Code security check and vulnerability mining method and system based on multi-dimensional scanning and readable medium

Abstract

The application discloses a code security checking and vulnerability mining method and system based on multi-dimensional scanning and a readable medium, and comprises the following steps: performing multi-dimensional static detection and dynamic sandbox verification on a code file, and extracting multi-dimensional feature data; performing semantic analysis on the multi-dimensional feature data through a code semantic understanding model, locating a vulnerability root cause, and generating a repair scheme; determining a risk level according to risk assessment information; pushing a repair scheme list according to the risk level, performing directional detection verification after repair, taking repair difference data as a training sample to retrain the code semantic understanding model to optimize model parameters; and continuously updating vulnerability information. The method can improve the accuracy of code security detection and vulnerability identification, greatly reduce the vulnerability repair cost, and realize continuous self-optimization of detection capability.

Description

Technical Field

[0001] This invention relates to the field of internet security inspection technology, specifically to a method, system, and readable medium for code security inspection and vulnerability discovery based on multi-dimensional scanning. Background Technology

[0002] With the rapid development of the internet and the popularization of artificial intelligence technology, cybersecurity and information security issues are increasing daily. Traditional security vulnerability scanning technologies cannot comprehensively cover security issues, cannot update and maintain vulnerability databases in real time, and cannot cope with the rapid development of current internet technologies. Furthermore, their importance in the software development lifecycle, from design and coding to post-launch security testing, is self-evident.

[0003] With the rapid development of internet technology, network security and information security issues have become increasingly prominent. Detection technologies are lagging behind, and vulnerability databases cannot be updated in real time, hindering effective solutions to security problems. SAST tools have weak capabilities in identifying complex nested code and implicit vulnerabilities, resulting in a high false negative rate. DAST tools, limited by testing environments, cannot cover all business scenarios. These tools can only discover vulnerabilities present in applications but cannot accurately pinpoint the specific code location causing them, requiring developers to spend extra time and effort to locate and fix the issues. DAST tools may also generate false positives, misclassifying non-real vulnerabilities as vulnerabilities, necessitating further manual analysis and verification of the test results. Alternatively, some detection tools perform vulnerability matching detection on static code based on corresponding rules or characteristics, resulting in a high probability of false positives and poor flexibility. Summary of the Invention

[0004] This invention provides a Chinese-based method, system, and readable medium for code security inspection and vulnerability discovery based on multi-dimensional scanning. It addresses the technical shortcomings of existing code security inspection technologies, such as high false negative rates in static scanning, high costs in dynamic testing, weak vulnerability tracing capabilities, lack of quantitative standards for risk assessment, and incomplete and undynamically updated security vulnerability databases.

[0005] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: A code security inspection and vulnerability discovery method based on multi-dimensional scanning includes: Perform multi-dimensional static analysis and dynamic sandbox verification on code files to extract multi-dimensional feature data; The multi-dimensional feature data is semantically analyzed using a code semantic understanding model, and the call chain is analyzed based on the code structure relationship diagram to locate the root cause of the vulnerability and generate a remediation plan. The detected vulnerability characteristics and remediation solutions are fed back to the dynamic vulnerability repository to update the repository data, and the risk level is determined based on the risk assessment information; A list of remediation solutions will be pushed out based on the risk level. After the remediation is completed, targeted testing and verification will be carried out. The remediation difference data will be used as training samples to retrain the code semantic understanding model in order to optimize the model parameters. Continuously update vulnerability information, feed rule optimization data back to the code semantic understanding model for incremental training, and feed the model optimization results back to the rule base for rule adjustment, forming a two-way feedback loop between rules and models.

[0006] Furthermore, the step of performing multi-dimensional static detection and dynamic sandbox verification on the code files to extract multi-dimensional feature data includes: Perform multi-dimensional static testing on the source code, including syntax, logic, components, compliance, and nesting, to identify complex nested logic and trace the source in both vertical depth and horizontal breadth. Run critical code snippets in an isolated sandbox environment to monitor runtime behavior and detect dynamic security vulnerabilities. Extract multi-dimensional feature data composed of syntactic features, logical features, and component features.

[0007] Furthermore, the step of performing semantic analysis on the multi-dimensional feature data using a code semantic understanding model, analyzing the call chain based on the code structure relationship graph, locating the root cause of the vulnerability, and generating a remediation plan includes: By using a deep learning-based code semantic understanding model, feature matching is performed on multi-dimensional feature data, and the matching results are used to identify abnormal feature sets from multiple perspectives, including syntactic, semantic, and logical dimensions. Based on the abstract syntax tree and program dependency graph, a code structure relationship graph is constructed. Starting from the vulnerability point, the data flow and control flow are traced in reverse to locate the root source code of the vulnerability, the affected code modules and third-party components are identified, and a customized remediation solution is generated.

[0008] Furthermore, the process of feeding back the detected vulnerability characteristics and remediation solutions to the dynamic vulnerability repository to update the repository data, and determining the risk level based on risk assessment information, includes: The dynamic vulnerability repository stores basic vulnerability information, rule sets, and component feature information according to programming language categories. The data comes from model scanning lists or manual review and entry. The vulnerability characteristics and remediation solutions discovered during detection are automatically fed back to the dynamic vulnerability repository to update the repository data. The accuracy and timeliness of the data are ensured through automatic identification and manual review. The risk level is determined by a weighted score based on the scope of impact, severity, and exploit complexity of the vulnerability's location in the code.

[0009] Furthermore, the process of pushing a list of remediation solutions based on risk levels, performing targeted detection and verification after remediation, and using the remediation discrepancies as training samples to retrain the code semantic understanding model to optimize model parameters includes: A list of vulnerability remediation solutions is pushed out in order of risk level, and standardized detection reports and remediation guidance plans are generated. The repaired code is re-entered into the system for targeted testing. The test results before and after the repair are summarized and compared to visually demonstrate the repair effect. The difference between the repair scheme generated by the model and the actual repair method is used as a training sample to retrain the code semantic understanding model, adjust the model weight parameters, and reduce the false alarm rate of the model through data feedback verification and rule adaptation.

