1853 results about "Vulnerability detection" patented technology

A vulnerability detection and repair system utilize a classifier model to detect a software vulnerability in a source code snippet and the tokens in the source code snippet attributable to the vulnerability. A large language model is then given the vulnerable source code snippet, its vulnerability type, the vulnerability tokens, and a few-shot examples to determine whether or not the source code snippet includes the identified vulnerability. The few-shot examples include positive and negative samples of the type of vulnerability to guide the large language model towards the correct output.

The present disclosure provides systems and methods that support identification of vulnerabilities within a dataset, such as an unknown binary, using customizable pipelines and workflows. The pipelines may be configured to apply various analysis techniques, including reverse engineering, machine learning / artificial intelligence, and other techniques to elicit various types of data and information from the unknown binary. The pipeline may include stages configured to analyze outputs of prior stages of the pipeline detect whether vulnerabilities or malicious code are present. Different stages of the pipeline may also be configured to initiate additional workflows for further analysis of the binary or intermediate representations of the binary output by prior stages of the pipeline. Additionally, the disclosed systems and methods provide functionality that enables generation of a reverse software bill of materials (SBOM) from an unknown binary or confirmation of contents of an existing SBOM.

The invention relates to the technical field of software engineering, in particular to a source code detection method, which comprises the steps of source code preprocessing, code dependency analysis, semantic understanding and analysis, code quality evaluation, dynamic behavior simulation, intelligent vulnerability detection and the like to realize comprehensive detection of potential vulnerabilities and quality problems in source codes. A support vector machine and a K-means clustering algorithm are combined, known and unknown vulnerabilities can be effectively recognized, in addition, a continuous optimization feedback mechanism is introduced, a mixed vulnerability detection model can be continuously optimized according to repair operation and feedback information of a developer, the detection accuracy is improved, and the coverage range is expanded. The generated comprehensive detection report covers code structures, vulnerability positioning, quality problems and optimization suggestions, supports integration of various output formats and development tool chains, helps developers to efficiently repair problems, and improves code quality and project progress; according to the method, the comprehensiveness, the self-adaptability and the user experience of code detection are effectively improved.

The invention discloses an unmanned aerial vehicle flight control system vulnerability detection method based on data flow analysis and LLM, and belongs to the technical field of intelligent software testing. Comprising the following steps: extracting a code function module associated with user operation in an unmanned aerial vehicle flight control system through a data flow analysis method, and establishing an operation-code mapping relation library; generating a structured natural language semantic description for each function module code by adopting a large language model LLM, and forming a multi-dimensional semantic feature vector; based on correlation analysis of multi-module semantic features, a combined test scene is constructed, and a natural language test case is generated; the natural language test case is converted into an executable test code through reverse semantic mapping, and coding reconstruction of test logic is completed; and executing a test code and capturing a runtime log in an unmanned aerial vehicle simulation environment, and performing vulnerability feature extraction and root cause positioning by using a large language model. According to the method, the efficiency is improved, and meanwhile, the deep coverage test of a complex interaction scene is supported.

Techniques for unknown exploit detection using attack traffic analysis and real-time attack event streaming are disclosed. In some embodiments, a system / process / computer program product for exploit detection using attack traffic analysis and real-time attack event streaming includes receiving a stream that includes a plurality of attack events from a security platform at a cloud security service; generating a cluster of attack events from the stream; and tagging the cluster with an unknown attack pattern for further automated security analysis at the cloud security service, wherein the tagged unknown attack pattern cluster does not match a preexisting signature for a known attack pattern.

