A code file scanning method and electronic device

Abstract

The application discloses a code file scanning method and an electronic device, and relates to the technical field of code security detection. A pre-trained model is called to output a code file to be scanned. Before performing scanning processing, the security risks of different code files can be distinguished based on the error-prone mode of the code file to be scanned, the function semantics, and the business context reflected by the path. The subsequent scanning processing corresponds to the security level obtained by the distinguishing, and there is no need to perform indiscriminate scanning processing on different security risk code files generated by the pre-trained model. Therefore, the technical problem that the code generated by the pre-trained model is indiscriminately scanned in the related art, resulting in high consumption of computing resources and long scanning time, can be solved. The technical effects of improving the pertinence of code file security scanning, reducing unnecessary scanning processing, reducing the consumption of computing resources, and shortening the scanning time are achieved.

Description

Technical Field

[0001] This application relates to the field of code security detection technology, and in particular to a method and electronic device for scanning code files. Background Technology

[0002] The code generated by pre-trained models often contains dangerous vulnerabilities such as hard-coded keys, structured query language injection, and command execution. To ensure security, indiscriminately calling static application security testing tools to scan all code generated by pre-trained models can easily lead to excessive consumption of pre-trained model tokens and other computational resources, and the scanning time is also long. Summary of the Invention

[0003] This application provides a method and electronic device for scanning code files, which at least solves the problem in related technologies that indiscriminately perform security scanning on code generated by pre-trained models, resulting in high consumption of computing resources and long scanning time.

[0004] This application provides a method for scanning code files, including: Call the pre-trained model to output the code file to be scanned; According to the security detection rules, the file characteristics of the code file to be scanned are matched with the corresponding target scanning skills to determine the corresponding error-prone pattern density; whereby the security detection rules are determined by the semantic features of the abstract syntax tree; Semantic analysis is performed on the framework features, user input processing features, and data processing operation features of the code file to be scanned to obtain the semantic file type score corresponding to the code file to be scanned. The corresponding dynamic business score is determined based on the path context information of the code file to be scanned. The security level of the code file to be scanned is determined based on the error-prone pattern density, semantic file type score, and dynamic business score, and then the corresponding scanning strategy is used for scanning.

[0005] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for implementing the scanning method of any of the above-described code files when executing the computer program.

[0006] This application utilizes a pre-trained model to output code files to be scanned. Based on security detection rules determined by the semantic features of an abstract syntax tree, the file features of the code files are matched with corresponding target scanning skills, and the density of corresponding error-prone patterns is determined. This allows for the identification of error-prone patterns matching the security detection rules based on the semantic features of the code itself. The error-prone pattern density reflects the concentration of error-prone patterns in the scanned code files, thus providing a basis for distinguishing the security risks of different scanned code files. Semantic analysis is performed based on the framework features, user input processing features, and data processing operation features of the scanned code files to obtain corresponding semantic file type scores. This reflects the functional semantics of the scanned code files from the aspects of the framework, user input processing, and data processing operations embodied in the code, enabling the security risk assessment of code files to not only depend on the occurrence of error-prone patterns but also to differentiate based on the functional semantics of the code files themselves. A dynamic business score is determined based on the path context information of the scanned code files. This utilizes the path context of the code files to reflect their business relevance, supplementing the security risk assessment based on code content with a business dimension. Furthermore, the security level of the code file to be scanned is determined based on the error-prone pattern density, semantic file type score, and dynamic business score. This allows the error-prone patterns, the functional semantics of the code itself, and the business context within the code file to be reflected in the security level, enabling different code files to be scanned to form corresponding security levels based on their own security risks. Then, scanning is performed according to the corresponding scanning strategy based on the security level, ensuring that the scanning process corresponds to the security level of the code file being scanned, and avoiding the use of the same scanning method for code files with different security risks.

[0007] Because the security risks of different code files can be distinguished based on their own error-prone patterns, functional semantics, and the business context reflected in the paths before the scanning process is performed, and the subsequent scanning process is made to correspond to the distinguished security level, without having to perform indiscriminate scanning of code files with different security risks generated by the pre-trained model, it can solve the technical problem in related technologies that result in high computational resource consumption and long scanning time due to indiscriminate security scanning of code generated by pre-trained models. It achieves the technical effects of improving the targeting of code file security scanning, reducing unnecessary scanning processes, reducing computational resource consumption, and shortening scanning time. Attached Figure Description

[0008] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0009] Figure 1 A flowchart illustrating a method for scanning code files provided in this application embodiment; Figure 2 A flowchart for determining the density of error-prone patterns provided in an embodiment of this application; Figure 3 A flowchart is provided for another method of scanning a code file to be scanned, as described in this application embodiment; Figure 4 A flowchart illustrating the scheduling optimization process for a code file to be scanned, provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of a code file scanning device provided in an embodiment of this application. Detailed Implementation

[0010] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0011] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0012] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0013] The specific application environment architecture or specific hardware architecture on which the scanning method of the combined code file depends is described here.

[0014] The code file scanning method provided in this application can be applied to an application environment assisted by a pre-trained model for code development. This application environment includes a pre-trained model, an electronic device executing the scanning method, and a static application security testing tool. The electronic device includes a processor and a memory that work together. The memory stores computer programs, a preset scanning skill library, security detection rules, and corresponding scoring and scheduling parameters. The processor executes the computer program to call the pre-trained model to output the code file to be scanned, obtains the file's code content and path context information, and uses the preset scanning skill library to perform syntax parsing, feature matching, and semantic analysis to determine the error-prone pattern density, semantic file type score, and dynamic business score. This determines the security level and calls the corresponding static application security testing tool to perform the scan. The electronic device can also schedule scanning tasks by combining the computational cost of the scanning tool and the lexical cost of the pre-trained model, and update the security criticality score and scanning skill library based on the actual scan results. This ensures that code generation, risk assessment, on-demand scanning, and feedback updates are interconnected. This application environment can be integrated into a continuous integration and continuous delivery pipeline.

[0015] The embodiments of this application provide a method for scanning code files, and the method is described in detail in conjunction with the execution flow of the code file scanning method.

[0016] Figure 1 A flowchart of a code file scanning method provided in this application embodiment is shown below. Figure 1 As shown, it includes: S11: Call the pre-trained model to output the code file to be scanned.

[0017] Pre-training is a strategy for training deep learning models. Its core lies in using large-scale datasets to initially train the model, enabling it to learn general feature representations. This process is similar to the basic learning stage humans undergo before learning new knowledge, accumulating experience through extensive reading and observation.

[0018] In other words, a pre-trained language model generally refers to a language model training task designed based on a large-scale corpus, including language training materials such as sentences and paragraphs. A large-scale neural network algorithm structure is trained to learn and implement this model, and the resulting large-scale neural network algorithm structure and parameters constitute the pre-trained language model. Subsequent tasks can then use this model to extract features or fine-tune the model to achieve specific task objectives. The idea behind pre-training is to first train a set of model parameters for one task, then use these parameters to initialize the network model parameters, and finally use the initialized network model to train other tasks, obtaining models adapted for those tasks. By pre-training on a large-scale corpus, neural language representation models can learn powerful language representation capabilities, extracting rich syntactic and semantic information from text. Pre-trained language models can provide tokens containing rich semantic information and sentence-level features for downstream tasks. Fine-tuning can also be performed directly on the pre-trained model for downstream tasks, conveniently and quickly obtaining downstream-specific models.

[0019] The neural network algorithm structure used to train the pre-trained language model can be a Convolutional Neural Network (CNN), a Recurrent Neural Network (RNN), a Long Short-Term Memory (LSTM), or a model built with attention networks, such as a transformer, a Bidirectional Encoder Representations from Transformers (BERT), a Generative Pre-trained Transformer (GPT), a Contrastive Language-Image Pre-training (Clip), or a Large Language Model (LLM). This application does not limit the specific architecture. An attention network is a network model trained using an attention mechanism. This model assigns different weights to each part of the input sequence, thereby extracting more important feature information from the input sequence, resulting in a more accurate output.

[0020] The code file to be scanned is the code file output by the pre-trained model that needs to be security checked. After the system calls the pre-trained model to obtain the code, it loads the corresponding file, reads the source code text into memory, and obtains the programming language and path information of the file for subsequent analysis.

[0021] S12: Match the file features of the code file to be scanned with the corresponding target scanning skills according to the security detection rules to determine the corresponding error-prone pattern density; wherein, the security detection rules are determined by the semantic features of the abstract syntax tree.

