CN118484814B - A slice-level feature-driven method for accurate software vulnerability detection - Google Patents

Abstract

The present invention discloses a slice-level feature-driven software vulnerability precision detection method, which relates to the field of software security technology. The present invention proposes a GRU statement embedding method, combines program slicing technology to obtain a more complete program feature representation, introduces the concept of a vulnerability dictionary, utilizes vulnerability detection models to mine and utilize vulnerability features in program slices, and realizes effective detection of function-level and statement-level vulnerabilities of a program to be tested.

Description

A slice-level feature-driven method for accurate software vulnerability detection

Technical Field

The present invention belongs to the field of software security technology, and specifically relates to a slice-level feature-driven software vulnerability accurate detection method.

Background Art

In recent years, the size of the global software market has continued to grow. By the end of 2023, global IT spending has reached 4.6 trillion US dollars. In today's digital wave, software vulnerabilities have become a major challenge in the field of digital security. With the deepening of the digital transformation of devices, systems and services, software plays an increasingly important role in personal life and business operations. However, while software is widely used, it also brings security risks that cannot be ignored, especially software vulnerabilities. With the diversification and complexity of software, software vulnerabilities caused by design and execution defects have become an unavoidable challenge in engineering practice, and these vulnerabilities may bring serious security risks.

The number and complexity of vulnerabilities are increasing significantly. In view of this situation, the detection and repair of software vulnerabilities has become urgent and extremely challenging. To address this challenge, an effective strategy is to conduct comprehensive detection of potential vulnerabilities before the application software is deployed. By taking preventive measures in the early stages of the software development life cycle, the threat of potential vulnerabilities to system security can be effectively reduced, providing a more solid security guarantee for the healthy development of the digital ecological environment. Software vulnerability detection is not only a key means to resist security threats, but also an important part of ensuring software quality.

Existing software vulnerability detection methods can be divided into static analysis methods, dynamic analysis methods, and deep learning-based methods. Static analysis methods rely on the analysis of source code, but usually have a high false positive rate. Dynamic analysis methods detect by executing programs and analyzing the dynamic information generated during their operation. This method usually faces the problem of low code coverage and is prone to a high false negative rate. In addition, both static and dynamic analysis methods are subject to expert knowledge, and the detection effect is not ideal when dealing with large-scale software vulnerabilities. To solve these problems, researchers have proposed vulnerability detection methods based on deep learning. Such methods do not require manual feature extraction, which greatly reduces the consumption of manual resources. Compared with traditional methods, the performance of vulnerability detection methods based on deep learning has been significantly improved. However, existing deep learning-based methods still have many challenges: (1) When processing long sequence programs, direct truncation operations are often used to unify the input length, resulting in feature loss and poor detection performance; (2) Most existing methods detect vulnerabilities by implicitly learning vulnerability features, but fail to fully explore and utilize vulnerability features, which limits the further improvement of model performance.

Summary of the invention

In order to solve the above problems existing in the prior art, the present invention provides a slice-level feature-driven software vulnerability accurate detection method. The technical problem to be solved by the present invention is achieved through the following technical solutions:

The present invention provides a slice-level feature-driven software vulnerability accurate detection method, comprising:

Step 1: Preprocess the training set to obtain the first statement embedding of the program slice, wherein the training set is an open source vulnerability dataset with statement-level vulnerability labels;

Step 2: Construct a vulnerability dictionary based on the training set;

Step 3: embed the first statement of the program slice into the cluster center matching the vulnerability dictionary for splicing to obtain a first splicing vector;

Step 4: input the first concatenated vector into a vulnerability detection model, learn the correlation between the first statement embedding of the program slice and the cluster center of the vulnerability dictionary, and obtain a trained vulnerability detection model;

Step 5: Preprocess the program to be tested to obtain the first statement embedding of the program slice to be tested, perform vulnerability detection on the program slice to be tested using the trained vulnerability detection model based on the first statement embedding of the program slice to be tested and the vulnerability dictionary, and obtain the vulnerability prediction result of the program to be tested based on the vulnerability prediction result of the program slice to be tested.

Compared with the prior art, the present invention has the following beneficial effects:

The slice-level feature-driven software vulnerability precise detection method of the present invention combines statement embedding and program slicing technology, performs slicing with vulnerability key points as the starting point, extracts code fragments closely related to the vulnerability, and uses statement embedding to aggregate statement information to obtain a more complete feature representation. The concept of vulnerability dictionary is introduced, and vulnerability features in program slicing are mined and utilized using vulnerability detection models to achieve effective detection of function-level and statement-level vulnerabilities in the program to be tested.

