112 results about "Control flow diagram" patented technology

The invention relates to the field of intelligent contract vulnerability detection, in particular to an intelligent contract vulnerability detection method based on code graph fusion analysis and a graph matching network. The method comprises the steps of constructing an intelligent contract source code data set; through static analysis, extracting three different code feature information including a control flow diagram, a data flow diagram and an abstract syntax tree from the source code of the smart contract; carrying out information integration on the three extracted code features, and constructing a code graph covering wider features; on the basis of the generated code graph, a GraphCodeBerT model is used for pre-training; vectorizing a code graph which is output by the pre-training model and contains structural and semantic features through a graph embedding network; and learning the feature representation of the contract pair by using a cross-graph attention mechanism of a graph matching network to realize specific vulnerability detection of the smart contract source code. According to the invention, potential vulnerabilities can be accurately identified.

The invention provides a multi-rule static detection and large-model dynamic repair method for code defects. The method comprises the steps that code defect types are summarized and abstracted into a unified defect mode rule set; constructing an abstract syntax tree, a control flow diagram and a data flow diagram of the source code; performing static analysis based on a multi-rule engine to identify potential defects; inputting the defect context into a large language model to generate a repair suggestion; performing semantic consistency verification and integration on the repair suggestions; and executing automatic testing and secondary static analysis to verify a repair result. According to the method, the traditional static analysis technology and the modern large language model capability are combined, accurate recognition and intelligent repair of code defects are achieved, a closed-loop defect processing flow is formed, the defect detection accuracy is improved, intelligent repair is achieved, closed-loop verification is formed, the development efficiency is improved, and man-machine cooperation is supported.

The invention provides an intelligent contract vulnerability detection method based on code slices and a neural network, and relates to the technical field of contract vulnerability detection, and the method specifically comprises the following steps: carrying out the static analysis of an intelligent contract code; checking a program execution path through depth-first traversal of the control flow diagram, detecting timestamp dependent vulnerabilities and unchecked external call vulnerabilities, and positioning vulnerability paths in the control flow diagram according to nodes corresponding to vulnerability statements; normalizing the smart contract code, removing smart contract code annotations, unifying variables and function naming, not renaming related state information related variables, converting a smart contract code statement into vector representation, and training and updating a vector; constructing a multilayer graph convolutional neural network as a neural network model for training and detecting vulnerabilities; and outputting a detection result by the multilayer graph convolutional neural network. According to the technical scheme, the problem that the intelligent contract vulnerability cannot be accurately and effectively detected in the prior art is solved.

The present invention discloses a method, device, and medium for identifying software component analysis, which relates to the technical field of software technology. Specifically, it includes: obtaining all files in the software to be identified to obtain a first data set; extracting meta-file data to obtain a second data set, and obtaining a first open-source file set through first feature matching; performing deletion processing on the first data set to obtain a third data set, calculating the minimum hash signature through the program abstract syntax tree and the corresponding sub-syntax tree to generate a second feature set, and obtaining a second open-source file set through third feature matching; performing deletion processing on the third data set to obtain a fourth data set, obtaining an updated syntax tree based on the abstract syntax tree and the fourth data set and constructing a control flow diagram, and obtaining a third open-source file set through fourth feature matching between the third feature set and a preset reference database; merging the first open-source file set, the second open-source file set, and the second open-source file set to obtain the total open-source component set in the software to be identified.

The invention discloses a graph neural network-based intelligent contract bytecode similarity detection method, which comprises the following steps of: performing disassembling operation on Ethereum virtual machine bytecodes, and performing data flow analysis and control flow analysis on disassembling results to obtain a data flow graph and a control flow graph corresponding to the bytecodes; combining the data flow diagram and the control flow diagram of each external function into a byte code characteristic diagram; a large number of intelligent contracts with similar labels are adopted to train a graph neural network, vectorization operation is performed on the byte code feature graph in the training process, and feature vectors are obtained; and taking the problem contract as a reference smart contract, respectively inputting the bytecode feature maps of the reference smart contract and the to-be-detected smart contract into the trained graph neural network to respectively obtain corresponding feature vectors, comparing the Euclidean distance of the two feature vectors, and measuring to obtain the similarity of the bytecode of the two smart contracts. Compared with a traditional method, the method has higher accuracy, problem contracts can be effectively recognized, and the safety of a block chain system is enhanced.