The present application provides a vulnerability detection method, comprising: acquiring a target branch of a target API in a detected code; generating a test case of the target API on the basis of proof information of a vulnerability API, wherein the test case of the target API is used for testing whether the target API has a vulnerability; determining an original seed for performing fuzz testing on the target branch of the target API; inputting the original seed into the test case of the target API; testing the target branch by means of the test case into which the original seed is inputted; screening for a seed on the basis of a test result; mutating the screened seed, and then inputting the mutated seed into the test case of the target API; and performing the next round of testing on the target branch by means of the test case into which the mutated seed is inputted so as to detect the vulnerability in the detected code. According to the method, saturation fuzz testing is performed on a specific branch (i.e., the target branch) of a specific API in a detected code, thereby achieving the objective of triggering the vulnerability quickly, realizing efficient fuzz testing for a vulnerability discovery scenario, and improving the vulnerability discovery efficiency.

The invention discloses a big language model reasoning and retrieval enhancement-based vulnerability description and repair suggestion generation method, which comprises the following steps of: constructing a vulnerability knowledge base by integrating vulnerability databases such as CWE and CVE and an external knowledge source, providing prompt information of professional knowledge for a big language model, preprocessing a to-be-tested code by utilizing a code analysis tool, and generating a big language model reasoning and retrieval enhancement-based vulnerability description and repair suggestion. And extracting vulnerability knowledge most related to a to-be-detected code from the vulnerability knowledge base through semantic matching and code matching, generating detailed vulnerability description and repair suggestions by utilizing a large language model based on the related vulnerability knowledge obtained in the retrieval enhancement stage, and optimizing a generation result through a thinking chain technology. By combining the semantic comprehension ability, the retrieval enhancement technology and the reasoning enhancement technology of the large language model, detailed and targeted vulnerability description and repair suggestions can be quickly generated, the vulnerability repair efficiency is remarkably improved, and the method can be flexibly applied to existing vulnerability detection tools and is suitable for various programming languages and vulnerability types.

A neural classifier model is used to detect cybersecurity vulnerabilities in the source code predicted by a deep learning code generation model having been trained on source code possibly containing security bugs. Upon the classifier model classifying a given source code snippet as likely containing a cybersecurity vulnerability, a proposed repair for the cybersecurity vulnerability is predicted from a neural decoder transformer model having been trained on non-vulnerable source code. The neural decoder transformer model is used to predict source code that repairs the cybersecurity vulnerability given the source code classified with a cybersecurity vulnerability.

The invention relates to the technical field of software reliability guarantee, in particular to a code vulnerability detection method based on efficient parameter fine tuning of a code pre-training model, which comprises the following steps: preprocessing source codes of a vulnerability data set; s2, converting the preprocessed source code, and extracting a token sequence and a code attribute graph path corresponding to the source code; s3, constructing a code vulnerability detection model, wherein the code vulnerability detection model comprises a semantic feature extractor, a structural feature extractor, a feature fusion layer and a classifier; s4, jointly training a code vulnerability detection model by using the token sequence corresponding to the extracted source code and the code attribute graph path; and S5, through the optimized code vulnerability detection model, outputting a result that whether the source code to be detected has vulnerabilities or not. According to the method, the model is finely adjusted through efficient parameter fine adjustment, training resources are saved, good performance is obtained, and the code vulnerability detection efficiency and accuracy are improved by fusing and learning semantic and structural features of source codes at the same time.

The present disclosure relates to a system and method for vulnerability localization based on deep learning, which comprises, at a minimum, a processor configured to: analyze a code file under detection to obtain a first abstract syntax tree devoid of semantic information; build upon the first abstract syntax tree by incorporating data-flow edges and / or control-flow edges, thereby forming a second abstract syntax tree with semantic-flow enhancement; split the second abstract syntax tree to obtain a plurality of second abstract syntax sub-trees; and input these second abstract syntax sub-trees into a pre-established vulnerability detection and localization model. Compared with existing code vulnerability detection methods, the present disclosure employs a semantically-enhanced abstract syntax tree and finely-grained segmentation thereof, enabling both the efficient detection and accurate localization of code vulnerabilities, characterized by swift detection rates, low false positive rates, and commendable interpretability of the detection results.

