24 results about "Static program analysis" patented technology

The invention provides an Android application task automation method based on a user interaction description diagram, and belongs to the technical field of automation. Comprising the steps that a first stage comprises user interaction description graph generation and aims at obtaining a user interaction description graph of an application; and outputting the user interaction description diagram of the application by taking the Android project as input. And the second stage comprises task execution path planning and adaptive interactive operation generation. According to the method, static program analysis is combined with the semantic reasoning ability of the LLM, the structured user interaction description graph is automatically constructed from the source code of the target application, the user interface elements, the interaction logic and the state jump relation are covered, and the problems of operation blindness and the like caused by lack of application prior knowledge before task execution of the LLM are solved. An initial operation instruction sequence can be generated in combination with user task requirements; through an adaptive instruction re-planning mechanism, state fault tolerance and path optimization in a task execution process are realized, and the task completion rate in a complex scene is remarkably improved.

The invention discloses an enhanced thinking chain prompt software vulnerability detection method based on ChatGPT, which analyzes and extracts abstract syntax tree information of a source code through a static program, and helps a large model to generate more reliable and efficient code feature auxiliary information. Meanwhile, an enhanced thinking chain prompt process is provided, the model learns specific reasoning steps through a Few-shot learning strategy, the randomness and illusion of the model are reduced, the model is guided to recognize and analyze vulnerability semantics, locate vulnerability positions and judge vulnerability types under step-by-step reasoning by designing specific prompt words, the accuracy of model output is improved, and the method is suitable for popularization and application. And the model is required to feed back an analysis result by using a self-verification strategy, so that the false alarm rate of the model is reduced.

The invention relates to the technical field of software engineering and information processing, in particular to a semantic verification method and device based on a large model.The method comprises the steps that a source code file and a corresponding software requirement and design document are obtained, code semantic representation is generated based on grammar analysis and static program analysis, and a semantic verification result is obtained; based on text analysis and business flow chart structure identification, generating a design demand semantic representation; respectively inputting the code semantic representation and the design demand semantic representation into a pre-training language large model to generate a code implementation logic description and a design demand logic description; and performing semantic consistency verification on the two types of logic descriptions to obtain a semantic inconsistency result, determining a code position in the source code file based on the semantic inconsistency result, and outputting a scanning report. According to the invention, the automation degree and the rechecking performance of consistency checking of requirements can be improved, and the leak detection and reworking cost can be reduced.

The invention provides a code vulnerability repair method based on static program analysis, and relates to the technical field of code vulnerability repair. Basic vulnerability information of a target code is acquired; extracting a vulnerability pollution path, performing node extraction on the vulnerability pollution path to obtain a plurality of pollution propagation nodes, and determining logic code information of each pollution propagation node through the target code; performing semantic extraction on each piece of logic code information to obtain a code semantic feature vector of each pollution propagation node, performing neighborhood coding on each code semantic feature vector to obtain a corresponding code context representation, and generating a logic code context of the target code according to all the code context representations; according to the method, the target code is subjected to vulnerability repair based on the large language model, the vulnerability pollution path and the logic code context, and the context quality required by vulnerability repair can be improved by utilizing static program analysis, so that the generation result quality of the large language model in the code vulnerability repair process is improved.

The invention relates to a structured query statement protection method and a computer program product. The method comprises the following steps: performing static program analysis on source code data of a network application program to obtain a static analysis result; extracting an interface parameter called by a database programming interface function in the source code data according to a static analysis result, and reversely querying definition data of the interface parameter in the source code data under the condition that the interface parameter is a variable, determining a structured query statement and the position of the structured query statement in the source code data according to the definition data of the interface parameters; and according to the structured query statement and the position of the structured query statement, adding a randomized tag to the keyword of the structured query statement so as to obtain the randomized structured query statement according to the randomized tag. By adopting the method, the problems of poor generality, low accuracy and low processing efficiency of SQL statement randomization can be solved at the same time.

