Vulnerability detection method, plug-in and non-volatile storage medium for compiler

Abstract

The application discloses a vulnerability detection method, a plug-in and a nonvolatile storage medium for a compiler. The method comprises the following steps: obtaining a source code sequence, an abstract syntax tree, a control flow graph and a compilation context information in a target compiler; extracting semantic features of the source code based on the source code sequence, the abstract syntax tree and the control flow graph, and obtaining a code hidden state matrix; encoding the compilation context information into a context vector; fusing the code hidden state matrix and the context vector to obtain a fused representation vector; and determining a vulnerability detection result based on the fused representation vector, wherein the vulnerability detection result comprises a vulnerability type, a vulnerability trigger condition, an influence range and a exploitability score. The application solves the technical problem that the traditional security detection only focuses on the semantics of the code itself and ignores the rich context information provided by the compiler, resulting in insufficient detection accuracy.

Description

Technical Field

[0001] This invention relates to the field of computer software security, and more specifically, to a vulnerability detection method for compilers, a plugin, and a non-volatile storage medium. Background Technology

[0002] As software development becomes increasingly complex, security vulnerabilities have become a major factor affecting software quality. Especially given the growing importance of supply chain security, developers need to pay attention to the security risks of both their own code and third-party libraries. Traditional software security development processes primarily rely on manual code auditing, static / dynamic analysis tools, and external dependency scanning, but these methods have significant shortcomings.

[0003] Manual auditing is costly and prone to omissions; traditional static analysis tools are mostly based on preset rules or pattern matching, and have limited ability to detect new vulnerabilities (such as zero-day vulnerabilities) or complex exploit chains, making it difficult to combine with threat intelligence for intelligent assessment; external dependency scanning is often independent of code auditing, lacks in-depth correlation analysis, and cannot accurately determine the impact of third-party library risks on specific code segments; in addition, existing tools have low integration with developer workflows (such as GitHub), insufficient automation, and difficult report interpretation, heavily relying on security experts for customized verification, resulting in low efficiency. Currently, although some research attempts to integrate security protection at the compiler level, most are limited to specific pattern matching or simple static analysis, lacking a deep understanding of code context, unable to intelligently predict vulnerability exploitability, and failing to effectively utilize compiler-specific contextual information (such as inlining decisions, type inference, etc.) to improve detection accuracy.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a vulnerability detection method, plugin, and non-volatile storage medium for compilers, to at least address the technical problem that traditional security detection focuses only on the semantics of the code itself and ignores the rich contextual information provided by the compiler, resulting in insufficient detection accuracy.

[0006] According to one aspect of the present invention, a vulnerability detection method for a compiler is provided, comprising: acquiring a sequence of source code, an abstract syntax tree, a control flow graph, and compilation context information from a target compiler, wherein the abstract syntax tree represents the syntactic structure of the source code, and the control flow graph represents all possible execution paths in the source code; extracting semantic features of the source code based on the sequence of source code, the abstract syntax tree, and the control flow graph to obtain a code-hidden state matrix, wherein the code-hidden state matrix is ​​used to represent the semantic features of the source code itself; encoding the compilation context information into a context vector; fusing the code-hidden state matrix and the context vector to obtain a fused representation vector; and determining a vulnerability detection result based on the fused representation vector, wherein the vulnerability detection result includes a vulnerability type, vulnerability triggering conditions, impact scope, and exploitability score.

[0007] Optionally, based on the sequence of source code, abstract syntax tree, and control flow graph, semantic features of the source code are extracted to obtain a code-hidden state matrix, including: using a preset graph neural network to perform multi-layer message passing processing on the abstract syntax tree and control flow graph respectively and concatenating them to obtain structural feature vectors; using a preset deep neural network to perform multi-layer encoding processing on the source code sequence to obtain semantic feature vectors; and weighting and summing the structural feature vectors and semantic feature vectors to obtain the code-hidden state matrix.

[0008] Optionally, the code-hidden state matrix and the context vector are fused to obtain a fused representation vector, including: determining the query vector, key vector, and value vector based on the code-hidden state matrix; and fusing the code-hidden state matrix and the context vector through an attention mechanism based on the query vector, key vector, and value vector to obtain the fused representation vector.

[0009] Optionally, determining the vulnerability detection result based on the fused representation vector includes: inputting the fused representation vector into a preset multi-task learning encoder, processing it in parallel through multiple task heads to obtain the vulnerability detection result, wherein processing through multiple task heads includes: identifying the vulnerability type through a first task head, predicting the vulnerability triggering conditions through a second task head, evaluating the impact range after the vulnerability is exploited through a third task head, and outputting an exploitability score by combining the prediction results of all task heads except the fourth task head through a fourth task head.

[0010] Optionally, the compilation context information includes inlining decision information, type inference results, optimization flag effects, and symbol table information. The inlining decision information indicates whether the target compiler inlines the functions called by the source code, the type inference results indicate the variable type information inferred by the target compiler during compilation, the optimization flag effects indicate the vulnerability triggering conditions corresponding to the optimization level of the target compiler, and the symbol table information indicates the structure information corresponding to the debugging symbols generated by the target compiler.

[0011] Optionally, if the exploitability score is higher than a preset threshold, test case code snippets that can trigger the vulnerability are generated based on the vulnerability triggering conditions and the scope of impact; the test case code snippets are injected into the source code and symbolic execution verification is performed to obtain symbolic execution verification results, wherein the symbolic execution verification results include evidence of successful vulnerability triggering or failure information; based on the symbolic execution verification results, the exploitability score is updated and the parameters of the target compiler are adjusted.

[0012] According to another aspect of the present invention, a vulnerability detection plugin for a compiler is also provided. The vulnerability detection plugin is installed in the target compiler and executes any of the above-described vulnerability detection methods for the compiler when the target compiler is running.