The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the following specifically cites a preferred embodiment and describes it in detail with the accompanying drawings as follows.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of a slice-level feature-driven software vulnerability precision detection method provided by an embodiment of the present invention;

FIG2 is a flow chart of a slice-level feature-driven software vulnerability precision detection method provided by an embodiment of the present invention;

FIG3 is a schematic diagram of a GRU sentence embedding provided by an embodiment of the present invention;

FIG4 is a flowchart of building a vulnerability dictionary provided by an embodiment of the present invention;

FIG5 is a diagram of a training process of a vulnerability detection model provided by an embodiment of the present invention;

FIG. 6 is a schematic diagram of the structure of a classifier provided in an embodiment of the present invention.

DETAILED DESCRIPTION

In order to further illustrate the technical means and effects adopted by the present invention to achieve the predetermined purpose of the invention, a slice-level feature-driven software vulnerability accurate detection method proposed in the present invention is described in detail below in combination with the accompanying drawings and specific implementation methods.

The above and other technical contents, features and effects of the present invention are clearly presented in the following detailed description of the specific implementation modes in conjunction with the accompanying drawings. Through the description of the specific implementation modes, the technical means and effects adopted by the present invention to achieve the predetermined purpose can be more deeply and specifically understood. However, the attached drawings are only for reference and explanation purposes and are not used to limit the technical solutions of the present invention.

An embodiment of the present invention provides a slice-level feature-driven software vulnerability precise detection method. Please refer to Figures 1 and 2. Figure 1 is a schematic diagram of a slice-level feature-driven software vulnerability precise detection method provided by an embodiment of the present invention; Figure 2 is a flow chart of a slice-level feature-driven software vulnerability precise detection method provided by an embodiment of the present invention.

As shown in FIG2 , the slice-level feature-driven software vulnerability precision detection method of this embodiment first obtains a vulnerability dictionary (vulDcit) by passing all the vulnerability statements in the training set through the embedding layer to obtain a plane vector and then through a clustering algorithm, wherein the embedding layer includes: program slicing, vocabulary embedding (EMB), and two GRU statement embeddings (GRU _stmt and GRU _vulI ). Then, during the training process, after the training set passes through the embedding layer, the input program slice statement embedding is spliced with the cluster center to which the vulnerability statement in the program slice belongs in the vulnerability dictionary, and the attention mechanism of the Transformer in the vulnerability detection model is used to fully learn the correlation between the program slice statement embedding and the cluster center of the vulnerability dictionary. Finally, the slice-level prediction and statement-level prediction of the program slice are obtained through the classifier to obtain the trained vulnerability detection model. In the detection stage, the test set, that is, the program to be tested, is passed through the embedding layer to obtain the statement embedding of the program slice to be tested, and the statement embedding of the program slice to be tested is spliced with each cluster center in the vulnerability dictionary in turn, and input into the trained vulnerability detection model to finally obtain the function-level prediction and statement-level prediction of the program to be tested.

Further, in conjunction with FIG1 , the slice-level feature-driven software vulnerability accurate detection method of this embodiment is described in detail. The method includes:

Step 1: Preprocess the training set to obtain the first statement embedding of the program slice.

In this embodiment, the training set is an open source vulnerability dataset with statement-level vulnerability labels, for example, the Big-Vul open source vulnerability dataset, which is one of the largest C/C++ vulnerability datasets with statement-level vulnerability labels.

In an optional embodiment, step 1 may include:

Step 1.1: Perform program slicing on the training set to obtain multiple program slices.

Optionally, step 1.1 includes:

Step 1.11: Use the open source static analysis tool Joern to analyze the programs in the training set and obtain the key points of the programs.

In this embodiment, the grammatical features of vulnerabilities that are prone to occur summarized in SyseVR (a source code vulnerability detection framework based on deep learning) are used as the key points of the program, including sensitive APIs, array operations, integers, and pointer usage. Specifically, the key point of vulnerabilities related to sensitive APIs is the API itself; the key point of vulnerabilities related to arrays and pointers is the array and pointer statements.

Exemplarily, based on the open source static analysis tool Joern, the AST (Abstract SyntaxCode) of the target function is constructed and matched with the grammatical features of the above key points. Any token that successfully matches can be used as the starting point for program slicing construction.