The invention provides a Java deserialization vulnerability mining method and device, and the method comprises the steps: carrying out the static analysis of a Java program file of a to-be-tested software system, so as to construct a program feature map for the Java program file; searching the program feature map to search for a suspicious function call sequence; evaluating the suspicious function call sequence, and updating the program feature map in real time according to an evaluation result; and searching the program feature map updated in real time, and if the search output is a complete call sequence from a deserialization function to a danger function, generating an effective load corresponding to the complete call sequence in a three-dimensional variation mode according to a search result. According to the method, the dynamic test result is utilized to improve the program feature map obtained by static program analysis, the dynamic search strategy is used on the program feature map to screen the suspicious function call sequence, and the search result is more thoroughly verified, so that the accuracy and efficiency of Java deserialization vulnerability mining are improved.

The invention provides an inline assembly code analysis method and system based on large language model assistance. The inline assembly code analysis method comprises the steps that the position of an inline assembly code potentially influencing the static program analysis effect is positioned and measured in a C source code item; target code abstract point selection: constructing a calling graph based on the identified inline assembly code and selecting a position suitable for code abstract in the graph; automatic code abstract generation assisted by the large language model: guiding the large language model to analyze an inline assembly function through a cue word project and generating a code abstract in a specific format; verifying the correctness of the code abstract, namely checking the correctness of the generated code abstract through methods such as large language model self-verification; and deploying and applying the code abstract, namely deploying and applying the verified code abstract in the program analysis framework to be optimized. The method is used for overcoming the defect that an existing source code level static program analysis framework has difficulty in cross-language analysis between a source code and an inline assembly code.

The present invention discloses a method for reducing the synchronization load of an Android activity management service based on escape analysis, and belongs to the technical field of Android systems. The present invention comprises: performing a static analysis based on escape analysis on an AMS source code, extracting object access information in the code; dividing the synchronization blocks into equivalence classes according to the object access information and the synchronization locks of each synchronization block; dividing the synchronization blocks with intersections of access objects into the same equivalence class, and the access object sets of synchronization blocks of different equivalence classes do not intersect each other; according to the equivalence class division result, reallocating the synchronization locks of the synchronization blocks in the code, so that different equivalence classes use different synchronization locks, and then outputting the optimized AMS code. The present invention optimizes the synchronization locks, so that synchronization blocks that were originally not parallel can be executed in parallel, thereby significantly improving the execution efficiency of the system, and can be completed in the static analysis stage of the program before the system is deployed, without increasing the load of the system during operation.

The invention discloses a static analysis tool test case generation method based on a program slicing technology, which comprises the following steps: step 1) according to a defect report of a static analysis tool, collecting and extracting variable information related to generation of a specific defect in a program as a slicing criterion; 2) through control flow analysis and data flow analysis, recording data and a control dependency relationship between statements, constructing a program dependency graph, and calculating a statement set having a dependency relationship with a slicing criterion; 3) positioning nodes corresponding to the statement set in the abstract syntax tree of the source code through a depth-first search algorithm, and deleting other nodes; the method comprises the following steps of (1) collecting a user-defined type or an external function declaration which is used through static program analysis, and outputting the type definition and the function declaration to an independent header file, and (5) writing edited codes into a file, and clearing redundant information to serve as a test case, the method adopts two-section analysis, and the test case can be generated efficiently and precisely.

The present invention discloses a kernel data competition detection method based on static program analysis and fuzzy testing. The method identifies shared resources in the code through static program analysis, obtains access operations for shared resources, records the read and write properties of the access operations, and determines access pairs of potential data competition. By analyzing the semantics of kernel synchronization primitives, shared resource access pairs that are unlikely to generate thread interleaving are filtered to generate a more accurate data competition pair set. Kernel resources and system calls are identified through static analysis, and a system call dependency graph is constructed. The data competition pair set and the system call dependency graph are used to guide the generation and mutation of kernel fuzzy test cases. A thread-aware fuzzy test generator is used to randomize the priority of threads to explore thread interleaving, and runtime feedback information is used to update the edge weights of the dependency graph, improve the system call dependency graph, and guide the mutation of subsequent fuzzy test inputs.

