149 results about "Control flow graph" patented technology

The invention relates to the technical field of vulnerability repair, in particular to a source code vulnerability repair method, electronic equipment and a storage medium, and the method comprises the following steps: obtaining an abstract syntax tree and a control flow graph according to a source code containing a vulnerability, and generating a vulnerability context feature vector by using a graph neural network model in combination with vulnerability position information, determining a historical vulnerability repair case corresponding to the vulnerability context feature vector from a vulnerability-repair knowledge base, inputting the vulnerability context feature vector and the corresponding historical vulnerability repair case into a code generation model, outputting a candidate repair code set corresponding to the source code, evaluating each candidate repair code, and determining the vulnerability-repair knowledge base according to the candidate repair code set. Screening out an optimal repair code to automatically repair the source code vulnerability; according to the method, deep semantic analysis is performed on the vulnerability context, and intelligent reasoning is performed, so that the repair code with correct grammar and adaptive context can be generated, and the automation level and accuracy of vulnerability repair are remarkably improved.

The invention provides a memory allocation method and device, electronic equipment, a storage medium and a chip. The method comprises the following steps: extracting tensor data of each tensor in a kernel program; constructing a control flow diagram according to the kernel program; allocating first address information in a static random access memory for each piece of tensor data; determining an active path of each tensor according to the control flow graph, the active path comprising a first node involving the tensor; an interferogram of the tensors is constructed according to the active path, each second node in the interferogram represents a different tensor, and edges between the second nodes represent an interference relation between the tensors; the first address information of each piece of tensor data is adjusted according to the interferogram, the second address information of each piece of tensor data is obtained, and in different steps of the kernel program, if no interference relation exists between the two tensors, the storage areas of the two pieces of tensor data are reused. According to the invention, the memory reuse rate can be improved.

The invention relates to the technical field of software security, and discloses a variational inference-based micropatch repair path adaptive optimization method, system, device and medium, and the method comprises the steps: constructing a joint control flow diagram and a data flow diagram of a to-be-analyzed program, and forming a program structure diagram; based on the program structure diagram, modeling and sampling potential variables of the repair paths through variational inference, and generating a plurality of candidate repair paths; for each candidate repair path, generating a micropatch statement according to context semantics of each node in the path, and inserting the micropatch statement into a corresponding instrumentation position in the source code; and performing multi-dimensional scoring and sorting on the candidate repair paths, and selecting an optimal repair path for deployment according to a scoring result. According to the method, the structural breakthrough of the whole process is realized in the aspects of path identification, patch generation, strategy optimization, engineering deployment and the like, and a technical support is provided for constructing a software vulnerability repair system with autonomous generation, semantic understanding and controllable deployment capabilities.

The invention discloses an intelligent contract vulnerability detection method and system based on semantic comprehension and program path analysis, and belongs to the technical field of network security. The method comprises the following steps: firstly, analyzing an intelligent contract code by using a large language model, and reasoning to generate a structured security rule for defining a taint source, a taint sink and a purifier; secondly, guiding a taint analysis engine by using a security rule, and tracking on a data flow and a control flow diagram of a program so as to efficiently screen out a high-risk taint path; then, carrying out reachability verification on the high-risk path by adopting a symbolic execution technology; and finally, performing final context review on the verified vulnerability path by using the large language model again to generate a vulnerability report. According to the method, the semantic comprehension ability of the large language model and the preciseness of traditional program analysis are subjected to multi-stage cooperation, so that the detection precision and efficiency of the intelligent contract logic vulnerability can be remarkably improved, the interpretability of a report result is greatly enhanced, and the method has important application value.