[0010] Furthermore, the continuous updating of vulnerability information, feeding rule optimization data back to the code semantic understanding model for incremental training, and feeding the model optimization results back to the rule base for rule adjustment, forming a two-way feedback loop between rules and the model, includes: Continuously update information on code vulnerabilities and third-party component defects, refine and optimize model judgment rules, and eliminate redundant rules; Using semantic features extracted from the scan preprocessing results as training samples, a multimodal dataset containing code text features, abstract syntax tree features, program dependency graph features, and component dependency features was constructed, and training was completed based on deep learning. A learning rate decay strategy is adopted to continuously collect vulnerability repair data for incremental training and model fine-tuning; The data from rule optimization is fed back to the code semantic understanding model for incremental training, and the model optimization results are fed back to the rule base for rule adjustment, forming a two-way feedback loop between rules and models, and building an automated process link of detection-analysis-optimization-expansion.

[0011] Furthermore, the step of retraining the code semantic understanding model using the repaired discrepancy data as training samples to optimize model parameters, and the step of feeding back the rule-optimized data to the code semantic understanding model for incremental training, include... The data for fixing discrepancies and the data for optimizing rules are merged into multi-source training data for joint training of the code semantic understanding model. Different sample weights are assigned based on the source type of the multi-source training data, with the weight of data that repairs discrepancies being higher than the weight of data that optimizes rules. Incremental training of the code semantic understanding model is performed based on weighted multi-source training data, enabling the model to learn both actual repair preferences and rule constraints, thereby optimizing the consistency between the model output and the actual repair methods.

[0012] This invention also provides a code security inspection and vulnerability discovery system based on multi-dimensional scanning, comprising: The dual-mode detection module is configured to perform multi-dimensional static detection and dynamic sandbox verification on code files, and extract multi-dimensional feature data. The dual-core analysis module is configured to perform semantic analysis on the multi-dimensional feature data through a code semantic understanding model, perform call chain analysis based on the code structure relationship diagram, locate the root cause of the vulnerability, and generate a remediation plan. The dynamic repository module feeds back the detected vulnerability features and remediation solutions to the dynamic vulnerability repository to update the repository data and determines the risk level based on the risk assessment information. The closed-loop verification module is configured to push a list of repair solutions based on the risk level, perform targeted detection and verification after repair, and use the repair difference data as training samples to retrain the code semantic understanding model to optimize the model parameters. The linkage optimization module is configured to continuously update vulnerability information, feed rule optimization data back to the code semantic understanding model for incremental training, and feed the model optimization results back to the rule base for rule adjustment, forming a two-way feedback loop between rules and models.

[0013] The present invention also provides an electronic device, comprising: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the methods described above.

[0014] The present invention also provides a computer-readable medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the above-described method.

[0015] Compared with the prior art, the present invention has the following beneficial effects: This invention enables comprehensive scanning of security vulnerabilities in the source code of internet software projects. It utilizes dynamic scanning and a vulnerability database as its core, driven by model training. This solves the problems of high false positive and false negative rates associated with traditional tools. Furthermore, the vulnerability database cannot be updated in real-time. With continuous updates and iterations of the technical architecture, some vulnerabilities have already been patched at the architecture level and can be removed from the database. The model can then be retrained and continuously updated to improve the accuracy of vulnerability identification, prevent vulnerabilities from being exposed after deployment, significantly reduce vulnerability patching costs, and enhance the software's own security protection capabilities.

[0016] First, multi-dimensional static analysis and dynamic sandbox verification are performed on the code files to extract multi-dimensional feature data. This allows for a preliminary scan and preprocessing of the entire codebase. The combination of multi-dimensional static analysis and dynamic sandbox verification improves detection coverage, while a feedback mechanism ensures continuous updates to the dynamic vulnerability repository.

[0017] Then, semantic analysis is performed on the multi-dimensional feature data using a code semantic understanding model. Call chain analysis is conducted based on the code structure relationship graph to locate the root cause of the vulnerability and generate a remediation plan. Thus, a deep learning-based code semantic understanding model can overcome the limitations of traditional rules, achieving precise vulnerability location through code semantic understanding capabilities. Multi-angle identification improves detection accuracy, and call chain analysis based on the code structure relationship graph reverse-tracks data and control flows, compressing the vulnerability response cycle to the minute level. Next, the detected vulnerability features and remediation plans are fed back to a dynamic vulnerability repository to update the repository data, and the risk level is determined based on risk assessment information. This allows for the construction of a dynamically updated vulnerability knowledge base. The automatic identification combined with manual review ensures data accuracy and real-time performance, providing continuously optimized data support for detection and enabling a shift in security auditing from post-event detection to pre-event prevention.

[0018] Secondly, a list of remediation solutions is pushed out based on the risk level. After remediation, targeted detection and verification are performed. The remediation discrepancies are used as training samples to retrain the code semantic understanding model to optimize model parameters. This allows for the quantitative output of detection results and closed-loop verification of remediation effectiveness, intuitively demonstrating the remediation effect. The discrepancy feedback mechanism continuously optimizes model performance and reduces the false positive rate. Finally, vulnerability information is continuously updated, and rule optimization data is fed back to the code semantic understanding model for incremental training. The model optimization results are fed back to the rule base for rule adjustment, forming a two-way feedback loop between rules and the model. This allows for the construction of an automated detection process chain of detection-analysis-optimization-expansion. Forward detection and analysis enable rapid security scanning, while a dynamically updated vulnerability repository drives model training and optimization, achieving a reverse-driven upgrade of detection capabilities. This two-way feedback loop between rules and the model enables the self-evolution and continuous improvement of security detection capabilities, ensuring the stable operation of the software system.

[0019] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating the code security inspection and vulnerability discovery method based on multi-dimensional scanning of the present invention. Figure 2 This is a detailed flowchart illustrating an embodiment of the code security inspection and vulnerability discovery method based on multi-dimensional scanning of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.

