Source code vulnerability detection method for code graph representation learning based on graph convolution network

Abstract

The invention discloses a source code vulnerability detection method for code graph representation learning based on a graph convolution network. The method comprises the following steps: generating acode attribute graph; adding a function calling relationship and an inter-process dependency relationship into the code attribute graph; obtaining code slices according to the vulnerability key points; deleting nodes in the graph by utilizing slices, and extracting graph structure information related to vulnerabilities; learning vector representation of each node by using a graph convolution network; dividing the sub-graphs according to the types of the edges, and obtaining vector representation of the graphs through a READOUT model based on an attention mechanism; adjusting network parameters according to the vector representation and the label of the graph; and detecting the code vulnerability by using the trained model. According to the method, the structure and attribute information of the vulnerability code can be fully utilized and learned, the problems that code structure information is easy to lose when a traditional deep network learns code representation and long code context information is lost due to the fact that the code needs to be represented as a fixed length sequence are avoided, and false alarm and missing alarm of vulnerability detection are reduced.

Description

technical field [0001] The invention relates to a method for detecting a software vulnerability, in particular to a method for detecting a source code vulnerability based on a graph convolutional network for learning the graph representation of the code. Background technique [0002] Software vulnerabilities are defects that are easily exploited by malicious attackers in the process of software design and development. The traditional source code review technology largely depends on the reviewer's understanding of security issues and the accumulation of long-term experience, and cannot meet the needs of vulnerability detection when the code size and complexity are increasing. Although the vulnerability detection method based on machine learning avoids the problem that the rule-based vulnerability detection method relies on experts to manually write detection rules, it still needs to manually extract vulnerability features. In recent years, the deep learning technology succes...

AI Technical Summary

Problems solved by technology

This method uses AST as the backbone to explicitly encode the control and data dependencies of the program. When the function scale is large, there is a problem that the graph structure is too deep and too large, resulting in low learning efficiency, and the analysis of the code by this method is limited to one function. , does not consider the data dependence between the function call and the process, and may cause false negatives for the vulnerabilities of cross-function calls

Images