The invention discloses an instruction-level code optimization method and device based on template matching, a medium and equipment. According to the method, instruction-level codes serve as input, the input instruction-level codes are firstly constructed into corresponding control flow diagrams, then value ranges of active variables and register quantities are initialized based on the control flow diagrams, then variable assignment instructions and related instructions are found out from instruction sequences of basic blocks to form instruction segments to be optimized, and the instruction segments to be optimized are optimized. The method comprises the following steps of: optimizing an instruction fragment, obtaining an optimized instruction fragment through template matching, performing SMT equivalence verification on the instruction fragment before and after optimization based on an active variable and a value range of a register quantity, and finally optimizing an input instruction-level code in a manner of replacing the instruction fragment before optimization with the optimized instruction fragment which is verified to be equivalent. And finally, the optimized instruction-level code is obtained.

The invention discloses a multi-language code generation method based on self-supervised pre-training, which comprises the following steps: acquiring and cleaning multi-language code data to form a training corpus; the method comprises the following steps: representing code data as an abstract syntax tree, extracting a control flow diagram and a data flow diagram of the code data, and obtaining unified semantic representation through combination of a diagram encoder and a sequence encoder; designing a self-supervised pre-training task, and pre-training the semantic representation based on the training corpus; constructing a multi-language pre-training model based on the structure-improved recurrent neural tensor network and the multi-language embedding matrix; when a user inputs a natural language, generating a target language code by using the multi-language pre-training model; and target language code correction is carried out through conventional function testing and grammar checking. According to the method, multi-channel recursive combination and a hierarchical recursive expansion mechanism are combined with self-supervised pre-training, so that accurate generation and performability improvement of cross-language codes are realized.

The invention relates to an application user tracking detection method and device based on a dynamic and static combination technology, and the method comprises the steps: obtaining a first interprocess control flow diagram associated with a device identifier according to an application package of a target application and a configuration file containing a predefined device identifier; according to a program behavior of a target application in a running state, determining a function associated with an application programming interface of the equipment identifier and an application programming interface of network data transmission, and obtaining a second interprocess control flow diagram of data leakage according to the function; integrating the first interprocess control flow diagram and the second interprocess control flow diagram to obtain a third interprocess control flow diagram; and obtaining a leakage path of the target application to the user data according to the third interprocess control flow diagram. By adopting the method, the problems of narrow detection coverage and low detection accuracy in the aspect of tracking the user by using the device identifier through the APP can be solved.

The invention relates to the technical field of Internet of Things equipment security detection, in particular to an Internet of Things equipment vulnerability detection method and system based on sensitive target guidance, and the method comprises the steps: extracting firmware key information of to-be-detected equipment; obtaining potential sensitive targets and paths in firmware of the to-be-detected equipment and basic block positions corresponding to the sensitive targets and the paths through reachable data streams in decompilation code execution; performing pruning operation on the control flow diagram in the key information according to the positions of the basic blocks corresponding to the sensitive target and the path, and obtaining a test space related to the sensitive target and the path; variation is carried out on request processing information, parameter information and control information in the test space, and the test case is guided to be executed to a sensitive target; and performing collapse variation on the sensitive function parameters in the test space, triggering the firmware vulnerability of the to-be-detected equipment in the execution process of the test case, and generating a test result. According to the method, the blindness of fuzzy testing is reduced, and the method has good adaptability to firmware analysis of embedded equipment.

The invention relates to the technical field of kernel fuzz testing, and provides a fuzz test input generation method based on characteristic unification and related equipment, the method comprises the following steps: generating a function call graph and a plurality of control flow graphs of a target system, and integrating the function call graph and all the control flow graphs to obtain an inter-program control flow graph; constructing a kernel code calling chain based on the inter-program control flow diagram; carrying out characteristic unified representation modeling based on the kernel configuration file and the kernel code call chain of the target system, and generating a configuration code relation mapping table; extracting related information of the characteristic related interface function according to the kernel code call chain, and performing grammar conversion based on the related information to generate a system call test protocol template of the characteristic related interface function; and generating fuzzy test input of the target system based on the system call test protocol template and the configuration code relation mapping table. According to the method provided by the invention, the correlation between kernel characteristic configuration and fuzzy test input can be improved.