[0022] Figure 1 The process of the code security inspection and vulnerability discovery method based on multi-dimensional scanning according to the present invention mainly includes five core steps: S101: Dual-mode detection. Performs multi-dimensional static detection and dynamic sandbox verification on code files to extract multi-dimensional feature data.

[0023] The computing device performs multi-dimensional static testing on the source code, including syntax, logic, components, compliance, and nesting, to identify complex nested logic and trace its origins in both vertical depth and horizontal breadth. It runs key code segments in an isolated sandbox environment to monitor runtime behavior and detect dynamic security vulnerabilities. It also extracts multi-dimensional feature data composed of syntax features, logic features, and component features.

[0024] The aforementioned multi-dimensional static testing comprehensively examines the syntax, logic, components, compliance, and nesting of the source code without requiring it to run. The aforementioned dynamic sandbox verification runs the code in an isolated virtual environment, monitors its runtime behavior, and detects potential dynamic security vulnerabilities, such as memory leaks, abnormal behavior, and unauthorized access.

[0025] The above syntactic features include the type of abstract syntax tree nodes, syntactic structure patterns, and keyword usage frequency; the above logical features include the complexity of conditional branches, the depth of nested loops, and the length of variable assignment chains; the above component features include the name, version number, and known vulnerability identifiers of third-party dependency packages.

[0026] In practice, computing devices can integrate open-source component vulnerability libraries using component detection methods to detect known vulnerabilities or dependency conflicts in third-party dependency packages. For standardization, tools like Jenkins can be integrated, making the detection process more convenient through standardized pipelines. The raw scan results are cleaned and processed, then output according to a standardized template. First, false detection results caused by comments and test code are filtered out. The initial result set is repeatedly verified to complete the data structure encapsulation. The final result is output as a visual report displaying vulnerability levels, numbers, etc., and the standardized result set is pushed to a vulnerability repository.

[0027] S102: Dual-core analysis. Semantic analysis is performed on the multi-dimensional feature data using a code semantic understanding model. Call chain analysis is conducted based on the code structure relationship diagram to locate the root cause of the vulnerability and generate a remediation plan.

[0028] The computing device performs feature matching on multi-dimensional feature data using a deep learning-based code semantic understanding model. The matching results are then compared with the abnormal feature set from multiple perspectives, including syntactic, semantic, and logical dimensions. Based on an abstract syntax tree and program dependency graph, a code structure relationship graph is constructed. Starting from the vulnerability, the data flow and control flow are traced in reverse to locate the root source code of the vulnerability, identify the affected code modules and third-party components, and generate a customized remediation solution.

[0029] The aforementioned deep learning-based model can be a code understanding model based on the Transformer architecture, such as the CodeBERT model, the GraphCodeBERT model, or a code understanding model based on CodeT5. The multi-dimensional recognition includes syntactic dimension recognition, semantic dimension recognition, and logical dimension recognition. Syntactic dimension recognition is used to detect whether the code's syntactic structure conforms to security specifications; semantic dimension recognition is used to detect whether there are security vulnerabilities in the code's semantic meaning; and logical dimension recognition is used to detect whether there are vulnerabilities in the code's execution logic.

[0030] The code structure diagram mentioned above can be constructed based on the Abstract Syntax Tree (AST) and the Program Dependence Graph (PDG). The code call chain analysis mentioned above can be an analysis method that starts from the vulnerability trigger point based on the code structure diagram, reverses the data flow and control flow, and locates the root cause of the vulnerability.

[0031] In practice, computing devices can use natural language processing (NLP) tools to parse static code and obtain an Abstract Syntax Tree (AST). For example, these NLP tools could be syntax parsing tools like ANTLR or Tree-sitter. Then, computing devices can construct a Program Dependency Graph (PDG) using program slicing techniques to analyze code logic dependencies. Next, computing devices can identify the usage of third-party components through component dependency analysis, such as by parsing dependency configuration files like pon.xml, package.json, and requirements.txt. Afterward, computing devices can verify whether the code conforms to secure coding standards through compliance checks, such as checking for hard-coded passwords and insecure random number generation. Finally, computing devices can identify potential vulnerabilities in complex nested structures through nesting hierarchy analysis, such as detecting callback hell and deep recursion.

[0032] Then, the computing device performs feature matching on multi-dimensional feature data through a code understanding model based on the Transformer architecture, marks the similarity of feature matching, and performs multi-angle identification of the result set with similarity greater than a preset similarity threshold (e.g., 0.75) and the abnormal feature set from multiple perspectives of syntax, semantics and logic.

[0033] Next, the computing device constructs a code structure relationship graph based on the abstract syntax tree and program dependency graph, performs call chain analysis, starts from the vulnerability trigger point, reverse traces the data flow and control flow, locates the root cause of the vulnerability, quickly identifies the affected code and third-party components, and generates a customized remediation solution for each security vulnerability.

[0034] In practice, computing devices can match the optimal remediation solution from a remediation solution library based on information such as vulnerability type, scope of impact, and code context, or generate customized remediation code through a large language model. If the generated remediation solution has deviations, developers can manually adjust it and feed the adjusted solution back to the system for subsequent model optimization. S103: Dynamic Repository. Discovered vulnerability characteristics and remediation plans are fed back to the dynamic vulnerability repository to update the repository data, and the risk level is determined based on risk assessment information.

[0035] The dynamic vulnerability repository stores basic vulnerability information, rule sets, and component characteristic information according to programming language categories. The data comes from model scanning lists or manual review and input. The vulnerability characteristics and remediation solutions discovered are automatically fed back to the dynamic vulnerability repository to update the repository data. The accuracy and timeliness of the data are ensured through automatic identification and manual review. The risk level is determined by a weighted score based on the impact range, severity, and exploit complexity of the vulnerability's code location.

[0036] The aforementioned dynamic vulnerability repository can be a database used to store basic security vulnerability data, rule sets, code component characteristics, and other information. The data structure of the dynamic vulnerability repository may include: a vulnerability basic information table (storing vulnerability ID, vulnerability name, CVE number, CVSS score, etc.), a rule set table (storing detection rule ID, rule content, applicable language, risk level, etc.), a component characteristic table (storing component name, version range, known vulnerability associations, etc.), and a risk assessment table (storing impact scope weight, severity weight, exploit complexity weight, etc.).