A method of code vulnerability detection includes obtaining a set of patches from at least one code repository for a vulnerability record of a vulnerability of a software component, applying the set of patches to obtain a modified set of code files modified by the set of patches, and inferring a vulnerable code section set according to the modified set of code files. The vulnerable code section set is a subset of the modified set of code files. The method further includes obtaining a vulnerable version list of a plurality of versions of the software component comprising the vulnerability, validating a version in the vulnerable version list as having the vulnerable code section set, and processing a target software comprising the version using the vulnerable code section set.

Systems and methods for detecting vulnerabilities in software in real time. In some aspects, the system receives a training dataset, including first source code, first runtime data flow, a set of sample vulnerable libraries, and a set of sample replacement software libraries. Using the training dataset, the system trains a vulnerability detection model. The system receives second source code being tested in a development environment and collects the second source code and second runtime data flow. The system processes the second source code and second runtime data flow using the vulnerability detection model to identify novel vulnerable software libraries and / or known vulnerable software libraries. The system generates suggestions to replace the known and / or novel vulnerable software libraries. In response to detecting a user choosing a first replacement library in place of a first vulnerable library, the system replaces the first vulnerable library with the first replacement library.

The invention discloses a deep learning artificial intelligence security vulnerability detection platform, and relates to the technical field of intelligent detection, and the platform comprises an information processing module which collects heterogeneous data in real time, carries out the labeling, format unification and modal aggregation processing of the data, and generates a sample set; the feature learning module is used for performing feature unwrapping on the sample set by using a variational auto-encoder, extracting modal data features and potential space representation learning, and outputting a potential space vector; the response generation module is used for generating a vulnerability response strategy through a modal consistency verification and response template matching mechanism based on the vulnerability risk level vector in combination with a response generation engine; and the repair feedback module is used for executing automatic vulnerability repair operation in combination with federal reinforcement learning and Bayesian optimization, performing feedback optimization according to an execution result, and outputting the vulnerability repair operation and a feedback result. According to the method, the response strategy is combined with intelligent matching of the real-time risk level, so that the accuracy and adaptability of vulnerability repair are improved.

The invention discloses an information security risk assessment method based on an API. The method comprises the steps that API assets in an enterprise are obtained through flow analysis; identifying and positioning the log file or sensitive data in the file by using a sensitive data identification model; integrating the vulnerability rule set, and detecting vulnerability vulnerabilities existing on the API through an API vulnerability detection model; a behavior risk automatic monitoring engine is set, and real-time monitoring and early warning are carried out on the behavior of abnormally calling the AP I to obtain data; constructing a network attack monitoring model; drawing an API risk link relationship based on a risk monitoring model trained by historical monitoring data, and speculating a suspicious data leakage path in combination with clue association ranking analysis; performing comprehensive trace reserving on the API data use behavior; and calculating the risk by using a matrix method, and generating an API information security risk assessment report. Through the method, a comprehensive API security risk assessment system can be established, API security risks can be effectively identified and managed, and enterprise data security is protected.

The present invention relates to the technical field of blockchains. Disclosed are a smart-contract vulnerability detection method and system based on a hypergraph and multi-teacher distillation. Specifically, the smart-contract vulnerability detection method based on a hypergraph and multi-teacher distillation comprises: using a vulnerability detection open-source tool to perform vulnerability detection and analysis on source codes of a smart contract, and marking labels for the source codes of the smart contract; then, using a hypergraph to dynamically capture a deeper and richer relationship between the source codes, key functions and key variables in the smart contract, and on the basis of the hypergraph, training a plurality of vulnerability detection teacher models having excellent performance; and finally, using the plurality of vulnerability detection teacher models to perform knowledge distillation, so as to obtain a vulnerability detection student model, such that the vulnerability detection student model can also obtain knowledge without exposure to large-scale data, and thus directly applies the knowledge to vulnerability detection of new data. The smart-contract vulnerability detection method based on a hypergraph and multi-teacher distillation in the present invention can effectively detect various types of smart-contract vulnerabilities, and can effectively reduce the occupancy of storage space and improve the running speed.