The invention relates to a malicious APP family identification method based on multi-modal feature fusion, and belongs to the technical field of information security. The method comprises the following steps: performing data preprocessing on the Android APK, including unpacking and decompiling operations, to obtain a byte code file and a smali code file; respectively extracting byte code image features, operation code sequence features and control flow chart features; according to the method, byte code image features are extracted by using an OfficientNetV2L convolutional neural network, operation code sequence features are extracted by using a k-Shingles algorithm and a SimHash algorithm, and control flow chart features are extracted by using a static analysis tool and a capsule graph neural network. And carrying out low-rank multi-modal fusion on the three features, and constructing a CNN-BiLSTM-Attention detection classification model, so as to realize identification and judgment on the malicious APP family. According to the method, the recognition accuracy is improved, and the generalization ability of the model is enhanced.

The invention provides an analysis method and system based on confused PASS in LLVM, and relates to the technical field of software protection. The method comprises the following steps: extracting a target function from a confused binary program, positioning the position of an encrypted character string in the target function, and determining decryption logic according to the position of the encrypted character string; searching a target expression in the target function, identifying expression logic through a mode matching mode, and determining character string encryption algorithm parameters based on decryption logic and the expression logic; constructing a control flow diagram according to the expression logic, identifying control variables in the control flow diagram, and generating a state conversion diagram of the control variables according to an assignment sequence of the control variables; and identifying an identifier of a useless basic block in the target function according to the state transition diagram, and determining obfuscation implementation logic of the obfuscated binary program based on the character string encryption algorithm parameter and the identifier of the useless basic block. According to the technical scheme provided by the invention, reverse derivation of the confusion implementation logic can be realized.

The invention discloses an intelligent contract vulnerability detection method and system based on semantic comprehension and program path analysis, and belongs to the technical field of network security. The method comprises the following steps: firstly, analyzing an intelligent contract code by using a large language model, and reasoning to generate a structured security rule for defining a taint source, a taint sink and a purifier; secondly, guiding a taint analysis engine by using a security rule, and tracking on a data flow and a control flow diagram of a program so as to efficiently screen out a high-risk taint path; then, carrying out reachability verification on the high-risk path by adopting a symbolic execution technology; and finally, performing final context review on the verified vulnerability path by using the large language model again to generate a vulnerability report. According to the method, the semantic comprehension ability of the large language model and the preciseness of traditional program analysis are subjected to multi-stage cooperation, so that the detection precision and efficiency of the intelligent contract logic vulnerability can be remarkably improved, the interpretability of a report result is greatly enhanced, and the method has important application value.

The invention discloses a graph neural network-based cross-architecture binary code similarity detection method, which comprises the following steps of: respectively implementing original feature extraction operation on an open source software binary file and a firmware binary file by utilizing a reverse engineering tool to obtain basic feature data of the open source software binary file and the firmware binary file; the control flow diagram of the open source software and the firmware is converted into an embedded representation through an embedded network, the open source software generates an embedded representation table, and the firmware generates a corresponding embedded representation; and storing the open source software embedded representation into an open source software database, storing the firmware embedded representation into a firmware database, and finally, comparing the similarity of data in the database to complete the similarity detection of the cross-architecture binary codes so as to screen out code fragments possibly having potential safety hazards in the firmware. According to the method, the similarity of the cross-architecture binary codes can be effectively detected, and the third-party codes with security risks in the firmware of the Internet of Things equipment can be accurately detected.

The invention relates to the field of embedded technologies, in particular to a WCET analysis method and device for an embedded multi-thread program. The method comprises the steps that synchronous operation in a multi-thread program under the POSIX thread standard is recognized, lock-related operation statements are recorded, and an expanded parallel program control flow diagram is generated to describe the synchronous dependency relationship between threads; based on a lock-protected critical region resource mutual exclusion access principle, calculating a program WCST caused by critical resource application of a thread; according to a control flow diagram of a parallel program, determining a parallel segment, running on other cores, of a certain program segment, taking the parallel segment as an interference set, and performing conflict analysis on the shared instruction cache through an abstract interpretation method; and inputting the analysis result as a parameter into a WCET calculation method IPET to obtain a WCET analysis result of the whole parallel program.