[0037] In practice, computing devices can store core data features, rule sets, code component features, and other information according to different programming languages ​​and categories. The data mainly comes from model scanning lists or feature data that has been manually entered after manual review, supporting the dynamic updating of metadata. Through the combination of automatic identification and manual review, the accuracy and real-time performance of the data warehouse are guaranteed.

[0038] Computing devices can automatically calculate the risk level of code vulnerabilities using the following steps: The first step is to determine the impact scope weight of the code containing the vulnerability. In practice, computing devices can determine the impact scope weight based on dimensions such as whether the vulnerable code involves core modules, user input interfaces, or authorization verification. For example, the impact scope weight of a vulnerability in a core module involving user input is 0.4, while the impact scope weight of a vulnerability in a non-core module not involving user input is 0.1.

[0039] The second step is to determine the severity weight of the vulnerability. In practice, computing devices can determine the severity weight based on dimensions such as whether the vulnerability can lead to remote code execution, whether it can lead to data leakage, and whether it can lead to privilege escalation. For example, a vulnerability that can lead to remote code execution has a severity weight of 0.4, while a vulnerability that can only lead to information leakage has a severity weight of 0.2.

[0040] The third step is to determine the exploit complexity weight. In practice, computing devices can determine the exploit complexity weight based on dimensions such as whether the exploitation requires specific conditions, user interaction, or network reachability. For example, the exploit complexity weight of a vulnerability that can be exploited without any conditions is 0.2, while the exploit complexity weight of a vulnerability that requires complex conditions is 0.05.

[0041] The fourth step is to calculate the risk score based on the weights for the scope of impact, severity of harm, and complexity of utilization. In practice, the calculation device can add the weights for the scope of impact, severity of harm, and complexity of utilization together to obtain the risk score. For example, the risk score is calculated as: Risk Score = Scope of Impact Weight + Severity of Harm Weight + Complexity of Utilization Weight.

[0042] The fifth step is to classify the risk level based on the risk score. In practice, the computing device can identify vulnerabilities with a risk score greater than a first preset threshold (e.g., 0.8) as high-risk, vulnerabilities with a risk score greater than a second preset threshold (e.g., 0.5) and less than or equal to the first preset threshold as medium-risk, and vulnerabilities with a risk score less than or equal to the second preset threshold as low-risk.

[0043] S104: Closed-loop verification. A list of remediation solutions is pushed out based on the risk level. After remediation, targeted detection and verification are performed. The remediation discrepancies are used as training samples to retrain the code semantic understanding model to optimize model parameters.

[0044] S105: Collaborative Optimization. Continuously update vulnerability information, feed rule optimization data back to the code semantic understanding model for incremental training, and feed the model optimization results back to the rule base for rule adjustment, forming a two-way feedback loop between rules and models.

[0045] The computing device pushes a list of vulnerability remediation solutions in order of risk level, and generates standardized detection reports and remediation guidance plans; the remediated code is re-entered into the system for targeted detection, and the detection results before and after the remediation are summarized and compared to intuitively display the remediation effect; the difference data between the remediation solution generated by the model and the actual remediation method is used as training samples to retrain the code semantic understanding model, adjust the model weight parameters, and reduce the model false positive rate through data feedback verification and rule adaptation.

[0046] The standardized detection report mentioned above can be a report generated according to a preset template format, containing vulnerability information, risk level, and remediation suggestions. The remediation guidance plan mentioned above can be a plan containing specific remediation code, modification locations, verification methods, etc. The preset template format mentioned above can include: report title, basic scan information (scan time, code version, scan scope, etc.), vulnerability summary statistics (number of high-risk, medium-risk, and low-risk vulnerabilities), and a detailed list of vulnerabilities (vulnerability name, location, level, remediation suggestions, etc.).

[0047] The aforementioned discrepancy data can be a set of detection results showing differences between the repair scheme generated by the model and the actual repair method. The aforementioned retraining can be based on the original model parameters, using the discrepancy data to adjust and train the model, optimizing the model weight parameters. The aforementioned data feedback verification can be a process of feeding the discrepancy data back to the model for re-verification.

[0048] In practice, computing devices can uniformly store detection data, scan records, and vulnerability information, providing data support for subsequent model optimization. After the repaired code re-enters the system for detection, targeted detection is performed to verify the repair results, and a detection list is generated again. The two result sets can be summarized and compared to intuitively display the repair effect.

[0049] The computing device compares the repair scheme generated by the model with the actual repair method and records the result set with differences as difference data. The difference data is used to retrain the code semantic understanding model, adjust the model weight parameters, and make the model output closer to the actual repair method. The model optimization effect is verified and evaluated through data feedback, and the false alarm rate of the model is reduced by combining rule adaptation.

[0050] Furthermore, the computing device continuously updates code vulnerability and third-party component defect information, refines and optimizes the model's judgment rules, and eliminates redundant rules. Using semantic features extracted from the scan preprocessing results as training samples, a multimodal dataset containing code text features, abstract syntax tree features, program dependency graph features, and component dependency features is constructed, and training is completed based on deep learning. A learning rate decay strategy is adopted to continuously collect vulnerability repair data for incremental training and model fine-tuning. The rule optimization data is fed back to the code semantic understanding model for incremental training, and the model optimization results are fed back to the rule base for rule adjustment, forming a two-way feedback loop between rules and models, and constructing an automated process link of detection-analysis-optimization-expansion.

[0051] The aforementioned multimodal dataset can be a collection of data containing various types of features, such as code text features, abstract syntax tree features, program dependency graph features, and component dependency features. The code text features can be character-level or word-level embedding vectors of the source code; the abstract syntax tree features can be the concatenation of type embedding vectors and structure embedding vectors of AST nodes; the program dependency graph features can be the embedding of data dependencies and control dependencies of nodes in the PDG; and the component dependency features can be the vulnerability association embedding vectors of third-party components.