[0013] According to another aspect of the present invention, a vulnerability detection apparatus for a compiler is also provided, comprising: an acquisition module, configured to acquire a sequence of source code, an abstract syntax tree, a control flow graph, and compilation context information in a target compiler, wherein the abstract syntax tree represents the syntactic structure of the source code, and the control flow graph represents all possible execution paths in the source code; an extraction module, configured to extract semantic features of the source code based on the source code sequence, the abstract syntax tree, and the control flow graph to obtain a code-hidden state matrix, wherein the code-hidden state matrix is ​​used to represent the semantic features of the source code itself; an encoding module, configured to encode the compilation context information into a context vector; a fusion module, configured to fuse the code-hidden state matrix and the context vector to obtain a fused representation vector; and a determination module, configured to determine a vulnerability detection result based on the fused representation vector, wherein the vulnerability detection result includes a vulnerability type, vulnerability triggering conditions, impact scope, and exploitability score.

[0014] According to another aspect of the present invention, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored program, wherein, during program execution, the device where the non-volatile storage medium is located is controlled to execute any of the above-described vulnerability detection methods for compilers.

[0015] According to another aspect of the present invention, a computer device is also provided, the computer device including a processor, the processor being configured to run a program, wherein the program executes any of the above-described vulnerability detection methods for a compiler during runtime.

[0016] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements any one of the above-described vulnerability detection methods for a compiler.

[0017] In this embodiment of the invention, a vulnerability detection method for compilers is employed. This method acquires the sequence of source code, abstract syntax tree (AST), control flow graph, and compilation context information from the target compiler. The AST represents the syntactic structure of the source code, and the control flow graph represents all possible execution paths within the source code. Based on the source code sequence, AST, and control flow graph, semantic features of the source code are extracted to obtain a code-hidden state matrix, which represents the semantic features of the source code itself. The compilation context information is encoded into a context vector. The code-hidden state matrix and the context vector are fused to obtain a fused representation vector. Based on the fused representation vector, the vulnerability detection result is determined, including the vulnerability type, vulnerability triggering conditions, impact scope, and exploitability score. This achieves the goal of integrating intelligent security analysis within the compiler, significantly improving the detection accuracy for novel and complex vulnerabilities. Furthermore, it solves the technical problem of insufficient detection accuracy caused by traditional security detection methods that only focus on the semantics of the code itself and ignore the rich context information provided by the compiler. Attached Figure Description

[0018] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0019] Figure 1 A hardware structure block diagram of a computer terminal for implementing a vulnerability detection method for a compiler is shown.

[0020] Figure 2 This is a flowchart illustrating a vulnerability detection method for a compiler provided according to an embodiment of the present invention;

[0021] Figure 3 This is a structural block diagram of a vulnerability detection device for a compiler provided according to an embodiment of the present invention. Detailed Implementation

[0022] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] According to an embodiment of the present invention, a vulnerability detection method for a compiler is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0025] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal for implementing a vulnerability detection method for a compiler is shown. Figure 1 As shown, the computer terminal 10 may include one or more processors (shown as 102a, 102b, ..., 102n in the figure) (the processor may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0026] It should be noted that the aforementioned one or more processors and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10. As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0027] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the vulnerability detection method for the compiler in this embodiment of the invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the aforementioned vulnerability detection method for the compiler in the application. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0028] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10.

[0029] Figure 2 This is a flowchart illustrating a vulnerability detection method for a compiler provided according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps:

[0030] Step S201: Obtain the sequence of source code, abstract syntax tree, control flow graph, and compilation context information from the target compiler. The abstract syntax tree represents the syntactic structure of the source code, and the control flow graph represents all possible execution paths in the source code.

[0031] In this step, the source code sequence is used to preserve the linear textual semantics of the code; the Abstract Syntax Tree (AST) precisely maps the syntactic hierarchy and structural relationships of the source code, enabling the model to understand the code's organization; the Control Flow Graph (CFG) completely covers all possible execution paths in the source code, revealing the program's control logic flow. Compilation context information goes beyond the pure code level, containing unique information generated by the compiler during compilation, such as inlining decisions, type inference results, optimization flag effects, and symbol table information. Additionally, the Control Flow Graph can be replaced with a Program Dependence Graph (PDG), which similarly reflects the dependency logic relationships within the program code.

[0032] By acquiring the above four types of information simultaneously, we can take into account the static structure of the code, the dynamic execution path, and the compiler-specific optimization and type constraint context. This lays a solid data foundation for subsequent extraction of semantic features, fusion of contextual information, and ultimately, the achievement of high-precision vulnerability type identification and exploitability scoring. This solves the technical problem of false positives or false negatives caused by traditional static analysis ignoring compiler context.

[0033] Step S202: Based on the sequence of source code, abstract syntax tree, and control flow graph, extract the semantic features of the source code to obtain the code hiding state matrix, whereby the code hiding state matrix is ​​used to characterize the semantic features of the source code itself.

[0034] In this step, a pre-defined graph neural network is used to perform multi-layer message passing processing on the abstract syntax tree and control flow graph to capture the tree-like hierarchical relationships and control flow dependencies in the code, thereby generating structural feature vectors that represent the static structural features of the code. Simultaneously, a pre-defined deep neural network is used to encode the source code sequence, extracting the lexical semantics and deep logical connections to generate semantic feature vectors. Subsequently, the structural feature vectors and semantic feature vectors are weighted and summed, with weighting coefficients used to balance the contributions of structural and semantic information to the final representation. The resulting code-hidden state matrix comprehensively and accurately represents the semantic features of the source code itself, providing a unified and rich feature representation foundation for subsequent vulnerability detection combined with the compilation context.

[0035] Step S203: Encode the compilation context information into a context vector.