The invention discloses a static binary code taint analysis method based on a propagation action scope, and relates to the field of static binary code taint analysis, and the static binary code taint analysis method comprises the following steps: extracting a program instruction set and a control flow structure based on a disassembling result of a target binary code; calculating a value set with a source of the binary code based on the control flow graph; on the basis of the control flow diagram and the value set with the source, executing cross-function stain propagation analysis, and identifying memory positions or registers influenced by pollution in each function and propagation action ranges of the memory positions or the registers; and extracting all instruction sets using the taint data based on the taint and the propagation action range thereof. According to the method, the false alarm rate of static binary taint analysis can be reduced and the instruction set involved in the taint analysis can be reduced without increasing the analysis overhead, so that the method has important significance in improving the instrumentation efficiency and the operation efficiency of dynamic taint analysis and improving the accuracy of protocol reversion, fuzzy testing and vulnerability mining based on the taint analysis.

The invention relates to the technical field of software development, and discloses a software development system and a software development method. The software development method comprises the following steps: constructing a multi-dimensional technical debt quantitative model, and calculating a technical debt score based on factors such as code complexity, change frequency and defect association degree; a code semantic multi-level representation model is constructed, and multi-level representation of codes is constructed through combined analysis of an abstract syntax tree, a data flow diagram and a control flow diagram; a self-supervised learning model is applied to train code representation, and development intentions and business concepts contained in codes are recognized; generating a context-dependent reconstruction suggestion; and optimizing the reconstruction path planning. Through objective quantification of the technical debt and deep understanding of code semantics, the technical problems that in the prior art, technical debt management is difficult to quantify and reconstruction decision-making lacks scientific basis are solved, code maintenance cost is remarkably reduced, and development efficiency is greatly improved.

The invention relates to the technical field of digital information application security, in particular to a fine-grained malicious behavior positioning method and system based on semantic enhancement, and the method comprises the steps: carrying out the feature extraction of a benign sample and a to-be-detected malicious sample, designing a feature set containing a semantic embedding API sequence, carrying out the coding through a weight, generating a node embedding expression, and carrying out the recognition of the feature set. Fusing the numerical features and the sequence features, and constructing an attribute control flow diagram; optimizing the attribute control flow diagram; training a graph attention auto-encoder model containing bidirectional propagation and multiple masks based on a benign sample; a malicious sample is input into the trained auto-encoder model for reconstruction, a reconstruction error is calculated, and basic block level fine-grained malicious behavior positioning is realized; according to the method, the related semantics of malicious behaviors in malicious samples are highly condensed, a feature coding technology and a graph structure optimization strategy are fused, and a trained model can accurately position basic blocks of the malicious behaviors through a customized loss function.

The invention discloses a code conversion method and a related device, and the method comprises the steps: obtaining an input code, carrying out the grammatical analysis of the input code, and generating an abstract syntax tree which comprises a plurality of nodes; coding a code text in the input code to generate a first semantic vector; encoding the structure in the abstract syntax tree to generate a second semantic vector; processing the first semantic vector, and converting the first semantic vector into a second semantic vector; generating a control flow diagram according to the abstract syntax tree, and constructing a data flow diagram; determining a plurality of semantic units according to the control flow diagram and the data flow diagram; obtaining a preset domain knowledge graph, wherein the preset domain knowledge graph comprises a plurality of concept nodes; according to the concept nodes and the semantic units, analyzing the second semantic vector to obtain a target semantic vector, decoding the target semantic vector into a target language, and generating a target code. By adopting the method and the device, code conversion expansibility and accuracy can be improved.

The invention discloses a control flow graph representation method and system for obtaining a basic block calling relation of an HIP kernel function, and the method comprises the steps: extracting the kernel function of an HIP program, compiling the kernel function into an LLVM IR intermediate code, and dividing the kernel function into a plurality of basic blocks; a unique serial number is distributed to each basic block, and a new edge basic block is inserted into the jump edge to represent the calling relation; generating a kernel function control flow diagram of a basic block level; the LLVM is used for instrumenting Pass, and instrumentation is carried out on the newly-added edge basic blocks; the method comprises the following steps: designing two lightweight thread instrumentation modes to reduce the instrumentation overhead, namely ProfileCTA and ProfileWavefront; the method comprises the following steps of: operating on a domestic DCU (Data Communication Unit) platform by adopting a compiling process of combining instrumentation of an equipment end and a host end, collecting calling times among basic blocks, taking dynamic information as an edge weight of CFG, and finally generating a basic-block-level HIP program kernel function CFG with the dynamic information. According to the method, the instrumentation overhead is effectively reduced, the obtaining efficiency of the dynamic calling relation is improved, and powerful support is provided for high-performance calculation and program optimization.