The invention discloses a Web vulnerability scanning method, system and device and a medium, and the method comprises the steps: data collection: obtaining a source code and a configuration file of a target Web application, and data and historical vulnerability information of the application during operation; feature extraction: analyzing source codes to extract key function calling, parameter passing and control flow information, and constructing semantic representation of codes; analyzing runtime data, and constructing a comprehensive feature vector in combination with a static code analysis result; model training: matching the extracted features with known vulnerability tags to form a training set and a test set; a deep learning model is selected for training according to problem characteristics, and hyper-parameters are adjusted to optimize model performance; vulnerability detection: executing automatic scanning on the Web application to be detected, and judging whether vulnerabilities exist or not according to the features extracted in real time; and generating a report. According to the method, a comprehensive automatic process from data collection to vulnerability report generation is realized, the scanning efficiency and accuracy are remarkably improved, and the security risk is effectively reduced.

The invention relates to the technical field of vulnerability detection, and provides a fine-grained vulnerability detection method and system based on semantic perception sparse attention, and the method comprises the steps: analyzing a to-be-detected source code, and generating an abstract syntax tree, a control flow graph and a program dependency graph; carrying out weighted fusion on graph representations of the abstract syntax tree, the control flow graph and the program dependency graph, and integrating into a code attribute graph; for the code attribute graph, processing the code attribute graph by adopting a semantic perception sparse attention method combined with sparse attention, a learnable Token pruning method and Top-k interaction frequency to obtain a Token attention score; and based on the obtained Token attention scores, accumulating the attention score of each Token in each row of the code, and detecting and determining a statement where the vulnerability code is located. According to the detection method disclosed by the invention, the capability of modeling code semantic information and capturing a structured dependency relationship can be effectively improved, and meanwhile, the calculation complexity is remarkably reduced.

The invention discloses an intelligent contract vulnerability detection and repair system based on a heterogeneous graph neural network, and belongs to the technical field of block chain security, and the system comprises a contract analysis module, a multilayer graph construction module, a heterogeneous graph neural network module, a vulnerability feature library, a vulnerability recognition engine, an automatic repair module and a visual interface. After the source code of the intelligent contract is input, code analysis and standardization are completed by a contract analysis module; the multi-layer graph construction module constructs a contract internal heterogeneous graph, an inter-contract interaction graph and an ecosystem relation graph based on a graph theory; the heterogeneous graph neural network module learns a vulnerability feature mode; the vulnerability recognition engine combines the vulnerability feature library to realize vulnerability classification and risk assessment; the automatic repairing module generates a repairing scheme; and the visual interface realizes detection progress monitoring, result display and encrypted report export. The intelligent contract vulnerability detection and restoration system based on the heterogeneous graph neural network provided by the invention provides technical support for block chain digital asset security and ecological stability.

There are provided methods and apparatuses for a control flow execution-guided deep learning framework for binary code vulnerability detection. Reinforcement learning is to enhance the branching decision at every program state transition and create a dynamic environment to learn the dependency between a vulnerability and certain program states. An implicitly defined neural network enables state transition until convergence, which captures the structural information at a higher level.

The invention discloses a PHP taint type vulnerability detection method based on a heterogeneous graph neural network, and belongs to the field of software security. The method comprises the following steps: performing annotation removal, variable naming standardization and character string standardization processing on a PHP source code through a code preprocessing module to generate a standardized code; based on a vulnerability sub-attribute graph extraction module, reversely tracking vulnerability sinks to a taint source, extracting a simplified vulnerability sub-attribute graph, and removing redundant nodes and edges; fusing BERT semantic features and node type features through a graph node embedding module to generate an initial embedding vector, and constructing a heterogeneous graph comprising an abstract syntax tree edge, a program flow graph edge and a control dependence graph edge; a heterogeneous graph neural network vulnerability detection module is adopted to perform independent feature aggregation on multiple types of edges, dynamic weighted fusion is performed in combination with an attention mechanism, and key nodes are screened through Top-k graph pooling; and finally, inputting the graph-level features into a classifier to realize vulnerability detection.