Step 1.12: Perform forward slicing and backward slicing operations with the key point as the starting point, extract all statements related to the starting point in the program, and obtain corresponding forward slicing and backward slicing.

In this embodiment, based on each starting point, Joern can be used again to generate a function PDG (Program Dependence Graph), and forward slicing and backward slicing operations can be performed to extract all statements related to the starting point. Forward slicing is to start from the starting point, trace along the data flow and control flow of the program, and identify all statements affected by the starting point; backward slicing is to take the starting point as the end point of the program, and trace the data flow and control flow backward from the end point to find all statements that affect the end point.

Step 1.13: Integrate the forward slice and the backward slice to remove duplicate statements, and attach a corresponding statement label to each statement to obtain program slices. The statement labels include vulnerability statement labels and non-vulnerability statement labels.

In this embodiment, by checking the statement label, it can be determined whether the program slice has a vulnerability, and a vulnerability slice label is attached to the program slice with the vulnerability statement, and a non-vulnerability slice label is attached to the program slice without the vulnerability statement.

It should be noted that each program slice contains an equal number of statements. Program slices can be expressed as ,in, Indicates Line statement, , The maximum number of statements for each program slice, that is, the total number of program slices If the number of statements in a program slice is less than , then for missing rows use Filling is performed if the number of statements in the program slice is greater than , the statements with extra lines are truncated.

Step 1.2: Perform word segmentation on each statement in the program slice to obtain a token sequence for each statement in the program slice.

Optionally, you can use Byte Pair Encoding (BPE) word segmentation to slice the program. of Perform word segmentation on the line statement to obtain the token sequence corresponding to the statement ,in, Indicates the first Tokens, , Indicates the maximum number of tokens for a preset statement.

It should be noted that each statement contains an equal number of tokens. If the number of tokens in a statement is less than , use a special token for missing tokens Fill if the number of tokens in the statement is greater than , the excess tokens are truncated.

Step 1.3: Perform vocabulary embedding on each token of each statement in the program slice to obtain the token embedding of the program slice.

In this embodiment, the vocabulary embedding layer can be used Get each token The embedding representation of Refers to the wordlist size of the tokenizer, is the token embedding vector dimension, represents the set of real numbers, The first Tokens, total Then, for program slicing The token embedding of can be expressed as .

For example, the embedding layer of the CodeT5 pre-trained model can be used Each token Mapped to a 768-dimensional vector space, is the token embedding vector dimension.

Step 1.4: Use GRU (Gated Recurrent Unit) to perform the first sentence embedding on the token embedding of the program slice to obtain the first sentence embedding of the program slice.

In this embodiment, the GRU sentence embedding method is used to enhance the expressiveness of the features, the number of tokens of each sentence 𝑟 is used as the time step, and the GRU is used to aggregate the information of the entire sentence. In the token sequence of each sentence, each token has an impact on the network state, and the hidden state of the last time step integrates these impacts, thereby effectively capturing the state and key information of the entire sentence.

Please refer to Figure 3, which is a schematic diagram of a GRU sentence embedding provided by an embodiment of the present invention. As shown in Figure 3, for program slicing Token embedding , using GRU for the first sentence embedding, that is, using GRU _stmt for summarization, the first sentence embedding obtained can be expressed as , as shown in formula (1):

(1).

GRU _stmt enables the model to learn and integrate the information of each token in the sentence into the sentence vector, while retaining the characteristics of key tokens and reducing the risk of information loss. and When , the method can process 3000 tokens in a single program slice, which is about six times that of 512 tokens. Therefore, the GRU sentence embedding proposed in this embodiment can provide a more complete information representation compared with the ordinary token embedding.

Step 2: Build a vulnerability dictionary based on the training set.

Please refer to FIG. 4 , which is a flowchart of building a vulnerability dictionary provided by an embodiment of the present invention. As shown in FIG. 4 , in an optional embodiment, step 2 includes:

Step 2.1: Filter out program slices containing vulnerable statements from multiple program slices to obtain vulnerable program slices, extract vulnerable statements in each vulnerable program slice, and obtain a set of vulnerable statements corresponding to each vulnerable program slice.

