6 results about "Misuse detection" patented technology

The application discloses a resource management API constraint extraction method and system based on a large language model, and belongs to the technical field of software automation analysis. In order to solve the illusion problem caused by directly using a large model to analyze API constraints, the application extracts function declarations and resource management sentences from API documents; constructs a multi-dimensional prompt template to obtain API allocation judgment results and reasoning processes; extracts core predicates of reasoning text and performs consistency verification to correct illusions; structures function declarations and extracts resource object types in combination with semantics; searches for paired release functions by taking the object types as constraints, and outputs API pairs; and finally performs resource misuse detection based on the API pairs through static analysis. The application can significantly reduce model output errors, improve release function searching accuracy, has strong anti-illusion ability and high automation degree.

The application discloses an API misuse detection method and device based on frequent subgraph mining, and the method comprises the following steps: a data set containing a plurality of API source codes is constructed, and at least one API path is generated from each API source code; based on the occurrence frequency of each subgraph in all API paths, an API path mode set corresponding to the data set is obtained; the API path of a to-be-detected source code is subjected to subgraph matching with the API path mode set, so as to obtain an API misuse detection result of the to-be-detected source code. The application can reduce the cost of manual work, expand the detection range, and enhance software security.

This invention discloses a method and system for detecting cryptographic misuse in open-source software based on a large language model, belonging to the field of computer data processing technology. First, the source code of the program under test is parsed to generate a hierarchical function call graph, and file-level components containing call points are selected. Then, a first cue word guides the large language model to determine whether the component is related to cryptographic functions, and a second cue word identifies the user-defined key cryptographic function for the relevant component. Next, parameter analysis and backward data flow tracing are performed on the function to generate function call path slices. Then, a third cue word guides the large language model to analyze the slices, generating a preliminary set of cryptographic misuse reports. Finally, a fourth cue word guides the large language model to calibrate the preliminary reports in conjunction with the code slices, outputting the final misuse report. This invention integrates the advantages of static analysis and a large language model, enabling more comprehensive detection of cryptographic misuse and effectively reducing the false positive rate.

The application discloses a kind of method and system for detecting application program interface misuse, belong to computer software technical field.The present application is to solve the technical problems that the API use specification depends on manual writing, the coverage is insufficient, the misuse detection capability is limited, mainly using the call chain analysis based on seed specification, key variable flow tracking, data flow verification and iteration expansion mechanism, automatically generating API use specification, and being used for static detection program API calling behavior not following specification.The present application can realize the efficient identification and accurate report of API misuse behavior, improve the security and reliability of software system.

The application discloses an API misuse detection method and system based on a large language model, and belongs to the technical field of software security. In order to solve the problem that API misuse detection in the prior art relies on manual rules and has a limited coverage, the application mainly generates API usage specifications by analyzing API source codes based on a large language model, verifies the correctness of the specifications by automatically constructing API calling codes that violate the specifications and combining dynamic execution and static analysis means, and then generates refined usage specifications and constructs detection codes to realize misuse identification. The application can automatically detect API misuse behaviors in application software, including null pointer dereferencing, memory leakage and double release, and the like, and improves the security and robustness of software.

The application discloses a kind of based on graph structure code slice detection android cryptography misuse method and device, method includes the following steps: to the Android application to be detected is reversed, and source code is obtained;The source code program dependency graph of Android application is obtained and graph structure slice is carried out, and encrypted misuse candidate graph structured code slice is obtained;Characterize cryptography misuse candidate graph structured code slice, and its graph information is characterized as the data set learned as neural network model;Neural network model training is carried out using data set;The trained neural network model is used to detect Android application, and cryptography misuse result is output.The application extracts graph structure source code slice according to cryptography misuse characteristics by source code program dependency graph, and cryptography misuse detection work is carried out using graph neural network model after graph structure slice information is characterized, to realize the detection of encryption misuse of Android application, and the potential threat of encryption misuse in Android application is discovered in time.