The invention relates to a cross-language software vulnerability detection method and device, and the method comprises the steps: carrying out the analysis of a Joern static analysis pair, carrying out the integration and semantic enhancement of an abstract syntax tree, a control flow graph and a data dependence graph, and obtaining a cross-warehouse heterogeneous code graph; obtaining cross-language intermediate representation based on a compiler framework; after the cross-language intermediate representation and the cross-warehouse heterogeneous code graph are modeled, weighted fusion is carried out through a gated cross attention mechanism, and a multi-modal data set is obtained; carrying out migration training on the multi-modal cross-language vulnerability detection model, and carrying out vulnerability detection on cross-language software to obtain a detection result; through multi-modal data fusion and modeling, in combination with cross-language intermediate representation and a cross-warehouse heterogeneous code graph, the defects of a traditional method in the aspects of cross-language generalization ability and context reasoning ability are effectively overcome; the method has the advantages that the generalization ability of cross-language vulnerability detection is improved, the false alarm rate and the missing report rate are reduced, and the comprehensive utilization effect of global structure information is enhanced.

The invention discloses an intelligent detection method for network security vulnerabilities, and relates to the technical field of network security vulnerability detection, and the method comprises the following steps: analyzing source codes to construct an abstract syntax tree, a control flow graph and a call graph, identifying sensitive operation points based on a rule base, and screening hotspot functions in combination with code indexes and the call graph; extracting a candidate path from a program entry to a sensitive operation point, encoding to generate a path context snapshot, and scoring through a pre-training model; selecting a high-risk path to execute sparse symbolic execution, simplifying constraints by using variable interval information, and dynamically feeding back and adjusting scores; poC input verification is generated for the path triggering the vulnerability constraint, a report containing the path constraint, the triggering condition and the PoC is output, program analysis and machine learning are combined, the vulnerability detection efficiency and precision are improved, and the method is suitable for code security analysis of scenes such as an embedded system.

The invention discloses a compiling method for compiling a C language source code into an RISC-V assembly code. The method comprises the following steps: acquiring a C language source code; performing lexical analysis on the C language source code to generate a mark flow; performing syntactic analysis on the mark flow, and constructing an abstract syntax tree; performing semantic analysis on the abstract syntax tree to generate a target abstract syntax tree; constructing a runtime environment of the RISC-V assembly code; generating an intermediate code and a control flow diagram corresponding to the intermediate code according to a rule in the runtime environment and the target abstract syntax tree; generating a target code by using the intermediate code and the control flow diagram corresponding to the intermediate code; according to the technical scheme, the intermediate representation more adaptive to RISC-V custom instruction mapping can be generated, so that the execution efficiency of assembly codes is improved; and meanwhile, by designing a lightweight runtime environment, the performance overhead is further reduced.

The invention discloses a malicious code control flow feature extraction method based on a graph neural network. The method comprises the following steps: constructing a control flow graph, a data flow graph and a function call graph; designing a drawing neural network architecture; training a graph-level classifier; performing graph interpretation by using a GNNExplainer algorithm, attention mechanism analysis and a gradient analysis method; converting the extracted control flow mode into a structured detection signature, and mapping the structured detection signature to an original binary code; and integrating with a static analysis tool through a standardized interface. The invention further discloses a malicious code control flow feature extraction system based on the graph neural network. Multi-level graph structure representation is constructed, important information such as a control flow structure and a data dependency relationship is fully reserved, the deep structure similarity of malicious codes can be recognized, the deformation resistance is higher, and therefore the malicious code detection precision is improved; according to the method, key sub-graphs can be recognized, graph structure features are converted into detection rules, then the detection rules are integrated with existing static analysis tools, and practicability is improved.

The invention relates to a firmware function vulnerability detection method and system based on multi-granularity feature fusion. The method comprises the following steps: preprocessing firmware to be detected to obtain a function instruction set and a function control flow diagram; extracting structural features and semantic features of the function instruction set and the function control flow diagram, and performing feature fusion by adopting a double-gating weighted fusion model to obtain function fusion features of the firmware to be detected; performing similarity comparison on the fusion feature of the firmware function to be detected and a preset vulnerability feature; and determining a vulnerability detection result based on a similarity comparison result, and performing visual display. A firmware function vulnerability detection technology based on multi-granularity feature fusion is provided, and a reset gate and an update gate are introduced to solve the problems of information selection and feature retention during fusion of different features; and then carrying out training and similarity detection on the model under a twinning neural network architecture. The detection accuracy is remarkably improved, and meanwhile, higher-degree automatic detection is realized.

