A method, apparatus and system for software vulnerability generation and software vulnerability detection

Abstract

The embodiment of the application discloses a software vulnerability generation and software vulnerability detection method, device and system. In the embodiment of the application, a vulnerability writer agent and a vulnerability detector agent are designed to generate a vulnerability and detect the vulnerability respectively, wherein the vulnerability writer agent is used to acquire a code attribute graph; code attribute graph representation is determined according to the code attribute graph, and then target code containing a vulnerability and a reward parameter of the vulnerability writer agent are generated, and the vulnerability writer agent is updated; the vulnerability detector agent is used to acquire code to be detected, generate a detection result, calculate a loss function according to the detection result; a loss parameter is determined according to the loss function, and the vulnerability detector agent is updated; through the above method, the vulnerability writer agent and the vulnerability detector agent are used to continuously improve the quality of the generated target code and the accuracy of the vulnerability detection in a self-game mode.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more specifically, to a method, apparatus, and system for generating and detecting software vulnerabilities. Background Technology

[0002] With the deepening of digital transformation, software systems have become a core element supporting the operation of the economy and critical infrastructure. The number and complexity of software security vulnerabilities are also increasing, and many high-risk vulnerabilities involve deep-seated issues such as memory security, logical defects, and privilege escalation. Therefore, it is necessary to effectively detect the above-mentioned software security vulnerabilities.

[0003] In the existing technology, various methods are used to detect vulnerabilities, such as static analysis based on predefined rules, vulnerability detection methods based on deep learning, vulnerability detection methods based on large language models, and vulnerability mining methods based on fuzzing. However, the above detection methods are all one-way static detection paradigms and cannot effectively detect new and complex vulnerabilities.

[0004] In conclusion, improving the accuracy of vulnerability detection is a problem that needs to be solved. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a method, apparatus and system for generating and detecting software vulnerabilities, which can improve the quality of generated vulnerabilities and improve the accuracy of vulnerability detection.

[0006] In a first aspect, embodiments of the present invention provide a method for generating software vulnerabilities, the method comprising: acquiring a code attribute graph, wherein the code attribute graph is constructed based on a source code file to be processed; determining a code attribute graph representation based on the code attribute graph, wherein the code attribute graph representation includes at least one representation vector; inputting the code attribute graph and the code attribute graph representation into a vulnerability writer agent, determining a code region into which a vulnerability is injected, and generating target code containing the vulnerability according to a pre-designed policy network; generating reward parameters for the vulnerability writer agent based on the target code, and updating the vulnerability writer agent, wherein the updated vulnerability writer agent is used to generate target code containing a high-complexity vulnerability.

[0007] Optionally, obtaining the code attribute graph specifically includes: obtaining the source code file to be processed; generating an abstract syntax tree, a control flow graph, and a program dependency graph based on the source code file to be processed; and generating the code attribute graph based on the abstract syntax tree, the control flow graph, and the program dependency graph.

[0008] Optionally, determining the code attribute graph representation based on the code attribute graph specifically includes: determining the node-level representation corresponding to each node based on the code attribute graph; determining the statement-level representation based on the node-level representation; determining the function-level representation based on the statement-level representation; determining the file-level representation based on the function-level representation; and determining the node-level representation, the statement-level representation, the function-level representation, and the file-level representation as the code attribute graph representation.

[0009] Optionally, the code attribute graph and its representation are input into the vulnerability writer agent to determine the code region where the vulnerability is injected, and target code containing the vulnerability is generated according to a pre-designed policy network. Specifically, this includes: inputting the code attribute graph and its representation into the vulnerability writer agent to determine the code region where the vulnerability is injected according to a graph attention mechanism; inputting the code attribute graph representation into the pre-designed policy network to output the probability distribution of at least one vulnerability injection operation in the action space; and performing the vulnerability injection operation in the code region where the vulnerability is injected according to the probability distribution to generate the target code containing the vulnerability.

[0010] Optionally, generating reward parameters for the vulnerability writer agent based on the target code and updating the vulnerability writer agent specifically includes: determining the value corresponding to the reward function based on the target code, wherein the reward function is pre-designed and used to judge the quality of the generated target code; calculating the reward parameters of the vulnerability writer agent based on the value corresponding to the reward function; and updating the vulnerability writer agent based on the reward parameters.

[0011] Optionally, the method further includes: performing static semantic verification and dynamic sandbox verification on the target code to determine the target code with high-fidelity vulnerabilities; and saving the target code with high-fidelity vulnerabilities to a training set, wherein the training set is used for training the vulnerability detector agent.

[0012] Secondly, embodiments of the present invention provide a method for software vulnerability detection, the method comprising: acquiring code to be detected, wherein the code to be detected includes target code generated by a vulnerability writer agent, source code files, and publicly disclosed general vulnerabilities and code exposing real vulnerabilities; inputting the code to be detected into a vulnerability detector agent and outputting detection results, wherein the detection results include existence determination, vulnerability type classification, and location; calculating a loss function of the vulnerability detector agent based on the detection results; determining loss parameters of the vulnerability detector agent based on the loss function and updating the vulnerability detector agent, wherein the updated vulnerability detector agent is used to detect the code to be detected containing highly complex vulnerabilities.

[0013] Optionally, calculating the loss function of the vulnerability detector agent based on the detection results specifically includes: determining the binary cross-entropy loss corresponding to the existence discrimination, the multi-class cross-entropy loss corresponding to the vulnerability type classification, and the sequence labeling loss corresponding to the location positioning based on the detection results; and determining the loss function based on the binary cross-entropy loss, the multi-class cross-entropy loss, and the sequence labeling loss.

[0014] Thirdly, embodiments of the present invention provide a software vulnerability generation apparatus, the apparatus comprising: a first acquisition unit, configured to acquire a code attribute graph, wherein the code attribute graph is constructed based on a source code file to be processed; a generation unit, configured to determine a code attribute graph representation based on the code attribute graph, wherein the code attribute graph representation includes at least one representation vector; a first determination unit, configured to input the code attribute graph and the code attribute graph representation into a vulnerability writer agent, determine a code region to inject a vulnerability, and generate target code containing the vulnerability according to a pre-designed policy network; and a first update unit, configured to generate reward parameters for the vulnerability writer agent based on the target code, and update the vulnerability writer agent, wherein the updated vulnerability writer agent is used to generate target code containing a high-complexity vulnerability.

[0015] Optionally, the first acquisition unit is specifically used to: acquire the source code file to be processed; generate an abstract syntax tree, a control flow graph, and a program dependency graph based on the source code file to be processed; and generate the code attribute graph based on the abstract syntax tree, the control flow graph, and the program dependency graph.

[0016] Optionally, the generation unit is specifically used to: determine the node-level representation corresponding to each node based on the code attribute graph; determine the statement-level representation based on the node-level representation; determine the function-level representation based on the statement-level representation; determine the file-level representation based on the function-level representation; and determine the node-level representation, the statement-level representation, the function-level representation, and the file-level representation as the code attribute graph representation.