The invention discloses an automatic function abstract generation method based on a large model. The method comprises the following steps: step 1) designing an abstract grammar and a related analysis tool in an EBNF (Extended Bass Normal Form) form; 2) aiming at input information of a function to be abstracted, screening similar use cases, grammar information and semantics of each instruction in abstract definition from the abstract knowledge base, and constructing cue words by using modeling knowledge such as methods; 3) transmitting the cue word to the large model and extracting a function abstract from the output of the large model; 4) performing grammar test and semantic test on the function abstract generated by the large model in the step 3), if the test is passed, entering the next step, otherwise, repeating the step 3), transmitting error information to the large model, and regenerating the abstract; 5, when a tripartite library function is encountered, a matched abstract is searched from the abstract library according to a function signature, the abstract is analyzed into a data structure convenient to use by a static analysis tool based on the constructed analysis tool, substitution operation is carried out, and simulation of the side effect of the function is achieved.By means of the method, the precision of static program analysis can be improved.

This invention provides a method and system for inline assembly code analysis based on a large language model (LLM), comprising: locating and measuring the positions of inline assembly code that may affect the static program analysis effect in a C source code project; selecting target code summary points by constructing a call graph based on the identified inline assembly code and selecting suitable positions for code summarization within the graph; generating automated code summaries with LLM assistance by guiding the LLM to analyze the functionality of inline assembly through prompt word engineering and generating code summaries in a specific format; verifying the correctness of the code summaries by checking the correctness of the generated code summaries through methods such as self-verification by the LLM; and deploying and applying the verified code summaries in the program analysis framework to be optimized. This invention overcomes the shortcomings of existing source code-level static program analysis frameworks in handling the difficult cross-language analysis between source code and inline assembly code.

The invention relates to the technical field of security threat monitoring, in particular to a system security threat monitoring method and system. Comprising the following steps: S1, converting a source code project file and an application program into corresponding intermediate language files; s2, performing static analysis on the intermediate language file based on a static program slicing method of an improved system dependency graph (SDG); s3, carrying out visual statistics and display on an analysis result, and accurately identifying a line number in the source code; s4, generating a corresponding analysis report to display the influenced component and the security dynamic state thereof, and detecting detailed information and influence range of the vulnerability; existing static program analysis is improved, whether codes conform to related regulation and national standard coding specifications or not can be found, by improving a static program slicing method based on a system dependency graph SDG, time complexity is remarkably reduced, universality is enhanced by adopting an intermediate language file so as to adapt to various programming languages, and the method has the advantages of being high in practicability and easy to popularize. And wider support is provided for static analysis.

The present invention relates to an Android code smell coexistence detection method that integrates static program analysis and machine learning. The purpose of the present invention is to solve the problem of low accuracy of existing methods in detecting Android code smell coexistence. The process is as follows: 1. Obtain a sample set as a labeled data set: download Android applications from an open source code library as a code corpus; parse the Android application source code to generate an abstract syntax tree of the code; use a static program analysis method to detect MC smells; based on the MC smell detection results, use a static program analysis method to detect the coexistence of MIM and MC smells; use two nested hash tables to store the smell detection results; generate a sample set based on automatically generated positive and negative samples; 2. Obtain a processed data set; 3. Obtain a trained deep neural network classifier; 4. Detect whether code smell coexistence exists in the Android code smell to be tested. The present invention is used in the field of code smell coexistence detection.