[0052] The incremental training described above can be based on existing model parameters and further trained using new data. In practice, a learning decay strategy can be adopted, for example, with an initial learning rate of 1e-5, which is decayed to 0.9 times the original rate every 1000 iterations. The model can be fine-tuned using the newly added differential data, adjusting the model weight parameters to make the model output closer to the actual repair method.

[0053] The above model fine-tuning can be carried out by freezing the underlying parameters of the model and training only the top classifier or the task-specific adaptation layer, in order to improve training efficiency and prevent overfitting.

[0054] The aforementioned two-way feedback loop can be a closed-loop mechanism where rule optimization data is fed back to the code semantic understanding model for incremental training, and the model optimization results are fed back to the rule base for rule adjustment, thus forming a closed-loop mechanism in which rules and models drive each other.

[0055] In practice, a security testing ecosystem can be established through multi-dimensional collaboration to continuously optimize vulnerability detection capabilities. Firstly, a forward-engineering intelligent detection and analysis approach enables rapid security scanning. Secondly, a continuously updated vulnerability repository, coupled with constantly optimized and upgraded model training, drives the upgrading of intelligent detection and analysis. This constructs an automated process chain of "detection-analysis-optimization-expansion," generating a comprehensive security testing system that improves the accuracy and efficiency of code security testing, ensuring the stable operation of software systems.

[0056] Furthermore, the computing device merges the repair discrepancy data and the rule optimization data into multi-source training data to jointly train the code semantic understanding model; different sample weights are assigned according to the source type of the multi-source training data, with the weight of the repair discrepancy data being higher than that of the rule optimization data; the code semantic understanding model is incrementally trained based on the weighted multi-source training data, so that the model can learn both actual repair preferences and rule constraints at the same time, and optimize the consistency between the model output and the actual repair method.

[0057] The aforementioned multi-source training data can be a mixed training dataset containing both discrepancy-correcting data and rule-optimizing data. The aforementioned joint training can utilize multi-source training data to train the model simultaneously, enabling the model to learn knowledge from multiple data sources. The aforementioned sample weights can be numerical values ​​used to balance the importance of different data sources.

[0058] In practice, sample weights can be assigned based on the importance of the repair discrepancy data in reflecting actual repair preferences and the stability of the rule optimization data in reflecting rule constraints. For example, the weight of the repair discrepancy data can be set to 0.7, and the weight of the rule optimization data can be set to 0.3. Then, the code semantic understanding model is incrementally trained based on the weighted multi-source training data, so that the model can learn both actual repair preferences and rule constraints at the same time, and optimize the consistency between the model output and the actual repair method.

[0059] Figure 2 This is a detailed flowchart of an embodiment of the code security inspection and vulnerability discovery method based on multi-dimensional scanning according to the present invention.

[0060] Step 201: Scanning Probe. The computing device receives the static code file to be scanned and configures parameters such as the scan range, scan type, and hazard level. The system then triggers the scanning mechanism, first performing static analysis on the uploaded file to complete standardized preprocessing.

[0061] The aforementioned code files can be source code files from internet software projects, including but not limited to code files in different programming languages ​​such as Java, Pathol, C / C++, JavaScript, and Go. The aforementioned scan scope can be information used to limit the scope of the scanned code, such as including all code, code from a specified module, or incremental code. The aforementioned scan type can be information used to limit the type of vulnerability being scanned, such as including SQL injection, cross-site scripting (XSS), buffer overflow, sensitive information disclosure, and insecure deserialization. The aforementioned severity level can be parameters used to limit the severity of the vulnerability of interest, such as including high-risk, medium-risk, and low-risk.

[0062] In practice, computing devices can scan the entire codebase, perform vulnerability analysis and identification on suspicious code features, provide remediation solutions, and back up the discovered vulnerability features and remediation solutions to the repository. At the same time, the repository can be manually updated to manually update publicly released vulnerabilities in the industry, enabling continuous data iteration and allowing the detection capabilities to be continuously optimized according to the usage scenarios.

[0063] Static code scanning is a prerequisite for security testing. It does not require code execution and, under the premise of setting up an adapted environment, enables comprehensive testing of source code syntax, logic, components, compliance, nesting, and other aspects. Based on the standard syntax of different languages ​​and enterprise-defined specifications, it detects security issues in the code; it identifies nested logic in complex methods or components, and traces the source in both vertical depth and horizontal breadth to ensure that there is no possibility of missing anything.

[0064] The dependency component detection method integrates an open-source component vulnerability library to detect known vulnerabilities or dependency conflicts in third-party dependency packages. For standards, it can integrate tools such as Jenkins, making the detection process more convenient through a standardized pipeline. The raw scan results are cleaned and processed before being output according to a standardized template. First, false detection results caused by comments and test code are filtered out. The initial result set is repeatedly verified and structurally encapsulated. The final results are output as a visual report displaying vulnerability level, quantity, etc., and the standardized result set is pushed to a vulnerability repository.

[0065] Step S202: Select the corresponding language: The computing device selects the corresponding language rule library based on the programming language of the uploaded code file, combines different rule libraries to adapt different models, and uses the analysis list of static scan results to pull the model to be detected, processes the original library of scan data, extracts feature data sets of various dimensions, performs data cleaning and processing, and completes data formatting preprocessing.

[0066] The aforementioned language rule bases can be pre-built sets of security detection rules for different programming languages, such as the OWASP rule base for Java, the Bandit rule base for Python, and the ESLint security rule base for JavaScript. The feature data for each of these dimensions includes syntactic features, logical features, component features, compliance features, and nesting features.

[0067] In practice, computing devices can use semantic embedding models to semantically embed each enhanced news headline, generating enhanced news headline vectors. The aforementioned semantic embedding model can be the BERT-base-chinese model.