[0017] Optionally, the first determining unit is specifically configured to: input the code attribute graph and the code attribute graph representation into the vulnerability writer agent, and determine the code region for injecting vulnerabilities according to the graph attention mechanism; input the code attribute graph representation into the pre-designed policy network, and output the probability distribution of at least one vulnerability injection operation in the action space; and perform vulnerability injection operation in the code region for injecting vulnerabilities according to the probability distribution to generate the target code containing the vulnerability.

[0018] Optionally, the first update unit is specifically used to: determine the value corresponding to the reward function based on the target code, wherein the reward function is pre-designed and used to judge the quality of the generated target code; calculate the reward parameter of the vulnerability writer agent based on the value corresponding to the reward function; and update the vulnerability writer agent based on the reward parameter.

[0019] Optionally, the apparatus further includes: a storage unit, configured to perform static semantic verification and dynamic sandbox verification on the target code to determine target code with high-fidelity vulnerabilities; and to save the target code with high-fidelity vulnerabilities to a training set, wherein the training set is used for training a vulnerability detector agent.

[0020] Fourthly, embodiments of the present invention provide a software vulnerability detection apparatus, the apparatus comprising: a second acquisition unit, configured to acquire code to be detected, wherein the code to be detected includes target code generated by a vulnerability writer agent, source code files, and publicly disclosed general vulnerabilities and code exposing real vulnerabilities; a detection unit, configured to detect inputting the code to be detected into a vulnerability detector agent and output detection results, wherein the detection results include existence determination, vulnerability type classification, and location positioning; a second determination unit, configured to calculate a loss function of the vulnerability detector agent based on the detection results; and a second update unit, configured to determine loss parameters of the vulnerability detector agent based on the loss function and update the vulnerability detector agent, wherein the updated vulnerability detector agent is used to detect the code to be detected containing highly complex vulnerabilities.

[0021] Optionally, the second determining unit is specifically used to determine, based on the detection results, the binary cross-entropy loss corresponding to the existence discrimination, the multi-class cross-entropy loss corresponding to the vulnerability type classification, and the sequence labeling loss corresponding to the location positioning; and to determine the loss function based on the binary cross-entropy loss, the multi-class cross-entropy loss, and the sequence labeling loss.

[0022] Fifthly, embodiments of the present invention provide a system for generating and detecting software vulnerabilities. The system includes: a vulnerability writer agent and a vulnerability detector agent; wherein the vulnerability writer agent is used to acquire a code attribute graph, wherein the code attribute graph is constructed based on a source code file to be processed; determine a code attribute graph representation based on the code attribute graph, wherein the code attribute graph representation includes at least one representation vector; input the code attribute graph and the code attribute graph representation into the vulnerability writer agent to determine a code region to inject vulnerabilities, and generate target code containing the vulnerabilities according to a pre-designed policy network; generate reward parameters for the vulnerability writer agent based on the target code, and update the vulnerability writer agent, wherein the update... The vulnerability writer agent is used to generate target code containing highly complex vulnerabilities; the vulnerability detector agent is used to acquire code to be detected, wherein the code to be detected includes target code generated by the vulnerability writer agent, source code files, and publicly disclosed general vulnerabilities and code exposing real vulnerabilities; the code to be detected is input into the vulnerability detector agent, and detection results are output, wherein the detection results include existence determination, vulnerability type classification, and location; the loss function of the vulnerability detector agent is calculated based on the detection results; the loss parameters of the vulnerability detector agent are determined based on the loss function, and the vulnerability detector agent is updated, wherein the updated vulnerability detector agent is used to detect the code to be detected containing highly complex vulnerabilities.

[0023] Optionally, the complexity of the target code containing the vulnerability generated by the vulnerability writer agent can be adjusted based on the vulnerability detection success rate of the vulnerability detector agent and the bypass success rate of the vulnerability writer agent.

[0024] In a sixth aspect, embodiments of the present invention provide an electronic device, including a memory and a processor, the memory being used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement the method as described in any one of the first aspect, any possible first aspect, the second aspect, or any possible second aspect.

[0025] In a seventh aspect, embodiments of the present invention provide a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the method as described in the first aspect or any one of the possibilities of the first aspect.

[0026] In this embodiment of the invention, a system for vulnerability generation and vulnerability detection is designed using a vulnerability writer agent and a vulnerability detector agent. The vulnerability writer agent is used to acquire a code attribute graph; determine a code attribute graph representation based on the code attribute graph; input the code attribute graph and the code attribute graph representation into the vulnerability writer agent to determine the code region to be injected with the vulnerability, and generate target code containing the vulnerability according to a pre-designed policy network; generate reward parameters for the vulnerability writer agent based on the target code, and update the vulnerability writer agent agent accordingly. The vulnerability detector agent is used to acquire code to be detected; input the code to be detected into the vulnerability detector agent, output the detection result; calculate the loss function of the vulnerability detector agent based on the detection result; determine the loss parameters of the vulnerability detector agent based on the loss function, and update the vulnerability detector agent agent accordingly. Through the above method, the vulnerability writer agent and the vulnerability detector agent, in a self-game manner, continuously improve the quality of the generated target code and the accuracy of vulnerability detection. Attached Figure Description

[0027] The above and other objects, features and advantages of the present invention will become clearer from the following description of embodiments of the invention with reference to the accompanying drawings, in which: Figure 1 This is a schematic diagram of a system for generating and detecting software vulnerabilities according to an embodiment of the present invention; Figure 2 This is a flowchart of a method for generating software vulnerabilities according to an embodiment of the present invention; Figure 3 This is a flowchart of a method for obtaining a code attribute graph according to an embodiment of the present invention; Figure 4 This is a flowchart of a method for generating target code according to an embodiment of the present invention; Figure 5 This is a flowchart of a method for updating a vulnerability writer's intelligent agent according to an embodiment of the present invention; Figure 6 This is a flowchart of another method for generating software vulnerabilities in an embodiment of the present invention; Figure 7 This is a flowchart of a software vulnerability detection method according to an embodiment of the present invention; Figure 8 This is a schematic diagram of a software vulnerability generation device according to an embodiment of the present invention; Figure 9 This is a schematic diagram of a software vulnerability detection device according to an embodiment of the present invention; Figure 10 This is a schematic diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0028] The present application is described below based on embodiments, but it is not limited to these embodiments. In the detailed description of the present application below, certain specific details are described in detail. Those skilled in the art can fully understand the present application without these details. To avoid obscuring the substance of the present application, well-known methods, processes, flows, elements, and circuits are not described in detail.

[0029] Furthermore, those skilled in the art should understand that the accompanying drawings provided herein are for illustrative purposes only and are not necessarily drawn to scale.

[0030] Unless the context explicitly requires it, words such as "including" or "contains" throughout the application should be interpreted as including rather than exclusive or exhaustive; that is, meaning "including but not limited to".

