CN118586009A - Code defect vulnerability scanning and determination method based on knowledge base - Google Patents

Abstract

The present invention relates to the technical field of code detection, and in particular to a code defect vulnerability scanning and determination method based on a knowledge base, comprising: generating a sub-code segment; calculating an abnormal tendency evaluation value of a target code; analyzing whether the abnormal tendency of the target code is qualified; performing an aggressive test and marking; regenerating a new sub-code segment; and adjusting an attack frequency. In the present invention, the abnormal tendency of the target code is comprehensively analyzed based on the conditional probability and repetition between each sub-code segment, thereby improving the control accuracy for the structural complexity of the target code, performing an aggressive test on the target code with unqualified abnormal tendency, marking each sub-code segment according to the test result, and storing the sub-code segment with a vulnerability in a vulnerability database, so as to facilitate subsequent comparison with the code segment in the vulnerability database to determine whether the target code segment has a vulnerability, thereby improving the vulnerability identification efficiency of the code.

Description

Code defect vulnerability scanning and determination method based on knowledge base

Technical Field

The present invention relates to the technical field of code detection, and in particular to a code defect vulnerability scanning and determination method based on a knowledge base.

Background Art

Code defect vulnerabilities are a very important security issue that requires comprehensive closed-loop management measures to solve. Use automated scanning tools, manual penetration testing, and other methods to fully discover security vulnerabilities in systems and applications. This is the first step in closed-loop management and lays the foundation for subsequent evaluation and repair. Existing technologies use machine self-learning technology to learn and identify effective defects based on historical code audit information, thereby enhancing the security of application software systems. However, the efficiency of identifying code vulnerabilities is low.

Chinese patent application number: CN202310636553.5 discloses a source code defect static audit detection system, including: AI automatic audit module, through machine self-learning technology, based on historical code audit information, function whitelist and code defect knowledge base, learn to identify effective defects; third-party component detection module, used to detect open source code vulnerabilities according to the defect rule set of the public vulnerability library; bytecode scanning module, through Java bytecode scanning technology, for graphical display and defect location tracking; deployment module, used for virtualized cloud deployment, distributed deployment, and mirror deployment. The advantages of this application are: consolidating the source: solving security problems from the source of the code, realizing security left shift, and enhancing the security and robustness of the application software system; autonomous and controllable: the product is independently developed, safe and controllable, and meets the requirements of information innovation; flexible deployment: the product can be deployed in virtualization, distributed, and Docker images; cost-effective: high performance indicators and low prices. It can be seen that the source code defect static audit detection system has the following problems: low efficiency in identifying code vulnerabilities.

Summary of the invention

To this end, the present invention provides a knowledge base-based code defect vulnerability scanning and determination method to overcome the problem of low efficiency in identifying code vulnerabilities in the prior art.

To achieve the above objectives, the present invention provides a method for scanning and determining code defects and vulnerabilities based on a knowledge base. The method comprises:

Step S1, dividing the target code of the knowledge base into several sub-code segments;

Step S2, calculating the abnormal tendency evaluation value of the target code based on the code repetition degree of each sub-code segment and the conditional probability of each sub-code segment;

Step S3, analyzing whether the abnormal tendency of the target code is qualified based on the abnormal tendency evaluation value;

Step S4, performing an aggressiveness test on the target code that fails the abnormal tendency test, and marking each sub-code segment;

Step S5: regenerate a new sub-code segment based on the secondary sub-code segment, and perform an offensive test to mark the new sub-code segment;

Step S6: adjusting the attack frequency on the sub-code segment based on the proportion of the first-level sub-code segment.

Furthermore, in the step S2, the conditional probabilities between the sub-code segments are calculated respectively, and the abnormal tendency evaluation value for the target code is calculated based on the calculated average value P of the conditional probabilities and the code repetition C of each sub-code segment, and the abnormal tendency evaluation value S=α×P/P0+β×C/C0 is set, wherein α is the conditional probability weight coefficient, β is the repetition weight coefficient, P0 is the preset average value, and C0 is the preset code repetition.

Furthermore, in step S3, the abnormal tendency of the target code is analyzed based on the abnormal tendency evaluation value to determine whether it is qualified.

If the abnormal tendency evaluation value is less than or equal to the first preset abnormal tendency evaluation value, it is determined that the abnormal tendency of the target code is qualified;

If the abnormal tendency evaluation value is greater than the first preset abnormal tendency evaluation value, the abnormal tendency of the target code is determined to be unqualified, and an aggressiveness test is performed on each of the sub-code segments, and a test log is recorded.