[0022] File features are the characteristics of the code file to be scanned that can be used for rule filtering and detection, including programming language, code structure, and the content represented by nodes. An Abstract Syntax Tree (AST) is a tree-like representation formed after parsing the source code according to its syntactic structure, where nodes correspond to specific syntactic components in the code, and node values ​​reflect the specific content of that syntactic component. Semantic features of an AST are the node and structural features that can reflect the meaning of code operations, such as string literals, related calls, or framework definition features.

[0023] Security detection rules are matching criteria determined based on the aforementioned semantic features, used to identify security patterns in the code that require attention. A scanning skill is a modular, reusable capability unit formed by encapsulating the methods, execution logic, and related resources of a specific detection task. A target scanning skill is the selected scanning skill that matches the current file. Scanning skills may have information such as a unique identifier, applicable language, detection method, matching pattern, and risk weight. By mapping security detection rules to the feature fingerprints of abstract syntax tree nodes, detection can be performed based on the code structure. Regular expressions can be further used for matching node content. Related technologies use text and regular expressions; this application uses an abstract syntax tree and regular expressions.

[0024] Regarding security detection rules, a pre-defined hardcoded_api_key detection rule can be loaded. This rule defines the following characteristics: a unique identifier is hardcoded_api_key; the applicable language of the corresponding code; the detection method is specified as abstract syntax tree literal detection (ast_literal); the matching pattern is defined as a regular expression pattern, such as sk-[a-zA-Z0]{20,}, used to match string structures that start with sk- followed by at least 20 letters or numbers; and the risk weight, set to a weight value of 1.0, representing a high error frequency of this pattern in the LLM-generated code.

[0025] Error-prone patterns are typical risk patterns that need to be detected in the code generated by the pre-trained model, including hard-coded keys, structured query language concatenation, command injection, and deserialization. Error-prone pattern density is a quantitative result of the concentration of each pattern by combining the number of hits, risk weights, and lines of code. The system identifies relevant patterns in the current code through pre-set scanning skills and represents the error-prone pattern density with a weighted number of hits per hundred lines, rather than judging its risk solely by the length of the code.

[0026] S13: Perform semantic analysis based on the framework features, user input processing features, and data processing operation features of the code file to be scanned to obtain the semantic file type score corresponding to the code file to be scanned.

[0027] Framework characteristics refer to the features in the code that reflect the framework used and the application's entry point. Examples include Flask route annotations, Django view classes or functions, and Spring Boot controller annotations. Flask route annotations map routes, binding Uniform Resource Locators (URLs) to functions. Django view classes or functions are logical units that handle requests and return responses. Spring Boot controllers are components responsible for receiving requests, invoking business logic, and returning responses. User input handling characteristics refer to the code's direct acquisition of external input, such as reading Hypertext Transfer Protocol (HTTP) request bodies, Lightweight Data Interchange (JavaScript Object Notation) data, or URL parameters. Data processing operation characteristics refer to the code's performance on corresponding data, including sensitive data processing such as password or token verification, and database operations such as database queries.

[0028] Semantic analysis is the process of identifying and quantifying the above content using predefined security semantic scanning skills. The semantic file type score reflects the actual function and sensitivity of the code file, rather than simply classifying files based on their extensions. After identifying the framework entry point, external input processing, and data operations, the system scores them according to their respective weights, and then uses a normalization function to obtain the semantic file type score, denoted as Stype.

[0029] Regarding semantic analysis, it can be based on positive weights corresponding to these three features, or negative weights can be added to obtain a comprehensive semantic file type score.

[0030] S14: Determine the corresponding dynamic business score based on the path context information of the code file to be scanned.

[0031] Path context information refers to the path of the code file to be scanned within the project, along with the directory attributes and business location reflected by that path. The dynamic business score, denoted as Scontext, is a score derived from the business context of the current file and reflects its relevance to core business logic or sensitive information. "Dynamic" here means that the score is determined based on the current file's context; the evaluation result can change depending on the file's business location.

[0032] Specifically, the system uses path scanning skills to match file paths, identifying core business directories such as payment, authentication, or interface layers, as well as configuration, environment, and confidential information directories, and test, simulation, and example directories. Positive weighting is applied to core business and configuration paths, while negative weighting is applied to test or example paths, resulting in a dynamic business score. The deduction for test or example paths is a correction to the business context and does not replace the detection of actual risk patterns in their code content.

[0033] In some implementations, context analysis also includes entry-level scanning and data-level scanning skills. Entry-level scanning skills match framework annotations or route definitions using an abstract syntax tree, while data-level scanning skills identify keywords or sensitive patterns, such as private key and ID card related patterns.

[0034] S15: Determine the security level of the code file to be scanned based on the error-prone pattern density, semantic file type score, and dynamic business score, and perform scanning processing according to the corresponding scanning strategy.

[0035] The security level is a risk classification result determined based on the density of error-prone patterns, semantic file type score, and dynamic business score. The scanning strategy is the scanning process arrangement corresponding to this level, reflecting the scanning scope, scanning depth, rule set used, and the degree of model involvement. Static Application Security Testing (SAST) examines the corresponding code without executing the application. This step selects the appropriate strategy based on the security level and calls the corresponding tools to complete the scanning process.

[0036] Specifically, the system fuses the error-prone pattern density (Spattern), semantic file type score (Stype), and dynamic business score (Scontext) with configurable weights to obtain a security criticality score (SecurityScore), and determines the security level based on the score's range. Spattern checks for errors in the code, such as directly including passwords. Stype determines the function of the code, such as whether it's a web page entry or a regular utility function. Scontext considers the file's origin, whether it's a sensitive data path or a relatively secure test path. The final output security score (SecurityScore) is used to drive the on-demand dynamic scheduling of the SAST tool.

[0037] It should be noted that in this embodiment, steps S12, S13 and S14 are not in any particular order; they can be performed sequentially, non-sequentially, or simultaneously.

[0038] This application utilizes a pre-trained model to output code files to be scanned. Based on security detection rules determined by the semantic features of an abstract syntax tree, the file features of the code files are matched with corresponding target scanning skills, and the density of corresponding error-prone patterns is determined. This allows for the identification of error-prone patterns matching the security detection rules based on the semantic features of the code itself. The error-prone pattern density reflects the concentration of error-prone patterns in the scanned code files, thus providing a basis for distinguishing the security risks of different scanned code files. Semantic analysis is performed based on the framework features, user input processing features, and data processing operation features of the scanned code files to obtain corresponding semantic file type scores. This reflects the functional semantics of the scanned code files from the aspects of the framework, user input processing, and data processing operations embodied in the code, enabling the security risk assessment of code files to not only depend on the occurrence of error-prone patterns but also to differentiate based on the functional semantics of the code files themselves. A dynamic business score is determined based on the path context information of the scanned code files. This utilizes the path context of the code files to reflect their business relevance, supplementing the security risk assessment based on code content with a business dimension. Furthermore, the security level of the code file to be scanned is determined based on the error-prone pattern density, semantic file type score, and dynamic business score. This allows the error-prone patterns, the functional semantics of the code itself, and the business context within the code file to be reflected in the security level, enabling different code files to be scanned to form corresponding security levels based on their own security risks. Then, scanning is performed according to the corresponding scanning strategy based on the security level, ensuring that the scanning process corresponds to the security level of the code file being scanned, and avoiding the use of the same scanning method for code files with different security risks.

[0039] Because the security risks of different code files can be distinguished based on their own error-prone patterns, functional semantics, and the business context reflected in the paths before the scanning process is performed, and the subsequent scanning process is made to correspond to the distinguished security level, without having to perform indiscriminate scanning of code files with different security risks generated by the pre-trained model, it can solve the technical problem in related technologies that result in high computational resource consumption and long scanning time due to indiscriminate security scanning of code generated by pre-trained models. It achieves the technical effects of improving the targeting of code file security scanning, reducing unnecessary scanning processes, reducing computational resource consumption, and shortening scanning time.

[0040] In some embodiments, the file characteristics of the code file to be scanned are matched with corresponding target scanning skills according to security detection rules to determine the corresponding error-prone pattern density, including: Extract the file type and / or code characteristics of the code file to be scanned; The file type and / or code characteristics are filtered against the skill filtering conditions corresponding to multiple preset scanning skill libraries to obtain at least one target scanning skill library that matches the code file to be scanned. The target scanning skill library is invoked to perform syntax parsing on the code file to be scanned, resulting in an abstract syntax tree; Pattern matching is performed between the node values ​​corresponding to the abstract syntax tree and the preset matching rules corresponding to the target scanning skill library to determine the rule hit information; The density of error-prone patterns corresponding to the target scanning skills in the target scanning skill library is determined based on the rule hit information.