In various examples, static single assignment-based control flow graph traversal analysis for uninitialized variable detection system and methods are disclosed. A pre-compiler stage of a compiler system, may reconstruct source code into an SSA form IR and detect and identify uninitialized variables based on applying a variable analysis pass that traverses a CFG corresponding to the SSA form IR. A variable analysis pass may traverse through the CFG to build a defined variable map and a Phi variable map. The maps may be used to map undefined variables to basic blocks of the CFG where the undefined variables occur. The variable analysis pass may pass uninitialized variable data to a compiler error handling process. The compiler error handling process may produce an error report that traces the basic block with undefined variables to lines of the source code to assist in efficiently debugging the source code.

The invention provides a code detection and protection method, system and device and a medium, and belongs to the technical field of malicious code detection.The method specifically comprises the steps that WASM byte codes are obtained; converting the byte code into a WAT text and an intermediate representation, and analyzing meta-information; respectively constructing control flow diagrams and program dependency diagrams of the JS and the WASM based on the AST and the intermediate representation, and fusing the control flow diagrams and the program dependency diagrams into a unified dependency diagram through cross-language interface nodes; matching the dependency graph by using a preset malicious rule base, and marking a suspicious level; if not, WASM is injected into a Unikernel mirror image to be executed in an isolation environment, and behavior fingerprints during operation are collected; and outputting a malicious and non-malicious conclusion by combining the static analysis result with dynamic feature rating such as resource consumption and abnormal events. Through cross-language dependency graph fusion and dynamic and static combination analysis, malicious behaviors in WASM and JS interaction are captured, execution and behavior collection are isolated, the misjudgment risk is reduced, the detection accuracy is improved, and efficient and accurate WebAssembly module protection is achieved.

The application discloses a kind of multilingual code generation methods based on self-supervised pre-training, comprising the following steps: obtaining and cleaning multilingual code data, forming training corpus;Code data is represented as abstract syntax tree, the control flow graph and data flow graph of code data are extracted, and unified semantic representation is obtained by combining graph encoder and sequence encoder;Self-supervised pre-training task is designed, and the semantic representation is pre-trained based on the training corpus;Multilingual pre-training model is constructed based on the recursive neural tensor network and multilingual embedding matrix improved in structure;When natural language is input by user, the multilingual pre-training model is used to generate target language code;Target language code is corrected by routine function test and syntax check.The application realizes accurate generation and executable improvement of cross-language code by combining self-supervised pre-training with multichannel recursive combination and hierarchical recursive development mechanism.

The application provides a smart contract security vulnerability automatic detection and protection early warning method and system, relates to the technical field of vulnerability detection, and comprises the following steps: converting a smart contract code into an abstract syntax tree to construct a control flow graph and a data flow graph, extracting a function call chain to construct a running track graph, detecting a vulnerability by using a double verification analysis technology, generating a risk assessment report, and constructing a vulnerability verification network based on zero-knowledge proof. The application can significantly improve the accuracy of smart contract vulnerability detection, realize early warning of security risks of smart contracts, and guarantee the safe and stable operation of a blockchain system.

Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include receiving a report of a first anomaly based on real-time control flow graph diagram monitoring of an application at a first system and receiving a second report of a second anomaly from a second system. An exploit report may be generated by providing the first report and the second report to a machine learning model trained to output information related to an exploit based on input reports, and subsequently to provide the output information to a cloud-based reporting tool.

The application discloses a code defect automatic repairing method based on code attribute graph and large model, comprising the following steps: collecting code samples, analyzing source code, generating code attribute graph fusing abstract syntax tree, control flow graph and data flow graph, then performing dynamic pruning according to node importance calculated based on node degree, PageRank and data propagation dependency degree, and retaining key nodes to improve graph learning efficiency; extracting features of the optimized graph through GAT, introducing multi-scale coding, and generating graph embedding vectors; combining node importance, screening high-value Token, performing structure-aware semantic embedding, and obtaining more accurate text representation; fusing graph and text vectors to generate comprehensive features, then inserting masks at weakly dependent or high-risk positions; fine-tuning and optimizing the mask positions; inputting the comprehensive features and the mask source code into a pre-trained language model to generate patches, performing multi-task evaluation and reordering, and selecting the optimal patch to complete the repairing.