Furthermore, in step S4, when the aggressiveness test is completed for each sub-code segment, the sub-code segment is marked based on the error log ratio of the aggressiveness test for a single sub-code segment.

If the error log ratio is less than or equal to a first preset error log ratio, marking the sub-code segment as a first-level sub-code segment;

If the error log ratio is greater than the first preset error log ratio and less than or equal to the second preset error log ratio, marking the sub-code segment as a secondary sub-code segment, and storing the sub-code segment in a temporary database;

If the error log ratio is greater than the second preset error log ratio, the sub-code segment is marked as a third-level sub-code segment, and the sub-code segment is stored in the vulnerability database.

Furthermore, when marking of each of the sub-code segments is completed, the first preset abnormal tendency evaluation value is adjusted based on the proportion of the number of the secondary sub-code segments.

Furthermore, when the marking of each sub-code segment is completed, the sub-code segments in the temporary database are randomly connected, and a number of new sub-code segments are randomly generated again, and an attack test is performed on each new sub-code segment, and each new sub-code segment is marked based on the new error log ratio of each new sub-code segment after the attack test.

If the new error log ratio is less than or equal to the second preset error log ratio, marking the new sub-code segment as a secondary sub-code segment, and storing the new sub-code segment in the temporary database;

If the new error log ratio is greater than the second preset error log ratio, the new sub-code segment is marked as a third-level sub-code segment, and the new sub-code segment is stored in the vulnerability database.

Further, when each of the new sub-code segments is marked complete, the number of generated new sub-code segments is determined based on the third-level proportion of the third-level sub-code segments,

If the third-level proportion is less than or equal to the preset third-level proportion, determining that the number of the generated new sub-code segments is the first-level number;

If the third-level proportion is greater than the preset third-level proportion, it is determined that the number of the new sub-code segments generated is the second-level number.

Furthermore, when the sub-code segments are marked, the attack frequency in the attack test process for each sub-code segment is corrected based on the first-level proportion of the marked first-level sub-code segments.

Further, when each of the sub-code segments is marked complete, it is determined whether to update the component version based on the proportion of the third-level sub-code segments.

If the proportion of the third-level sub-code segments is greater than or equal to the proportion of the preset third-level sub-code segments, it is determined that the component version is low, and the component version is updated;

If the proportion of the third-level sub-code segments is less than the proportion of the preset third-level sub-code segments, it is determined that the component version is normal and the component version is not updated.

Furthermore, the attack test includes: analyzing whether the sub-code segment has a vulnerability based on the matching degree between the known vulnerability code segment in the big data and the sub-code segment, and testing the sub-code segment using a black box test.

Compared with the prior art, the beneficial effect of the present invention lies in that, in the present invention, the greater the conditional probability between each sub-code segment, the closer the connection between each sub-code segment, the stronger the dependency between codes, the more rigorous the code needs to be tested, the higher the repetition of each sub-code segment, the greater the maintenance difficulty, the abnormal tendency of the target code is comprehensively analyzed based on the conditional probability and repetition between each sub-code segment, the control accuracy of the structural complexity of the target code is improved, the target code with unqualified abnormal tendency is subjected to an aggressive test, and each sub-code segment is marked according to the test results, and the sub-code segment with vulnerabilities is stored in a vulnerability database, which is convenient for subsequent comparison with the code segment in the vulnerability database to determine whether the target code segment has vulnerabilities, thereby improving the vulnerability identification efficiency of the code.

Furthermore, in the present invention, the secondary sub-code segments are stored in a temporary database, and the sub-code segments are recombined to generate new sub-code segments, the newly generated sub-code segments are tested, and the sub-code segments with vulnerabilities are stored in a vulnerability database, thereby achieving an expansion of the types of sub-code segments in the vulnerability database.

Furthermore, in the present invention, the first preset abnormal tendency evaluation value is reduced according to the proportion of the secondary sub-code segment, the range of qualified target codes is narrowed, the range of target codes that need further analysis is increased, and the analysis accuracy of the target code segment is improved.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flow chart of a method for scanning and determining code defects and vulnerabilities based on a knowledge base of the present invention;

FIG2 is a flow chart of analyzing whether the abnormal tendency of a target code is qualified according to the present invention;

FIG3 is a flow chart of a marking subcode segment of the present invention;

FIG. 4 is a flow chart of adjusting the first preset abnormal tendency evaluation value according to the present invention.