[0036] In this step, heterogeneous compiled data is mapped into a unified context vector using a specific context embedder, and then an attention mechanism is used to interact and fuse with the semantic features of the code. This encoding method enables the perception of the real behavioral characteristics of code in a specific compilation environment, distinguishing semantically similar code segments but with different compilation processing, thereby significantly improving the detection accuracy and exploitation prediction accuracy of potential vulnerabilities under specific compiler optimizations, and solving the technical deficiency of traditional static analysis that ignores the correlation of compilation context.

[0037] Step S204: The code hiding state matrix and the context vector are fused to obtain the fused representation vector.

[0038] In this step, an attention mechanism can be used, with the code-hidden state matrix as the query input, key input, and value input, to dynamically evaluate the correlation strength between various parts of the code and compiler context information (such as inlining decisions, type inference results, optimization flag effects, and symbol table information). This mechanism ensures that the model does not simply concatenate data, but rather weights and modulates the code semantics based on contextual information, highlighting key code segments affected by specific compiler processing strategies. For example, inlining decisions reflect function complexity, type inference reveals potential type confusion risks, and optimization flags affect the triggering conditions of specific vulnerabilities. The fused representation vector not only preserves the deep semantic structure of the source code itself but also incorporates dynamic behavioral characteristics and constraints during the compilation process, thereby generating a unified representation that comprehensively reflects the security state of the code in a specific compilation environment.

[0039] Step S205: Based on the fused representation vector, determine the vulnerability detection results, which include vulnerability type, vulnerability triggering conditions, impact scope, and exploitability score.

[0040] In this step, the fused representation vector can be input into a multi-task learning encoder. This encoder contains shared parameters to capture common code security features and connects multiple specific task heads for parallel processing. The first task head is responsible for identifying specific vulnerability types, such as buffer overflows or type confusion; the second task head predicts the specific conditions required to trigger the vulnerability, including input format, memory layout, or system state; the third task head assesses the potential impact of successful exploitation of the vulnerability, covering consequences such as code execution, privilege escalation, or information leakage; and the fourth task head integrates the prediction results of the previous three task heads and outputs an exploitability score through a regression algorithm. This mechanism breaks through the binary limitation of traditional technologies that can only determine the existence of vulnerabilities, and can quantitatively assess the actual severity of vulnerabilities. By combining contextual information such as compiler-specific inline decisions, type inference, and optimization flags, it can not only identify potential defects but also accurately simulate their exploitability in specific compilation environments. This provides developers with risk classification and remediation suggestions with operational guidance, significantly improving the intelligence and accuracy of security detection.

[0041] Through the above steps, the goal of integrating intelligent security analysis within the compiler is achieved, thereby significantly improving the detection accuracy of new and complex vulnerabilities. This solves the technical problem that traditional security detection focuses only on the semantics of the code itself and ignores the rich contextual information provided by the compiler, resulting in insufficient detection accuracy.

[0042] As an optional embodiment, based on the sequence of source code, abstract syntax tree, and control flow graph, semantic features of the source code are extracted to obtain a code-hidden state matrix, including: using a preset graph neural network to perform multi-layer message passing processing on the abstract syntax tree and control flow graph respectively and concatenating them to obtain structural feature vectors; using a preset deep neural network to perform multi-layer encoding processing on the source code sequence to obtain semantic feature vectors; and weighted summing of the structural feature vectors and semantic feature vectors to obtain the code-hidden state matrix.

[0043] Optionally, firstly, a pre-defined Graph Neural Network (GNN) is used to perform independent multi-layer message passing processing on the abstract syntax tree and control flow graph, capturing the syntactic hierarchy and execution path dependencies of the code respectively. Then, the outputs of both are concatenated to form a structural feature vector, thus fully representing the structured information of the code. Simultaneously, a pre-defined deep neural network, such as the Transformer, is used to perform multi-layer encoding processing on the source code text sequence, extracting linear semantic features and generating a semantic feature vector. Finally, the structural feature vector and the semantic feature vector are weighted and summed, where the weight coefficients are used to balance the contributions of structural and semantic information to the final feature representation, thereby obtaining a code hidden state matrix that comprehensively represents the semantic features of the source code itself.

[0044] Specifically, the token sequence of the source code can be set as follows: Its initial embedding is Through the L-layer Transformer encoder and GNN message passing Obtain the code hiding matrix :

[0045]

[0046] in, These are the weighting coefficients for structural features. For abstract syntax trees, For control flow graphs.

[0047] As an optional embodiment, the code hiding state matrix and the context vector are fused to obtain a fused representation vector, including: determining the query vector, key vector, and value vector based on the code hiding state matrix; and fusing the code hiding state matrix and the context vector through an attention mechanism based on the query vector, key vector, and value vector to obtain the fused representation vector.

[0048] Optionally, firstly, the code-hidden state matrix is ​​used as input, from which query vectors, key vectors, and value vectors are generated. The query vector captures the current semantic focus of the code, while the key and value vectors carry code structural features and potential contextual information, respectively. Subsequently, the encoded context vector is introduced into the attention calculation system as a supplement or replacement source for the key and value vectors. Specifically, by calculating the similarity weight between the query vector and the context vector, the degree of attention given to key information in the code-hidden state is dynamically adjusted. This mechanism allows the model to adaptively reweight the semantic representation of the code based on specific compilation context information, such as inlining decisions and type inference results. Finally, based on the calculated attention weights, the code-hidden state matrix is ​​weighted and aggregated to generate a fused representation vector.

[0049]

[0050] in, The output of the code semantic encoder, i.e., the code hiding matrix. For fusion representation vectors, To attract attention, , , These are the query vector, key vector, and value vector, respectively. For compilation context information, This serves as a context vector. This fusion process effectively combines the deep semantic features of the code itself with the compiler-specific environmental context information, eliminating the shortcomings of traditional methods that separate code analysis from the compilation context. It provides a unified feature representation rich in context awareness for subsequent multi-task learning modules, thereby improving the accuracy of predicting vulnerability types, triggering conditions, and exploitability scores.