This application discloses a method, system, and device for detecting malicious code variants using control flow graph semantic matching, belonging to the field of computer network security technology. It includes: disassembling the target executable file, constructing a control flow graph, and extracting basic block semantic features to generate semantic vectors; obtaining semantic equivalence classes based on semantic vector clustering, identifying main anchor points, and constructing a main anchor point skeleton graph; performing semantic compression and noise processing with the anchor point skeleton as constraints, and obtaining a semantic core graph through topological verification; hierarchically normalizing the semantic core graph and the main anchor point skeleton graph to generate a composite hash signature; and matching the composite hash signature with a malicious code family signature library to complete variant determination. The above scheme, through the main anchor point constraint compression and normalization process, resists structural obfuscation disturbances, improves the consistency of homologous variant identification, and has advantages such as strong robustness, high efficiency, and good interpretability. It is suitable for detecting malicious code variants using control flow graph semantic matching in complex obfuscated environments.

The invention provides a binary program vulnerability mining method, device and system based on symbolic execution and taint analysis and a medium, and the method comprises the steps: disassembling a target program, extracting a control flow graph (CFG) and a data flow graph (DFG), recording a node state through a hash table, and generating a feature representation through nonlinear transformation; performing simulation execution based on CFG, DFG and feature representation, recording variable symbol values to obtain path conditions, and recursively solving constraints to generate path mapping; marking input as taint data, recursively calculating a propagation path to generate a taint flow diagram, and determining a taint state after sensitive operation; checking whether the stains are subjected to sensitive operation or not, and if the influence of integral formula calculation exceeds a threshold value, judging that potential vulnerabilities generate a candidate set; and calculating grades through a risk assessment formula, and generating a report containing positions, types, grades and repair suggestions. The method combines symbolic execution and taint analysis, can comprehensively and accurately detect vulnerabilities, has remarkable precision and efficiency advantages, and is suitable for complex program security analysis.

The application discloses a patch existence detection method based on key basic blocks, which comprises the following steps: firstly, modeling the semantics of a vulnerability function, a patch function and a target function to be detected into a function static control flow graph, and performing necessary preprocessing to minimize the influence caused by compilation confusion; then, a basic block matching algorithm is proposed, and the basic block matching is performed between the vulnerability function, the patch function and the target function respectively, so as to generate a matching basic block pair set; then, the change degree of a feature basic block related to the patch is analyzed, and the top N feature basic blocks are selected as key basic blocks for effective patch existence test; finally, the key basic blocks of the patch function and the vulnerability function are searched in the target function respectively, and it is judged whether the target function is more similar to the patch function, that is, whether the vulnerability has been patched. Through the above method, it can be quickly and accurately judged whether the vulnerability in a large-scale function to be detected has been patched.

The invention relates to the technical field of attack tracing, in particular to an attack tracing method and device based on a symbolic execution engine, and the method comprises the steps: recognizing a plurality of dependent explosion functions of a pre-constructed execution unit sequence, so as to construct an independent subprogram; constructing a system call control flow diagram of a historical event processing cycle by combining static and dynamic analysis; auditing logs containing parameter values are collected in the execution period of the target program so as to construct a thread-level traceability graph; and according to the system call control flow diagram, determining whether a node of dependent explosion exists in the thread-level traceability diagram, if so, reconstructing the independent subprogram by using the node of dependent explosion, and analyzing the reconstructed independent subprogram by using a symbolic execution engine to reconstruct an attack path. Therefore, the problem that a related tracing attack method needs to carry out instrumentation on a system, or depends on static analysis, or depends on an unreliable application log, or needs to use additional auxiliary hardware to realize tracking is solved.

The invention discloses a method for evaluating vulnerabilities by combining vulnerability codes and vulnerability description texts and using a cross-task attention mechanism. The method comprises the following steps: firstly, for a vulnerability code part, converting the vulnerability code part into a control flow diagram, and generating a plurality of execution paths from the control flow diagram; for the vulnerability description text part, some key vulnerability elements are extracted from the vulnerability description text part; then, considering that seven evaluation tasks have certain relevance, when feature representation of codes and texts is learned, a cross-task attention mechanism is introduced to capture relevance features among the tasks; and finally, carrying out weighted summation on the probability predicted by the classifiers at the code level and the text level to obtain a prediction result of final vulnerability assessment.