After program slicing the training set, multiple program slices will be obtained. By checking the statement label, it can be determined whether the program slice has a vulnerability, so as to filter out the program slice containing the vulnerability statement from the multiple program slices to obtain the vulnerable program slice. Then, according to the statement label in the vulnerable program slice, the vulnerable statement is extracted to obtain the vulnerability statement set corresponding to each vulnerable program slice. In this embodiment, the vulnerability statement set can be recorded as VulnerabilityInstance (vulnerability instance), abbreviated as vulI.

In this embodiment, program slicing The vulI in can be expressed as ,in It is the preset maximum number of vulnerable statements per program slice.

If the number of vulnerable statements in a program slice is less than , will use Fill in missing rows.

Step 2.2: Perform word segmentation on each vulnerability statement in the vulnerability statement set to obtain a token sequence of each vulnerability statement in the vulnerability statement set.

In this embodiment, similar to the preprocessing process of the training set, the BPE word segmentation method can be used to Each sentence is segmented to obtain the corresponding token sequence ,in is the preset maximum number of tokens per statement. If the number of tokens in a statement is less than , a special token <pad> is used for padding, and if the sequence is too long, it is truncated.

Step 2.3: Perform vocabulary embedding on each token of each vulnerability statement in the vulnerability statement set to obtain the token embedding of the vulnerability statement set.

In this embodiment, similar to the preprocessing process of the training set, each token is mapped to a token ID in the vocabulary. For example, the embedding layer of the CodeT5 pre-trained model can be used. Each token , Mapped to a 768-dimensional vector space, where Represents the wordlist size of the tokenizer, =768 is the token embedding vector dimension. Therefore, the token embedding of each vulI can be expressed as .

Step 2.4: Use GRU to perform the first sentence embedding on the token embedding of the vulnerable sentence set to obtain the first sentence embedding of the vulnerable sentence set.

In this embodiment, similar to the preprocessing process of the training set, the token embedding of each vulI is performed using GRU _stmt Perform the first sentence embedding to summarize the information of each sentence in vulI, and finally get the first sentence embedding of the vulnerability sentence set , as shown in formula (2):

(2).

Step 2.5: Use GRU to perform a second sentence embedding on the first sentence embedding of the vulnerability sentence set to obtain the second sentence embedding of the vulnerability sentence set.

In order to facilitate the construction of the plane vector of the vulnerability statement set, GRU is used to embed the first statement of the vulnerability statement set for the second time, that is, GRU _vulI is used to embed the first statement of each vulI Further aggregation to obtain the hidden state , that is, the second sentence embedding of the vulnerability sentence set, as shown in formula (3):

(3).

In this embodiment, the structure of GRU _vulI is the same as that of GRU _stmt .

Step 2.6: The second sentence embedding of the vulnerability sentence set is compressed in the first dimension and mapped to a plane vector to obtain a plane vector of the vulnerability sentence set.

In this embodiment, The first dimension is compressed and mapped to a flat vector Finally, we get the plane vector of the vulnerability statement set.

Step 2.7: The plane vectors of the vulnerability statement set corresponding to all vulnerable program slices constitute a vulnerability plane vector set. The cluster center of the vulnerability plane vector set is obtained by using a clustering algorithm. All cluster centers constitute a vulnerability dictionary.

In this embodiment, the vulnerability plane vector set can be recorded as Vulnerability Set (vulnerability set), abbreviated as vulSet. Among them Indicates the total number of vulnerability slices extracted. As shown in Figure 4, the squares filled with patterns represent vulnerability statements, and the squares without pattern filling represent non-vulnerability statements. There may be many repeated or similar vulIs in the training set. In addition, in this embodiment, the number of vulIs extracted from the training set is as high as 33,647. In the subsequent training and detection stages, the huge number of vulSets will consume a lot of computing resources when matching each program slice with the elements in the vulSet.

This embodiment proposes to construct a concise set that covers all vulIs, called vulDict (VulnerabilityDictionary). The vulnerability dictionary is a set containing all vulCenters (VulnerabilityCenter), which can represent all vulIs.

In this embodiment, the vulnerability dictionary is represented by vulDict= , where each is an element in vulDict, also called vulCenter, is the number of elements in vulDict. vulDict integrates vulIs with similar features, and each vulCenter represents a group or a class of similar vulIs. To ensure that each vulCenter can represent a group of similar vulIs, this embodiment uses the K-means clustering algorithm to simplify and summarize vulSet, and the result is Each vulCenter represents the common characteristics of its category and can be regarded as a typical vulI of this category.