[0051] As an optional embodiment, determining the vulnerability detection result based on the fused representation vector includes: inputting the fused representation vector into a preset multi-task learning encoder, processing it in parallel through multiple task heads to obtain the vulnerability detection result, wherein processing through multiple task heads includes: identifying the vulnerability type through a first task head, predicting the vulnerability triggering conditions through a second task head, evaluating the impact range after the vulnerability is exploited through a third task head, and outputting an exploitability score by combining the prediction results of all task heads except the fourth task head through a fourth task head.

[0052] Optionally, the fused representation vector can be input into a pre-defined multi-task learning encoder to capture common code security features by sharing underlying parameters, and multiple dedicated task heads can be activated in parallel to extract prediction results for specific dimensions. The first task head is a vulnerability type classification head, focusing on semantic classification to identify specific vulnerability types, such as buffer overflows, type obfuscation, use-and-release, and time-check-to-use time race conditions; the second task head is a trigger condition prediction head, focusing on condition inference to predict the specific conditions required to trigger a vulnerability, such as specific input formats, memory layouts, and system states; the third task head is an impact scope assessment head, responsible for consequence assessment, evaluating the potential impact of vulnerability exploitation, such as code execution, privilege escalation, information leakage, and denial-of-service; the fourth task head is an exploitability score regression head, which, as a regression head, combines the prediction outputs of the aforementioned three task heads and generates an exploitability score of 0 to 100 through weighted calculation, thereby quantifying the actual danger of the vulnerability. This parallel processing mechanism not only avoids information loss caused by traditional binary judgment, but also improves the overall prediction accuracy through the implicit correlation between tasks. It upgrades the detection result from a single judgment of the existence of defects to a comprehensive security assessment that includes type, conditions, consequences and risk level, providing a refined basis for subsequent manual auditing or automated blocking.

[0053] As an optional embodiment, the compilation context information includes inlining decision information, type inference results, optimization flag effects, and symbol table information. The inlining decision information indicates whether the target compiler inlines the functions called by the source code, the type inference results indicate the variable type information inferred by the target compiler during compilation, the optimization flag effects indicate the vulnerability triggering conditions corresponding to the optimization level of the target compiler, and the symbol table information indicates the structure information corresponding to the debugging symbols generated by the target compiler.

[0054] Optionally, compilation context information is a key component of the fused representation vector, specifically including inline decision information, type inference results, optimization flags, and symbol table information. Inline decision information characterizes whether the target compiler inlines functions called by the source code. This information reflects the function's complexity and its performance impact. Inlined code may expose previously hidden boundary conditions, thus helping the model identify potential risks. Type inference results characterize the variable type information inferred by the target compiler during compilation. This information can be used to accurately identify type confusion-related vulnerabilities, compensating for the lack of type information in static analysis. Optimization flags characterize the vulnerability triggering conditions corresponding to the target compiler's optimization levels. Since different optimization levels (such as -O0, -O2, -Os) change code behavior, some vulnerabilities only trigger under specific optimization conditions. This information helps the model assess the actual existence of vulnerabilities in a specific compilation environment. Symbol table information characterizes the structural information corresponding to the debugging symbols generated by the target compiler, containing rich structural details that can be used to more accurately locate vulnerabilities and enhance the accuracy of context awareness.

[0055] As an optional embodiment, if the exploitability score is higher than a preset threshold, test case code snippets that can trigger the vulnerability are generated based on the vulnerability triggering conditions and the scope of impact; the test case code snippets are injected into the source code and symbolic execution verification is performed to obtain symbolic execution verification results, wherein the symbolic execution verification results include evidence of successful vulnerability triggering or failure information; based on the symbolic execution verification results, the exploitability score is updated and the parameters of the target compiler are adjusted.

[0056] Optionally, when the exploitability score output by the vulnerability detection module exceeds a preset threshold, it indicates that the vulnerability has extremely high potential harm, and the deep verification phase begins. First, based on the vulnerability triggering conditions and impact scope output by the aforementioned multi-task learning encoder, an adversarial detection generator automatically constructs targeted test case code snippets. These snippets aim to simulate specific attack scenarios, covering the boundary conditions for vulnerability triggering as much as possible. Subsequently, the generated test case code snippets are injected into the source code to be compiled via a compiler instrumentation mechanism, and a symbolic execution engine is used to explore the paths of the injected program. Without specific runtime environment dependencies, the symbolic execution engine analyzes all possible execution paths through constraint solving, thereby verifying whether the vulnerability truly exists, and finally generating a symbolic execution verification result containing evidence of successful vulnerability triggering or reasons for failure.

[0057] After verification, the symbolic execution verification results are fed back to the models used in the previous processing (e.g., graph neural networks and neural network models). Based on the verification results, the training dataset is expanded in real time, and newly verified samples and their labels are added to the training queue. Elastic Weight Consolidation (EWC) technology is employed to allow the model to learn from new samples without forgetting existing knowledge. Simultaneously, an online incremental learning mechanism is used to update the exploitability score, making the score more accurately reflect the actual risk of the vulnerability. When the compiler version is updated, relevant parameters of the target compiler are adjusted based on the verification results, such as optimizing the compilation strategy or adjusting the inlining decision threshold, to enhance the compiler's defense capabilities against similar vulnerabilities or improve subsequent detection efficiency. This mechanism allows the model to adapt to new compilation behaviors and optimization strategies through incremental learning, enabling it to continuously learn and evolve in practical use, gradually improving detection accuracy and exploitability prediction capabilities. This forms a closed-loop iterative process from discovery and verification to model and configuration optimization, thereby significantly improving detection accuracy and reducing false positives.