DETAILED DESCRIPTION

In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

It should be pointed out that the data in this embodiment are obtained by comprehensive analysis and evaluation of the historical data of the system of the present invention in the six months before this judgment and the corresponding historical judgment results. Before this detection, the system of the present invention comprehensively determines the values of the preset parameter standards for this judgment based on the evaluation values of the 37,383 retrieval results detected cumulatively in the first three months. It can be understood by those skilled in the art that the system of the present invention can determine the single parameter mentioned above by selecting the value with the highest proportion as the preset standard parameter according to the data distribution, using weighted summation to use the obtained value as the preset standard parameter, substituting each historical data into a specific formula and using the value obtained by the formula as the preset standard parameter or other selection methods, as long as the system of the present invention can clearly define the different specific situations in the single judgment process through the obtained values.

The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

Please refer to FIG. 1 , which is a flow chart of a code defect vulnerability scanning and determination method based on a knowledge base of the present invention.

An embodiment of the present invention provides a method for scanning and determining code defects and vulnerabilities based on a knowledge base, comprising:

Step S1, dividing the target code of the knowledge base into several sub-code segments;

Step S2, calculating the abnormal tendency evaluation value of the target code based on the code repetition degree of each sub-code segment and the conditional probability of each sub-code segment;

Step S3, analyzing whether the abnormal tendency of the target code is qualified based on the abnormal tendency evaluation value;

Step S4, performing an aggressiveness test on the target code that fails the abnormal tendency test, and marking each sub-code segment;

Step S5: regenerate a new sub-code segment based on the secondary sub-code segment, and perform an offensive test to mark the new sub-code segment;

Step S6: adjusting the attack frequency on the sub-code segment based on the proportion of the first-level sub-code segment.

Specifically, in the step S2, the conditional probabilities between the sub-code segments are calculated respectively, and the abnormal tendency evaluation value for the target code is calculated based on the calculated average value P of the conditional probabilities and the code repetition C of each sub-code segment, and the abnormal tendency evaluation value S=α×P/P0+β×C/C0 is set, wherein α is the conditional probability weight coefficient, β is the repetition weight coefficient, P0 is the preset average value, and C0 is the preset code repetition.

In the embodiment of the present invention, the conditional probability weight coefficient is 0.35, the repetition weight coefficient is 0.65, P0 is 0.65, and the preset code repetition is 0.75.

In the present invention, the greater the conditional probability between each sub-code segment, the closer the connection between each sub-code segment, the stronger the dependency between codes, the more rigorous the code needs to be tested, the higher the repetition of each sub-code segment, the greater the maintenance difficulty, the abnormal tendency of the target code is comprehensively analyzed based on the conditional probability and repetition between each sub-code segment, the control accuracy of the structural complexity of the target code is improved, the target code with unqualified abnormal tendency is tested for aggressiveness, and each sub-code segment is marked according to the test results, and the sub-code segment with vulnerabilities is stored in the vulnerability database, which is convenient for subsequent comparison with the code segment in the vulnerability database to determine whether the target code segment has vulnerabilities, thereby improving the vulnerability identification efficiency of the code.

Please refer to FIG. 2 , which is a flow chart for analyzing whether the abnormal tendency of the target code is qualified.

Specifically, in step S3, the abnormal tendency of the target code is analyzed based on the abnormal tendency evaluation value to determine whether it is qualified.

If the abnormal tendency evaluation value is less than or equal to the first preset abnormal tendency evaluation value, it is determined that the abnormal tendency of the target code is qualified;

If the abnormal tendency evaluation value is greater than the first preset abnormal tendency evaluation value, the abnormal tendency of the target code is determined to be unqualified, and an aggressiveness test is performed on each of the sub-code segments, and a test log is recorded.

In the embodiment of the present invention, the first preset abnormal tendency evaluation value is 1.05.

Please refer to FIG. 3 , which is a flow chart of the marking sub-code segment.

Specifically, in step S4, when the aggressiveness test is completed for each sub-code segment, the sub-code segment is marked based on the error log ratio of the aggressiveness test for a single sub-code segment.

If the error log ratio is less than or equal to a first preset error log ratio, marking the sub-code segment as a first-level sub-code segment;

If the error log ratio is greater than the first preset error log ratio and less than or equal to the second preset error log ratio, marking the sub-code segment as a secondary sub-code segment, and storing the sub-code segment in a temporary database;

If the error log ratio is greater than the second preset error log ratio, the sub-code segment is marked as a third-level sub-code segment, and the sub-code segment is stored in the vulnerability database.