This application discloses a static program analysis method for the Spring Boot framework, including constructing an annotation model and a configuration property model; the annotation model is configured to parse annotations; the configuration property model is configured to provide a unified hierarchical key-value representation structure for configuration files of different formats; establishing a mapping set between annotations and configuration files and pointer analysis side effect handling logic; generating an intermediate representation in the form of a corresponding three-address code based on the target program to be analyzed; performing pointer analysis based on framework characteristics on the intermediate representation, and triggering the corresponding side effect handling logic according to the mapping set, completing missing pointer edges on the pointer flow graph, and completing implicit call relationships on the method call graph; obtaining a complete pointer flow graph and method call graph; and performing static program analysis based on the complete pointer flow graph and method call graph. This solves the problem of missing core components in static analysis due to auto-configuration in Spring Boot applications.

The invention discloses an Android code peculiar smell coexistence detection method fusing static program analysis and machine learning, and relates to a code peculiar smell coexistence detection method. The objective of the invention is to solve the problem of low detection accuracy of Android code peculiar smell coexistence by an existing method. The method comprises the following steps of: 1, acquiring a sample set as a label data set: downloading an Android application program from an open source code library as a code corpus; analyzing the Android application program source code to generate an abstract syntax tree of the code; detecting MC peculiar smell by using a static program analysis method; detecting MIM and MC peculiar smell coexistence by adopting a static program analysis method based on an MC peculiar smell detection result; two nested hash tables are used for storing peculiar smell detection results; generating a sample set based on automatically generated positive and negative samples; 2, obtaining a processed data set; 3, obtaining a trained deep neural network classifier; and 4, detecting whether code peculiar smell coexistence exists in the to-be-detected Android code peculiar smell or not. The method is applied to the field of code odor coexistence detection.

The present invention discloses a method and device for security analysis of IoT smart home scenarios, which are used to solve the problem that the security analysis of IoT platforms has limitations in monitoring range and is difficult to analyze when facing multiple IoT platforms. The method includes: static program analysis of IoT application source code to extract device entities and linkage rules; identification of description texts of IoT device functions and IoT application uses to obtain IoT physical channels; construction of an IoT model composed of entity units based on device entities, linkage rules and IoT physical channels; in the IoT model, a depth-first algorithm is used to detect whether there is a path between the trigger entity units in the linkage rules, and whether the trigger entity units of different IoT applications have accessibility to the same functional attributes or physical channels, thereby determining the risk factors of IoT smart home scenarios.

The application discloses a code pre-training model training method based on program dependency graph prediction, which predicts the program dependency graph of code in the pre-training stage, helps the pre-training model to perceive and capture the semantic structure features of the code, and improves the performance of downstream tasks sensitive to the semantic structure of the code. The method first extracts the program dependency graph of the code by using a static program analysis tool and constructs pre-training supervision information according to the program dependency graph, then encodes the code into a real value feature vector sequence by using a neural network encoder, and predicts the program dependency graph of the code based on the feature vector sequence, and finally updates the weight of the model according to the difference between the prediction result and the actual program dependency graph. The pre-trained model can be directly used for program dependency analysis, and the massive code can be quickly analyzed by using a parallel processor such as a GPU, and the pre-trained model can also be used for downstream tasks sensitive to the semantic structure of the code after fine tuning, such as vulnerability analysis related tasks and the like.

The present invention discloses a method for calculating the upper bound of a loop based on high-precision static program analysis. Step 1: Locate the loop statements in the program and identify the loop control variables. Step 2: Analyze the data dependence relationship of the loop variables. Step 3: Analyze the possible values of the variables in the loop upper bound dependence expression. Step 4: Recursively calculate the possible values of the loop dependence expression, where for the ordinary variables in the expression, the method of Step 3 is called to analyze the specific values. Step 5: Calculate the final result according to the formula for the loop upper bound summarized by the loop structure. This method can analyze the actual parameters at the call point for the case where the loop-related variables come from formal parameters. This method can calculate the results of complex expressions formed by permutations and combinations of some frequently used basic expressions. This method can calculate the case where the loop-related variables of the inner loop are the outer loop control variables, and can give more accurate results for some nested loops with frequently used patterns.