The embodiment of the invention provides a program problem static analysis method and device, electronic equipment, a readable storage medium and a program product, and relates to the technical field of program static analysis. The method comprises the steps that a target program is analyzed based on a rule constraint set of target syntax, and an abstract syntax tree is generated; constructing an annotation control flow graph according to the abstract syntax tree; according to the annotation control flow diagram, identifying a periodic task in the target program; and on the basis of performing loop expansion on the execution process of the periodic task, performing symbolic execution analysis on the annotation control flow diagram, and identifying the cross-period conflict problem of the periodic task. By identifying the periodic task and circularly expanding the periodic task, the analysis limitation on the program problem in the related technology is solved, the cross-period conflict problem in the program is efficiently identified, and the static guarantee capability on the program quality is improved.

The invention relates to a method for detecting obfuscated Android malicious applications based on code semantics and text embedding. The method comprises the following steps: collecting a malicious software data set; malicious software in the data set is confused; aPI calling features in the permission and control flow chart are extracted; embedding the features by using a BERT pre-training model, and filtering the features in combination with a clustering algorithm; the API calling features are coded; building a deep learning framework, wherein a deep learning model adopted for training in the framework is a model BERT + Self-Attention + TextCNN (Convolutional Neural Network); and repeating multiple iterations to obtain a final prediction effect. According to the method, code semantics and text embedding are used, a clustering algorithm is combined, and the classification robustness of the confused malicious software can be remarkably improved by training the improved pre-training model.

In various examples, static single assignment-based control flow graph traversal analysis for uninitialized variable detection system and methods are disclosed. A pre-compiler stage of a compiler system, may reconstruct source code into an SSA form IR and detect and identify uninitialized variables based on applying a variable analysis pass that traverses a CFG corresponding to the SSA form IR. A variable analysis pass may traverse through the CFG to build a defined variable map and a Phi variable map. The maps may be used to map undefined variables to basic blocks of the CFG where the undefined variables occur. The variable analysis pass may pass uninitialized variable data to a compiler error handling process. The compiler error handling process may produce an error report that traces the basic block with undefined variables to lines of the source code to assist in efficiently debugging the source code.

The invention provides a code detection and protection method, system and device and a medium, and belongs to the technical field of malicious code detection.The method specifically comprises the steps that WASM byte codes are obtained; converting the byte code into a WAT text and an intermediate representation, and analyzing meta-information; respectively constructing control flow diagrams and program dependency diagrams of the JS and the WASM based on the AST and the intermediate representation, and fusing the control flow diagrams and the program dependency diagrams into a unified dependency diagram through cross-language interface nodes; matching the dependency graph by using a preset malicious rule base, and marking a suspicious level; if not, WASM is injected into a Unikernel mirror image to be executed in an isolation environment, and behavior fingerprints during operation are collected; and outputting a malicious and non-malicious conclusion by combining the static analysis result with dynamic feature rating such as resource consumption and abnormal events. Through cross-language dependency graph fusion and dynamic and static combination analysis, malicious behaviors in WASM and JS interaction are captured, execution and behavior collection are isolated, the misjudgment risk is reduced, the detection accuracy is improved, and efficient and accurate WebAssembly module protection is achieved.

The invention relates to the technical field of computers, and discloses a method, a device, equipment and a medium for multi-thread undefined behavior detection, and the method comprises the following steps: constructing a control flow diagram and a data flow diagram based on a multi-thread program code, and creating a multi-thread execution path model based on the control flow diagram and the data flow diagram; distributing a thread fragment data set in the multi-thread execution path model to a plurality of computing nodes, and extracting an operation sequence in the distributed thread fragment data set in each computing node; performing iteration and layering processing on the operation sequence, and constructing a causal relationship graph; based on the causal relationship graph, generating an operation dependency track, mapping the operation dependency track to different memory models, performing execution sequence simulation to obtain a plurality of execution paths, and performing behavior analysis based on the execution paths to obtain a behavior analysis result. According to the method, the undefined behaviors in the multi-thread program can be systematically detected, and the stability and the safety of the system can be improved.