[0031] In the description of this application, it should be understood that the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0032] In existing technologies, various methods are used to detect vulnerabilities, including static analysis based on predefined rules, vulnerability detection methods based on deep learning, vulnerability detection methods based on large language models, and vulnerability mining methods based on fuzzing. Specifically, the static analysis method based on predefined rules scans and matches source code using manually defined vulnerability pattern rules. Its main drawbacks include the high cost and long update cycle of writing and maintaining rules, which requires a large number of security experts; the coverage of the rules is limited to known vulnerability patterns and it is essentially unable to detect zero-day vulnerabilities and new attack methods; and the lack of understanding of the deep semantics and context of the code leads to a large number of false positives and false negatives. The aforementioned deep learning-based vulnerability detection methods train detection models on labeled vulnerability datasets using graph neural networks or pre-trained language models. Their main drawbacks include heavy reliance on large-scale, high-quality labeled data, while real vulnerability data is extremely scarce, resulting in a severe imbalance between positive and negative samples. The detection models are highly sensitive to semantic changes in the code; simple variable renaming or code reorganization can lead to inverted detection results, indicating insufficient robustness. Furthermore, the static training paradigm on fixed datasets means the detection model's capabilities are fixed after training and cannot adaptively improve with evolving attack methods. The aforementioned Large Language Model (LLM)-based vulnerability detection methods utilize the code understanding and reasoning capabilities of large language models for vulnerability analysis. Their main drawbacks include extremely poor judgment stability in vulnerability detection; even minor code changes can lead to inverted conclusions. They suffer from a serious "illusion" problem, where LLM may misclassify secure code as vulnerable or provide incorrect security assessments of real vulnerabilities. They lack structured code representation capabilities and have limited detection capabilities for vulnerability types sensitive to control flow and data flow. Finally, they lack a mechanism to proactively generate adversarial examples to enhance their detection capabilities. The aforementioned fuzz-based vulnerability discovery methods trigger abnormal program behavior by generating a large number of random or semi-random test inputs. Their main drawbacks include a reliance on coverage-driven, blind exploration strategies, resulting in extremely low efficiency for triggering deep vulnerabilities requiring complex constraints; the generated test cases lack a high-level semantic understanding of vulnerability patterns, making it difficult to construct inputs specifically designed to trigger CWE (Critical Weapon Exception) type vulnerabilities; and they are typically only applicable to binary or compiled programs, offering insufficient coverage of logical vulnerabilities at the source code level. In summary, the above detection methods are all one-way, static detection paradigms, unable to effectively detect novel and complex vulnerabilities. Therefore, improving the accuracy of vulnerability detection is a problem that needs to be addressed.

[0033] In this embodiment of the invention, to address the aforementioned problems, a system for generating and detecting software vulnerabilities is proposed, specifically as follows: Figure 1As shown, the system includes a vulnerability writer agent 101 and a vulnerability detector agent 102. The vulnerability writer agent 101 and the vulnerability detector agent 102 engage in self-play to achieve a closed-loop adversarial training framework, enabling the vulnerability detection capability to continuously evolve with increasing adversarial complexity. The self-play is a training paradigm derived from game theory, where the vulnerability writer agent and the vulnerability detector agent train against each other, allowing their capabilities to co-evolve and improve through iterative game play. The aforementioned agents refer to computing units with perception, decision-making, and execution capabilities, capable of independently completing specific tasks or functional modules under given goals or rule constraints. The vulnerability writer agent can also be called a vulnerability writer, and the vulnerability detector agent can also be called a vulnerability detector.

[0034] The processing procedures of the vulnerability writer agent and the vulnerability detector agent are described in detail below.

[0035] In this embodiment of the invention, a method for generating software vulnerabilities is proposed, specifically as follows: Figure 2 As shown, the method includes: Step S201: Obtain the code attribute map.

[0036] Specifically, the code attribute graph is constructed based on the source code file to be processed. The source code file supports multiple languages, such as C / C++, Java, and Python. The construction process of the code attribute graph is as follows: Figure 3 As shown, it includes the following steps: Step S301: Obtain the source code file to be processed.

[0037] Step S302: Generate an abstract syntax tree, a control flow graph, and a program dependency graph based on the source code file to be processed.

[0038] Specifically, the source code file to be processed is input into a syntax parser to generate an Abstract Syntax Tree (AST). The hierarchical syntax structure of the source code file is extracted from the AST, which is a tree-like representation of the syntax structure of the source code file, where each node represents a syntax construct in the source code. Based on control flow analysis of the source code file to be processed, a Control Flow Graph (CFG) is generated, depicting all possible execution paths and branch jump relationships of the source code file. The CFG is a directed graph describing all possible paths during the execution of the source code file, where nodes represent basic blocks and edges represent control transfer relationships. Based on control flow analysis of the source code file to be processed, a Program Dependence Graph (PDG) is generated, representing the graph structure of data dependencies and control dependencies between statements in the source code file.

[0039] Step S303: Generate the code attribute graph based on the abstract syntax tree, the control flow graph, and the program dependency graph.

[0040] Specifically, the Program Dependence Graph (CPG) is used to represent the syntax structure, execution path, and data flow relationships of the source code file. The CPG uses the nodes of the AST as the base node set, and superimposes the control flow edges of the CFG and the data dependency edges and control dependency edges of the PDG on the AST to form a heterogeneous graph structure G = (V, E_ast, E_cfg, E_ddg, E_cdg) containing multiple edge types. Here, V is the node set, and E_ast, E_cfg, E_ddg, and E_cdg represent syntax structure edges, control flow edges, data dependency edges, and control dependency edges, respectively. The heterogeneous graph structure is the graph structure of the Program Dependence Graph.

[0041] Step S202: Determine the code attribute diagram representation based on the code attribute diagram.

[0042] Specifically, the code attribute graph representation includes at least one representation vector, which includes node-level representation, statement-level representation, file-level representation, and file-level representation. In one possible implementation, the node-level representation corresponding to each node is determined based on the code attribute graph. Specifically, based on the constructed CPG, a heterogeneous graph attention network is employed. The Attention Network (HAN) iteratively aggregates and updates node features. For the feature update of node v at layer L, attention-weighted aggregation is calculated for each edge type r. The specific formula for the node features of node v at layer L+1 is as follows: h_v^{(L+1)} = σ(∑_{r∈R} ∑_{u∈N_r(v)} α_{vu}^{r} W_r^{(L)} h_u^{(L)}) Wherein, R = {ast, cfg, ddg, cdg} is the set of edge types, N_r(v) is the set of neighboring nodes of node v under edge type r, α_{vu}^{r} is the edge weight calculated by the graph attention mechanism, W_r^{(L)} is the learnable parameter matrix of edge type r in layer L, h_u^{(L)} is the latent feature vector of a certain type of edge r neighbor node u of node v in the L-th layer network, and σ is a non-linear activation function.

[0043] In one possible implementation, based on node-level representations, multi-granularity code representations are extracted through hierarchical pooling operations. These multi-granularity code representations include statement-level, file-level, and document-level representations. The node-level representations can also be referred to as node features. Specifically, attention pooling is performed on AST subtree nodes belonging to the same code statement to generate statement-level representations. Graph-level global pooling is performed on the entire function CPG to generate function-level representations. A call graph is constructed based on the call relationships between functions, and graph pooling is performed on the call graph to generate document-level representations. The multi-granularity representations of statement-level, document-level, and document-level representations provide flexible operational granularity for the construction and detection of vulnerabilities at different levels in the subsequent self-game process.

