8 results about "Static program analysis" patented technology

The invention relates to the technical field of software engineering and information processing, in particular to a semantic verification method and device based on a large model.The method comprises the steps that a source code file and a corresponding software requirement and design document are obtained, code semantic representation is generated based on grammar analysis and static program analysis, and a semantic verification result is obtained; based on text analysis and business flow chart structure identification, generating a design demand semantic representation; respectively inputting the code semantic representation and the design demand semantic representation into a pre-training language large model to generate a code implementation logic description and a design demand logic description; and performing semantic consistency verification on the two types of logic descriptions to obtain a semantic inconsistency result, determining a code position in the source code file based on the semantic inconsistency result, and outputting a scanning report. According to the invention, the automation degree and the rechecking performance of consistency checking of requirements can be improved, and the leak detection and reworking cost can be reduced.

The invention discloses a static analysis tool test case generation method based on a program slicing technology, which comprises the following steps: step 1) according to a defect report of a static analysis tool, collecting and extracting variable information related to generation of a specific defect in a program as a slicing criterion; 2) through control flow analysis and data flow analysis, recording data and a control dependency relationship between statements, constructing a program dependency graph, and calculating a statement set having a dependency relationship with a slicing criterion; 3) positioning nodes corresponding to the statement set in the abstract syntax tree of the source code through a depth-first search algorithm, and deleting other nodes; the method comprises the following steps of (1) collecting a user-defined type or an external function declaration which is used through static program analysis, and outputting the type definition and the function declaration to an independent header file, and (5) writing edited codes into a file, and clearing redundant information to serve as a test case, the method adopts two-section analysis, and the test case can be generated efficiently and precisely.

The invention discloses an automatic function abstract generation method based on a large model. The method comprises the following steps: step 1) designing an abstract grammar and a related analysis tool in an EBNF (Extended Bass Normal Form) form; 2) aiming at input information of a function to be abstracted, screening similar use cases, grammar information and semantics of each instruction in abstract definition from the abstract knowledge base, and constructing cue words by using modeling knowledge such as methods; 3) transmitting the cue word to the large model and extracting a function abstract from the output of the large model; 4) performing grammar test and semantic test on the function abstract generated by the large model in the step 3), if the test is passed, entering the next step, otherwise, repeating the step 3), transmitting error information to the large model, and regenerating the abstract; 5, when a tripartite library function is encountered, a matched abstract is searched from the abstract library according to a function signature, the abstract is analyzed into a data structure convenient to use by a static analysis tool based on the constructed analysis tool, substitution operation is carried out, and simulation of the side effect of the function is achieved.By means of the method, the precision of static program analysis can be improved.

This application discloses a static program analysis method for the Spring Boot framework, including constructing an annotation model and a configuration property model; the annotation model is configured to parse annotations; the configuration property model is configured to provide a unified hierarchical key-value representation structure for configuration files of different formats; establishing a mapping set between annotations and configuration files and pointer analysis side effect handling logic; generating an intermediate representation in the form of a corresponding three-address code based on the target program to be analyzed; performing pointer analysis based on framework characteristics on the intermediate representation, and triggering the corresponding side effect handling logic according to the mapping set, completing missing pointer edges on the pointer flow graph, and completing implicit call relationships on the method call graph; obtaining a complete pointer flow graph and method call graph; and performing static program analysis based on the complete pointer flow graph and method call graph. This solves the problem of missing core components in static analysis due to auto-configuration in Spring Boot applications.

The application discloses a code pre-training model training method based on program dependency graph prediction, which predicts the program dependency graph of code in the pre-training stage, helps the pre-training model to perceive and capture the semantic structure features of the code, and improves the performance of downstream tasks sensitive to the semantic structure of the code. The method first extracts the program dependency graph of the code by using a static program analysis tool and constructs pre-training supervision information according to the program dependency graph, then encodes the code into a real value feature vector sequence by using a neural network encoder, and predicts the program dependency graph of the code based on the feature vector sequence, and finally updates the weight of the model according to the difference between the prediction result and the actual program dependency graph. The pre-trained model can be directly used for program dependency analysis, and the massive code can be quickly analyzed by using a parallel processor such as a GPU, and the pre-trained model can also be used for downstream tasks sensitive to the semantic structure of the code after fine tuning, such as vulnerability analysis related tasks and the like.

The invention belongs to the technical field of software security, and particularly discloses a vulnerability verification method, device and equipment based on large model and static program analysis. According to the method and the device, the target large model is called, and the key variable conforming to the vulnerability feature is determined according to the initial vulnerability information and the source code; generating a target slice code according to a static program analysis strategy and the key variable, and performing substantial vulnerability verification on the target slice code by calling a target large model; and performing formalized verification on the path condition of the target slice code according to the accessibility detection strategy, and determining a verification result of the to-be-verified vulnerability according to the substantial vulnerability verification result and the formalized verification result. Through the above mode, a cross validation mechanism is formed by the target large model and the static program analysis strategy, the limitation of static analysis is made up by calling the target large model to perform context sensing, and vulnerability validation is performed from a substantial dimension and a formalized dimension, so that the accuracy of vulnerability validation can be effectively improved.

The invention discloses a depth code model robustness improvement method and system based on code normalization, and the method comprises the steps: recognizing all identifiers in a code through a static program analysis technology, and replacing the identifiers with meaningless placeholders, so as to eliminate potential attack features; on the basis of the context understanding capability of a large language model, semantic reconstruction is carried out on placeholders, meaningful identifier names are generated, and code semantic information is recovered; using standardized training data to perform distribution alignment fine adjustment on the model, and adopting the same preprocessing process in the reasoning stage to ensure input distribution consistency. According to the method, on three code tasks (clone detection, defect prediction and vulnerability detection) and four mainstream models, the average experience robustness of multiple attack methods is improved by 15.4%-126.0%, and the method is superior to an existing defense method under the condition of 87.9% in 33 test scenes.

The present disclosure provides a method and device for analyzing function call relationship under micro-service architecture, and relates to the technical field of computer, in particular to the field of static program analysis. The specific implementation scheme is as follows: a plurality of functions are obtained as static pointer analysis starting points; static program analysis is performed on a target code library according to the static pointer analysis starting points, and a function call graph is generated according to an analysis result, the function call graph including a plurality of call edges determined based on the static pointer analysis starting points, the call edges being used to represent function call relationship of function calls performed by the static pointer analysis starting points as caller nodes; a plurality of call edges included in the function call graph are traversed to obtain target call edges stored in a graph database.