Vulnerability similarity measurement method based on context semantics

Abstract

A vulnerability similarity measurement method based on context semantics is characterized in that a natural language processing thought is used for reference, starting from the perspective of code semantics, a static code scanning tool is used for carrying out source code security scanning, code context information is obtained based on a control flow diagram and a data flow diagram, and code semantic analysis is carried out; the method also includes mapping the code context statement to a vector space: function: T-> T ''; calculating the similarity Similarity (T ''n, T'' m) between the vulnerability and the vulnerability of the known type, setting a threshold value for identification, automatically screening misreported vulnerabilities, and evaluating the recall ratio and precision ratio of the identification; according to the invention, bug misinformation can be effectively filtered, static code scanning tool misinformation and the cost of screening real bugs by developers or engineers are reduced, the problem that the traditional static scanning misinformation rate is high is solved, a high-accuracy misinformation examination service is provided, meanwhile, system bugs are found,and the software security is guaranteed.

Description

technical field [0001] The invention belongs to the field of software engineering, in particular to the application of code semantic understanding in the field of software engineering, which is used for filtering false positive vulnerability information generated by a static code vulnerability scanning tool. Background technique [0002] With the continuous expansion of software application fields, there are more and more attacks on information systems, and the attack points that can be exploited are often errors or defects (called loopholes) in the source code design or implementation process of the program itself. Source code security audits can discover potential security vulnerabilities during the system development phase, thereby helping to reduce security vulnerabilities by 10% to 50%. Therefore, scanning the program for vulnerabilities at the source code level can effectively reduce the occurrence of security vulnerabilities at the source, thereby reducing the occurre...

AI Technical Summary

Problems solved by technology

[0006] The problem to be solved by the present invention is: the high false positive rate of static vulnerability detection tools and the high cost and time-consuming problems of pure manual screening

Images