[0044] Step S203: Input the code attribute graph and the code attribute graph representation into the vulnerability writer agent to determine the code region where the vulnerability is injected, and generate target code containing the vulnerability according to the pre-designed policy network.

[0045] In one possible implementation, the vulnerability writer agent is a code generation and mutation agent trained using reinforcement learning. The goal of the vulnerability writer agent is to inject real, covert, and security-threatening vulnerabilities into given normal code through carefully designed code modifications. The specific processing flow of step S203 is as follows: Figure 4 As shown, it includes the following steps: Step S401: Input the code attribute graph and the code attribute graph representation into the vulnerability writer agent, and determine the code region for injection vulnerability based on the graph attention mechanism.

[0046] In one possible implementation, the vulnerability writer agent selects the modification location and vulnerability injection operation type under the guidance of the code attribute graph representation; specifically, it locates the most suitable code region for vulnerability injection on the CPG through a graph attention mechanism, such as near security checkpoints, memory operation-intensive areas, etc., which is only an example here.

[0047] Step S402: Input the code attribute graph representation into the pre-designed policy network and output the probability distribution of at least one vulnerability injection operation in the action space.

[0048] Specifically, the pre-designed policy network π_w(a|s) takes the code attribute graph as its state input and outputs the probability distribution of at least one vulnerability injection operation in the action space, where 'a' represents an action and 's' represents a state. The action space includes various operation types such as buffer operation, control flow operation, data flow operation, logic operation, and combination operation. Specifically, the buffer operation type includes modifying array boundary check conditions, adjusting memory allocation size, and introducing off-by-one errors. The control flow operation type includes inserting conditional race windows, modifying exception handling logic, and introducing unreachable but exploitable branch paths. The data flow operation type includes introducing the use of uninitialized variables, constructing use-after-free scenarios, and creating a conversion chain from integer overflow to buffer overflow. The logic operation type includes modifying permission verification conditions, introducing time-of-check-to-time-of-use (TOCTOU) race states, and constructing type obfuscation scenarios. The combination operation type specifically combines the above operations semantically to construct complex vulnerabilities across functions and files.

[0049] Step S403: Perform vulnerability injection operation in the code region of the injection vulnerability according to the probability distribution to generate the target code containing the vulnerability.

[0050] In this embodiment of the invention, vulnerabilities are injected into normal code through steps S401 to S403.

[0051] Step S204: Generate reward parameters for the vulnerability writer agent based on the target code, and update the vulnerability writer agent.

[0052] Specifically, the updated vulnerability writer agent is used to generate target code containing highly complex vulnerabilities, and the specific processing flow of step S204 is as follows: Figure 5 As shown, it includes the following steps: Step 501: Determine the value corresponding to the reward function based on the target code.

[0053] Specifically, the reward function is pre-designed and used to determine the quality of the generated target code.

[0054] In one possible implementation, the reward function is formulated as follows: R_w = λ_1 · (1 - D(x')) + λ_2 · V(x') - λ_3 · max(0, δ_s - S(x,x')) Wherein, D(x') is the detection probability of the vulnerability detector agent for the modified code x', the modified code is the target code injected with the vulnerability, V(x') is the actual exploitability score of the injected vulnerability, S(x,x') is the logical similarity between the code before and after modification, δ_s is the concealment threshold, and λ_1, λ_2 and λ_3 are balance coefficients. In one possible implementation, the third term of the reward function adopts a hinged penalty form: if S(x, x') ≥ δ_s, the penalty is zero, meaning the modification range is unconstrained within a reasonable range; if S(x, x') < δ_s, a linear penalty is applied to prevent the vulnerability writer agent from making excessive code rewrites; the design of the reward function allows the vulnerability writer agent to focus on maximizing the deceptiveness and authenticity of the vulnerability under the concealment constraint, avoiding the "no modification" degenerate solution caused by directly maximizing similarity; at the same time, in order to prevent the trivial solution where V(x') and (1-D(x')) simultaneously approach zero, only vulnerability samples with V(x') > ε_v can obtain a positive reward, otherwise the overall reward is set to a negative penalty, where ε_v is the minimum exploitability threshold.

[0055] Step 502: Calculate the reward parameters of the vulnerability writer agent based on the value corresponding to the reward function.

[0056] Specifically, the reward parameter is denoted as θ_w, and the goal of the vulnerability writer agent is to maximize the reward parameter max_{θ_w}, expressed as follows:

[0057] Wherein, G(x) is the attribute graph representation of code x, P_data is the normal code distribution, E represents the calculation of the expected value, D represents the vulnerability detector agent, and θ_d represents the loss parameter of the vulnerability detector agent.

[0058] In one possible implementation, the optimization of the reward parameter θ_w can be achieved using a policy gradient method, such as the Proximal Policy Optimization (PPO) algorithm.

[0059] Step 503: Update the vulnerability writer agent according to the reward parameters.

[0060] In this embodiment of the invention, by optimizing the reward parameter θ_w, the vulnerability writer agent generates vulnerability samples that can bypass the current vulnerability detector agent.

[0061] In one possible implementation, after step S204, other steps are included, specifically as follows: Figure 6 As shown, it includes the following: Step S205: Perform static semantic verification and dynamic sandbox verification on the target code to identify the target code with high-fidelity vulnerabilities.

[0062] Specifically, the static semantic verification involves performing static semantic analysis on the target code to verify the following constraints: the modified injection vulnerability code can still be compiled and is legal at the syntax and type system level; the data flow path of the vulnerability injection point is indeed reachable, i.e., there is a valid data flow from the input to the vulnerability trigger point; the injected vulnerability conforms to the characteristic pattern of the Common Weakness Enumeration (CWE) type. If the target code does not meet the above constraints, it is marked as an invalid sample and is not included in the positive reward of the vulnerability writer agent. The target code can also be called a vulnerability sample. The dynamic sandbox verification involves performing dynamic execution verification on the vulnerability samples that have passed the static verification in an isolated sandbox environment, including: constructing a proof-of-concept (PoC) input that can trigger the vulnerability; executing the vulnerability code in a controlled environment and monitoring whether the expected security anomalies occur, such as memory out-of-bounds access, privilege escalation, information leakage, etc.; recording the complete execution path and context information of the vulnerability trigger; the vulnerability samples confirmed by the dynamic sandbox verification are regarded as high-fidelity samples and obtain a higher V(x') score in the reward function of the vulnerability writer agent.

[0063] Step S206: Save the target code with the high-fidelity vulnerability to the training set.

[0064] Specifically, the training set is used for training the vulnerability detector agent.