In this embodiment, vulDict is constructed with the help of vulCenter to replace the original vulSet, aiming to compress the size of vulSet and improve the detection efficiency of the model. It should be noted that before clustering, the data in vulSet can be normalized to reduce the impact of some abnormal data on the clustering results.

While retaining the key information of vulI, the constructed vulDict successfully reduces the size of vulSet and reduces the computational burden of subsequent training and detection stages. The constructed vulDict enables the vulnerability detection model to more effectively capture the commonalities of vulI, providing more representative features for subsequent vulnerability detection and analysis.

Step 3: Concatenate the first statement embedding of the program slice with the matching cluster center in the vulnerability dictionary to obtain the first concatenated vector.

In an optional embodiment, step 3 includes:

Step 3.1: Embed the first statement of the program slice for compression to obtain a compressed statement embedding of the program slice.

In this embodiment, the first statement of the program slice is embedded in , the compressed sentence embedding obtained after compression can be expressed as .

Step 3.2: For a program slice containing a vulnerable statement, determine the cluster center to which the vulnerable statement in the program slice belongs in the vulnerability dictionary, and concatenate the compressed statement embedding of the program slice containing the vulnerable statement with the determined cluster center to obtain a first concatenated vector.

In this embodiment, the cluster center to which the vulnerability statement belongs in the vulnerability dictionary can be determined by calculating the Euclidean distance between the plane vector of the vulnerability statement and the cluster centers in the vulnerability dictionary, and selecting the cluster center corresponding to the minimum Euclidean distance as the cluster center to which the vulnerability statement belongs in the vulnerability dictionary. Specifically, the process of determining the cluster center to which the vulnerability statement belongs in the vulnerability dictionary is shown in formula (4):

(4);

In the formula, is the cluster center to which the vulnerability statement belongs, is the plane vector of the vulnerability statement, is the number of cluster centers in the vulnerability dictionary.

Among them, the calculation process of the plane vector of the vulnerable statement is to use GRU _stmt and GRU _vulI to process the vulI in the program slice containing the vulnerable statement, and then perform first dimension compression and map it to the plane vector to obtain the plane vector of the vulnerable statement.

Use formula (4) to determine the cluster center that is most similar to the plane vector of the vulnerability statement Then, the compressed statements of the program slice containing the vulnerable statements are embedded into The most similar cluster center Splice to form the first splicing vector , as shown in formula (5), As input to subsequent vulnerability detection models.

(5).

Step 3.3: For a program slice that does not contain a vulnerability statement, determine the cluster center to which the preset special embedding belongs in the vulnerability dictionary, and concatenate the compressed statement embedding of the program slice that does not contain the vulnerability statement with the determined cluster center to obtain a first concatenated vector.

In this embodiment, for program slices that do not contain vulnerability statements, a preset special embedding matrix is used To represent the first statement embedding of the vulnerability statement, and fill it with <pad>, where is the maximum number of vulIs. Similarly, GRU _vulI is used to embed the first sentence of the vulnerability sentence into Summarize into a flat vector .

In this embodiment, the specific cluster center and stitching process are similar to those described in step 3.2 and will not be described in detail here.

Step 4: Input the first concatenated vector into the vulnerability detection model, learn the correlation between the first statement embedding of the program slice and the cluster center of the vulnerability dictionary, and obtain a trained vulnerability detection model.

Please refer to FIG. 5, which is a diagram of a training process of a vulnerability detection model provided by an embodiment of the present invention. As shown in FIG. 5, after obtaining the first concatenated vector Then input it into the vulnerability detection model for learning and training.

Optionally, the vulnerability detection model includes: a plurality of cascaded Transformer Encoder modules, and a classifier connected to the last Transformer Encoder module.

In this embodiment, a plurality of cascaded Transformer Encoder modules are used to perform feature learning on the first concatenated vector to obtain a correlation feature matrix, and 12 cascaded Transformer Encoder modules are provided.

The task of software vulnerability detection can be regarded as a text classification task, which learns the features of sequence information and uses classifiers for prediction. In such tasks, the widely used model is Transformer, whose unique self-attention mechanism performs well in understanding the semantic features of code, especially when processing long sequence data. It is more effective than traditional sequence models such as RNN (Recurrent Neural Network) and LSTM (Long Short Term Memory) networks, and can effectively learn the relationship between every two tokens in the input sequence, thereby better capturing the connection between tokens.