[0068] Step S203: Intelligent Model Analysis. The computing device supports pipeline integration to achieve automatic code link detection; it generates data objects to be detected through static code scanning and identifies static security defects based on the security rule base; it performs feature matching between feature sets and basic data features, marks the similarity of feature matching, and uses a deep learning model to identify the result set with high similarity and the abnormal feature set from multiple perspectives. Based on code call link analysis, it locates the root cause of the vulnerability, quickly identifies the affected code and third-party components, performs intelligent analysis of the problem, generates customized remediation solutions for each security vulnerability, and compresses the vulnerability response cycle to the minute level.

[0069] The aforementioned deep learning models can be code understanding models based on the Transformer architecture, such as the CodeBERT model, the GraphCodeBERT model, or a code understanding model based on CodeT5. The multi-dimensional recognition includes syntactic dimension recognition, semantic dimension recognition, and logical dimension recognition.

[0070] The above code call chain analysis can be an analysis method that constructs a code structure relationship graph based on an abstract syntax tree (AST) and a program dependency graph (PDG), starts from the vulnerability trigger point, and traces the data flow and control flow in reverse to locate the root cause of the vulnerability.

[0071] In practice, computing devices can perform syntax parsing on static code to generate abstract syntax trees, perform logical dependency analysis to generate program dependency graphs, perform component dependency analysis to identify the usage of third-party components, perform compliance checks to verify whether the code conforms to secure coding standards, and perform nesting level analysis to identify potential vulnerabilities in complex nested structures.

[0072] Then, the computing device performs feature matching on multi-dimensional feature data through a deep learning-based code semantic understanding model, marks the feature matching similarity, and performs multi-angle identification of the result set with similarity greater than a preset similarity threshold (e.g., 0.75) and the abnormal feature set from the perspectives of syntax, semantics and logic.

[0073] Next, the computing device constructs a code structure relationship graph based on the abstract syntax tree and program dependency graph. Starting from the vulnerability trigger point, it reverse-tracks the data flow and control flow to locate the root source code of the vulnerability. Based on the vulnerability propagation path, it locks down the affected code modules and third-party components and generates a customized remediation solution.

[0074] Step S204: Repository. The computing device pushes corresponding basic security vulnerability data based on the configured programming language, used by the model to identify and locate vulnerabilities. The vulnerability repository not only provides basic data features for code scanning but also integrates key information from risk assessment dimensions, such as vulnerability exploitation value, impact scope, and remediation priority. It also provides specific dependency replacement code and log configuration modification methods, providing quantitative basis for security scanning. The risk level of code vulnerabilities can be automatically calculated based on the result set, distinguishing between 'high, medium, and low' risks. Each scan result list is synchronized to the repository, updating and iterating the basic data to ensure data accuracy.

[0075] The code vulnerability repository is not a static data repository, but a dynamic library that is updated in real time. It stores core data features, rule sets, and code component characteristics according to different programming languages ​​and categories. The data mainly comes from model scan lists or feature data manually entered after review, supporting dynamic updates of metadata. Through a combination of automatic identification and manual review, the accuracy and real-time nature of the data warehouse are ensured.

[0076] In practice, computing devices can store core data features, rule sets, code component features, and other information according to different programming languages ​​and categories. The data mainly comes from model scanning lists or feature data that has been manually entered after manual review, supporting the dynamic updating of metadata.

[0077] Step S205: Detection List. The computing device pushes a list of vulnerability remediation solutions based on the result set identified by the quantification model, sorted by risk level; the result output module generates a standardized detection report and remediation guidance plan; at the same time, it realizes unified storage of detection data, scan records, and vulnerability information, providing data support for subsequent model optimization; after the remediated code re-enters the system for detection, targeted detection is performed to verify the remediation results, and a new detection list is generated. The two result sets can be summarized and compared to intuitively display the remediation effect.

[0078] Step S206: Rectification complete. After the computing device has patched the vulnerabilities, it scans again. If all items on the to-be-detected list pass the security review, it is marked as having passed. The model's solutions are compared with the actual solutions. The sets of results with discrepancies are organized and recorded. The discrepancy datasets are then used to retrain the model. Data return is used to verify and adapt the rules to reduce the model's false positive rate.

[0079] Step S207: Rule Update and Model Training. The computing device continuously updates code vulnerabilities and third-party component defects to improve the accuracy and timeliness of code security detection. Combining programming language compliance requirements with actual detection results, the model's judgment rules and scanning granularity are refined and optimized, redundant rules are eliminated, and the timeliness and adaptability of the rule base are ensured. Model training uses scan preprocessing results as the data foundation to extract semantic features as training samples, constructing a multimodal dataset. Training is completed based on deep learning. Simultaneously, using the updated data as a foundation, data feature samples and vulnerability remediation data are continuously collected for incremental training and model fine-tuning, improving model detection accuracy and forming a two-way linkage between rules and models, continuously updating and optimizing an intelligent security detection system.

[0080] In practice, computing devices can establish a security detection ecosystem through multi-dimensional collaboration, enabling continuous optimization of vulnerability detection capabilities. Firstly, a forward-engineering intelligent detection and analysis approach achieves rapid security scanning. Secondly, a continuously updated vulnerability repository, coupled with continuously optimized and upgraded model training, drives the upgrading of intelligent detection and analysis. This constructs an automated "detection-analysis-optimization-expansion" process, generating a comprehensive security detection system, improving the accuracy and efficiency of code security detection, and ensuring the stable operation of software systems.

[0081] This invention integrates three dimensions—scanning analysis, code vulnerability repository, and intelligent analysis and solutions—in code security inspection and vulnerability discovery, forming a multi-dimensional integration. Each dimension has a clear division of labor, working collaboratively to achieve comprehensive detection. Scanning analysis, integrating code scanning, vulnerability discovery, and security issue tracing, is the core execution unit of the system, relying on the code vulnerability repository to provide a data foundation for static scanning. The vulnerability repository stores massive amounts of vulnerability cases and rule-based judgments, strongly supporting security inspection and vulnerability discovery. Intelligent analysis, through intelligent algorithms and model training, overcomes the rule limitations of existing traditional tools, achieving improved automation and intelligence efficiency through code analysis and intelligent model recognition. Simultaneously, it provides corresponding vulnerability avoidance solutions based on model recognition results. Through a foundational data base and intelligent collaboration, security auditing is transformed into proactive prevention, continuously improving software code security through real-time feedback and remediation guidance.