[0065] In this embodiment of the invention, differentiated feedback signals are applied to the vulnerability writer and vulnerability detector agents in a self-playing game based on the verification results of vulnerability samples that have passed the static semantic verification and the dynamic sandbox verification. For the vulnerability writer agent, positive reinforcement rewards are given for valid vulnerabilities, and penalty signals are given for invalid vulnerabilities. Vulnerabilities confirmed as exploitable through dynamic sandbox verification are given additional reward bonuses. At the same time, the vulnerability features successfully detected by the vulnerability detector agent are injected into the adversarial prior of the vulnerability writer agent, guiding the vulnerability writer agent to evolve in a more covert direction. For the vulnerability detector agent, newly generated high-fidelity vulnerability samples are added to the training set as difficult positive samples. At the same time, the CPG representation and CWE annotation of the vulnerability are used to enrich the supervision signals of the vulnerability detector agent. Samples misjudged by the vulnerability detector agent are summarized as failure modes. Attention visualization is used to locate the blind spots of the vulnerability detector agent's attention on the CPG, and enhanced samples of this mode are generated in a targeted manner.

[0066] In one possible implementation, the training set can also be called a vulnerability sample library, which is indexed and managed according to the CWE type, complexity level, verification status, and other dimensions. A prioritized experience replay strategy can also be adopted to prioritize sampling difficult samples that the vulnerability detector agent was prone to misjudging in the past and newly generated high-quality samples in subsequent training, so as to ensure the efficiency and relevance of training.

[0067] In this embodiment of the invention, a method for software vulnerability detection is also proposed, specifically as follows: Figure 7 As shown, the method includes: Step S701: Obtain the code to be detected.

[0068] Specifically, the code to be detected includes target code generated by the vulnerability writer's intelligent agent, source code files, and publicly disclosed general vulnerabilities and code that exposes real vulnerabilities.

[0069] In one possible implementation, the code to be detected serves as training data for the vulnerability detector agent. This training data dynamically originates from target code generated by the vulnerability writer agent, source code files, and publicly available Common Vulnerabilities and Exposures (CVE) real-world vulnerability code. The target code can also be referred to as adversarial vulnerability samples or synthetic positive samples; the source code files can also be referred to as negative samples; and the publicly available CVE real-world vulnerability code can also be referred to as anchored positive samples. These anchored positive samples serve as a baseline anchor set throughout the entire training cycle, ensuring that the vulnerability detector agent maintains its ability to perceive the distribution characteristics of real-world vulnerabilities while learning to identify vulnerabilities synthesized by the vulnerability writer agent. This avoids the vulnerability detector agent from overfitting to low-quality synthetic patterns due to insufficient early capabilities of the vulnerability writer agent. The anchor set composed of anchored positive samples is mixed and sampled at a fixed ratio γ in each training batch, for example, γ = 0.2. As the vulnerabilities generated by the vulnerability writer agent become increasingly sophisticated and complex, the detection agent continuously improves the upper limit of its detection capabilities.

[0070] Step S702: Input the code to be detected into the vulnerability detector agent and output the detection result.

[0071] Specifically, the detection results include existence determination, vulnerability type classification, and location identification.

[0072] In one possible implementation, the vulnerability detector agent is a vulnerability identification agent based on a fusion architecture of graph neural networks and Transformers. The goal of the vulnerability detector agent is to accurately identify and locate security vulnerabilities in the input code to be detected. The graph neural network (GNN) is a type of deep learning model that learns on graph-structured data, capable of capturing the topological relationships and feature propagation between nodes and edges in the graph. The vulnerability detector agent includes three levels of detection heads: an existence discrimination head, a type classification head, and a location positioning head. The existence discrimination head performs binary classification on the function-level representation of the CPG to determine whether a vulnerability exists in the code to be detected, generating an existence discrimination detection result. The type classification head performs CWE type classification on the detected vulnerabilities, mapping them to a standardized vulnerability category system to generate a vulnerability type classification detection result. The location positioning head uses the statement-level representation of the CPG and sequence labeling to locate the specific code statements involved in the vulnerability, generating a location positioning detection result.

[0073] Step S703: Calculate the loss function of the vulnerability detector agent based on the detection results.

[0074] Specifically, based on the detection results, the binary cross-entropy loss corresponding to the existence discrimination, the multi-class cross-entropy loss corresponding to the vulnerability type classification, and the sequence labeling loss corresponding to the location positioning are determined respectively; and the loss function is determined based on the binary cross-entropy loss, the multi-class cross-entropy loss, and the sequence labeling loss.

[0075] In one possible implementation, the loss function is formulated as follows: L_d = L_exist + β_1 · L_type + β_2 · L_locate Wherein, L_exist is the binary cross-entropy loss, L_type is the multi-class cross-entropy loss, L_locate is the sequence labeling loss, and β_1 and β_2 are balance coefficients.

[0076] Step S704: Determine the loss parameters of the vulnerability detector agent according to the loss function, and update the vulnerability detector agent.

[0077] Specifically, the updated vulnerability detector agent is used to detect the code to be detected that contains highly complex vulnerabilities.

[0078] In one possible implementation, the loss parameter is denoted as θ_d, and the objective of the vulnerability detector agent is to minimize the loss parameter min_{θ_d}, that is, to minimize the joint detection loss of the vulnerability detector agent on the vulnerability code generated by the current vulnerability writer agent and the real vulnerability anchor set. The loss parameter is expressed as follows:

[0079] Wherein, P_cve is the distribution of real CVE vulnerability samples, γ is the mixing ratio of the real vulnerability anchor set, E represents the calculated expected value, D represents the vulnerability detector agent, and θ_d represents the loss parameter of the vulnerability detector agent; x' is the modified code, y' is the vulnerability label, x_r is the source code, and y_r is the label of the source code.

[0080] In one possible implementation, the calculation of the loss parameter θ_d can be optimized using the gradient descent method.

[0081] In this embodiment of the invention, the current capability levels of the vulnerability generating agent and the vulnerability detecting agent are evaluated on a validation set. When the detection rate of the vulnerability detecting agent against the vulnerability samples generated by the vulnerability writer agent, and the bypass rate of the vulnerability writer agent against the vulnerability detecting agent, tend to stabilize, it is determined that the current stage has reached an approximate Nash equilibrium, triggering a course-based difficulty upgrade to the next difficulty level. The course-based difficulty upgrade refers to adjusting the complexity of the target code containing vulnerabilities generated by the vulnerability writer agent and the detection capability of the vulnerability detecting agent through a course-based difficulty adaptive adjustment module. This ensures the stability and efficiency of the self-game training process and avoids training collapse caused by excessive capability gap between the two parties. For example, the writer generates vulnerability samples that the detector cannot recognize at all too early, or the detector is too strong, causing the writer to be unable to obtain effective learning signals.

[0082] In one possible implementation, the complexity metric of the vulnerability sample is represented by C(x'), where C(x') is a multidimensional scoring vector, specifically represented as follows: C(x') = (c_struct, c_scope, c_semantic, c_chain) Wherein, c_struct is the structural complexity, used to measure the code structure hierarchy involved in the vulnerability, such as single statement, cross branch, cross function, or cross file; c_scope is the scope complexity, used to measure the scope of variables and data flow affected by the vulnerability; c_semantic is the semantic complexity, used to measure the number of semantic constraints required to trigger the vulnerability; and c_chain is the chain complexity, used to measure the length of the multi-step operation chain required to exploit the vulnerability.