Therefore, in this embodiment, multiple cascaded Transformer Encoder modules are used to fully learn the correlation between code embedding and vulCenter.

In this embodiment, the classifier includes a statement-level prediction branch and a slice-level prediction branch in parallel, wherein the statement-level prediction branch is used to perform statement-level prediction based on the associated feature matrix to obtain the vulnerability prediction probability of each statement in the program slice; the slice-level prediction branch is used to perform slice-level prediction based on the associated feature matrix to obtain the vulnerability prediction probability of the program slice.

In this example, the output of the last Transformer Encoder module is As the input of the classifier, Represents the maximum number of statements preset for each program slice.

Please refer to FIG6 , which is a schematic diagram of the structure of a classifier provided by an embodiment of the present invention. As shown in FIG6 , the sentence-level prediction branch includes a cascaded first Dropout layer, a first fully connected layer, a first activation layer, a second Dropout layer, and a second fully connected layer. That is, After being processed by the first Dropout layer, the first fully connected layer, the first activation layer (the activation function is Tanh), and the second Dropout layer, the features of the second dimension are mapped to scalar values to make the final statement-level prediction and obtain the vulnerability prediction probability of each statement in the program slice.

As shown in Figure 6, the slice-level prediction branch includes a cascade of GRU units, a vector compression layer, a third Dropout layer, a third fully connected layer, a second activation layer, a fourth Dropout layer, and a fourth fully connected layer. To summarize, we obtain the hidden state of the last time step and compress it through the vector compression layer to obtain . Then, It is processed in sequence through the third Dropout layer, the third fully connected layer, the second activation layer (the activation function is Tanh), and the fourth Dropout layer, and finally mapped to a scalar value through the fourth fully connected layer to achieve slice-level prediction and obtain the vulnerability prediction probability of the program slice.

Step 5: Preprocess the program to be tested to obtain the first statement embedding of the program slice to be tested. According to the first statement embedding of the program slice to be tested and the vulnerability dictionary, use the trained vulnerability detection model to perform vulnerability detection on the program slice to be tested. According to the vulnerability prediction result of the program slice to be tested, obtain the vulnerability prediction result of the program to be tested.

In an optional embodiment, step 5 includes:

Step 5.1: Slice the program to be tested to obtain multiple program slices to be tested, and perform word segmentation, vocabulary embedding and first sentence embedding on each program slice to obtain the first sentence embedding of the program slice to be tested.

In the detection phase, the process of preprocessing the program to be tested refers to the preprocessing process of the training set, which will not be described in detail here.

It is worth noting that, taking a function F as the program to be tested, assuming that F is cut into z program slices to be tested, it is necessary to save the line number of the statement corresponding to the source function in each program slice to be tested. And when the word list is embedded, the number of sentences is insufficient The slice of the program to be tested is padded with -1 instead of line number to keep the number consistent.

Step 5.2: Concatenate the first statement embedding of the program slice to be tested with each cluster center in the vulnerability dictionary to obtain a corresponding second concatenation vector.

In this embodiment, the first statement of the program slice to be tested is embedded, that is, The second concatenation vector.

Step 5.3: Input the second concatenated vector into the trained vulnerability detection model to obtain the vulnerability prediction probability of each statement of the program slice to be tested and the vulnerability prediction probability of the program slice to be tested.

In this embodiment, for the program slice to be tested, the trained vulnerability detection model is used to obtain The slice-level vulnerability prediction probability and statement-level vulnerability prediction probability are calculated.

For slice-level prediction, select The maximum value of the vulnerability prediction probabilities is taken as the vulnerability prediction probability of the program slice to be tested; for statement-level prediction, the average value of the vulnerability prediction probabilities of each statement in different cluster centers is calculated, and this is taken as the vulnerability prediction probability of each statement in the program slice to be tested.

Step 5.4: According to the vulnerability prediction probability of each slice of the program to be tested, the vulnerability prediction result of the program to be tested is obtained.

Optionally, the maximum value of the vulnerability prediction probability can be determined based on the vulnerability prediction probability of each slice of the program to be tested. If the maximum value is greater than a preset threshold, the program to be tested has a vulnerability, otherwise the program to be tested does not have a vulnerability.

In this embodiment, the preset threshold is 0.5. For function F , if its program slice has a vulnerability, then the function must also have a vulnerability, thereby achieving function-level vulnerability prediction.