[0082] This invention constructs a code security protection system based on static code detection, supported by a code vulnerability repository, and centered on intelligent analysis and solutions. Breaking away from traditional security scanning tools, it achieves a multi-dimensional, deeply collaborative, and real-time data repository update mechanism, enabling intelligent judgment and automated solution generation from comprehensive code detection and precise vulnerability matching to a massive vulnerability repository as the data foundation. It retrieves corresponding security scanning strategies based on different programming languages, making it suitable for the development processes of various types of internet software projects. It can quickly identify and uncover hidden security vulnerabilities in the code, overcoming the shortcomings of traditional detection tools such as low accuracy and lack of practicality in remediation strategies, thus improving the coverage of code security detection. By updating the vulnerability repository in real time, the model can be continuously improved to adapt to the rapid iteration of current technologies, thereby improving the accuracy and efficiency of security detection and significantly reducing security risks during the development process.

[0083] This invention uses static code as the basis for detection in three dimensions: scanning the entire code, identifying suspicious code, retrieving intelligent analysis models, performing vulnerability analysis and identification on the characteristics of suspicious code, providing remediation solutions, and back-complementing the discovered vulnerability characteristics and remediation solutions to the repository. At the same time, the repository can be manually updated, and publicly released vulnerabilities in the industry can be manually updated to achieve continuous data iteration, allowing the detection capabilities to be continuously optimized according to the usage scenarios.

[0084] Static code scanning serves as a prerequisite for security testing. Without requiring code execution, it provides comprehensive testing of source code syntax, logic, components, compliance, and nesting, provided a suitable environment is set up. Based on standard syntax of different languages ​​and enterprise-defined specifications, it detects security issues in the code. It identifies nested logic in complex methods or components, tracing the source both vertically and horizontally to ensure no missed vulnerabilities. Dependency component detection integrates open-source component vulnerability libraries to detect known vulnerabilities or dependency conflicts in third-party dependency packages. For standardization, tools like Jenkins can be integrated to streamline the testing process. The raw scan results are cleaned and processed before being output according to a standardized template. First, it identifies false positives caused by comments and test code, and repeatedly verifies the initial result set to achieve data structuring and encapsulation. The final result is output as a visual report displaying vulnerability levels, numbers, etc., while the standardized result set is pushed to a vulnerability repository.

[0085] The code vulnerability repository is not a static data repository, but a dynamic library that is updated in real time. It stores core data features, rule sets, and code component characteristics according to different programming languages ​​and categories. The data mainly comes from model scan lists or feature data manually entered after review, supporting dynamic updates of metadata. Through a combination of automatic identification and manual review, the accuracy and real-time nature of the data warehouse are ensured.

[0086] Intelligent analysis and solutions utilize a vulnerability repository as a data foundation, combining machine learning for model training. It also accepts manually inputted vulnerability information, matching and associating it with the repository to update and train the model, expanding its capabilities and scope for security detection. Based on rule matching or model training, it automatically provides corresponding remediation solutions for vulnerability detection results. If the remediation solutions deviate, manual adjustments can be made to ensure the accuracy of security detection. A built-in risk data analysis model categorizes risk levels based on impact scope, severity, and different dimensions, generating risk analysis reports that intuitively display vulnerability locations, remediation plans, and risk levels, allowing developers to quickly and easily complete remediation.

[0087] Through multi-dimensional collaboration, a security testing ecosystem is established to continuously optimize vulnerability detection capabilities. Firstly, a forward-engineering intelligent detection and analysis approach enables rapid security scanning. Secondly, a constantly updated vulnerability repository, coupled with continuously optimized and upgraded model training, drives the upgrading of intelligent detection and analysis. An automated "detection-analysis-optimization-expansion" process is constructed to generate a comprehensive security testing system, improving the accuracy and efficiency of code security testing and ensuring the stable operation of software systems.

[0088] This invention also provides a code security inspection and vulnerability discovery system based on multi-dimensional scanning, comprising: The dual-mode detection module is configured to perform multi-dimensional static detection and dynamic sandbox verification on code files, and extract multi-dimensional feature data. The dual-core analysis module is configured to perform semantic analysis on the multi-dimensional feature data through a code semantic understanding model, perform call chain analysis based on the code structure relationship diagram, locate the root cause of the vulnerability, and generate a remediation plan. The dynamic repository module feeds back the detected vulnerability features and remediation solutions to the dynamic vulnerability repository to update the repository data and determines the risk level based on the risk assessment information. The closed-loop verification module is configured to push a list of repair solutions based on the risk level, perform targeted detection and verification after repair, and use the repair difference data as training samples to retrain the code semantic understanding model to optimize the model parameters. The linkage optimization module is configured to continuously update vulnerability information, feed rule optimization data back to the code semantic understanding model for incremental training, and feed the model optimization results back to the rule base for rule adjustment, forming a two-way feedback loop between rules and models.

[0089] The present invention also provides an electronic device, comprising: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the methods described above.

[0090] The present invention also provides a computer-readable medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the above-described method.

[0091] The aforementioned computer-readable media can be internal storage units of a computer device, such as hard disks and memory. They can also be external storage devices, such as plug-in hard disks, smart memory cards, secure digital cards, and flash memory cards.

[0092] Optionally, some possible implementations may include all or part of the above-described implementations.

[0093] It should be understood that in the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples" refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this description, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate different embodiments or examples described in this specification, as well as some features of different embodiments or examples.

[0094] Of course, those skilled in the art can make various corresponding changes and modifications based on the present invention without departing from its spirit and essence, but such changes and modifications should all fall within the protection scope of the claims of the present invention.