[0041] Specifically, file type refers to type information used to determine whether a detection skill is applicable, such as the programming language used in the source code. Code features are structural or content characteristics that can be identified from the code content. Skill selection criteria are applicable conditions pre-configured for the scanning skill library. The target scanning skill library is the set of skills that meet the current file selection criteria. This file type is used to select applicable skills and has a different role from the semantic file type score used to evaluate functional sensitivity.

[0042] The system extracts the file type and / or code features of the code file to be scanned and compares them with the skill selection criteria of multiple preset scanning skill libraries to obtain at least one target scanning skill library. For example, after reading the source code of a preset code language, skills applicable to that preset code language are selected. Multiple preset scanning skill libraries may include a Pattern Skill library for detecting error-prone patterns, a Type Skill library for identifying functional semantics, and a ContextSkill library for analyzing business context. They may also include other skill libraries, with each skill participating in the corresponding analysis according to its own detection task and applicable conditions.

[0043] Subsequently, the parsing capabilities corresponding to the target scanning skill library are invoked to parse the code file to be scanned into an abstract syntax tree, obtain the node values ​​corresponding to the detection task, and perform pattern matching with preset matching rules. The preset matching rules are the judgment conditions pre-saved in the skills, and the rule hit information records whether the rule matched successfully and its hit status. For multiple selected skills, they can be analyzed in parallel according to their respective abstract syntax tree patterns or keyword detection methods to form the hit results for each skill. The hit results used for error-prone pattern detection are then used for density calculation.

[0044] The specific steps are as follows: First, load the code file to be scanned generated by the pre-trained model. This requires the path to the source code file to be analyzed as input. The processing involves reading the file content into memory, and the output includes variables from the source code file. Next, filter for applicable skill libraries. The input is the source code text and programming language type. The processing involves filtering all skills applicable to the programming language from a predefined skill library, and the output is a list of skills matching the source code language, serving as rule hit information. Finally, the error-prone pattern density is determined based on the rule hit information.

[0045] This embodiment provides a method to match the file type and / or code characteristics of the code file to be scanned with skill screening criteria, thereby filtering out the target scanning skill library suitable for the code file to be scanned and reducing the processing overhead caused by calling inapplicable scanning skills. By parsing the syntax of the code file to be scanned and performing pattern matching between the node values ​​of the abstract syntax tree and preset matching rules, the rule matching is based on the code syntax structure, improving the targeting of error-prone pattern identification. Determining the error-prone pattern density based on the rule hit information can transform the error-prone patterns identified in the code into quantitative evidence for security risk assessment, thereby supporting the subsequent determination of security level and selection of scanning strategy, and improving the accuracy of scanning.

[0046] In some embodiments, determining the error-prone pattern density corresponding to the target scanning skill in the target scanning skill library based on rule hit information includes: Based on the rule hit information, determine the number of hits corresponding to each target scanning skill in the target scanning skill library; The weighted total number of hits is determined based on the number of hits of each target scanning skill and the risk weight corresponding to each target scanning skill; Based on the number of lines of code in the code file to be scanned and the preset number of lines of code, the weighted hit count for each interval of lines of code is determined as the error-prone pattern density.

[0047] Specifically, the hit count is the number of times the target scanning skill successfully matches within the current file. The risk weight is a numerical value used to reflect the degree of risk concern associated with the corresponding error-prone pattern. The weighted total hit count is the sum of the hit counts of each skill multiplied by its risk weight. The preset code line count is the number of lines of code used for density conversion; for example, in this embodiment, it is 100 lines.

[0048] Based on the rule-based hit information, obtain the hit count hi and risk weight ri for the i-th target scanning skill, and calculate the weighted total hit count H, with the calculation relationship H = Σ(hi × ri). For example, for the hard-coded key detection skill, its hit contribution can be accumulated with a risk weight of 1.0. After recording the results for each skill separately, they are then aggregated into the same code file to be scanned, avoiding the mixing of hit results from different files in the calculation.

[0049] After obtaining the current file's line count L, it is calculated per 100 lines of code, with the formula: Pattern = H ÷ (L ÷ 100). If the number of lines of code is less than 100, it is calculated as 100 lines, and the denominator is at least 1. Therefore, the error-prone pattern density represents the weighted hit count corresponding to each preset number of lines of code, rather than the total hit count without considering the code size.

[0050] The various skills in the filtered skill library are executed in parallel. The input is the source code text and the filtered skill list. The processing is to scan the code concurrently for each skill according to its type, such as abstract syntax tree pattern, keyword search, etc. Each time a match is found, the corresponding hit count is recorded and multiplied by the weight of the skill. Finally, the weighted hit count list of each skill is output.

[0051] This embodiment combines the hit count of each target scanning skill with its corresponding risk weight, enabling the weighted hit count to simultaneously reflect the frequency of occurrence of error-prone patterns and their risk differences. This reduces the bias caused by treating different error-prone patterns equally when evaluating solely based on the hit count. Determining the weighted hit count at each interval of code lines based on the code line count and a preset code line count reduces the impact of file size differences on the evaluation results, allowing for the comparison of the concentration of error-prone patterns in scanned code files of different sizes using a uniform code line count scale.

[0052] In some embodiments, after calling the target scanning skill library to perform syntax parsing on the code file to be scanned and obtaining an abstract syntax tree, the method further includes: Traverse the abstract syntax tree to filter out string literal nodes; The node value corresponding to the string literal node is matched with the preset matching rules corresponding to the target scanning skill library to determine the rule hit information.

[0053] Specifically, a string literal node is a node in the abstract syntax tree that represents a string constant specified in the code, and the node value is the actual content of that string. The system first parses and traverses the abstract syntax tree, filters string literal nodes, and then executes a preset matching rule on the filtered node values.

[0054] In the AST structure, the system automatically traverses all nodes and filters out nodes of type StringLiteral. For each filtered StringLiteral node, the system executes the following judgment logic to extract the node's value. The extracted value is then matched against the regular expression sk-[a-zA-Z0-9]{20,} defined in the rules to identify string structures that begin with sk- and are followed by at least 20 letters or numbers. String literals are the logical node category, and their specific representation is determined by the parser used.

[0055] The system extracts the Value for each selected string literal node and compares this value with the matching pattern described above. If a match is successful, the system records the corresponding rule hit and increments the hit count for that rule. After traversing all nodes, a weighted statistical process is performed on the hit count. This process uses an abstract syntax tree to filter the detection objects and then performs pattern matching on the node content, achieving continuous processing from code parsing and node filtering to hit counting and density output.

[0056] Figure 2 A flowchart for determining the density of error-prone patterns is provided for an embodiment of this application, as follows: Figure 2 As shown, the method includes: S21: Load the code file to be scanned; S22: Select the applicable target scanning skill set; S23: Perform parallel scanning of the skill library for each target; S24: Calculate the weighted total number of hits; S25: Normalized to density per hundred rows, used as the density of error-prone patterns.

[0057] This embodiment limits the types of nodes examined, enabling string content detection to be based on syntax parsing results and thus locating key patterns appearing as string literals. This hit result is used to characterize corresponding risk clues and provide a basis for subsequent scanning, rather than replacing the confirmation of actual vulnerability validity with a single pattern hit.

[0058] In some embodiments, semantic analysis is performed based on the framework features, user input processing features, and data processing operation features of the code file to be scanned to obtain a semantic file type score corresponding to the code file to be scanned, including: For each of the frame features, user input processing features, and data processing operation features of the code file to be scanned, corresponding weight parameters are assigned to perform positive semantic analysis, resulting in frame feature scores, user input processing feature scores, and data processing feature scores. The positive semantic score is determined based on the frame feature score, user input processing feature score, and data processing feature score. The semantic file type score is obtained by mapping the positive semantic score using a normalization function.

[0059] Specifically, the weight parameter is the score contribution value set for the corresponding code feature. Positive semantic analysis is an analysis method that identifies features that can improve the sensitivity of file functionality, assigns them corresponding positive weight parameters, and accumulates the corresponding scores. The frame feature score, user input processing feature score, and data processing feature score reflect the contributions of the three dimensions, respectively, while the positive semantic score is the raw score obtained by summing up these contributions.

