Software vulnerability intelligent detection and positioning method and system based on intermediate language

Abstract

The invention discloses a software vulnerability intelligent detection and positioning method and system based on an intermediate language, and belongs to the field of vulnerability detection. The method comprises the steps of converting a training program source code and a target source code into the intermediate language program slices, wherein the intermediate language program slices comprise the codes related to the suspicious vulnerability elements; if the intermediate language program slice corresponding to the training program source code contains the known vulnerability code, adding avulnerability tag to the intermediate language program slice and recording the position of the intermediate language program slice in the slice; if not, adding a vulnerability-free label to the targetobject; training a recurrent neural network based on the sample difference; and performing vulnerability intelligent detection and positioning on the intermediate language program slice correspondingto the target program source code by using the trained sample difference-based recurrent neural network. According to the present invention, the intermediate language slice is used as a unit of vulnerability detection, and the detection accuracy is improved. And only the data corresponding to the known vulnerability rows is selected from the output sequence of the recurrent neural network to participate in forward propagation, so that the trained model can identify the vulnerability rows.

Description

technical field [0001] The invention belongs to the field of vulnerability detection, and more particularly, relates to an intermediate language-based intelligent detection and positioning method and system for software vulnerabilities. Background technique [0002] Software vulnerabilities are the main culprit in network security, however, despite the use of various means to eliminate vulnerabilities, there are still a large number of vulnerabilities in the Common Vulnerabilities and Exposures (CVE) report. Detecting vulnerabilities and patching them in a timely manner is the key to eliminating vulnerabilities. Ideally, vulnerability detection tools should be able to have high accuracy, low false positives, and low false positives, and can accurately determine the location of vulnerabilities. Inspection tools are not able to achieve satisfactory results. Static vulnerability detection is widely used by code auditors to find potential vulnerabilities in software source code...

AI Technical Summary

Problems solved by technology

[0004] Aiming at the defects of the prior art, the purpose of the present invention is to solve the technical problem that the leak detection rate of the prior art is high and the false positive rate is high, and the positioning of the leak cannot be realized

Images