The invention provides an evidence-driven large language model MISRA C rule review method and system for aviation safety. According to the method, formalized feature extraction is carried out from four aspects of grammar structure features, semantic structure features, logic analysis features and preprocessing behavior features for target codes according to various rules of MISRA C forcing class rules, and diagnosis information is diagnosed in combination with an industrial-grade compiler; generating a structured evidence set comprising abstract syntax tree node statistical features, code context structure features, control flow graph features, function internal data flow analysis features, symbol and type table features and macro definition analysis features; and based on the structured evidence set and the large language model, executing evidence tracing, rule matching and logical reasoning according to a preset thinking chain process, and outputting a structured judgment result containing illegal rule numbers, evidence description and code positions. According to the method, the false alarm rate can be remarkably reduced while the high rule coverage rate and the detection accuracy are kept.

A method of detecting malicious behavior in a malicious behavior detection apparatus that detects malicious behavior by analyzing the code of a program, comprises generating a first control flow graph (CFG) by performing dynamic analysis on the program, generating a second CFG by extracting a code block that is likely to be executed by a conditional branch instruction included in the program, and comparing the first CFG and the second CFG to detect hidden code included in the program, and detecting a malicious behavior of the program by determining whether the detected hidden code is a malicious code. According to the constitutions, the time it takes to discover and respond to new types of malicious code can be shorten by extracting hidden code related to the malicious behavior and detecting malicious behavior.

The invention discloses an intelligent contract vulnerability detection method based on multi-view learning. The method comprises the following steps: statically analyzing an intelligent contract to obtain an abstract syntax tree, a control flow diagram and a data flow diagram of three representation modes of an intelligent contract source code; noise codes except for calling external functions and variable positions are pruned for different representation modes, and features of the noise codes are obtained; abstract syntax tree features are learned through an extended recurrent neural network, and features of a control flow graph and a data flow graph are learned through a graph attention network; and detecting the vulnerability of the smart contract based on the final feature obtained by fusing the three features. According to the intelligent contract vulnerability detection method based on multi-view learning, the indicative features of vulnerabilities can be captured from codes more comprehensively, redundant noise is reduced, and the performance and effect of intelligent contract vulnerability detection are improved.

The invention relates to the technical field of computers, in particular to a metamorphic relation identification method based on program dependency graph features. The method comprises the following steps: obtaining a control flow graph (CFG) of a target program, and obtaining a control dependency graph according to the control flow graph and a forward dominating tree; obtaining a program dependency graph according to the control dependency graph and the data dependency relationship; according to a program analysis requirement slicing criterion C = (N, V) of a target program, graph traversal is conducted on the program dependency graph, program slicing features are obtained, N represents instructions in the target program, and V represents a variable set; and inputting the program slice features into a target prediction model for identification, and obtaining a prediction result corresponding to the metamorphic relationship of the target program. By the adoption of the method and device, the metamorphic relation obtaining accuracy can be improved, the situation that the metamorphic relation cannot be obtained is reduced, program testing convenience can be improved, and software quality is improved.

The application discloses a code verification method and device based on path traversal, a medium and equipment. The method finds all paths from the program entrance to the target statement with a path length not exceeding K in a control flow graph through a loop body step decomposition manner, and forms a path set. Then, the paths are traversed, and reachability verification is performed on the traversed paths. When the paths are subjected to reachability verification, array variables are simplified into array elements through expression simplification calculation, and operations related to the array variables are expanded into SMT constraint expressions related to the array elements in combination with variable constraint replacement, so that the SMT constraint solving can process variables related to arrays, the complexity of the SMT constraint solving is reduced, the solving and analysis of unreachable path segments are avoided, and the analysis efficiency is improved.