[0060] In terms of framework features, the system identifies the routing or controller definition patterns of specific web frameworks, such as Flask's @app.route, Django's view classes or functions, and Spring Boot's @RestController. When a match is found, a weight of 0.90 can be assigned to accurately locate the entry point of the web application and identify the application entry point.

[0061] In terms of user input processing features, the system detects whether the code directly reads the HTTP request body, JSON data, or URL parameters. For example, matching request.json and req.body can assign a weight of 0.85 when a match is found, marking that the file involves external user input to reflect external user input processing.

[0062] In the data processing operation feature dimension, sensitive data processing and database operations are identified and weighted accordingly. Each feature dimension is assigned a corresponding positive weight (i.e., a positive number). The positive weights for each feature dimension are then summed to obtain the corresponding feature scores, resulting in a positive semantic score.

[0063] The original semantic score is non-linearly normalized using the Sigmoid function, mapping it to the standard interval [0, 1] to obtain the final semantic file type score Stype.

[0064] For example, the code contains `@app.route` and `db.query`, with weights of 0.90 and 0.75 respectively. Considering only the positive hits mentioned above, the positive semantic score is 1.65. Substituting these into the Sigmoid function yields the corresponding semantic file type score.

[0065] This embodiment assigns corresponding weight parameters to framework features, user input processing features, and data processing operation features, allowing the impact of different functional semantic features on security risks to be reflected in their respective feature scores. The positive semantic score comprehensively reflects the application entry point, external input processing, and data operations involved in the code file, providing a code content-based basis for evaluating semantically typed files. Mapping the positive semantic score using a normalization function converts scores from different feature combinations to a unified numerical range, facilitating subsequent fusion with error-prone pattern density and dynamic business scores, and improving the processability of each scoring parameter during comprehensive evaluation.

[0066] In some embodiments, data processing operation features of the code file to be scanned are assigned corresponding weight parameters for positive semantic analysis to obtain data processing feature scores, including: Obtain the sensitive data processing features and database operation features corresponding to the data processing operation features of the code file to be scanned; wherein, the sensitive data processing features include at least preset sensitive data keywords and / or preset sensitive data processing interfaces; Sensitive data processing features and database operation features are assigned their respective weight parameters to obtain data processing feature scores.

[0067] Specifically, sensitive data processing characteristics are code features that reflect sensitive processing logic such as password processing and token verification. Preset sensitive data keywords are pre-defined keywords used to identify relevant logic. Preset sensitive data processing interfaces are interface calls used to match relevant processing functions. Database operation characteristics are the features of code accessing the database and performing corresponding operations, such as database query statements.

[0068] The system identifies keywords such as "password" and "secret" from the code files to be scanned, and / or identifies specific interface calls such as "jwt.decode" to determine sensitive data processing characteristics, assigning a high-risk weight of 0.95. For database query characteristics such as "db.query," the system assigns a base weight of 0.75 to reflect the semantic contribution of regular database operations. Keywords and interface calls can be used as two types of identification criteria, with the corresponding characteristics determined based on the actual hit rate of the rules.

[0069] Subsequently, the weighted contributions of the sensitive data processing features and database operation features are used to determine the data processing feature score, which, together with the framework feature score and the user input processing feature score, forms a positive semantic score. This score indicates that the code involves corresponding sensitive processing or database operations, but it does not equate to the conclusion that these legitimate interfaces themselves are vulnerable.

[0070] This embodiment provides a method for identifying sensitive data processing characteristics by pre-setting sensitive data keywords and / or pre-setting sensitive data processing interfaces. This method can identify sensitive data processing behaviors such as password processing and token verification from data identifiers and interface call information in the code. By assigning corresponding weight parameters to sensitive data processing characteristics and database operation characteristics, the data processing characteristic scores can reflect the risk differences of different data processing behaviors, thereby enhancing the ability to distinguish code files involving sensitive data processing.

[0071] In some embodiments, after determining the positive semantic score based on the frame feature score, the user input processing feature score, and the data processing feature score, the method further includes: If the code file to be scanned does not contain network requests, database interactions, or system command calls, then the code file to be scanned is determined to be the code file corresponding to the utility function. Assign negative weight parameters to the code files corresponding to the utility functions; The actual semantic score is determined based on the positive semantic score and the negative weight parameter; The semantic file type score is obtained by mapping the actual semantic score using a normalization function.

[0072] Specifically, the code file corresponding to the utility function is the file determined when the current file does not contain network requests, database interactions, or system command calls. The negative weight parameter is a negative value used to reduce the original semantic score of this type of file. The actual semantic score is the score obtained by combining this negative weight parameter with the positive semantic score.

[0073] After obtaining the positive semantic score, a negative weight parameter is introduced to reduce the false positive rate. The system detects whether the current file contains network requests, database interactions, and system command calls, such as identifying features related to request, database, operating system, and subprocess. If none of these three types of operations are present, the file is determined to be the code file corresponding to the utility function, and a negative weight parameter of -0.40 can be assigned. This negative weight parameter is added to the positive semantic score to form the actual semantic score, and then the actual semantic score is substituted into the Sigmoid function to obtain Stype, thereby effectively reducing the overall sensitivity of this type of file in the comprehensive score. If the above conditions are not met, the entire file is not assigned a negative weight according to this embodiment.

[0074] Negative Skills can also identify features such as utility functions, operations without input / output, or test code to adjust the sensitivity of the corresponding analysis object. For example, the sum of positive weights 0.90 and 0.75 is 1.65. If the corresponding analysis object also meets the applicable negative rules for utility functions, then adding -0.40 results in an actual semantic score of 1.25, which is approximately 0.78 after Sigmoid function mapping. This calculation reflects the combination of positive and negative contributions. For a complete file containing db.query, if the premise of not containing database interaction in this embodiment is not met, the negative judgment of the entire file cannot be applied simply because it also contains utility functions.

[0075] This embodiment reduces the functional sensitivity evaluation of pure utility function files by clearly defining the triggering conditions for negative correction, thereby reducing the over-scanning of such files.

[0076] In some embodiments, determining the corresponding dynamic business score based on the path context information of the code file to be scanned includes: Obtain the path matching rules corresponding to each of the pre-set core business directories, configuration directories, and test and / or example directories; The path of the code file to be scanned is matched with the path matching rules. If the core business directory is hit in the path, the corresponding first positive weight parameter is assigned to the hit target core directory. If a configuration directory is hit in the path, the corresponding second positive weight parameter is assigned to the hit target configuration directory; If the path hits the test directory or the example directory, then the target test directory or the target example directory is assigned the corresponding first negative weight parameter. The dynamic business score is determined based on the first positive weight parameter, the second positive weight parameter, and the first negative weight parameter.

[0077] Specifically, the core business directory reflects core business functions such as payment, authentication, or the interface layer. The configuration directory reflects configuration, environment, or security information. The test and example directories are used for testing, simulation, or sample code. The path matching rules are pre-configured matching conditions for the above directories and can use regular expressions. The target directory is the directory that the current file path actually matches.

[0078] The system obtains the path matching rules corresponding to each directory and matches the relative paths of the code files to be scanned against the rules. When the path matches the core business directories such as payment / checkout, auth / login, and api_v1, a first positive weight parameter of 0.90, 0.88, and 0.80 can be assigned respectively. The first positive weight parameter is used to reflect the scoring contribution of different core business directories, rather than using the same value for all directories.

[0079] When a path contains configuration directories such as / config / , / env / , or / secret / , a second positive weight parameter is assigned based on the target configuration directory that was hit, reflecting the business risk that the corresponding path may involve sensitive information. When a path contains test, simulation, or example directories such as / test / , / mock / , or / example / , a first negative weight parameter is assigned to deduct points. The system summarizes the actual hit first positive weight parameter, second positive weight parameter, and first negative weight parameter to determine the dynamic business score. Each parameter participates in the calculation based on the actual hit situation; directories that were not hit are not included in the parameter calculation.

[0080] This embodiment provides a method to match the path of the code file to be scanned with the path matching rules corresponding to the core business directory, configuration directory, and test directory and / or example directory. This allows the directory affiliation of the file in the project to be transformed into business context information. By assigning positive weight parameters to the matched core business directory and configuration directory, and negative weight parameters to the matched test directory or example directory, the dynamic business score can reflect the business importance and risk tendency corresponding to different directory affiliations. This supplements the code content analysis results with a business dimension, enabling files with similar code content but different business uses to obtain differentiated risk assessments, and improving the targeting of subsequent scanning resource allocation.