Claims

1. A code security inspection and vulnerability discovery method based on multi-dimensional scanning, characterized in that, include: Perform multi-dimensional static analysis and dynamic sandbox verification on code files to extract multi-dimensional feature data; The multi-dimensional feature data is semantically analyzed using a code semantic understanding model, and the call chain is analyzed based on the code structure relationship diagram to locate the root cause of the vulnerability and generate a remediation plan. The detected vulnerability characteristics and remediation solutions are fed back to the dynamic vulnerability repository to update the repository data, and the risk level is determined based on the risk assessment information; A list of remediation solutions will be pushed out based on the risk level. After the remediation is completed, targeted testing and verification will be carried out. The remediation difference data will be used as training samples to retrain the code semantic understanding model in order to optimize the model parameters. Continuously update vulnerability information, feed rule optimization data back to the code semantic understanding model for incremental training, and feed the model optimization results back to the rule base for rule adjustment, forming a two-way feedback loop between rules and models.

2. The method according to claim 1, characterized in that, The process of performing multi-dimensional static analysis and dynamic sandbox verification on code files to extract multi-dimensional feature data includes: Perform multi-dimensional static testing on the source code, including syntax, logic, components, compliance, and nesting, to identify complex nested logic and trace the source in both vertical depth and horizontal breadth. Run critical code snippets in an isolated sandbox environment to monitor runtime behavior and detect dynamic security vulnerabilities. Extract multi-dimensional feature data composed of syntactic features, logical features, and component features.

3. The method according to claim 1, characterized in that, The step involves performing semantic analysis on the multi-dimensional feature data using a code semantic understanding model, analyzing the call chain based on the code structure relationship graph, locating the root cause of the vulnerability, and generating a remediation plan, including: By using a deep learning-based code semantic understanding model, feature matching is performed on multi-dimensional feature data, and the matching results are used to identify abnormal feature sets from multiple perspectives, including syntactic, semantic, and logical dimensions. Based on the abstract syntax tree and program dependency graph, a code structure relationship graph is constructed. Starting from the vulnerability point, the data flow and control flow are traced in reverse to locate the root source code of the vulnerability, the affected code modules and third-party components are identified, and a customized remediation solution is generated.

4. The method according to claim 1, characterized in that, The process of feeding back the detected vulnerability characteristics and remediation solutions to the dynamic vulnerability repository to update the repository data, and determining the risk level based on risk assessment information, includes: The dynamic vulnerability repository stores basic vulnerability information, rule sets, and component feature information according to programming language categories. The data comes from model scanning lists or manual review and entry. The vulnerability characteristics and remediation solutions discovered during detection are automatically fed back to the dynamic vulnerability repository to update the repository data. The accuracy and timeliness of the data are ensured through automatic identification and manual review. The risk level is determined by a weighted score based on the scope of impact, severity, and exploit complexity of the vulnerability's location in the code.

5. The method according to claim 1, characterized in that, The process of pushing a list of remediation solutions based on risk levels, performing targeted detection and verification after remediation, and using the remediation discrepancies as training samples to retrain the code semantic understanding model to optimize model parameters includes: A list of vulnerability remediation solutions is pushed out in order of risk level, and standardized detection reports and remediation guidance plans are generated. The repaired code is re-entered into the system for targeted testing. The test results before and after the repair are summarized and compared to visually demonstrate the repair effect. The difference between the repair scheme generated by the model and the actual repair method is used as a training sample to retrain the code semantic understanding model, adjust the model weight parameters, and reduce the false alarm rate of the model through data feedback verification and rule adaptation.

6. The method according to claim 1, characterized in that, The continuous updating of vulnerability information, feeding rule optimization data back to the code semantic understanding model for incremental training, and feeding the model optimization results back to the rule base for rule adjustment, forms a two-way feedback loop between rules and models, including: Continuously update information on code vulnerabilities and third-party component defects, refine and optimize model judgment rules, and eliminate redundant rules; Using semantic features extracted from the scan preprocessing results as training samples, a multimodal dataset containing code text features, abstract syntax tree features, program dependency graph features, and component dependency features was constructed, and training was completed based on deep learning. A learning rate decay strategy is adopted to continuously collect vulnerability repair data for incremental training and model fine-tuning; The data from rule optimization is fed back to the code semantic understanding model for incremental training, and the model optimization results are fed back to the rule base for rule adjustment, forming a two-way feedback loop between rules and models, and building an automated process link of detection-analysis-optimization-expansion.

7. The method according to claim 1, characterized in that, The steps of retraining the code semantic understanding model using the repaired discrepancy data as training samples to optimize model parameters and feeding the rule-optimized data back to the code semantic understanding model for incremental training include... The data for fixing discrepancies and the data for optimizing rules are merged into multi-source training data for joint training of the code semantic understanding model. Different sample weights are assigned based on the source type of the multi-source training data, with the weight of data that repairs discrepancies being higher than the weight of data that optimizes rules. Incremental training of the code semantic understanding model is performed based on weighted multi-source training data, enabling the model to learn both actual repair preferences and rule constraints, thereby optimizing the consistency between the model output and the actual repair methods.

8. A code security inspection and vulnerability discovery system based on multi-dimensional scanning, characterized in that, include: The dual-mode detection module is configured to perform multi-dimensional static detection and dynamic sandbox verification on code files, and extract multi-dimensional feature data. The dual-core analysis module is configured to perform semantic analysis on the multi-dimensional feature data through a code semantic understanding model, perform call chain analysis based on the code structure relationship diagram, locate the root cause of the vulnerability, and generate a remediation plan. The dynamic repository module feeds back the detected vulnerability features and remediation solutions to the dynamic vulnerability repository to update the repository data and determines the risk level based on the risk assessment information. The closed-loop verification module is configured to push a list of repair solutions based on the risk level, perform targeted detection and verification after repair, and use the repair difference data as training samples to retrain the code semantic understanding model to optimize the model parameters. The linkage optimization module is configured to continuously update vulnerability information, feed rule optimization data back to the code semantic understanding model for incremental training, and feed the model optimization results back to the rule base for rule adjustment, forming a two-way feedback loop between rules and models.

9. An electronic device, characterized in that, include: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-7.

10. A computer-readable medium, characterized in that, It stores a computer program thereon, wherein the computer program, when executed by a processor, implements the method as described in any one of claims 1-7.

Images