[0083] In one possible implementation, based on the detector's detection success rate η and the writer's bypass success rate ε, calculated using a sliding window, the upper bound of the complexity of the vulnerability generated by the writer in the next round is dynamically adjusted. For example, if η > τ_high, indicating the detector is performing strongly, the lower bound of the writer's complexity is increased, prompting the writer to generate more complex vulnerabilities; if ε > τ_high, indicating the writer is performing strongly, the upper bound of the writer's complexity is appropriately reduced, giving the detector room to catch up; if both η and ε are in the range [τ_low, τ_high], the current difficulty level is maintained, and the writer and the detector are in an effective game state, where τ_low and τ_high are preset threshold parameters.

[0084] In this embodiment of the invention, the training process for the writer and the detector can be divided into three stages: a basic stage, an intermediate stage, and an advanced stage. This training process can also be referred to as a training course. Specifically, in the basic stage, the writer is only allowed to perform a single type of atomic vulnerability injection operation, such as a single-point buffer overflow, while the detector learns to identify basic vulnerability patterns. In the intermediate stage, the writer can perform combined operations to generate composite vulnerabilities involving multiple code locations and various vulnerability types, requiring the detector to have cross-statement and cross-function correlation analysis capabilities. In the advanced stage, the writer can generate complex vulnerability chains across files and modules, containing multi-step triggering conditions and non-trivial exploitation paths, requiring the detector to possess global code understanding and complex reasoning capabilities.

[0085] In one possible implementation, the promotion conditions between stages are defined as follows: When, in K consecutive rounds of play, for example, K is a preset stability window, K=10, the detection success rate η of the detector and the bypass success rate ε of the writer are both stable within the interval [τ_low, τ_high], and the proportion of vulnerability samples of the highest complexity category allowed in the current stage exceeds 50%, indicating that both parties have fully explored the current difficulty space, then the difficulty promotion to the next stage is triggered. When the difficulty is promoted, the writer's action space is expanded to the operation categories allowed in the new stage, and at the same time, the detector's real vulnerability anchoring set is supplemented with CVE samples of the corresponding complexity level to ensure the gradualness and stability of training.

[0086] In one possible implementation, the binary game between a single writer and a single detector can be extended to a multi-writer-multi-detector group game framework. Different writers specialize in constructing vulnerabilities of different CWE types, such as memory security writers, logic vulnerability writers, and concurrency security writers, while different detectors specialize in detection tasks of different granularities, such as quickly screening detectors and accurately locating detectors. More comprehensive capability coverage can be achieved through group-level game theory.

[0087] In one possible implementation, based on the code attribute graph representation, vulnerability detection capabilities can be transferred across programming languages ​​through language-independent graph structure features. Specifically, a self-game model that is fully trained on one computer language can be transferred to other computer languages ​​through attribute graph-level domain adaptation, significantly reducing the training cost of adapting to new languages.

[0088] In this embodiment of the invention, a closed-loop game training framework is constructed, consisting of two adversarial agents, a writer and a detector. Supported by code attribute graph augmented representation, and combined with a course-based difficulty adaptive adjustment mechanism and a multi-granularity verification feedback loop, the vulnerability detection capability achieves continuous autonomous evolution, adapting to newly emerging vulnerability types without human intervention. Furthermore, it overcomes several fundamental defects in existing technologies, including the lag of static rules, scarcity of training data and generalization bottlenecks, the instability and illusion problem of LLM judgments, and the lack of an attack-defense co-evolution mechanism. This improves vulnerability detection coverage, false positive rate, and detection robustness.

[0089] Through the above embodiments, firstly, a game theory-driven self-game training paradigm is introduced into the field of software vulnerability detection. By constructing a closed-loop adversarial training framework between vulnerability writers and vulnerability detectors, the autonomous and continuous evolution of security detection capabilities through "attack-driven defense" is achieved, fundamentally breaking through the bottleneck of fixed detection capabilities under the traditional static training paradigm. Secondly, it proposes to unify abstract syntax trees, control flow graphs, and program dependency graphs into a heterogeneous code attribute graph, and to perform multi-granularity encoding through a heterogeneous graph attention network. This provides both sides of the self-game with a three-dimensional structured code representation of syntax structure, control flow, and data flow, significantly improving the detection of data flow-sensitive and control flow-sensitive vulnerabilities. First, it enhances the ability to represent and identify vulnerabilities. Second, it designs a course-based training strategy based on multi-dimensional vulnerability complexity and game equilibrium evaluation. By dynamically adjusting the upper bound of the generation complexity of vulnerability writers, it ensures the gradualness and stability of the self-game training process, avoids training collapse caused by excessive gaps in attack and defense capabilities, and guarantees the continuous effectiveness of game evolution. Finally, it constructs a multi-layered vulnerability authenticity confirmation mechanism from static semantic verification to dynamic sandbox execution verification. Combined with differentiated feedback strategies and priority experience replay, it forms a complete quality assurance closed loop of vulnerability generation, verification, feedback, and evolution, ensuring the high fidelity of vulnerability samples and training signals generated during the self-game process.

[0090] In this embodiment of the invention, a software vulnerability generation device is provided, such as... Figure 8As shown, the system specifically includes: a first acquisition unit 801, a generation unit 802, a first determination unit 803, and a first update unit 804; wherein, the first acquisition unit 801 is used to acquire a code attribute graph, wherein the code attribute graph is constructed based on the source code file to be processed; the generation unit 802 is used to determine a code attribute graph representation based on the code attribute graph, wherein the code attribute graph representation includes at least one representation vector; the first determination unit 803 is used to input the code attribute graph and the code attribute graph representation into a vulnerability writer agent, determine the code region to be injected with the vulnerability, and generate target code containing the vulnerability according to a pre-designed policy network; the first update unit 804 is used to generate reward parameters for the vulnerability writer agent based on the target code, and update the vulnerability writer agent, wherein the updated vulnerability writer agent is used to generate target code containing a high-complexity vulnerability.

[0091] Further, the first acquisition unit is specifically used to: acquire the source code file to be processed; generate an abstract syntax tree, a control flow graph, and a program dependency graph based on the source code file to be processed; and generate the code attribute graph based on the abstract syntax tree, the control flow graph, and the program dependency graph.

[0092] Further, the generation unit is specifically used to: determine the node-level representation corresponding to each node based on the code attribute graph; determine the statement-level representation based on the node-level representation; determine the function-level representation based on the statement-level representation; determine the file-level representation based on the function-level representation; and determine the node-level representation, the statement-level representation, the function-level representation, and the file-level representation as the code attribute graph representation.

[0093] Further, the first determining unit is specifically used to: input the code attribute graph and the code attribute graph representation into the vulnerability writer agent, and determine the code region for injecting vulnerabilities according to the graph attention mechanism; input the code attribute graph representation into the pre-designed policy network, and output the probability distribution of at least one vulnerability injection operation in the action space; and perform vulnerability injection operation in the code region for injecting vulnerabilities according to the probability distribution to generate the target code containing the vulnerability.

[0094] Further, the first update unit is specifically used to: determine the value corresponding to the reward function based on the target code, wherein the reward function is pre-designed and used to judge the quality of the generated target code; calculate the reward parameter of the vulnerability writer agent based on the value corresponding to the reward function; and update the vulnerability writer agent based on the reward parameter.