It should be noted that if function F has no vulnerability, the subsequent step 5.5 will not be executed.

Step 5.5: For a program to be tested that has vulnerabilities, determine the vulnerability statement prediction result of the program to be tested according to the vulnerability prediction probability of each statement of each slice of the program to be tested.

Optionally, for a program under test with vulnerabilities, K statements with the highest vulnerability prediction probabilities may be selected according to the vulnerability prediction probabilities of each statement in each slice of the program under test as the vulnerability statement prediction results of the program under test.

In this embodiment, after selecting the K statements with the highest vulnerability prediction probability, the predicted probability of the statement in each program slice is mapped back to the original line number of function F according to the original line number corresponding to the statement of each program slice saved, and finally the K statements in function F that are most likely to have vulnerabilities are obtained.

The slice-level feature-driven software vulnerability precision detection method of the embodiment of the present invention combines statement embedding and program slicing technology, performs slicing with vulnerability key points as the starting point, extracts code snippets closely related to the vulnerability, and uses statement embedding to aggregate statement information to obtain a more complete feature representation. The concept of vulnerability dictionary is introduced, and vulnerability features in program slices are mined and utilized using vulnerability detection models to achieve effective detection of function-level and statement-level vulnerabilities in the program to be tested.

It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants are intended to cover non-exclusive inclusion, so that an article or device including a series of elements includes not only those elements, but also other elements that are not explicitly listed. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the article or device including the elements. Similar words such as "connect" or "connected" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect.

The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims (9)

