareness. Simultaneously, a two-stage training strategy is adopted: first, pre-training is performed on a large-scale general code defect repair dataset to learn general code repair patterns; then, multi-task joint fine-tuning is performed on a vulnerability repair dataset to further improve the model's ability to specifically repair security vulnerabilities.

[0062] In other implementations, this application may also replace the auxiliary task or loss function, or replace the encoder with CNN+LSTM.

[0063] refer to Figure 7 The diagram shown is a flowchart of a long code vulnerability remediation method based on structure awareness and vulnerability guidance, provided in the second aspect of an embodiment of this application. Figure 7 The long code vulnerability remediation method based on structure awareness and vulnerability guidance includes the following steps S201, S202, S203 and S204.

[0064] S201. Obtain the long code to be repaired and the repair marker.

[0065] S202. Determine the vulnerability dependency sequence based on the control flow, data flow, and control dependencies of the long code to be repaired.

[0066] Further, step S202 includes: performing dependency graph construction processing on the control flow, data flow, and control dependencies of the long code to be repaired to obtain a target dependency graph; performing slicing processing on the target dependency graph using a differentiated directional slicing strategy to obtain a target subgraph; mapping the vulnerability dependency distance of each node in the target subgraph to a token-level vulnerability dependency distance vector aligned with the token sequence through character interval matching, and constructing the vulnerability dependency sequence from all token-level vulnerability dependency distance vectors.

[0067] Furthermore, the steps of constructing a dependency graph for the control flow, data flow, and control dependencies of the long code to be repaired to obtain the target dependency graph include: extracting the control flow graph, data dependency graph, and control dependency graph after static parsing of the long code to be repaired; and fusing the control flow graph, the data dependency graph, and the control dependency graph to obtain the target dependency graph.

[0068] Further, the steps of extracting the control flow graph, data dependency graph, and control dependency graph after static parsing of the long code to be repaired include: performing static parsing of the syntax structure of the long code to be repaired to obtain an abstract syntax tree; traversing the abstract syntax tree and taking all branch, loop, and jump-type control statements with jump functions as target statements; using all target statements as dividing boundaries, dividing the long code to be repaired into multiple continuous and uninterrupted execution code blocks; determining the program jump execution logic corresponding to each code block based on the terminal statement of each code block; determining the next code block corresponding to each code block according to the program jump execution logic corresponding to each code block; establishing control transfer associations between each code block and the next code block corresponding to each code block; and using each code block as a node to control the data dependency graph. The control flow graph is constructed by using edges to represent control transfer associations. The abstract syntax tree and the control flow graph are traversed to identify all variable definition statements and reference statements. These are used as nodes, with the direction from a definition statement to a reference statement as a dependency variable, thus forming a data dependency graph. The abstract syntax tree and the control flow graph are then traversed to identify all conditional and loop statements. All conditional statements, loop statements, statements controlled by conditional statements, and statements controlled by loop statements are used as nodes. The direction from each conditional statement to a statement controlled by that conditional statement is used as an edge, and the direction from each loop statement to a statement controlled by that loop statement is also used as an edge, thus forming a control dependency graph.

[0069] S203. Multiple encoders are used to perform feature enhancement processing on the long code to be repaired to obtain a global feature vector.

[0070] Further, when the plurality of encoders includes a first encoder and a second encoder, step S203 includes: using the first encoder to perform feature enhancement processing on the long code to be repaired to obtain a first feature vector to be processed; and using the second encoder to perform feature enhancement processing on the first feature vector to be processed to obtain the global feature vector.

[0071] Further, refer to Figure 3As shown, the step of using the first encoder to perform feature enhancement processing on the long code to be repaired to obtain a first feature vector to be processed includes: using the first multi-head self-attention layer of the first encoder to perform attention feature extraction processing on the long code to be repaired to obtain a second feature vector to be processed; using the first residual connection and normalization layer of the first encoder to perform feature fusion and feature standardization processing on the second feature vector to be processed and the long code to be repaired to obtain a third feature vector to be processed; and using the first feedforward network layer of the first encoder to perform feature enhancement processing on the third feature vector to be processed to obtain the first feature vector to be processed.

[0072] Further, the step of using the second encoder to perform feature enhancement processing on the first feature vector to be processed to obtain the global feature vector includes: using the third multi-head self-attention layer of the second encoder to perform attention feature extraction processing on the first feature vector to be processed to obtain an eighth feature vector to be processed; using the fourth residual connection and normalization layer of the second encoder to perform feature fusion and feature standardization processing on the eighth feature vector to be processed and the long code to be repaired to obtain a ninth feature vector to be processed; and using the third feedforward network layer of the second encoder to perform feature enhancement processing on the ninth feature vector to be processed to obtain the global feature vector.

[0073] S204. Multiple decoders are used to perform vulnerability focusing and repair processing on the repair marker, the global feature vector, and the vulnerability dependency sequence to obtain the target repair code corresponding to the long code to be repaired.