[0058] The core ideas of adversarial probe generators include: symbolic execution guidance, which uses the model's predictions to guide the selection of symbolic execution paths, prioritizing the exploration of paths that may trigger vulnerabilities; mutation policy learning, where the model learns historically successful vulnerability triggering patterns to generate mutation inputs that are more likely to expose vulnerabilities; and gradient basis generation, which uses the gradient information from the model's predictions to construct adversarial examples for differentiable code regions. Compared with traditional fuzz testing (such as AFL and AFLGo), adversarial probe generators have the following advantages: they can utilize code semantic understanding capabilities to avoid blind mutation; they can run during compilation without requiring a complete runtime environment; and they can combine type information and boundary constraints provided by the compiler to generate more accurate probe inputs.

[0059] Combining the above optional embodiments, the logical steps of the above embodiments can be integrated into an AI model specifically optimized for compiler environments—the CCVD (Compiler Context-aware Vulnerability Detection) model. The CCVD model adopts a three-stage cascaded structure. The input layer (Compiler Input) includes source code token sequences, AST (Abstract Syntax Tree), CFG (Control Flow Graph) / PDG (Program Dependency Graph), and compilation context information (compiler flags, inlining decisions, type inference results). Stage one is the compiler-aware encoder (CE), which aims to fuse unstructured code semantics with structured compiler context information to generate a unified code representation vector. This process is divided into three sub-steps: parallel encoding, context embedding, and attention fusion. Stage two is the multi-task Exploitability Prediction framework. This multi-task learning framework adopts an architecture of shared encoder + task-specific head. Shared parameters capture common code safety features, while the task-specific head learns predictive capabilities in different dimensions. Multi-task learning can significantly improve the accuracy of each task because there are implicit correlations between tasks (e.g., certain types of vulnerabilities are more likely to be triggered by specific conditions). Phase three is the feedback loop training module (RL), which learns from actual validation results.

[0060] The training of a CCVD model can be divided into two stages: pre-training and fine-tuning.

[0061] Pre-training phase: Large-scale code corpus pre-training, using a large-scale code corpus from GitHub open-source projects (approximately 1 million+ open-source projects), and employing self-supervised learning tasks (such as masked language modeling and code completion) to pre-train the base model; compiler context pre-training, designing special pre-training tasks to allow the model to learn the relationship between compiler optimization decisions and code behavior; vulnerability pattern pre-training, using publicly available CVE datasets (such as NVD and GitHub SecurityAdvisory) to perform weakly supervised learning on the model, enabling it to initially possess vulnerability identification capabilities.

[0062] Fine-tuning phase: Multi-task fine-tuning, using a more finely labeled internal dataset (including vulnerability type, triggering conditions, impact scope, and exploitability score) to fine-tune the model on multiple tasks; Contrastive learning, introducing a contrastive learning method to enable the model to distinguish between "similar secure code" and "similar dangerous code"; Adversarial training, introducing adversarial examples during training to improve the model's robustness against malicious constructs.

[0063] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0064] Through the above description of the embodiments, those skilled in the art can clearly understand that the vulnerability detection method for compilers according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0065] According to an embodiment of the present invention, a vulnerability detection plugin for a compiler is also provided. The vulnerability detection plugin is installed in the target compiler and executes any of the above-described vulnerability detection methods for the compiler when the target compiler is running.

[0066] Optionally, a vulnerability detection plugin for a compiler is an intelligent component installed within the target compiler and automatically executing vulnerability detection methods during compilation. Its core working principle is to first acquire the source code sequence, abstract syntax tree, and control flow graph from the target compiler, while simultaneously extracting compilation context information such as inlining decisions, type inference, optimization flags, and symbol tables. The plugin uses a graph neural network to perform message passing on the abstract syntax tree and control flow graph to extract structural features, and utilizes a deep neural network to encode the source code sequence to obtain semantic features, which are then weighted and fused to obtain a code-hidden state matrix. Subsequently, the plugin encodes the compilation context information into a context vector and fuses it with the code-hidden state matrix through an attention mechanism to generate a fused representation vector containing rich semantic and compilation environment information. Based on this fused representation vector, the plugin uses a multi-task learning framework to process multiple task heads in parallel, identifying vulnerability types, predicting trigger conditions, assessing the scope of impact, and comprehensively outputting an exploitability score, thereby achieving high-precision vulnerability detection. When the score exceeds a preset threshold, the plugin also generates test case code snippets and injects them into the source code for symbolic execution verification. Based on the verification results, it dynamically updates the score and adjusts compiler parameters, forming a closed-loop optimization. This plugin not only combines static code analysis with dynamic verification, but also significantly improves the accuracy and intelligence of vulnerability detection through deep integration of compilation context information.

[0067] For example, the above plugin can be divided into several functional modules:

[0068] The intelligent code auditing module takes source code files, compilation parameters, and project configurations as input and outputs a security audit report containing vulnerability location, type, and exploitability score. The processing flow includes: a compiler front-end interface that receives the intermediate representation (IR) from the LLVM / Clang front-end and extracts the AST, CFG, and compilation context information; CCVD model inference that inputs the above information into a trained CCVD model to obtain vulnerability detection results and exploitability scores; and post-processing that filters low-risk items based on preset thresholds and triggers subsequent verification processes for high-risk vulnerabilities.

[0069] The vulnerability exploitation simulation and verification module takes high-risk vulnerability instances discovered by the audit module as input and outputs a vulnerability exploitability verification report, including evidence of successful triggering or failure analysis. The processing flow includes: probe code generation, which calls the adversarial probe generator of the CCVD model to automatically generate one or more test cases for each vulnerability; compile-time injection, which injects the generated probe code into the target program via the LLVM Pass mechanism; symbolic execution verification, which uses symbolic execution engines such as KLEE and angr to run the probe cases on the intermediate code generated during compilation; and result evaluation, which feeds the results of symbolic execution back to the CCVD model to update the exploitability score.