According to the static program analysis abstract domain optimization method based on multi-objective optimization and parallel solution, a parallelization method is utilized, interval analysis of program variables is modeled into a multi-objective optimization problem by constructing a multi-objective optimization model, and objective and accurate solution is achieved by using a mathematical method. A bit vector constraint formula is converted into a conjunctive normal form CNF, so that an efficient SAT solver is supported, and the solving efficiency is improved; the CNF structure allows application clause simplification and conflict-driven clause learning, and the solution process can be accelerated. By using a parallel optimization method, the optimal value of each target under the constraint of the conjunctive normal form CNF is solved in a multi-thread parallel mode, the performance of a multi-core processor is fully utilized, and the solving time is shortened; a task scheduling algorithm is used for balancing thread loads, idle cores are avoided, and hardware performance is maximized. An optimal abstract domain analysis program is used, the precision of program analysis is improved, and misinformation and missing report of program analysis are reduced; and the program analysis time is shortened.

The invention discloses a static program analysis method for inter-language interaction behaviors in a multi-language program, which comprises the following steps of: constructing a uniform expression model of analysis results of a Java pointer analysis framework and a C pointer analysis framework, and simultaneously modeling inter-language interaction interfaces defined in various Java local interface specifications; the analysis result of the Java pointer analysis framework and the C pointer analysis framework at the inter-language interaction point can be represented by the representation model and perceived by the pointer analysis framework of the other party, so that the pointer analysis framework of the other party can analyze specific inter-language interaction behaviors according to modeling of the inter-language interaction interface. In addition, the method can be used for being combined with a current most advanced pointer analysis framework, and the accuracy and efficiency of inter-language interaction behavior analysis are improved. Through the method, a more complete analysis result is expected to be provided for applications such as program security analysis and defect detection.

The invention belongs to the technical field of software security, and particularly discloses a vulnerability verification method, device and equipment based on large model and static program analysis. According to the method and the device, the target large model is called, and the key variable conforming to the vulnerability feature is determined according to the initial vulnerability information and the source code; generating a target slice code according to a static program analysis strategy and the key variable, and performing substantial vulnerability verification on the target slice code by calling a target large model; and performing formalized verification on the path condition of the target slice code according to the accessibility detection strategy, and determining a verification result of the to-be-verified vulnerability according to the substantial vulnerability verification result and the formalized verification result. Through the above mode, a cross validation mechanism is formed by the target large model and the static program analysis strategy, the limitation of static analysis is made up by calling the target large model to perform context sensing, and vulnerability validation is performed from a substantial dimension and a formalized dimension, so that the accuracy of vulnerability validation can be effectively improved.

The invention discloses a depth code model robustness improvement method and system based on code normalization, and the method comprises the steps: recognizing all identifiers in a code through a static program analysis technology, and replacing the identifiers with meaningless placeholders, so as to eliminate potential attack features; on the basis of the context understanding capability of a large language model, semantic reconstruction is carried out on placeholders, meaningful identifier names are generated, and code semantic information is recovered; using standardized training data to perform distribution alignment fine adjustment on the model, and adopting the same preprocessing process in the reasoning stage to ensure input distribution consistency. According to the method, on three code tasks (clone detection, defect prediction and vulnerability detection) and four mainstream models, the average experience robustness of multiple attack methods is improved by 15.4%-126.0%, and the method is superior to an existing defense method under the condition of 87.9% in 33 test scenes.

The present disclosure provides a method and device for analyzing function call relationship under micro-service architecture, and relates to the technical field of computer, in particular to the field of static program analysis. The specific implementation scheme is as follows: a plurality of functions are obtained as static pointer analysis starting points; static program analysis is performed on a target code library according to the static pointer analysis starting points, and a function call graph is generated according to an analysis result, the function call graph including a plurality of call edges determined based on the static pointer analysis starting points, the call edges being used to represent function call relationship of function calls performed by the static pointer analysis starting points as caller nodes; a plurality of call edges included in the function call graph are traversed to obtain target call edges stored in a graph database.