[0074] Further, when the plurality of decoders includes a first decoder and a second decoder, step S204 includes: using the first decoder to perform vulnerability focusing and repair processing on the repair marker, the global feature vector, and the vulnerability dependency sequence to obtain the code to be improved; using the second decoder to perform vulnerability focusing and repair processing on the code to be improved, the global feature vector, and the vulnerability dependency sequence to obtain the target repair code corresponding to the long code to be repaired.

[0075] Further, the step of using the first decoder to perform vulnerability focusing and repair processing on the repair marker, the global feature vector, and the vulnerability dependency sequence to obtain the code to be improved includes: using the second multi-head self-attention layer of the first decoder to perform attention feature extraction processing on the repair marker to obtain a fourth feature vector to be processed; using the second residual connection and normalization layer of the first decoder to perform feature fusion and feature standardization processing on the fourth feature vector to be processed and the repair marker to obtain a fifth feature vector to be processed; using the first multi-head cross-attention layer of the first decoder to perform vulnerability focusing and repair processing on the fifth feature vector to be processed, the global feature vector, and the vulnerability dependency sequence to obtain a sixth feature vector to be processed; using the third residual connection and normalization layer of the first decoder to perform feature fusion and feature standardization processing on the sixth feature vector to be processed and the fifth feature vector to be processed to obtain a seventh feature vector to be processed; and using the second feedforward network layer of the first decoder to perform feature enhancement processing on the seventh feature vector to be processed to obtain the code to be improved.

[0076] Further, the step of using the second decoder to perform vulnerability focusing and repair processing on the code to be improved, the global feature vector, and the vulnerability dependency sequence to obtain the target repair code corresponding to the long code to be repaired includes: using the fourth multi-head self-attention layer of the second decoder to perform attention feature extraction processing on the code to be improved to obtain the tenth feature vector to be processed; using the fifth residual connection and normalization layer of the second decoder to perform feature fusion and feature standardization processing on the tenth feature vector to be processed and the code to be improved to obtain the eleventh feature vector to be processed; using the second multi-head cross-attention layer of the second decoder to perform vulnerability focusing and repair processing on the eleventh feature vector to be processed, the global feature vector, and the vulnerability dependency sequence to obtain the twelfth feature vector to be processed; using the sixth residual connection and normalization layer of the second decoder to perform feature fusion and feature standardization processing on the twelfth feature vector to be processed and the eleventh feature vector to be processed to obtain the thirteenth feature vector to be processed; and using the fourth feedforward network layer of the second decoder to perform feature enhancement processing on the thirteenth feature vector to obtain the target repair code corresponding to the long code to be repaired.

[0077] A third aspect of this application provides a terminal device, the schematic diagram of which is as follows: Figure 8As shown. The terminal device includes a processor, memory, network interface, display screen, and temperature sensor connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface of the terminal device is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a long-code vulnerability remediation method based on structure awareness and vulnerability guidance. The display screen can be a liquid crystal display (LCD) or an e-ink display. The temperature sensor is pre-installed inside the terminal device to detect the operating temperature of the internal components.

[0078] Those skilled in the art will understand that Figure 8 The schematic diagram shown is only a partial structural diagram related to the present invention and does not constitute a limitation on the terminal device to which the present invention is applied. The specific terminal device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0079] In some embodiments, this application provides a terminal device including a processor and a memory for storing computer programs. The processor is used to call and run the computer programs stored in the memory to perform the steps of the long code vulnerability remediation method based on structure awareness and vulnerability guidance provided in the second aspect of this application.

[0080] A fourth aspect of this application provides a computer-readable storage medium for storing a computer program that causes a computer to perform the steps of the long code vulnerability remediation method based on structure awareness and vulnerability guidance provided in the second aspect of this application.

[0081] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0082] The technical features of the above embodiments can be combined without changing the basic principles of this application. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0083] The above embodiments merely illustrate several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the patent protection scope of this application should be determined by the appended claims.

Claims

1. A long code vulnerability remediation system based on structure awareness and vulnerability guidance, characterized in that, It includes a code acquisition module, a structural modeling module, an encoder structure awareness enhancement module, and a vulnerability bootstrapping decoding module. The code acquisition module is used to acquire the long code to be repaired and the repair marker; The structural modeling module is used to determine the vulnerability dependency sequence based on the control flow, data flow, and control dependencies of the long code to be repaired. The encoder structure awareness enhancement module is used to perform feature enhancement processing on the long code to be repaired using multiple encoders to obtain a global feature vector. The vulnerability-guided decoding module is used to perform vulnerability focusing and repair processing on the repair marker, the global feature vector, and the vulnerability dependency sequence using multiple decoders to obtain the target repair code corresponding to the long code to be repaired.

2. The long code vulnerability remediation system based on structure awareness and vulnerability guidance according to claim 1, characterized in that, The structural modeling module includes a graph construction module, a directional slicing module, and a vulnerability dependency sequence composition module, wherein... The graph construction module is used to perform dependency graph construction processing on the control flow, data flow and control dependencies of the long code to be repaired, and obtain the target dependency graph. The targeted slicing module is used to slice the target dependency graph using a differentiated targeted slicing strategy to obtain a target subgraph; The vulnerability dependency sequence construction module is used to map the vulnerability dependency distance of each node in the target subgraph to a token-level vulnerability dependency distance vector aligned with the token sequence through character range matching, and to construct the vulnerability dependency sequence from all token-level vulnerability dependency distance vectors.