[0081] In some embodiments, the security level of the code file to be scanned is determined based on the error-prone pattern density, semantic file type score, and dynamic business score, and scanning processing is performed according to the corresponding scanning strategy, including: The error-prone pattern density, semantic file type score, and dynamic business score are each assigned their own weight parameters to determine the security criticality score. If the safety criticality score is greater than or equal to the first preset score, it is determined to be the first security level, and a full scan scanning strategy is executed accordingly. If the safety criticality score is greater than or equal to the second preset score and less than the first preset score, it is determined to be the second security level, and the corresponding scanning strategy of lightweight rule set scanning is executed for scanning. If the safety criticality score is less than the second preset score, it is determined to be the third security level, and a simplified check is performed and scanning is prohibited; wherein, the security of the first security level is lower than that of the second security level, and the security of the second security level is lower than that of the third security level.

[0082] Specifically, the safety criticality score is the result of weighted fusion of three dimensions; the first and second preset scores are the scoring boundaries used to divide the levels, with the first preset score being greater than the second preset score. The first, second, and third safety levels correspond to different levels of safety concern and scanning requirements, respectively.

[0083] Assign fusion weights w1, w2, and w3 to Pattern, Stype, and Scontext respectively, and calculate the security criticality score using the formula: SecurityScore = w1 × Pattern + w2 × Stype + w3 × Scontext. In one example, w1 = 0.40, w2 = 0.35, and w3 = 0.25, meaning the error-prone pattern density accounts for 40%, semantic file type score accounts for 35%, and dynamic business score accounts for 25%. These weights are configurable and are used to differentiate the contributions of the three dimensions to the overall evaluation. The allocation of each weight can be set according to the actual situation and will not be elaborated here.

[0084] When the SecurityScore is greater than or equal to the first preset score, it is determined to be at the first security level and a full scan is performed. In the example where the first preset score is 0.7, files with a score of 0.7 are processed in the high-risk module, where a full deep scan can be enabled, and a large language model participates in vulnerability remediation and interpretation, allowing higher-risk files to receive corresponding analysis depth.

[0085] When the SecurityScore is greater than or equal to the second preset score and less than the first preset score, it is determined to be at the second security level and a lightweight rule set scan is performed. For example, when the second preset score is 0.3, for files with a SecurityScore of 0.3 ≤ SecurityScore < 0.7, only key and structured query language injection rules can be checked, and the large language model can be called only when fuzzy arbitration is needed. The lightweight rule set is a set of detection rules with a reduced scope compared to the full set of rules, and fuzzy arbitration is for further analysis of hit results that are difficult to determine directly.

[0086] When the SecurityScore is less than the second preset score, it is determined to be at the third security level, and a simplified check is performed while scanning is prohibited. In this embodiment, the simplified check is retained as the processing for this branch, and prohibiting scanning corresponds to not entering the above-mentioned full scan or lightweight rule set scan process. Combined with model resource control, this branch disables large language models for scanning analysis. The evaluation results of low-risk files can be recorded and the current scheduling can be ended to reduce lexical overhead.

[0087] Figure 3 A flowchart of another method for scanning code files to be scanned is provided for embodiments of this application, such as... Figure 3 As shown, the steps include: S31: Load the code file to be scanned; S32: Analyze each generated code file to be scanned; S33: Statistical analysis of the frequency of error-prone patterns; S34: Normalized to the weighted hit count per 100 rows; S35: Output error-prone pattern density; S36: Obtain the framework features, user input processing features, and data processing operation features of the code file to be scanned; S37: Assign corresponding weight parameters to the framework features, user input processing features, and data processing operation features of the code file to be scanned; S38: Output positive semantic score; S39: Match the path of the code file to be scanned with each path matching rule; S40: Assign corresponding weight parameters to the matched core business directory, configuration directory, test directory, or sample directory; S41: Output dynamic service score; S42: Determine the security level of the code file to be scanned and perform scanning processing according to the corresponding scanning strategy.

[0088] This embodiment provides a weighted processing method for error-prone pattern density, semantic file type score, and dynamic business score, enabling the security criticality score to comprehensively reflect the concentration of error-prone patterns, code functional semantics, and business context, reducing the limitations of determining scan intensity based on only a single dimension. By using a first preset score and a second preset score to classify security levels and corresponding to full scan, lightweight rule set scan, and simplified inspection and scan prohibition processing methods, the scan scope and processing intensity can be configured differently according to the security level. This allows for more sufficient scanning processing to be used for high-security-level files, reducing unnecessary scanning overhead for medium and low-security-level files, and reducing overall computing resource consumption and scanning time.

[0089] In some embodiments, during the scanning process, the method further includes: In the process of executing a scanning strategy on a code file to be scanned, at least one scanning tool used to execute the scanning strategy and at least one target scanning skill invoked are obtained, and the tool computation cost corresponding to at least one scanning tool and the lexical cost corresponding to at least one target scanning skill are determined respectively. The total execution cost of the scanning strategy is determined based on the tool computation cost of at least one scanning tool and the lexical cost of at least one target scanning skill. The tool's computational cost is determined by the historical running data of the scanning tool and the running time of the preset benchmark task, while the lexical cost is determined by the number of target scanning skills hit and the average lexical cost corresponding to each target scanning skill.

[0090] Specifically, the scanning tool is a static detection tool that executes the scanning strategy. The tool's computational cost is the resource consumption value calculated based on the tool's historical execution data and the time consumed by a preset baseline task. The lexical cost is the value calculated based on the lexical overhead required for the model to participate in the target scanning skill analysis. The total execution cost is the sum of the tool's computational cost and the lexical cost after placing them on a comparable scale.

[0091] Obtain at least one scanning tool used by the current strategy and the target scanning skill invoked. Compare the time required for each tool to execute the equivalent benchmark task based on historical execution data. Use the time taken by the heavyweight tool SonarQube to scan the benchmark code, corresponding to a cost of 1.0, as the baseline. The cost of the lightweight tool Semgrep can be proportionally reduced to the actual time taken for the equivalent task, for example, 0.05. Historical execution data reflects the consumption of computing resources such as processor and memory used by the tools to perform the scan, and the benchmark task provides consistent comparison conditions.

[0092] For model lexical cost, the system pre-calculates the average empirical value of lexical units required for analysis of each semantic feature probe, and estimates the total number of lexical units based on the number of target scanning skills hit. When a uniform empirical value is used for the average cost per skill, the estimated number of lexical units = total number of target scanning skills hit × average lexical unit cost per skill; when the average cost of each skill is recorded separately, it is summarized based on the empirical cost corresponding to each hit skill. The number of hit skills is used for cost estimation, which is different from the statistics of the number of times the same skill is hit multiple times in a file in the above embodiment.

[0093] The estimated number of lexical units is converted into cost units according to a preset ratio, for example, 1000 lexical units correspond to 1.0 cost unit. Then, the calculation cost of the scanning tool used is added to the cost of the lexical units to obtain the total execution cost, which is used for cost evaluation in subsequent candidate task scheduling.

[0094] This embodiment provides a method for determining tool computational costs based on historical operational data and the execution time of preset benchmark tasks, enabling a comparable evaluation basis for the computational resource overhead of different scanning tools. By determining lexical costs based on the number of target scanning skills hit and their average lexical cost, the lexical cost can be adjusted according to the actual number of target scanning skills hit, reflecting the model call overhead corresponding to different code files and scanning strategies. Including both tool computational costs and lexical costs in the total execution cost reduces cost evaluation bias caused by omitting either type of resource overhead, providing a basis for subsequent resource scheduling based on scanning revenue.

[0095] In some embodiments, after determining the total execution cost corresponding to the scanning strategy, the method further includes: Obtain the security criticality score and the corresponding total execution cost for each code file to be scanned; The expected scanning benefits of executing a scanning strategy on the code files to be scanned are determined based on the security criticality score. The input-output ratio of the code file to be scanned is determined based on the expected scanning benefits and the total execution cost; whereby the expected scanning benefits are used to characterize the expected value of obtaining effective security detection results after executing the scanning strategy. The scanning priority of the code files to be scanned is determined based on the input-output ratio and the input-output ratio threshold, and then the scanning is scheduled.