The invention relates to the technical field of software security, and discloses an intelligent code maintenance method and system based on fusion of a large model and static analysis. An intelligent code maintenance method based on large model and static analysis fusion comprises the following steps: S1, a data analysis step: receiving multi-source heterogeneous code input, and converting the multi-source heterogeneous code input into a program representation which can be understood and processed by a subsequent detection engine and is rich in structured information; the multi-source heterogeneous code input content comprises a code warehouse, a local file and an analysis rule; s2, constructing a global program map, and constructing the global program map on the basis of the abstract syntax tree; the global program graph comprises a control flow graph, a data flow graph and a function call dependency graph, and is used for describing a call relation between functions, a variable transfer path and program execution logic. According to the method, the defect detection precision is remarkably improved, and the technical problem of high false alarm rate is effectively solved.

The application relates to the technical field of software test automation, and provides a requirement-driven test case automatic generation method and system based on a semantic test graph, which comprises the following steps: performing multidimensional static analysis on source code, respectively constructing an abstract syntax tree, a control flow graph and a function call graph, and extracting function call relations and data flow dependency relations; constructing a semantic test graph by taking functions as nodes, taking function call relations as main edges and taking data flow dependency relations as auxiliary edges, and aggregating function nodes in the semantic test graph into several function modules; obtaining several test requirement nodes, calculating semantic similarity between the test requirement nodes and the function modules, establishing a mapping relationship from the test requirement nodes to the function modules, and forming a requirement-program structure association graph; and based on the requirement-program structure association graph, generating a test intention for each test requirement node, and converting the test intention into an executable test case. The highly corresponding relationship between the generated test case and the business requirement is ensured.

The application relates to the technical field of computer network information security, and discloses an intelligent analysis and judgment system for network security vulnerability detection, which comprises the following modules: a state acquisition and marking module, which extracts a microstate feature vector and assigns a binary stain label based on a propagation condition to generate a high-dimensional point cloud set with labels; a semantic topology reconstruction module, which extracts a control flow graph and a data dependency graph, and generates a non-Euclidean distance weight matrix in combination with Euclidean numerical differences; a relative homology calculation module, which divides a trusted subspace and a full-amount topology space according to the non-Euclidean distance weight matrix to generate relative topological invariant data; and a vulnerability analysis and judgment module, which constructs a high-dimensional continuous bar graph, generates a vulnerability triggering alarm signal when a Wasserstein topology distance exceeds a dynamic security threshold value, and generates a topology deformation gradient to be fed back to a fuzzy test engine. The application eliminates normal execution background interference, and realizes high-precision identification of deep vulnerabilities and intelligent guidance of a test direction.

The present disclosure provides a method and device for restoring obfuscation of an Android string, a computer device and a medium, comprising: converting intermediate bytecode of an Android application installation package data into a first representation file and a second representation file; performing semantic understanding on the second representation file to obtain a control flow graph corresponding to a target method body; identifying obfuscation points based on the control flow graph corresponding to the target method body to obtain a plurality of target candidate sentences; generating a corresponding slice standard representation for each target candidate sentence; reversely constructing a program dependency chain based on the plurality of target candidate sentences to obtain a data flow graph structure; determining a minimum code subset based on the data flow graph structure and the slice standard representation corresponding to each target candidate sentence; performing a reorganization operation on the minimum code subset to generate a subprogram; embedding the subprogram into a class file to obtain a target class file; and executing the target class file through the first representation file to obtain a decrypted string. Thus, the success rate of string decryption is improved.

The invention provides a binary program static analysis method based on a comprehensive control flow diagram. According to the scheme, the method comprises preprocessing, a control flow diagram generation module, a reverse control flow diagram generation module, target address ambiguity instruction recognition and a specific basic block path. The control flow diagram generation module obtains binary program information through preprocessing and generates a control flow diagram by using a breadth-first search algorithm. The reverse control flow diagram generation module initializes a reverse control flow diagram and generates a reverse edge by traversing the control flow diagram. A target address ambiguity instruction analysis module identifies a target address ambiguity jump or call instruction in the basic block. The specific basic block path analysis module uses a path search algorithm to obtain all paths of a specific basic block, and analyzes execution conditions of the paths through a symbolic execution technology. According to the method, the binary program can be comprehensively analyzed, the analysis efficiency and accuracy are improved, and powerful support is provided for software security and quality improvement.