3. The long code vulnerability remediation system based on structure awareness and vulnerability guidance according to claim 1, characterized in that, In the case where the plurality of encoders includes a first encoder and a second encoder, the encoder structure perception enhancement module includes a first structure perception enhancement module and a second structure perception enhancement module, wherein, The first structure-aware enhancement module is used to perform feature enhancement processing on the long code to be repaired using the first encoder to obtain a first feature vector to be processed; The second structure-aware enhancement module is used to perform feature enhancement processing on the first feature vector to be processed using the second encoder to obtain the global feature vector.

4. The long code vulnerability remediation system based on structure awareness and vulnerability guidance according to claim 3, characterized in that, The first structure-aware enhancement module includes a first attention feature extraction module, a first feature fusion and feature normalization module, and a first feature enhancement submodule, wherein, The first attention feature extraction module is used to perform attention feature extraction processing on the long code to be repaired using the first multi-head self-attention layer of the first encoder to obtain a second feature vector to be processed; The first feature fusion and feature standardization module is used to perform feature fusion and feature standardization on the second feature vector to be processed and the long code to be repaired using the first residual connection and normalization layer of the first encoder to obtain a third feature vector to be processed. The first feature enhancement submodule is used to perform feature enhancement processing on the third feature vector to be processed using the first feedforward network layer of the first encoder to obtain the first feature vector to be processed.

5. The long code vulnerability remediation system based on structure awareness and vulnerability guidance according to claim 1, characterized in that, In the case where the plurality of decoders includes a first decoder and a second decoder, the vulnerability boot decoding module includes a first vulnerability repair module and a second vulnerability repair module, wherein, The first vulnerability repair module is used to perform vulnerability focusing and repair processing on the repair marker, the global feature vector and the vulnerability dependency sequence using the first decoder to obtain the code to be improved; The second vulnerability repair module is used to perform vulnerability focusing and repair processing on the code to be improved, the global feature vector and the vulnerability dependency sequence using the second decoder, so as to obtain the target repair code corresponding to the long code to be repaired.

6. The long code vulnerability remediation system based on structure awareness and vulnerability guidance according to claim 5, characterized in that, The first vulnerability remediation module includes a second attention feature extraction module, a second feature fusion and feature normalization module, a first cross-attention module, a third feature fusion and feature normalization module, and a second feature enhancement submodule, wherein, The second attention feature extraction module is used to perform attention feature extraction processing on the repair marker using the second multi-head self-attention layer of the first decoder to obtain a fourth feature vector to be processed; The second feature fusion and feature standardization module is used to perform feature fusion and feature standardization on the fourth feature vector to be processed and the repair mark using the second residual connection and normalization layer of the first decoder to obtain the fifth feature vector to be processed; The first cross-attention module is used to perform vulnerability focusing and repair processing on the fifth feature vector to be processed, the global feature vector and the vulnerability dependency sequence using the first multi-head cross-attention layer of the first decoder, to obtain the sixth feature vector to be processed; The third feature fusion and feature standardization module is used to perform feature fusion and feature standardization on the sixth feature vector to be processed and the fifth feature vector to be processed using the third residual connection and normalization layer of the first decoder to obtain the seventh feature vector to be processed. The second feature enhancement submodule is used to perform feature enhancement processing on the seventh feature vector to be processed using the second feedforward network layer of the first decoder to obtain the code to be improved.

7. The long code vulnerability remediation system based on structure awareness and vulnerability guidance according to claim 1, characterized in that, The encoder structure perception enhancement module further includes a third structure perception enhancement module, which is used to perform vulnerability dependency strength prediction processing on the vulnerability dependency sequence using a vulnerability dependency strength predictor to obtain the target vulnerability dependency strength label corresponding to each element in the vulnerability dependency sequence.

8. A long code vulnerability remediation method based on structure awareness and vulnerability guidance, characterized in that, include: Get the long code to be repaired and the repair markers; The vulnerability dependency sequence is determined based on the control flow, data flow, and control dependencies of the long code to be repaired; Multiple encoders are used to perform feature enhancement processing on the long code to be repaired to obtain a global feature vector; Multiple decoders are used to perform vulnerability focusing and repair processing on the repair marker, the global feature vector, and the vulnerability dependency sequence to obtain the target repair code corresponding to the long code to be repaired.

9. A terminal device, characterized in that, include: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory, and to perform the steps of the long code vulnerability remediation method based on structure awareness and vulnerability guidance as described in claim 8.

10. A computer-readable storage medium, characterized in that, Used to store a computer program that causes a computer to perform the steps of the long code vulnerability remediation method based on structure awareness and vulnerability guidance as described in claim 8.

Images