The invention discloses a lightweight program control flow obfuscation method, system and device and a medium, and the method comprises the steps: carrying out the static analysis of a program based on a program source code, recognizing all basic blocks, analyzing the execution sequence and jump relation of the basic blocks, and obtaining a control flow diagram of the program; a unique runtime state is distributed for the basic blocks by analyzing the dependency relationship among the basic blocks, and a conversion rule among the states is defined, so that a state transition model is obtained; the method comprises the following steps: dynamically generating an encryption key by using a state conversion relationship, and encrypting sensitive information in a control flow to obtain an encryption program code subjected to obfuscation protection; a current runtime state is read in a program execution process, a corresponding decryption key is generated, a plaintext address of sensitive information is restored, and executable implicit jump and variable access operation is obtained. Static analysis, especially control flow analysis, can be effectively resisted, so that source codes and algorithms of software are protected from being easily acquired or tampered.

The invention relates to the technical field of function name prediction, in particular to a function name prediction method and system based on bidirectional semantic transfer. The method comprises the following steps of: 1, acquiring a target function of a binary file, and extracting a function body and an interprocess control flow diagram of the target function; wherein the target function is a function with a function name to be predicted; step 2, inputting the function body of the target function into a preset bidirectional semantic transfer framework, and obtaining global information of the target function; wherein the bidirectional semantic transfer framework obtains a corresponding sub-function and a parent function according to the target function, obtains an internal semantic database, a sub-function semantic database and a parent function semantic database of the target function by utilizing a large language model, and performs semantic fusion as global information; and 3, taking the global information of the target function as input of the large language model, and generating a function name of the target function in combination with the cue word. According to the method, the function name prediction reasoning capability can be improved.

The invention provides a repeated vulnerability detection method based on multi-object type state analysis, and the method comprises the steps: employing a preset vulnerability mode description language, constructing a corresponding vulnerability mode description rule for each vulnerability, and the rule comprises a plurality of variable objects and program statements causing the vulnerabilities; translating the vulnerability mode description rule into a corresponding linear sequential logic formula; converting the formula into an automaton, wherein the automaton comprises an accepting state of the automaton and binding constraints of a plurality of variable objects of the environment in the accepting state; constructing an interprocess control flow diagram for the target program to be detected, wherein the interprocess control flow diagram comprises a plurality of program points; performing multivariable object analysis on the target program based on the graph to obtain an automaton state set of each program point and a data dependency relationship of a plurality of variable objects under each automaton state, and when an automaton state in an accepting state exists and the data dependency relationship of the plurality of variable objects meets the binding constraint, performing the multivariable object analysis on the target program; and detecting that a corresponding vulnerability exists in the target program.

The invention discloses a method for evaluating vulnerabilities by combining vulnerability codes and vulnerability description texts and using a cross-task attention mechanism. The method comprises the following steps: firstly, for a vulnerability code part, converting the vulnerability code part into a control flow diagram, and generating a plurality of execution paths from the control flow diagram; for the vulnerability description text part, some key vulnerability elements are extracted from the vulnerability description text part; then, considering that seven evaluation tasks have certain relevance, when feature representation of codes and texts is learned, a cross-task attention mechanism is introduced to capture relevance features among the tasks; and finally, carrying out weighted summation on the probability predicted by the classifiers at the code level and the text level to obtain a prediction result of final vulnerability assessment.

The invention provides an intelligent contract security vulnerability automatic detection and protection early warning method and system, and relates to the technical field of vulnerability detection, and the method comprises the steps: converting an intelligent contract code into an abstract syntax tree to construct a control flow diagram and a data flow diagram, extracting a function call chain and the like to construct a moving trajectory diagram, and employing a dual verification analysis technology to detect vulnerabilities. And generating a risk assessment report, and constructing a vulnerability verification network based on zero-knowledge proof. According to the invention, the vulnerability detection accuracy of the smart contract can be remarkably improved, early warning of security risks of the smart contract is realized, and safe and stable operation of a block chain system is ensured.