Yangzhou University

Lili Bo

Bin Li

Xiaobing Sun

Wei Liu

Ying Wei

Xiaoxue Wu

Sicong Cao

Xingqi Cheng

Disclosed in the present disclosure are an explainable vulnerability detection method and system based on dual-view causal reasoning. The vulnerability detection method includes: S, obtaining code samples, where the code samples include a training sample and a sample to be detected, sequentially performing data augmentation, static analysis, code property graph construction and feature extraction on the training sample, and obtaining a training data set; and sequentially performing static analysis, code property graph construction and feature extraction on the sample to be detected, and obtaining a data set to be detect; S, processing the training data set through a hybrid contrastive learning method, and establishing a vulnerability detection model; and inputting the data set to be detected into the vulnerability detection model, and outputting a vulnerability code; and S, performing causal reasoning on the vulnerability code, and outputting a vulnerability detection explanation.

Explainable vulnerability detection method and system based on dual-view causal reasoning

Provided is an automatic event graph construction method for multi-source vulnerability information. The method includes the following steps. A vulnerability report is crawled from a vulnerability database, a cause of vulnerability is taken as an event trigger word, and a vulnerability type is determined through the cause of vulnerability. An attacker, consequence, location and other information in a description are identified by named-entity recognition, and information completion is performed. An explicit relation between events is extracted by using text information, an implicit relation between events is extracted by using text similarity, and vulnerability-related code representation is performed. Obtained vulnerability event information is visualized into an event graph through a visualization tool.

Automatic event graph construction method and device for multi-source vulnerability information

Growing community of inventors

Jiangsu, China

Lili Bo