An end-to-end approach for (i) identifying potential vulnerabilities in software applications, including security vulnerabilities, (ii) verifying / confirming the potential vulnerabilities as actual vulnerabilities and (iii) in response, identifying the necessary remedial actions necessary to eliminate or at least mitigate the vulnerabilities. An intelligent agent is implemented that is configured to detect a change to the application's code or computing environment and, as a result of detection of changes to the code or computing environment, identify potential vulnerabilities, verify / confirm the potential vulnerabilities as actual vulnerabilities through determination / creation of vulnerability test cases and automatically identify the necessary remedial actions necessary to eliminate or mitigate the vulnerabilities.

The invention is applicable to the technical field of vulnerability detection, and provides a power system software security vulnerability dynamic and static combined detection method, which comprises the following steps: acquiring static source code data of power system software and dynamic behavior log data during operation; generating a hierarchical abstract syntax tree and structured time series data; performing multi-dimensional feature extraction on the static source code data and the dynamic behavior log data based on a vulnerability knowledge graph of the power system; generating a domain constraint confrontation sample based on the power protocol features and the abnormal features during operation, and inputting the domain constraint confrontation sample into the constructed hybrid detection model for confrontation training to obtain a trained hybrid detection model; and performing automatic detection on the power system software by utilizing the trained hybrid detection model, and outputting a detection result containing a static code defect position and a dynamic attack path. The full-life-cycle accurate detection of the software vulnerability of the power system is realized, and the network security protection capability of the power system is improved.

A live mapping framework may be generated for large enterprise- wide networks and systems. The live mapping framework includes identification of key attributes of every device connected to the network. The key attributes may include device type, installed software packages, network connection information, device usage information, and other information. Frequent updates to the live mapping framework and trending over time enable the identification of system vulnerabilities. Generative and explainable Al may additional be used for penetration testing of virtual replicas of the enterprise- wide networks, leading to the generation of solution sets addressing the identified vulnerabilities.

Improved vulnerability detection in a cloud computing environment may be achieved by monitoring, by an agent executing in a compute asset of the cloud computing environment, one or more events associated with code deployed in the cloud computing environment; based at least in part on the one or more events, determining whether the code is active in the cloud computing environment; in response to the code being active, scanning the code to identify one or more vulnerabilities; and performing a notification in response to identifying one or more vulnerabilities.

The invention provides a firmware logic vulnerability detection method and system based on a big language model thinking chain, electronic equipment and a computer readable storage medium. The method comprises the following steps: constructing a business logic vulnerability knowledge base by adopting a first big language model; obtaining basic data of a firmware business program to be detected to construct a business object knowledge graph; based on the business logic vulnerability knowledge base, adopting a retrieval enhancement generation algorithm to obtain a sensitive control flow and a business logic vulnerability normal form corresponding to the to-be-detected firmware business program; based on the business logic vulnerability normal form and the sensitive control flow corresponding to the to-be-detected firmware business program, adopting a large language model thinking chain technology to iteratively generate multi-level cue words; and based on the multi-level cue word and the business object knowledge graph, adopting a second large language model to obtain a logic vulnerability detection result. According to the method and the device, various service logic vulnerabilities in the Internet of Things terminal firmware can be detected.