[0070] The dependency security intelligent assessment module takes as input a project dependency list (package.json, pom.xml, etc.) and dependency library source code, and outputs a comprehensive security assessment report integrating the project code and dependency libraries. The processing flow includes: dependency graph construction, parsing project dependencies and constructing a complete directed acyclic graph (DAG); CVE correlation analysis, matching dependency library version information with a vulnerability database; CCVD-assisted risk assessment, using the CCVD model to analyze API calls in dependency libraries that interact with the project code, and assessing the actual exploitability of known vulnerabilities; and context-aware report generation, combining code audit results to generate a dependency risk report considering the specific use cases of the project.

[0071] This module is deeply integrated into the GitHub workflow, running as a compiler plugin or a standalone security agent. Its output includes security analysis results and remediation recommendations integrated into the GitHub interface. The process includes: event listening (monitoring Push, PR, and other events via GitHub Webhook); incremental analysis (running CCVD model inference only on changed code files, optimizing performance through incremental computation); report generation (converting audit and verification results into a developer-friendly format and outputting them to the PR comment section or security dashboard); and automated decision-making (automatically marking high-risk PRs based on availability scores and supporting blocking / merging).

[0072] To achieve the above functions, the core architecture of the plugin can include: an AI engine (front-end), which performs static analysis based on a deep learning model to understand code semantics; an executable code generation and injection module, which automatically converts the parts discovered or suggested for modification by the AI ​​engine into small executable fragments (BPF, bytecode instrumentation, etc.), and injects them in the compilation output or at runtime for dynamic simulation and verification; a vulnerability database / knowledge base, which has built-in known vulnerability patterns, attack vector characteristics, and security information of dependent libraries; a simulation and verification engine, which simulates attack paths to verify vulnerability exploitability based on injected code fragments, symbolic execution, or constraint solvers; a dependency resolver, which automatically scans the third-party libraries used by the project, analyzes their components, and associates them with the security database; and a GitHub workflow integrator, which acts as a plugin for Git hooks or CI / CD tools to automate analysis, reporting, and feedback.

[0073] For example, one possible implementation of the plugin for a work scenario includes: a developer develops and modifies code locally, then commits `git commit -m "fix"`. In the IDE (development phase), the plugin performs preliminary static analysis, highlighting potential risks introduced by code changes. Upon `git push` or creating a PR, the GitHub integrator is triggered for a more comprehensive AI-powered security audit and vulnerability verification. The dependency resolver simultaneously scans the project's `package.json` (npm), `pom.xml` (maven), and `requirements.txt` (Python), among others. The audit results and dependency security reports are displayed on the PR page or in the IDE, with the AI ​​engine highlighting critical, highly exploitable vulnerabilities. The developer then modifies and re-pushes based on the report.

[0074] According to embodiments of the present invention, an apparatus for implementing the above-described vulnerability detection method for compilers is also provided. Figure 3 This is a structural block diagram of a vulnerability detection device for a compiler provided according to an embodiment of the present invention, such as... Figure 3 As shown, the device includes: an acquisition module 31, an extraction module 32, an encoding module 33, a fusion module 34, and a determination module 35. The device will be described below.

[0075] The acquisition module 31 is used to acquire the sequence of source code, abstract syntax tree, control flow graph and compilation context information in the target compiler. The abstract syntax tree represents the syntactic structure of the source code and the control flow graph represents all possible execution paths in the source code.

[0076] Extraction module 32, connected to acquisition module 31, is used to extract semantic features of source code based on source code sequence, abstract syntax tree, and control flow graph to obtain code hiding state matrix, wherein the code hiding state matrix is ​​used to characterize the semantic features of the source code itself.

[0077] Encoding module 33, connected to extraction module 32, is used to encode compilation context information into a context vector.

[0078] The fusion module 34, connected to the encoding module 33, is used to fuse the code hiding state matrix and the context vector to obtain the fused representation vector.

[0079] The determination module 35, connected to the fusion module 34, is used to determine the vulnerability detection results based on the fused representation vector. The vulnerability detection results include the vulnerability type, vulnerability triggering conditions, impact scope, and exploitability score.

[0080] It should be noted that the acquisition module 31, extraction module 32, encoding module 33, fusion module 34, and determination module 35 mentioned above correspond to steps S201 to S205 in the embodiments. Multiple modules and their corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above modules, as part of the device, can run on the computer terminal 10 provided in the embodiments.

[0081] Embodiments of the present invention may provide a computer device. Optionally, in this embodiment, the computer device may be located in at least one of a plurality of network devices in a computer network. The computer device includes a memory and a processor.

[0082] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the vulnerability detection method and apparatus for compilers in this embodiment of the invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the aforementioned vulnerability detection method for compilers. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to a computer terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0083] The processor can access information and applications stored in memory via a transmission device to perform the following steps: acquiring the sequence of source code, abstract syntax tree, control flow graph, and compilation context information from the target compiler, where the abstract syntax tree represents the syntactic structure of the source code, and the control flow graph represents all possible execution paths in the source code; extracting semantic features from the source code based on the sequence of source code, abstract syntax tree, and control flow graph to obtain a code-hidden state matrix, where the code-hidden state matrix represents the semantic features of the source code itself; encoding the compilation context information into a context vector; fusing the code-hidden state matrix and the context vector to obtain a fused representation vector; and determining the vulnerability detection result based on the fused representation vector, where the vulnerability detection result includes the vulnerability type, vulnerability triggering conditions, impact scope, and exploitability score.

[0084] Optionally, the processor may also execute program code with the following steps: extracting semantic features from the source code sequence, abstract syntax tree, and control flow graph to obtain a code-hidden state matrix, including: using a preset graph neural network to perform multi-layer message passing processing on the abstract syntax tree and control flow graph respectively and concatenating them to obtain a structural feature vector; using a preset deep neural network to perform multi-layer encoding processing on the source code sequence to obtain a semantic feature vector; and weighting and summing the structural feature vector and the semantic feature vector to obtain the code-hidden state matrix.