[0096] Specifically, the expected scan benefit characterizes the anticipated value of obtaining effective security detection results after executing a scanning strategy. The security value derived from discovering dangerous vulnerabilities can be estimated using security criticality scoring. The return on investment (ROI) is the ratio of the expected scan benefit to the total execution cost. The ROI threshold serves as a boundary for prioritizing scheduling tasks, and scan scheduling priorities determine the order in which tasks receive scanning resources.

[0097] Obtain the security criticality score of each code file to be scanned and the total execution cost of its corresponding scanning strategy. Determine the expected scanning benefit B based on the score, and calculate ROI = B ÷ C when the total execution cost C is positive. A higher score indicates a higher level of scanning focus, while a lower cost indicates less investment required to complete the corresponding strategy. Therefore, when comparing candidate solutions, a higher ROI can be used to prioritize scanning tasks with higher expected value and lower cost.

[0098] In some embodiments, a mapping is used where SecurityScore = 0.85 corresponds to an expected return of 0.85, representing the expected value of detecting a critical vulnerability. When the score uses a probabilistic expression in the range of 0 to 1, it can be used as a probability estimate for detecting a critical vulnerability. This example does not imply that any value obtained by directly weighting the density of every hundred rows can be unconditionally used as a probability. For the score value used for grading, the expected return is still determined based on its mapping to the expected security detection value.

[0099] This embodiment determines the expected scanning benefit based on security criticality scores and the return on investment (ROI) by combining the total execution cost. This links the expected value of obtaining effective security detection results with the resource overhead required to achieve that value, allowing scanning tasks for different code files to be scanned to be compared based on the expected scanning benefit per unit of execution cost. Scanning scheduling priorities are determined based on the ROI and a threshold, ensuring that tasks with higher expected scanning benefits and lower execution costs receive priority access to scanning resources. This improves the rationality of resource allocation when scanning resources are limited, reducing excessive resource consumption by tasks with low expected benefits and high execution costs.

[0100] In some embodiments, the scanning scheduling priority of the code file to be scanned is determined based on the input-output ratio and an input-output ratio threshold, and the scheduling process is performed, including: Obtain a first input-output ratio threshold and a second input-output ratio threshold, wherein the first input-output ratio threshold is greater than the second input-output ratio threshold; If the input-output ratio is greater than or equal to the first input-output ratio threshold, the scanning scheduling priority corresponding to the code file to be scanned is determined as the first priority; If the input-output ratio is greater than or equal to the second input-output ratio threshold and less than the first input-output ratio threshold, the scanning scheduling priority corresponding to the code file to be scanned is determined to be the second priority. If the input-output ratio is less than the second input-output ratio threshold, the scanning scheduling priority corresponding to the code file to be scanned is determined to be the third priority.

[0101] Specifically, the input-output ratio (ROR) of the code file to be scanned is compared with the two thresholds mentioned above. When the ROR is greater than or equal to the first ROR threshold, it indicates that the expected scanning benefit per unit cost obtained by executing the corresponding scanning strategy is high. The scanning scheduling priority of this code file is then set to first priority, allowing for priority allocation of scanning resources and execution of the corresponding scanning task. When the ROR is greater than or equal to the second ROR threshold but less than the first ROR threshold, the scanning scheduling priority of this code file is set to second priority, and its scanning task is scheduled after the first priority scanning task. When the ROR is less than the second ROR threshold, it indicates that the expected scanning benefit per unit cost of the corresponding scanning strategy is low. The scanning scheduling priority of this code file is set to third priority, and its scanning task is scheduled after the second priority scanning task. Thus, scanning tasks with different scheduling priorities can be formed based on the ROR range to which each code file to be scanned belongs.

[0102] For example, for code files to be scanned with a high security criticality score and low total execution cost, their corresponding return on investment (ROI) is relatively high. When the first ROI threshold is reached, they can be prioritized as first-priority scan tasks. For code files to be scanned with a low security criticality score and high total execution cost, their corresponding ROI is relatively low. When the ROI falls below the second ROI threshold, they are scheduled as third-priority scan tasks. During dynamic scheduling, scanning schemes with low ROI can be downgraded or skipped based on scanning resource availability, allowing scanning resources to be prioritized for code files with higher expected scanning benefits per unit cost. It should be noted that the scan scheduling priority reflects the order of scheduling determined by the combined expected scanning benefits and total execution cost, while the security level of the file is determined by the security criticality score. These two factors respectively characterize the scheduling priority and the degree of security risk.

[0103] This embodiment divides the input-output ratio into three interconnected and non-overlapping intervals by setting different first and second input-output ratio thresholds. This allows each code file to be scanned to obtain a clear scan scheduling priority based on the comparison results, reducing boundary ambiguity in priority division. By assigning higher input-output ratios to higher scan scheduling priorities, scanning tasks that can bring higher expected security detection value per unit of execution cost are given priority in obtaining scanning resources. This integrates expected scanning benefits with tool computation costs and lexical costs into the scheduling order of scanning tasks, reducing resource crowding and execution blocking of high input-output ratio tasks by low input-output ratio tasks, improving the utilization efficiency of limited scanning resources and the expected security detection benefits per unit of resources.

[0104] In some embodiments, the scanning process corresponding to the scanning scheduling priority of multiple code files to be scanned includes: The scanning tasks corresponding to multiple code files to be scanned are sorted according to the scanning scheduling priority to obtain a scanning task sequence; Allocate scanning resources to each scanning task sequentially according to the scanning task sequence; The corresponding scanning strategy is determined based on the scanning scheduling priority of each scanning task. Obtain resource consumption information and scan results after each scan task is executed; The status of the corresponding scanning task is updated based on resource consumption information and scanning results, so as to adjust the scheduling order of subsequent scanning tasks according to the updated scanning task status.

[0105] Specifically, a scanning task is a processing unit that performs detection on a corresponding code file to be scanned according to a scanning strategy. The scanning task sequence is an arrangement of tasks ordered by priority. Scanning resources include the computational resources required by the execution tool and the lexical resources required for model analysis. Resource consumption information reflects the resource usage generated during actual task execution, and the scanning task status reflects the execution status of the task and its related results.

[0106] The scanning tasks are sorted according to the scanning scheduling priority of each file to obtain a scanning task sequence, and scanning resources are allocated to the tasks in sequence. Higher priority tasks are allocated resources first, and the corresponding scanning strategy is determined according to their security level and scheduling priority.

[0107] After task execution, the resource consumption information and scan results of the scanning tools and models are obtained, and the status of the corresponding scanning tasks is updated. The scan results reflect whether the corresponding risks were detected, and the resource consumption information reflects the actual input of implementing the strategy. The scheduling order of tasks that have not yet been executed is adjusted according to the updated status, so that subsequent allocation can take into account the consumption and detection status of completed tasks, rather than remaining unchanged after the task sequence is generated.

[0108] This embodiment sorts multiple scanning tasks according to their scanning scheduling priority, allocates scanning resources sequentially, and determines corresponding scanning strategies. This ensures that scanning scheduling priority is reflected in the task execution order, resource allocation, and scanning processing method, allowing higher-priority tasks to receive priority scanning processing. The task status is updated based on resource consumption information and scanning results after task execution, and the scheduling order of subsequent scanning tasks is adjusted accordingly. This allows the scheduling process to respond to actual execution conditions, reducing resource allocation incompatibility caused by consistently using the initial sorting, thereby improving the flexibility of resource utilization and task scheduling during the continuous execution of multiple scanning tasks.

[0109] In some embodiments, the method further includes: Obtain the actual scan results corresponding to the code file to be scanned after the scan is performed; If a pre-defined level of dangerous vulnerability is detected in the actual scan results and the dangerous vulnerability is confirmed to be effective, the code file to be scanned will be identified as a positive feedback sample, and the security criticality score of the code file to be scanned will be positively corrected according to the vulnerability characteristics corresponding to the dangerous vulnerability. The security level and return on investment of the code file to be scanned are updated based on the positively corrected security criticality score, and the subsequent scanning strategy and scheduling priority of the code file to be scanned are adjusted based on the updated security level and return on investment.

[0110] Specifically, a pre-defined level of danger vulnerability refers to a vulnerability that reaches a pre-set level of concern. Confirmation of validity indicates that the corresponding detection result has been verified as a real vulnerability. A positive feedback sample is a document that meets this condition and is used to increase the subsequent level of risk concern. Positive remediation is the process of increasing the security criticality score of the document based on the confirmed vulnerability characteristics.