[0095] Furthermore, the device further includes: a storage unit, used to perform static semantic verification and dynamic sandbox verification on the target code to determine the target code with high-fidelity vulnerabilities; and to save the target code with high-fidelity vulnerabilities to a training set, wherein the training set is used for training the vulnerability detector agent.

[0096] In this embodiment of the invention, a software vulnerability detection device is provided, such as... Figure 9 As shown, the device includes: a second acquisition unit 901, a detection unit 902, a second determination unit 903, and a second update unit 904; wherein, the second acquisition unit 901 is used to acquire code to be detected, wherein the code to be detected includes target code generated by a vulnerability writer agent, source code files, and publicly disclosed general vulnerabilities and exposed real vulnerability code; the detection unit 902 is used to detect the input of the code to be detected into the vulnerability detector agent and output detection results, wherein the detection results include existence determination, vulnerability type classification, and location; the second determination unit 903 is used to calculate the loss function of the vulnerability detector agent based on the detection results; the second update unit 904 is used to determine the loss parameters of the vulnerability detector agent based on the loss function and update the vulnerability detector agent, wherein the updated vulnerability detector agent is used to detect the code to be detected containing high-complexity vulnerabilities.

[0097] Further, the second determining unit is specifically used to determine, based on the detection results, the binary cross-entropy loss corresponding to the existence discrimination, the multi-class cross-entropy loss corresponding to the vulnerability type classification, and the sequence labeling loss corresponding to the location positioning; and to determine the loss function based on the binary cross-entropy loss, the multi-class cross-entropy loss, and the sequence labeling loss.

[0098] Figure 10 This is a schematic diagram of the structure of the electronic device described in an embodiment of the present invention. Figure 10As shown, it includes a general computer hardware architecture, which includes at least a processor 1001 and a memory 1002. The processor 1001 and the memory 1002 are connected via a bus 1003. The memory 1002 is adapted to store instructions or programs executable by the processor 1001. The processor 1001 can be a standalone microprocessor or a collection of one or more microprocessors. Thus, the processor 1001 executes the instructions stored in the memory 1002 to perform the method flow of the embodiments of the present invention as described above, thereby realizing data processing and control of other devices. The bus 1003 connects the above-mentioned components together, and also connects the above-mentioned components to the display controller 1004, the display device, and the input / output (I / O) device 1005. The input / output (I / O) device 1005 can be a mouse, keyboard, modem, network interface, touch input device, motion-sensing input device, printer, and other devices known in the art. Typically, the input / output device 1005 is connected to the system via an input / output (I / O) controller 1006.

[0099] The instructions stored in memory 1002 are executed by at least one processor 1001 to achieve the following: acquiring a code attribute map; determining a code attribute map representation based on the code attribute map; inputting the code attribute map and the code attribute map representation into a vulnerability writer agent; determining the code region to be injected with the vulnerability; generating target code containing the vulnerability according to a pre-designed policy network; generating reward parameters for the vulnerability writer agent based on the target code; and updating the vulnerability writer agent; acquiring code to be detected, wherein the code to be detected includes target code generated by the vulnerability writer agent, source code files, and publicly disclosed general vulnerabilities and code exposing real vulnerabilities; inputting the code to be detected into a vulnerability detector agent; outputting detection results; calculating a loss function for the vulnerability detector agent based on the detection results; determining loss parameters for the vulnerability detector agent based on the loss function; and updating the vulnerability detector agent.

[0100] Specifically, the electronic device includes: one or more processors 1001 and a memory 1002. Figure 10 Take a processor 1001 as an example. The processor 1001 and the memory 1002 can be connected via a bus or other means. Figure 10 Taking a bus connection as an example, memory 1002, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Processor 1001 executes various functional applications and data processing of the device by running the non-volatile software programs, instructions, and modules stored in memory 1002, thereby implementing the aforementioned methods for determining software vulnerability generation and software vulnerability detection.

[0101] The memory 1002 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store an option list, etc. Furthermore, the memory 1002 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 1002 may optionally include memory remotely located relative to the processor 1001, and these remote memories can be connected to external devices via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0102] One or more modules are stored in memory 1002, and when executed by one or more processors 1001, they perform the methods for generating and detecting software vulnerabilities in any of the above method embodiments.

[0103] As those skilled in the art will recognize, various aspects of the embodiments of the present invention can be implemented as a system, method, or computer program product. Therefore, various aspects of the embodiments of the present invention can take the form of a completely hardware implementation, a completely software implementation (including firmware, resident software, microcode, etc.), or an implementation combining software and hardware aspects, which may generally be referred to herein as a "circuit," "module," or "system." Furthermore, various aspects of the embodiments of the present invention can take the form of a computer program product implemented in one or more computer-readable media having computer-readable program code implemented thereon.

[0104] Any combination of one or more computer-readable media can be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example, (but not limited to) an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination thereof. More specific examples (not an exhaustive list) of computer-readable storage media will include: an electrical connection having one or more wires, a portable computer floppy disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable optical disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the context of embodiments of the present invention, a computer-readable storage medium can be any tangible medium capable of containing or storing a program used by or in conjunction with an instruction execution system, device, or apparatus.

[0105] Computer-readable signal media may include propagated digital signals having computer-readable program code implemented therein, such as in baseband or as part of a carrier wave. Such propagated signals may take any of a variety of forms, including, but not limited to, electromagnetic, optical, or any suitable combination thereof. A computer-readable signal medium may be any computer-readable medium that is not a computer-readable storage medium and can communicate, propagate, or transmit a program used by or in conjunction with an instruction execution system, device, or apparatus.

[0106] Program code implemented on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, fiber optic cable, RF, or any suitable combination thereof.

[0107] Computer program code for performing operations relating to various aspects of embodiments of the present invention can be written in any combination of one or more programming languages, including: object-oriented programming languages ​​such as Java, Smalltalk, C++, etc.; and conventional procedural programming languages ​​such as the "C" programming language or similar programming languages. The program code can be executed as a standalone software package entirely on the user's computer, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet provided by an Internet service provider).

[0108] The flowchart illustrations and / or block diagrams of the methods, apparatus (systems), and computer program products according to embodiments of the present invention describe various aspects of the embodiments of the present invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus to produce a machine such that the instructions (executed via the processor of the computer or other programmable data processing apparatus) create means for implementing the functions / actions specified in the flowchart and / or block diagram blocks or blocks.

[0109] These computer program instructions may also be stored in a computer-readable medium that can direct a computer, other programmable data processing apparatus or other means to operate in a particular manner, such that the instructions stored in the computer-readable medium produce an article of writing that includes instructions that implement the functions / actions specified in flowchart and / or block diagram blocks or blocks.

[0110] Computer program instructions may also be loaded onto a computer, other programmable data processing apparatus or other device to cause a series of operable steps to be performed on the computer, other programmable apparatus or other device to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide for implementing the functions / actions specified in flowchart and / or block diagram blocks or blocks.