In the embodiment of the present invention, the error log ratio is the ratio of the number of error logs to the total number of logs, the first preset error log ratio is 0.3, and the second preset error log ratio is 0.4.

In the present invention, the secondary sub-code segments are stored in a temporary database, and the sub-code segments are recombined to generate new sub-code segments, the newly generated sub-code segments are tested, and the sub-code segments with vulnerabilities are stored in a vulnerability database, thereby achieving an expansion of the types of sub-code segments in the vulnerability database.

Please refer to FIG. 4 , which is a flow chart of adjusting the first preset abnormal tendency evaluation value.

Specifically, when marking of each of the sub-code segments is completed, the first preset abnormal tendency evaluation value is adjusted based on the proportion of the number of the secondary sub-code segments.

If the quantity ratio is less than or equal to the preset quantity ratio, the first adjustment coefficient t1 is selected to adjust the first preset abnormal tendency evaluation value D to the corresponding value, and the adjusted first preset abnormal tendency evaluation value D'=t1×D0 is set, where D0 is the initial first preset abnormal tendency evaluation value before adjustment;

If the quantity ratio is greater than the preset quantity ratio, the second adjustment coefficient t2 is selected to adjust the first preset abnormal tendency evaluation value D to a corresponding value, and the adjusted first preset abnormal tendency evaluation value D' is set to t2×D0.

In the embodiment of the present invention, the first adjustment coefficient is 0.9, and the second adjustment coefficient is 0.8.

In the present invention, the first preset abnormal tendency evaluation value is reduced according to the proportion of the secondary sub-code segment, the range of qualified target codes is narrowed, the range of target codes that need further analysis is increased, and the analysis accuracy of the target code segment is improved.

Specifically, when the marking of each sub-code segment is completed, the sub-code segments in the temporary database are randomly connected, and a number of new sub-code segments are randomly regenerated, and an attack test is performed on each new sub-code segment, and each new sub-code segment is marked based on the proportion of new error logs of each new sub-code segment after the attack test.

If the new error log ratio is less than or equal to the second preset error log ratio, marking the new sub-code segment as a secondary sub-code segment, and storing the new sub-code segment in the temporary database;

If the new error log ratio is greater than the second preset error log ratio, the new sub-code segment is marked as a third-level sub-code segment, and the new sub-code segment is stored in the vulnerability database.

Specifically, when marking of each of the new sub-code segments is completed, the number of generated new sub-code segments is determined based on the third-level proportion of the third-level sub-code segments.

If the third-level proportion is less than or equal to the preset third-level proportion, determining that the number of the generated new sub-code segments is the first-level number;

If the third-level proportion is greater than the preset third-level proportion, it is determined that the number of the new sub-code segments generated is the second-level number.

Specifically, when the sub-code segments are marked, the attack frequency in the attack test process for each sub-code segment is corrected based on the first-level proportion of the marked first-level sub-code segments.

If the first-level proportion is less than or equal to the preset first-level proportion, it is determined that the first correction coefficient z1 is selected to correct the attack frequency V to the corresponding value, and the corrected attack frequency V'=z1×V0 is set, where V0 is the initial attack frequency before correction;

If the first-level proportion is greater than the preset first-level proportion, it is determined that the second correction coefficient z2 is selected to correct the attack frequency V to a corresponding value, and the corrected attack frequency V'=z2×V0 is set.

In the embodiment of the present invention, the first correction coefficient is 2, and the second correction coefficient is 2.5.

Specifically, when each of the sub-code segments is marked complete, it is determined whether to update the component version based on the proportion of the third-level sub-code segments.

If the proportion of the third-level sub-code segments is greater than or equal to the proportion of the preset third-level sub-code segments, it is determined that the component version is low, and the component version is updated;

If the proportion of the third-level sub-code segments is less than the proportion of the preset third-level sub-code segments, it is determined that the component version is normal and the component version is not updated.

Specifically, the attack test includes: analyzing whether the sub-code segment has a vulnerability based on the matching degree between the known vulnerability code segment in the big data and the sub-code segment, and testing the sub-code segment using a black box test.