The invention provides an Internet of Vehicles vulnerability management method, system, device and medium based on a block chain, and relates to the technical field of vehicle networks, the method can comprehensively identify potential safety risks of vehicles through a dynamic and static combined vulnerability detection mechanism, and generates a structured vulnerability report; hash abstract chaining evidence storage is performed on key data of reports and subsequent repair links by using a block chain, so that the whole process of vulnerability discovery, analysis and repair is ensured not to be tampered and traceable, and the authenticity and credibility of data are improved; the integrity of the report is verified at the cloud end, and an AI analysis engine is combined to associate a CVE database and threat intelligence, so that intelligent generation and decision support of a repair scheme are realized; the hash abstract on the chain of the OTA patch is verified at the vehicle end, so that the credibility of the patch source and the integrity of the content are guaranteed; and finally, through feedback of an installation result and secondary uplink archiving, complete closed-loop management from vulnerability discovery to repair verification is formed.

Some embodiments provide a vulnerability data processing system that uses machine learning (ML) to identify anomalous vulnerability data among vulnerability data acquired for configuring vulnerability detection of a computer network security system configured to monitor a computing environment. The system obtains vulnerability data that comprises values of a vulnerability parameter. The system generates datapoints representing values of the vulnerability parameter included in the obtained vulnerability data. The system clusters the datapoints to obtain vulnerability parameter clusters. The system identifies anomalous vulnerability data using the vulnerability parameter clusters.

The invention discloses a vulnerability hidden danger intelligent detection method based on a large model, and the method comprises the steps: firstly carrying out the global static analysis of a source code set, constructing a complete call graph and a complete data flow graph of a program, and forming a structured code knowledge graph; and then, aiming at the identified candidate vulnerability slices, based on the maps, carrying out accurate context retrieval and enhancement, converting key information such as a call chain and a data traceability path which are strongly related to the vulnerability slices into natural language description which can be understood by a large language model, and injecting the natural language description into cue words, so that missing global context information is provided for the model. And the defect of complex code analysis capability is overcome. In this way, the problem that an attention mechanism loses efficacy in remote code association is solved, and the accuracy and reliability of vulnerability detection are remarkably improved.

The invention discloses an automatic network protocol fuzz testing system, particularly relates to the field of automatic network protocol testing, is used for solving the problems of protocol vulnerability detection and security verification, and improves the coverage rate and efficiency of protocol testing through an automatic network protocol fuzz testing system. The method comprises the following steps: firstly, capturing and recording complete communication data, generating an FSA of a protocol, mapping a protocol state and a conversion process by utilizing a proxy server, and performing message clustering and state association analysis and simplifying protocol behavior analysis by generating a GMS; secondly, dynamically analyzing the stability of the protocol state and the difference of the message sequence, intelligently selecting a deterministic or non-deterministic test function, and widely covering a protocol behavior scene; in the testing process, input, output and state information is recorded in real time, and the protocol state is automatically reset or returned when abnormity occurs, so that the continuity and traceability of the test are ensured. The potential vulnerabilities can be found comprehensively, the manual test workload is reduced, and the security and robustness of the protocol are ensured.

The invention discloses a cross-chain smart contract vulnerability detection method and system based on multi-feature fusion learning. The method comprises the following steps: collecting a cross-chain smart contract vulnerability data set for cleaning and labeling; feature extraction is carried out from the source code and the byte code, an abstract syntax tree (AST) is extracted from the cleaned source code, a basic control flow graph (CFG) is extracted from the byte code, and a cross-chain control flow graph (xCFG) is constructed; carrying out feature representation on AST and xCFG, generating a graph vector through a graph neural network (GNN), generating a semantic vector through CodeBert, and fusing the semantic vector into a feature fusion vector; performing model training and detection, taking the generated vectors as training data and test data, obtaining a cross-chain smart contract vulnerability detection model by adopting Transform-FC model training data, and finally evaluating model performance through accuracy, recall rate, precision rate and F1 value. According to the method, the structural features and semantic features of the codes can be effectively fused, potential vulnerability information in the codes can be fully mined, the recognition capability of the model for cross-chain vulnerabilities can be enhanced, and the accuracy and reliability of the cross-chain vulnerability detection model can be improved, so that the security of a block chain system can be more efficiently guaranteed.