[0085] Optionally, the processor may also execute program code that performs the following steps: fusing the code-hidden state matrix and the context vector to obtain a fused representation vector, including: determining the query vector, key vector, and value vector based on the code-hidden state matrix; and fusing the code-hidden state matrix and the context vector through an attention mechanism based on the query vector, key vector, and value vector to obtain the fused representation vector.

[0086] Optionally, the processor may also execute program code with the following steps: determining vulnerability detection results based on the fused representation vector, including: inputting the fused representation vector into a preset multi-task learning encoder, processing it in parallel through multiple task heads to obtain vulnerability detection results, wherein processing through multiple task heads includes: identifying vulnerability types through a first task head, predicting vulnerability triggering conditions through a second task head, evaluating the impact range after the vulnerability is exploited through a third task head, and outputting an exploitability score by combining the prediction results of all task heads except the fourth task head through a fourth task head.

[0087] Optionally, the processor may also execute program code with the following steps: compilation context information includes inlining decision information, type inference results, optimization flag effects, and symbol table information. Inlining decision information indicates whether the target compiler inlines the functions called by the source code, type inference results indicate the variable type information inferred by the target compiler during compilation, optimization flag effects indicate the vulnerability triggering conditions corresponding to the optimization level of the target compiler, and symbol table information indicates the structure information corresponding to the debugging symbols generated by the target compiler.

[0088] Optionally, the processor may also execute program code that performs the following steps: if the exploitability score is higher than a preset threshold, generate test case code snippets that can trigger the vulnerability based on the vulnerability triggering conditions and scope of impact; inject the test case code snippets into the source code and perform symbolic execution verification to obtain symbolic execution verification results, wherein the symbolic execution verification results include evidence of successful vulnerability triggering or failure information; and update the exploitability score and adjust the parameters of the target compiler based on the symbolic execution verification results.

[0089] This invention provides a vulnerability detection method for compilers. It acquires the sequence of source code, abstract syntax tree (AST), control flow graph (CLP), and compilation context information from the target compiler. The AST represents the syntactic structure of the source code, and the CLP represents all possible execution paths. Based on the source code sequence, AST, and CLP, semantic features are extracted to obtain a code-hidden state matrix, which represents the semantic features of the source code itself. The compilation context information is encoded into a context vector. The code-hidden state matrix and the context vector are fused to obtain a fused representation vector. Based on the fused representation vector, the vulnerability detection result is determined, including the vulnerability type, vulnerability triggering conditions, impact scope, and exploitability score. This method integrates intelligent security analysis within the compiler, significantly improving the detection accuracy for novel and complex vulnerabilities. It also solves the problem of insufficient detection accuracy caused by traditional security detection methods that focus only on the semantics of the code itself and ignore the rich context information provided by the compiler.

[0090] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a non-volatile storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0091] Embodiments of the present invention also provide a non-volatile storage medium. Optionally, in this embodiment, the aforementioned non-volatile storage medium can be used to store the program code executed by the vulnerability detection method for compilers provided in the above embodiments.

[0092] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0093] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: obtaining the sequence of source code, abstract syntax tree, control flow graph, and compilation context information from the target compiler, wherein the abstract syntax tree represents the syntactic structure of the source code, and the control flow graph represents all possible execution paths in the source code; extracting semantic features of the source code based on the sequence of source code, abstract syntax tree, and control flow graph to obtain a code-hidden state matrix, wherein the code-hidden state matrix is ​​used to represent the semantic features of the source code itself; encoding the compilation context information into a context vector; fusing the code-hidden state matrix and the context vector to obtain a fused representation vector; and determining the vulnerability detection result based on the fused representation vector, wherein the vulnerability detection result includes the vulnerability type, vulnerability triggering conditions, impact scope, and exploitability score.

[0094] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: extracting semantic features of the source code based on the sequence of source code, abstract syntax tree, and control flow graph to obtain a code-hidden state matrix, including: using a preset graph neural network to perform multi-layer message passing processing on the abstract syntax tree and control flow graph respectively and concatenating them to obtain a structural feature vector; using a preset deep neural network to perform multi-layer encoding processing on the source code sequence to obtain a semantic feature vector; and weighting and summing the structural feature vector and the semantic feature vector to obtain a code-hidden state matrix.

[0095] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: fusing the code-hidden state matrix and the context vector to obtain a fused representation vector, including: determining a query vector, a key vector, and a value vector based on the code-hidden state matrix; and fusing the code-hidden state matrix and the context vector through an attention mechanism based on the query vector, the key vector, and the value vector to obtain a fused representation vector.

[0096] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: determining vulnerability detection results based on the fused representation vector, including: inputting the fused representation vector into a preset multi-task learning encoder, processing it in parallel through multiple task heads to obtain vulnerability detection results, wherein processing through multiple task heads includes: identifying vulnerability types through a first task head, predicting vulnerability triggering conditions through a second task head, evaluating the impact range after the vulnerability is exploited through a third task head, and outputting an exploitability score by combining the prediction results of all task heads except the fourth task head through a fourth task head.

[0097] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: compilation context information includes inlining decision information, type inference results, optimization flag effects, and symbol table information, wherein the inlining decision information indicates whether the target compiler inlines the functions called by the source code, the type inference results indicate the variable type information inferred by the target compiler during compilation, the optimization flag effects indicate the vulnerability triggering conditions corresponding to the optimization level of the target compiler, and the symbol table information indicates the structure information corresponding to the debugging symbols generated by the target compiler.

[0098] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: when the exploitability score is higher than a preset threshold, generating test case code fragments that can trigger the vulnerability based on the vulnerability triggering conditions and the scope of impact; injecting the test case code fragments into the source code and performing symbolic execution verification to obtain symbolic execution verification results, wherein the symbolic execution verification results include evidence of successful vulnerability triggering or failure information; and updating the exploitability score and adjusting the parameters of the target compiler based on the symbolic execution verification results.