[0111] The system acquires scan results, and when a dangerous vulnerability is detected and confirmed to be valid, the corresponding file is designated as a positive feedback sample, and its security criticality score is increased. For example, the score is increased by 0.15, with the revised maximum score being 1.0. Simultaneously, the weight of relevant error-prone patterns can be enhanced based on the characteristics corresponding to the confirmed vulnerability; for example, the risk weight of the os.system pattern can be increased, ensuring that subsequent identification of similar risks reflects actual detection feedback.

[0112] The security level of a file is reassessed based on the positively revised score, and this score is used to update the expected scanning benefits. The ROI is then updated in conjunction with the corresponding total execution cost, and the subsequent scanning strategy and scheduling priority for that file are adjusted accordingly. The vulnerability heatmap is updated incrementally, only updating the affected file nodes to avoid a full recalculation of all files due to feedback from a single file.

[0113] For dangerous vulnerabilities not identified during the static analysis phase but discovered during subsequent manual audits or runtime monitoring, the system can extract their vulnerability characteristics, generate new detection rules (scanning skills), and update the scanning skill library. These new rules are used for matching corresponding features in subsequent code files, enabling feedback to both correct the weights of existing risk patterns and supplement previously uncovered patterns.

[0114] This embodiment uses detected and confirmed valid vulnerability files as positive feedback samples to support the positive correction of security criticality scores, thereby reducing the interference of unconfirmed detection results on risk assessment. By positively correcting the security criticality score based on the vulnerability characteristics corresponding to the critical vulnerabilities, and combining this with updated security levels and return on investment, confirmed vulnerability information can be transmitted to the subsequent process of determining scanning strategies and scheduling priorities. This corrects the underestimation of the security risk of the file and improves the timeliness and targeting of allocating appropriate scanning intensity and resources to the file.

[0115] In some embodiments, the method further includes: Count the number of consecutive scans of the code file to be scanned, and obtain the vulnerability detection results corresponding to each scan; If the number of consecutive scans reaches the preset number and the vulnerability detection results of each scan do not detect vulnerabilities of the preset level or above, the code file to be scanned will be identified as a negative feedback sample, and the security criticality score of the code file to be scanned will be negatively corrected according to the preset correction range. The security level and return on investment of the code file to be scanned are updated based on the negatively corrected security criticality score, and the subsequent scanning strategy and scheduling priority of the code file to be scanned are adjusted based on the updated security level and return on investment.

[0116] Specifically, the number of consecutive scans refers to the number of times the same code file to be scanned is executed consecutively. The preset number of scans, denoted as N, is the number of times a negative feedback judgment is triggered. The negative feedback sample is a file that has been scanned consecutively to meet this condition and in which none of the scans detected vulnerabilities of a preset level or higher. The preset correction range is the value used to negatively adjust the score.

[0117] The system counts the number of consecutive scans of the same file and obtains the vulnerability detection results for each scan. When the number of consecutive scans reaches N, and no vulnerabilities of a preset level or higher are detected in any of the scans, the file is identified as a negative feedback sample. For example, if the scope of concern is set to medium-risk vulnerabilities, and no medium-risk vulnerabilities are found in N consecutive scans, the security criticality score is reduced by 0.05, and the lower limit of correction is set to 0.2 to avoid excessive reduction in the score.

[0118] After a score decreases, the corresponding security level and expected scanning benefits are updated, and the ROI is recalculated based on the corresponding total execution cost, thereby adjusting the subsequent scanning strategy and scheduling priority for the file. Negative feedback also uses incremental updates of the vulnerability heatmap, only processing affected file nodes. For files with frequent false positives, the feedback module can use the validity judgment of the results to form a basis for correction. Under the specific triggering method of this embodiment, the conditions of consecutive counts and each time no vulnerability of level above is detected must still be met; continuous feedback cannot be triggered based solely on a single undetected result.

[0119] This embodiment controls score reduction through continuous detection results and sets a lower limit for examples to reduce excessive scanning resources consumed by dangerous vulnerability files that have not been detected for a long time, while maintaining a certain level of security concern. Positive and negative feedback work together to adjust the risk assessment according to actual scan results, reduce false alarm interference, and reduce redundant calculations through incremental updates, supporting continuous optimization of security scanning capabilities.

[0120] Figure 4 A flowchart of a scheduling optimization process for a code file to be scanned, provided as an embodiment of this application, is shown below. Figure 4 As shown, it includes: S51: Obtain a safety criticality score; S52: Determine whether the safety criticality score is greater than the first preset score. If yes, proceed to step S53; otherwise, proceed to step S54. S53: Select the corresponding scanning strategy based on resource awareness; S54: Record only or perform a light inspection; S55: Execute static application security testing tools; S56: Determine whether a repair suggestion for scheduling the pre-trained model is needed; if yes, proceed to step S57; otherwise, proceed to step S58. S57: Obtain the total execution cost; S58: End this scheduling session; S59: If a dangerous vulnerability is found, perform a positive correction; if no dangerous vulnerability is found and there are no vulnerabilities for a long time, or if there are frequent false alarms, perform a negative correction; update the weight parameters corresponding to the error-prone pattern density. S60: End scheduling.

[0121] The suggested fix for step S56 is that, in the above embodiments of this application, when the SecurityScore is greater than or equal to the second preset score and less than the first preset score, the system determines the security level to be medium and performs a fuzzy mode under a lightweight rule set scan.

[0122] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0123] Embodiments of this application also provide a code file scanning device. Figure 5 This is a schematic diagram of the structure of a code file scanning device provided in an embodiment of this application, as shown below. Figure 5 As shown, the device includes: Module 11 is invoked to call the pre-trained model to output the code file to be scanned. The matching module 12 is used to match the file features of the code file to be scanned with the corresponding target scanning skills according to the security detection rules, so as to determine the corresponding error-prone pattern density; wherein, the security detection rules are determined by the semantic features of the abstract syntax tree; Analysis module 13 is used to perform semantic analysis based on the framework features, user input processing features and data processing operation features of the code file to be scanned, and to obtain the semantic file type score corresponding to the code file to be scanned. Module 14 is used to determine the corresponding dynamic business score based on the path context information of the code file to be scanned; The scanning module 15 is used to determine the security level of the code file to be scanned based on the error-prone pattern density, semantic file type score, and dynamic business score, and to perform scanning processing according to the corresponding scanning strategy.

[0124] For a description of the features in the embodiment corresponding to this device, please refer to the relevant description of the embodiment corresponding to the scanning method of the code file, which will not be repeated here.

[0125] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the above-described code file scanning method embodiments.

[0126] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described code file scanning method embodiments when it is run.

[0127] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0128] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described code file scanning method embodiments.

[0129] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described code file scanning method embodiments.

[0130] Any of the components, modules, units, parts, methods, and operations described herein can be implemented using software, firmware, hardware (e.g., fixed logic circuitry), manual processing, or any combination thereof. Alternatively or additionally, any functionality described herein can be executed at least in part by one or more hardware logic components, such as, but not limited to, a central processing unit (CPU), a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), an application-specific standard product (ASSP), a system-on-chip (SoC), a complex programmable logic device (CPLD), a microcontroller unit (MCU), etc. The terms "system," "computing device," or "apparatus" as used herein encompass various means, devices, and machines for processing data, including, for example, one or more programmable processors, computers, SoCs, or combinations thereof. The apparatus may also include code that creates an execution environment for the computer program in question, such as code constituting processor firmware, a protocol stack, a database management system, an operating system, a cross-platform runtime environment, a virtual machine, or a combination thereof. The aforementioned computer program (also known as a program, software, software application, application (App), script, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as a standalone program or as a module, component, subroutine, object, or other unit suitable for a computing environment.

[0131] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0132] The foregoing has provided a detailed description of a code file scanning method and electronic device provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A method for scanning code files, characterized in that, include: Call the pre-trained model to output the code file to be scanned; According to the security detection rules, the file features of the code file to be scanned are matched with the corresponding target scanning skills to determine the corresponding error-prone pattern density; wherein, the security detection rules are determined by the semantic features of the abstract syntax tree; Semantic analysis is performed on the framework features, user input processing features, and data processing operation features of the code file to be scanned to obtain the semantic file type score corresponding to the code file to be scanned. The corresponding dynamic business score is determined based on the path context information of the code file to be scanned. The security level of the code file to be scanned is determined based on the error-prone pattern density, semantic file type score, and dynamic business score, and then scanned according to the corresponding scanning strategy.