1. A slice-level feature-driven software vulnerability precision detection method, characterized by comprising: Step 1: preprocessing the training set to obtain the first statement embedding of the program slice, wherein the training set is an open source vulnerability dataset with statement-level vulnerability labels; Step 1 includes: Step 1.1: performing program slicing processing on the training set to obtain a plurality of program slices, wherein each program slice contains an equal number of statements; Step 1.2: performing word segmentation processing on each statement in the program slice to obtain a token sequence of each statement in the program slice, wherein each statement contains an equal number of tokens; Step 1.3: embed each token of each statement in the program slice into a vocabulary to obtain a token embedding of the program slice; Step 1.4: Perform a first sentence embedding on the token embedding of the program slice using GRU to obtain a first sentence embedding of the program slice; Step 2: Construct a vulnerability dictionary based on the training set; Step 3: embed the first statement of the program slice into the cluster center matching the vulnerability dictionary for splicing to obtain a first splicing vector; Step 4: input the first concatenated vector into a vulnerability detection model, learn the correlation between the first statement embedding of the program slice and the cluster center of the vulnerability dictionary, and obtain a trained vulnerability detection model; Step 5: Preprocess the program to be tested to obtain the first statement embedding of the program slice to be tested, perform vulnerability detection on the program slice to be tested using the trained vulnerability detection model based on the first statement embedding of the program slice to be tested and the vulnerability dictionary, and obtain the vulnerability prediction result of the program to be tested based on the vulnerability prediction result of the program slice to be tested. 2. According to the slice-level feature-driven software vulnerability accurate detection method of claim 1, it is characterized in that the step 1.1 comprises: Step 1.11: Use the open source static analysis tool Joern to analyze the programs in the training set to obtain the key points of the programs, including sensitive APIs, array operations, integers, and pointer usage; Step 1.12: Execute forward slicing and backward slicing operations with the key point as the starting point, extract all statements related to the starting point in the program, and obtain corresponding forward slicing and backward slicing; Step 1.13: Integrate the forward slice and the backward slice to remove duplicate statements, and attach a corresponding statement label to each statement to obtain the program slice, where the statement label includes a vulnerability statement label and a non-vulnerability statement label. 3. According to claim 1, the slice-level feature-driven software vulnerability accurate detection method is characterized in that step 2 comprises: Step 2.1: Filter out program slices containing vulnerability statements from the multiple program slices to obtain vulnerable program slices, extract the vulnerability statements in each of the vulnerable program slices, and obtain a set of vulnerability statements corresponding to each of the vulnerable program slices; Step 2.2: performing word segmentation processing on each vulnerability statement in the vulnerability statement set to obtain a token sequence of each vulnerability statement in the vulnerability statement set; Step 2.3: embedding each token of each vulnerability statement in the vulnerability statement set into a vocabulary to obtain a token embedding of the vulnerability statement set; Step 2.4: Use GRU to perform a first sentence embedding on the token embedding of the vulnerable sentence set to obtain the first sentence embedding of the vulnerable sentence set; Step 2.5: Perform a second sentence embedding on the first sentence embedding of the vulnerable sentence set using GRU to obtain a second sentence embedding of the vulnerable sentence set; Step 2.6: embedding the second sentence of the vulnerability sentence set into a first dimension and compressing it and mapping it onto a plane vector to obtain the plane vector of the vulnerability sentence set; Step 2.7: The plane vectors of the vulnerability statement sets corresponding to all the vulnerable program slices form a vulnerability plane vector set, and the cluster centers of the vulnerability plane vector set are obtained by using a clustering algorithm. All cluster centers form the vulnerability dictionary. 4. The slice-level feature-driven software vulnerability accurate detection method according to claim 1, wherein step 3 comprises: Step 3.1: embedding and compressing the first statement of the program slice to obtain a compressed statement embedding of the program slice; Step 3.2: for a program slice containing a vulnerable statement, determine the cluster center to which the vulnerable statement in the program slice belongs in the vulnerability dictionary, and concatenate the compressed statement embedding of the program slice containing the vulnerable statement with the determined cluster center to obtain the first concatenation vector; Step 3.3: For a program slice that does not contain a vulnerability statement, determine the cluster center to which the preset special embedding in the vulnerability dictionary belongs, and splice the compressed statement embedding of the program slice that does not contain a vulnerability statement with the determined cluster center to obtain the first splicing vector. 5. The slice-level feature-driven software vulnerability accurate detection method according to claim 1 is characterized in that the vulnerability detection model comprises: a plurality of cascaded Transformer Encoder modules, and a classifier connected to the last Transformer Encoder module, the classifier comprising a parallel statement-level prediction branch and a slice-level prediction branch, wherein: The cascaded multiple Transformer Encoder modules are used to perform feature learning on the first concatenated vector to obtain a correlation feature matrix; The statement-level prediction branch is used to perform statement-level prediction according to the association feature matrix to obtain the vulnerability prediction probability of each statement of the program slice; The slice-level prediction branch is used to perform slice-level prediction according to the associated feature matrix to obtain the vulnerability prediction probability of the program slice. 6. The slice-level feature-driven software vulnerability accurate detection method according to claim 5, characterized in that the statement-level prediction branch comprises a cascaded first Dropout layer, a first fully connected layer, a first activation layer, a second Dropout layer, and a second fully connected layer; The slice-level prediction branch includes a cascaded GRU unit, a vector compression layer, a third Dropout layer, a third fully connected layer, a second activation layer, a fourth Dropout layer and a fourth fully connected layer. 7. The slice-level feature-driven software vulnerability accurate detection method according to claim 1, wherein step 5 comprises: Step 5.1: performing program slicing processing on the program to be tested to obtain multiple program slices to be tested, and performing word segmentation processing, vocabulary embedding and first sentence embedding on each program slice to be tested in sequence to obtain the first sentence embedding of the program slice to be tested; Step 5.2: concatenate the first statement embedding of the program slice to be tested with each cluster center in the vulnerability dictionary to obtain a corresponding second concatenation vector; Step 5.3: input the second concatenated vector into the trained vulnerability detection model to obtain the vulnerability prediction probability of each statement of the program slice to be tested and the vulnerability prediction probability of the program slice to be tested; Step 5.4: Obtaining a vulnerability prediction result of the program to be tested according to the vulnerability prediction probability of each slice of the program to be tested; Step 5.5: For a program to be tested that has vulnerabilities, determine a vulnerability statement prediction result of the program to be tested according to the vulnerability prediction probability of each statement of each slice of the program to be tested. 8. The slice-level feature-driven software vulnerability accurate detection method according to claim 7, wherein step 5.4 comprises: According to the vulnerability prediction probability of each slice of the program to be tested, a maximum value of the vulnerability prediction probability is determined. If the maximum value is greater than a preset threshold, the program to be tested has a vulnerability; otherwise, the program to be tested does not have a vulnerability. 9. The slice-level feature-driven software vulnerability accurate detection method according to claim 7, wherein step 5.5 comprises: For a program under test with vulnerabilities, K statements with the highest vulnerability prediction probabilities are selected according to the vulnerability prediction probability of each statement in each slice of the program under test as the vulnerability statement prediction results of the program under test.