[0099] Embodiments of the present invention also provide a computer program product, including a computer program. Optionally, in this embodiment, when the computer program is executed by a processor, it can: acquire a sequence of source code, an abstract syntax tree, a control flow graph, and compilation context information from a target compiler, wherein the abstract syntax tree represents the syntactic structure of the source code, and the control flow graph represents all possible execution paths in the source code; extract semantic features of the source code based on the sequence of source code, the abstract syntax tree, and the control flow graph to obtain a code-hidden state matrix, wherein the code-hidden state matrix is ​​used to represent the semantic features of the source code itself; encode the compilation context information into a context vector; fuse the code-hidden state matrix and the context vector to obtain a fused representation vector; and determine a vulnerability detection result based on the fused representation vector, wherein the vulnerability detection result includes vulnerability type, vulnerability triggering conditions, impact scope, and exploitability score.

[0100] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0101] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0102] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0103] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0104] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0105] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a non-volatile storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0106] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A vulnerability detection method for compilers, characterized in that, include: Obtain the sequence of source code, abstract syntax tree, control flow graph, and compilation context information from the target compiler, wherein the abstract syntax tree represents the syntactic structure of the source code, and the control flow graph represents all possible execution paths in the source code; Based on the sequence of the source code, the abstract syntax tree, and the control flow graph, the semantic features of the source code are extracted to obtain a code hiding state matrix, wherein the code hiding state matrix is ​​used to characterize the semantic features of the source code itself; The compilation context information is encoded into a context vector; The code-hidden state matrix and the context vector are fused to obtain a fused representation vector; Based on the fused representation vector, the vulnerability detection result is determined, wherein the vulnerability detection result includes vulnerability type, vulnerability triggering conditions, impact scope, and exploitability score.

2. The method according to claim 1, characterized in that, The semantic features of the source code are extracted based on the sequence of the source code, the abstract syntax tree, and the control flow graph to obtain the code-hidden state matrix, including: A pre-defined graph neural network is used to perform multi-layer message passing processing on the abstract syntax tree and the control flow graph, and then concatenate them to obtain a structural feature vector. The source code sequence is processed through multi-layer encoding using a pre-defined deep neural network to obtain semantic feature vectors. The structural feature vector and the semantic feature vector are weighted and summed to obtain the code hiding state matrix.

3. The method according to claim 1, characterized in that, The step of fusing the code-hiding state matrix and the context vector to obtain a fused representation vector includes: Based on the code-hiding state matrix, determine the query vector, key vector, and value vector; Based on the query vector, the key vector, and the value vector, the code-hidden state matrix and the context vector are fused using an attention mechanism to obtain the fused representation vector.

4. The method according to claim 1, characterized in that, The process of determining the vulnerability detection result based on the fused representation vector includes: The fused representation vector is input into a preset multi-task learning encoder and processed in parallel through multiple task heads to obtain the vulnerability detection result. The processing through multiple task heads includes: identifying the vulnerability type through a first task head, predicting the vulnerability triggering conditions through a second task head, evaluating the impact range after the vulnerability is exploited through a third task head, and outputting the exploitability score by combining the prediction results of all task heads except the fourth task head through a fourth task head.

5. The method according to claim 1, characterized in that, The compilation context information includes inlining decision information, type inference results, optimization flag effects, and symbol table information. The inlining decision information indicates whether the target compiler inlines the functions called by the source code. The type inference results indicate the variable type information inferred by the target compiler during compilation. The optimization flag effects indicate the vulnerability triggering conditions corresponding to the optimization level of the target compiler. The symbol table information indicates the structure information corresponding to the debugging symbols generated by the target compiler.

6. The method according to any one of claims 1 to 5, characterized in that, Also includes: If the exploitability score is higher than a preset threshold, test case code snippets that can trigger the vulnerability are generated based on the vulnerability triggering conditions and the scope of impact. The test case code snippet is injected into the source code and symbolic execution verification is performed to obtain the symbolic execution verification result, wherein the symbolic execution verification result includes evidence of successful vulnerability triggering or failure information; Based on the symbolic execution verification results, the availability score is updated and the parameters of the target compiler are adjusted.

7. A vulnerability detection plugin for a compiler, characterized in that, The vulnerability detection plugin is installed in the target compiler and executes the vulnerability detection method for the compiler as described in any one of claims 1 to 6 when the target compiler is running.

8. A vulnerability detection device for a compiler, characterized in that, include: The acquisition module is used to acquire the sequence of source code, abstract syntax tree, control flow graph and compilation context information in the target compiler, wherein the abstract syntax tree represents the syntactic structure of the source code and the control flow graph represents all possible execution paths in the source code; An extraction module is used to extract semantic features of the source code based on the source code sequence, the abstract syntax tree, and the control flow graph to obtain a code hiding state matrix, wherein the code hiding state matrix is ​​used to characterize the semantic features of the source code itself. The encoding module is used to encode the compilation context information into a context vector; The fusion module is used to fuse the code-hiding state matrix and the context vector to obtain a fused representation vector; The determination module is used to determine the vulnerability detection result based on the fused representation vector, wherein the vulnerability detection result includes vulnerability type, vulnerability triggering conditions, impact scope, and exploitability score.

9. A non-volatile storage medium, characterized in that, The non-volatile storage medium includes a stored program, wherein, when the program is executed, the device containing the non-volatile storage medium is controlled to execute the vulnerability detection method for a compiler as described in any one of claims 1 to 6.

10. A computer device, characterized in that, include: Memory and processor The memory stores computer programs; The processor is configured to execute a computer program stored in the memory, wherein when the computer program is executed, the processor performs the vulnerability detection method for a compiler as described in any one of claims 1 to 6.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the vulnerability detection method for a compiler as described in any one of claims 1 to 6.

Images