[0111] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

[0112] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use, and processing of such data must comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding access points are provided for users to choose to authorize or refuse processing. A user's refusal to process personal information beyond what is necessary for basic functions will not affect the user's use of basic functions.

Claims

1. A method for generating software vulnerabilities, characterized in that, The method includes: Obtain a code attribute graph, wherein the code attribute graph is constructed based on the source code file to be processed; The code attribute graph representation is determined based on the code attribute graph, wherein the code attribute graph representation includes at least one representation vector; The code attribute graph and the code attribute graph representation are input into the vulnerability writer agent to determine the code region where the vulnerability is injected, and target code containing the vulnerability is generated according to the pre-designed policy network. The vulnerability writer agent is updated by generating reward parameters based on the target code, wherein the updated vulnerability writer agent is used to generate target code containing highly complex vulnerabilities.

2. The method according to claim 1, characterized in that, The acquisition of the code attribute map specifically includes: Obtain the source code file to be processed; Generate an abstract syntax tree, a control flow graph, and a program dependency graph based on the source code file to be processed; The code attribute graph is generated based on the abstract syntax tree, the control flow graph, and the program dependency graph.

3. The method according to claim 1, characterized in that, The step of determining the code attribute map representation based on the code attribute map specifically includes: The node-level representation corresponding to each node is determined based on the code attribute graph; Determine the statement-level representation based on the node-level representation; Determine the function-level representation based on the statement-level representation; Determine the file-level representation based on the function-level representation; The node-level representation, the statement-level representation, the function-level representation, and the file-level representation are determined as the code attribute graph representation.

4. The method according to claim 1, characterized in that, The code attribute graph and its representation are input into the vulnerability writer agent to determine the code region where the vulnerability is injected, and target code containing the vulnerability is generated according to a pre-designed policy network, specifically including: The code attribute graph and the code attribute graph representation are input into the vulnerability writer agent, and the code region for injecting the vulnerability is determined according to the graph attention mechanism. The code attribute graph representation is input into the pre-designed policy network, and the probability distribution of at least one vulnerability injection operation in the action space is output. Based on the probability distribution, a vulnerability injection operation is performed in the code region containing the injection vulnerability to generate the target code containing the vulnerability.

5. The method according to claim 1, characterized in that, The step of generating reward parameters for the vulnerability writer agent based on the target code and updating the vulnerability writer agent specifically includes: The value corresponding to the reward function is determined based on the target code, wherein the reward function is pre-designed and used to judge the quality of the generated target code; The reward parameters of the vulnerability writer agent are calculated based on the numerical value corresponding to the reward function. The vulnerability writer agent is updated based on the reward parameters.

6. The method according to claim 1, characterized in that, The method further includes: The target code is subjected to static semantic verification and dynamic sandbox verification to identify the target code with high-fidelity vulnerabilities. The target code with the high-fidelity vulnerability is saved to the training set, which is used to train the vulnerability detector agent.

7. A method for detecting software vulnerabilities, characterized in that, The method includes: Obtain the code to be detected, wherein the code to be detected includes target code generated by the vulnerability writer's intelligent agent, source code files, and publicly disclosed general vulnerabilities and code exposing real vulnerabilities; The code to be detected is input into the vulnerability detector agent, and the detection results are output, including existence determination, vulnerability type classification and location; Calculate the loss function of the vulnerability detector agent based on the detection results; The loss parameters of the vulnerability detector agent are determined according to the loss function, and the vulnerability detector agent is updated. The updated vulnerability detector agent is used to detect the code to be detected that contains highly complex vulnerabilities.

8. The method according to claim 7, characterized in that, The calculation of the loss function of the vulnerability detector agent based on the detection results specifically includes: Based on the detection results, determine the binary cross-entropy loss corresponding to the existence discrimination, the multi-class cross-entropy loss corresponding to the vulnerability type classification, and the sequence labeling loss corresponding to the location positioning. The loss function is determined based on the binary cross-entropy loss, the multi-class cross-entropy loss, and the sequence labeling loss.

9. An apparatus for generating software vulnerabilities, characterized in that, The device includes: The first acquisition unit is used to acquire a code attribute map, wherein the code attribute map is constructed based on the source code file to be processed; A generation unit is configured to determine a code attribute graph representation based on the code attribute graph, wherein the code attribute graph representation includes at least one representation vector; The first determining unit is used to input the code attribute map and the code attribute map representation into the vulnerability writer agent, determine the code region to be injected with the vulnerability, and generate target code containing the vulnerability according to a pre-designed policy network. The first update unit is used to generate reward parameters for the vulnerability writer agent based on the target code and update the vulnerability writer agent, wherein the updated vulnerability writer agent is used to generate target code containing high-complexity vulnerabilities.

10. A device for detecting software vulnerabilities, characterized in that, The device includes: The second acquisition unit is used to acquire the code to be detected, wherein the code to be detected includes target code generated by the vulnerability writer agent, source code files, and publicly disclosed general vulnerabilities and code exposing real vulnerabilities; The detection unit is used to detect the input of the code to be detected into the vulnerability detector agent and output the detection results, wherein the detection results include existence determination, vulnerability type classification and location; The second determining unit is used to calculate the loss function of the vulnerability detector agent based on the detection result; The second update unit is used to determine the loss parameters of the vulnerability detector agent according to the loss function and update the vulnerability detector agent, wherein the updated vulnerability detector agent is used to detect the code to be detected that contains high-complexity vulnerabilities.

11. A system for generating and detecting software vulnerabilities, characterized in that, The system includes: a vulnerability writer intelligent agent and a vulnerability detector intelligent agent; The vulnerability writer agent is configured to: acquire a code attribute graph, which is constructed based on the source code file to be processed; determine a code attribute graph representation based on the code attribute graph, wherein the code attribute graph representation includes at least one representation vector; input the code attribute graph and the code attribute graph representation into the vulnerability writer agent to determine the code region to be injected with the vulnerability, and generate target code containing the vulnerability according to a pre-designed policy network; generate reward parameters for the vulnerability writer agent based on the target code, and update the vulnerability writer agent, wherein the updated vulnerability writer agent is used to generate target code containing a high-complexity vulnerability; The vulnerability detector agent is used to acquire code to be detected, wherein the code to be detected includes target code generated by the vulnerability writer agent, source code files, and publicly disclosed general vulnerabilities and code exposing real vulnerabilities; the code to be detected is input into the vulnerability detector agent, and detection results are output, wherein the detection results include existence determination, vulnerability type classification, and location; a loss function of the vulnerability detector agent is calculated based on the detection results; loss parameters of the vulnerability detector agent are determined based on the loss function, and the vulnerability detector agent is updated, wherein the updated vulnerability detector agent is used to detect the code to be detected containing high-complexity vulnerabilities.

12. The system according to claim 11, characterized in that, The complexity of the target code containing vulnerabilities generated by the vulnerability writer agent is adjusted based on the vulnerability detection success rate of the vulnerability detector agent and the bypass success rate of the vulnerability writer agent.

13. An electronic device comprising a memory and a processor, characterized in that, The memory is used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement the method as described in any one of claims 1-8.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1-8.

Images