2. The method for scanning code files according to claim 1, characterized in that, According to security detection rules, the file characteristics of the code file to be scanned are matched with corresponding target scanning skills to determine the corresponding error-prone pattern density, including: Extract the file type and / or code features of the code file to be scanned; The file type and / or code characteristics are filtered against the skill filtering conditions corresponding to multiple preset scanning skill libraries to obtain at least one target scanning skill library that matches the code file to be scanned. The target scanning skill library is invoked to perform syntax parsing on the code file to be scanned, resulting in an abstract syntax tree; Pattern matching is performed between the node values ​​corresponding to the abstract syntax tree and the preset matching rules corresponding to the target scanning skill library to determine the rule hit information; The error-prone pattern density corresponding to the target scanning skill in the target scanning skill library is determined based on the rule hit information.

3. The code file scanning method according to claim 2, characterized in that, Determining the error-prone pattern density corresponding to the target scanning skill in the target scanning skill library based on the rule hit information includes: Based on the rule hit information, determine the number of hits corresponding to each target scanning skill in the target scanning skill library; The weighted total number of hits is determined based on the number of hits of each target scanning skill and the risk weight corresponding to each target scanning skill; Based on the number of lines of code in the code file to be scanned and the preset number of lines of code, a weighted hit count for each interval of lines of code is determined, which is used as the error-prone pattern density.

4. The method for scanning code files according to claim 2, characterized in that, After invoking the target scanning skill library to perform syntax parsing on the code file to be scanned and obtaining an abstract syntax tree, the method further includes: Traverse the abstract syntax tree to filter out string literal nodes; The node value corresponding to the string literal node is matched with the preset matching rule corresponding to the target scanning skill library to determine the rule hit information.

5. The method for scanning code files according to claim 1, characterized in that, Semantic analysis is performed based on the framework features, user input processing features, and data processing operation features of the code file to be scanned to obtain a semantic file type score corresponding to the code file to be scanned, including: The frame features, user input processing features, and data processing operation features of the code file to be scanned are assigned their respective weight parameters and positive semantic analysis is performed to obtain the frame feature score, user input processing feature score, and data processing feature score. A positive semantic score is determined based on the framework feature score, the user input processing feature score, and the data processing feature score; The semantic file type score is obtained by mapping the positive semantic score using a normalization function.

6. The method for scanning code files according to claim 5, characterized in that, The data processing operation features of the code file to be scanned are assigned corresponding weight parameters for positive semantic analysis to obtain the data processing feature scores, including: Obtain the sensitive data processing features and database operation features corresponding to the data processing operation features of the code file to be scanned; wherein, the sensitive data processing features include at least preset sensitive data keywords and / or preset sensitive data processing interfaces; The sensitive data processing features and the database operation features are each assigned their own corresponding weight parameters to obtain the data processing feature scores.

7. The method for scanning code files according to claim 5 or 6, characterized in that, After determining the positive semantic score based on the frame feature score, the user input processing feature score, and the data processing feature score, the method further includes: If the code file to be scanned does not contain network requests, database interactions, or system command calls, then the code file to be scanned is determined to be the code file corresponding to a utility function. Assign negative weight parameters to the code files corresponding to the aforementioned tool functions; The actual semantic score is determined based on the positive semantic score and the negative weight parameter; The semantic file type score is obtained by mapping the actual semantic score using a normalization function.

8. The method for scanning code files according to claim 1, characterized in that, The dynamic business score is determined based on the path context information of the code file to be scanned, including: Obtain the path matching rules corresponding to each of the pre-set core business directories, configuration directories, and test and / or example directories; The path of the code file to be scanned is matched with each of the path matching rules; If the core business directory is hit in the path, the target core directory is assigned a corresponding first positive weight parameter. If a configuration directory is hit in the path, the target configuration directory is assigned a corresponding second positive weight parameter. If a test directory or an example directory is hit in the path, the target test directory or target example directory is assigned a corresponding first negative weight parameter. The dynamic service score is determined based on the first positive weight parameter, the second positive weight parameter, and the first negative weight parameter.

9. The method for scanning code files according to claim 1, characterized in that, The security level of the code file to be scanned is determined based on the error-prone pattern density, semantic file type score, and dynamic business score, and scanning is performed according to the corresponding scanning strategy, including: The error-prone pattern density, semantic file type score, and dynamic business score are each assigned their own corresponding weight parameters to determine the security criticality score; When the safety criticality score is greater than or equal to the first preset score, it is determined to be the first safety level, and a full scan scanning strategy is executed accordingly. When the safety criticality score is greater than or equal to the second preset score and less than the first preset score, it is determined to be the second security level, and a scanning strategy of lightweight rule set scanning is executed accordingly. When the security criticality score is less than the second preset score, it is determined to be at the third security level, a simplified check is performed, and scanning is prohibited; wherein, the security of the first security level is lower than that of the second security level, and the security of the second security level is lower than that of the third security level.

10. The method for scanning code files according to claim 9, characterized in that, During the scanning process, the method further includes: During the execution of the scanning strategy on the code file to be scanned, at least one scanning tool for executing the scanning strategy and at least one target scanning skill invoked are obtained, and the tool computation cost corresponding to the at least one scanning tool and the lexical cost corresponding to the at least one target scanning skill are determined respectively. The total execution cost corresponding to the scanning strategy is determined based on the tool computation cost of the at least one scanning tool and the lexical cost of the at least one target scanning skill. The computational cost of the tool is determined by the historical running data of the scanning tool and the running time of the preset benchmark task, and the lexical cost is determined by the number of target scanning skills hit and the average lexical cost corresponding to each target scanning skill.

11. The method for scanning code files according to claim 10, characterized in that, After determining the total execution cost corresponding to the scanning strategy, the method further includes: Obtain the security criticality score and the corresponding total execution cost for each code file to be scanned; The expected scanning benefits of executing the scanning strategy on the code file to be scanned are determined based on the security criticality score. The input-output ratio of the code file to be scanned is determined based on the expected scanning revenue and the total execution cost; wherein, the expected scanning revenue is used to characterize the expected value of obtaining effective security detection results after executing the scanning strategy; The scanning priority of the code file to be scanned is determined based on the input-output ratio and the input-output ratio threshold, and the scanning is then scheduled.

12. The method for scanning code files according to claim 11, characterized in that, The scanning process for multiple code files to be scanned, based on their respective scan scheduling priorities, includes: The scanning tasks corresponding to the plurality of code files to be scanned are sorted according to the scanning scheduling priority to obtain a scanning task sequence; Scanning resources are allocated to each of the scan tasks in the sequence of scan tasks. The corresponding scanning strategy is determined based on the scanning scheduling priority of each scanning task. Obtain resource consumption information and scan results after each scan task is executed; The corresponding scanning task status is updated based on the resource consumption information and the scanning results, so as to adjust the scheduling order of subsequent scanning tasks according to the updated scanning task status.

13. The method for scanning code files according to claim 11, characterized in that, The method further includes: Obtain the actual scan results corresponding to the code file to be scanned after the scan is performed; If a pre-defined level of dangerous vulnerability is detected in the actual scan results and the dangerous vulnerability is confirmed to be effective, the code file to be scanned is identified as a positive feedback sample, and the security criticality score of the code file to be scanned is positively corrected according to the vulnerability characteristics corresponding to the dangerous vulnerability. The security level and return on investment of the code file to be scanned are updated based on the positively corrected security criticality score, and the subsequent scanning strategy and scheduling priority of the code file to be scanned are adjusted based on the updated security level and return on investment.

14. The method for scanning code files according to claim 11, characterized in that, The method further includes: The number of consecutive scans of the code file to be scanned is counted, and the vulnerability detection results corresponding to each scan are obtained; If the number of consecutive scans reaches a preset number and the vulnerability detection results corresponding to each scan do not detect vulnerabilities of a preset level or above, the code file to be scanned is identified as a negative feedback sample, and the security criticality score corresponding to the code file to be scanned is negatively corrected according to a preset correction range. The security level and return on investment of the code file to be scanned are updated based on the negatively corrected security criticality score, and the subsequent scanning strategy and scheduling priority of the code file to be scanned are adjusted based on the updated security level and return on investment.

15. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to perform the steps of the code file scanning method as described in any one of claims 1 to 14 when executing the computer program.

Images