So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims (10)

1. The code defect vulnerability scanning and determining method based on the knowledge base is characterized by comprising the following steps of:

S1, dividing an object code of a knowledge base into a plurality of sub-code segments;

S2, calculating an abnormality tendency evaluation value of the target code based on the code repetition degree of each sub-code segment and the conditional probability of each sub-code segment;

s3, analyzing whether the abnormal tendency of the target code is qualified or not based on the abnormal tendency evaluation value;

s4, carrying out aggressiveness test on the object code with unqualified abnormal tendency, and marking each subcode segment;

S5, regenerating a new sub-code segment based on the second-level sub-code segment, and performing an aggressiveness test to mark the new sub-code segment;

and step S6, adjusting the attack frequency for the sub-code segments based on the duty ratio of the first-level sub-code segments.

2. The knowledge base-based code bug scan determination method according to claim 1, wherein in the step S2, conditional probabilities among the sub-code segments are calculated respectively, and an abnormal tendency evaluation value for the target code is calculated based on an average value P of the calculated conditional probabilities and a code repetition degree C of each sub-code segment, and an abnormal tendency evaluation value s=α×p/p0+β×c/C0 is set, where α is a conditional probability weight coefficient, β is a repetition degree weight coefficient, P0 is a preset average value, and C0 is a preset code repetition degree.

3. The knowledge base based code bug scan determination method of claim 2, wherein analyzing whether the object code is qualified for abnormal tendency based on the abnormal tendency evaluation value in the step S3,

If the abnormal tendency evaluation value is smaller than or equal to a first preset abnormal tendency evaluation value, judging that the abnormal tendency of the target code is qualified;

If the abnormality tendency evaluation value is larger than the first preset abnormality tendency evaluation value, judging that the abnormality tendency of the target code is unqualified, carrying out an aggressiveness test on each sub-code segment, and recording a test log.

4. The knowledge base based code bug scan determination method of claim 3, wherein at the completion of the offensiveness test on each of the sub-code segments in the step S4, the sub-code segments are marked based on an error log duty ratio of the offensiveness test for a single sub-code segment,

If the error log duty cycle is smaller than or equal to a first preset error log duty cycle, marking the sub-code segment as a primary sub-code segment;

If the error log duty ratio is larger than the first preset error log duty ratio and smaller than or equal to the second preset error log duty ratio, marking the subcode segment as a secondary subcode segment, and storing the subcode segment into a temporary database;

and if the error log duty ratio is larger than the second preset error log duty ratio, marking the sub-code segment as a three-level sub-code segment, and storing the sub-code segment into a vulnerability database.

5. The knowledge base based code bug scan determination method of claim 4, wherein the first preset anomaly propensity scoring value is adjusted based on a number of secondary subcode segments duty cycle when marking each of the subcode segments is complete.

6. The method of claim 5, wherein when the marking of each sub-code segment is completed, the sub-code segments in the temporary database are randomly connected and a plurality of new sub-code segments are randomly generated again, attack tests are performed on each new sub-code segment, and each new sub-code segment is marked based on the new error log occupation ratio of each new sub-code segment after the attack tests,

If the new error log duty ratio is smaller than or equal to the second preset error log duty ratio, marking the new sub-code segment as a secondary sub-code segment, and storing the new sub-code segment into the temporary database;

and if the new error log duty ratio is larger than the second preset error log duty ratio, marking the new sub-code segment as a three-level sub-code segment, and storing the new sub-code segment into the vulnerability database.

7. The knowledge base based code bug scan determination method of claim 6, wherein the number of new sub-code segments generated is determined based on the three-level duty cycle of the three-level sub-code segments when marking each of the new sub-code segments is complete,

If the three-level duty ratio is smaller than or equal to a preset three-level duty ratio, determining the number of the new sub-code segments to be generated as a first-level number;

and if the three-level duty ratio is larger than the preset three-level duty ratio, determining that the number of the generated new sub-code segments is two-level number.

8. The knowledge base based code bug scan determination method of claim 7, wherein the primary duty cycle of marked primary sub-code segments when marking the sub-code segments is completed corrects attack frequencies during attack testing for each sub-code segment.

9. The knowledge base based code bug scan determination method of claim 8, wherein determining whether to update a component version based on the duty cycle of the three-level sub-code segments when marking each of the sub-code segments is complete,

If the duty ratio of the three-level sub-code segment is larger than or equal to the duty ratio of the preset three-level sub-code segment, judging that the component version is low, and updating the component version;

and if the duty ratio of the three-level sub-code segment is smaller than that of the preset three-level sub-code segment, judging that the component version is normal, and not updating the component version.

10. The knowledge base based code bug scan determination method of claim 9, wherein the attack test comprises: analyzing whether the sub-code segment has the loopholes or not based on the matching degree of the known loophole code segment in the big data and the sub-code segment, and adopting a black box test to test the sub-code segment.