Software security defect prediction methods and devices
Teachings of the present disclosure include software security flaw prediction methods. An example method includes: scanning a segment of software source code to obtain a quantity of each error-prone mode present; determining a probability of violating each secure programming rule, based on the number of occurrences of each mode; predicting a probability of each security flaw based on the probability of the software source code violating each secure programming rule; acquiring each item of alert information obtained by analysis using a static code scanning tool, wherein an item of alert information indicates that a security flaw might occur in the software source code; and determining a probability of each item of alert information indicating a true security flaw, according to the probability of each security flaw potentially present in the software source code.
1 . A software security flaw prediction method comprising:
scanning a segment of software source code to obtain a number of occurrences of each one of multiple error-prone modes present in the software source code;
determining a probability of the software source code violating each one of multiple secure programming rules, based at least in part on the number of occurrences of each error-prone mode;
predicting a probability of each one of multiple security flaws potentially present in the software source code based at least in part on the probability of the software source code violating each secure programming rule;
acquiring each of multiple items of alert information obtained by analysis of the software source code by a static code scanning tool, wherein an item of alert information indicates that a security flaw might occur in the software source code; and
determining a probability of each item of alert information indicating a true security flaw, according to the probability of each security flaw potentially present in the software source code.
2 . The method as claimed in claim 1 , wherein determining the probability of the software source code violating each secure programming rule comprises entering the number of occurrences of each error-prone mode into a pre-trained first neural network model to obtain the probability, as calculated by the first neural network model, of the software source code violating each secure programming rule, wherein the first neural network model indicates a relationship between the number of occurrences of each error-prone mode and the probability of each secure programming rule being violated.
3 . The method as claimed in claim 1 , wherein predicting the probability of each security flaw potentially present in the software source code comprises entering the probability of the software source code violating each secure programming rule into a pre-trained second neural network model to obtain the probability, as calculated by the second neural model, of occurrence of each security flaw potentially present in the software source code, wherein the second neural network model indicates a relationship between the probability of each secure programming rule being violated and the probability of each flaw.
4 . The method as claimed in claim 1 , wherein determining the probability of each item of alert information indicating a true security flaw comprises:
if the probability of occurrence of a security flaw potentially present in the software source code is above a threshold, and alert information indicating that said security flaw might occur in the software source code is obtained through analysis of the software source code using the static code scanning tool, then assign the probability of the alert information indicating a true security flaw as high.
5 . A software security flaw prediction apparatus comprising:
a code scanning module to scan a number of occurrences of each one of multiple error-prone modes present in a segment of software source code;
a first processing module to determine a probability of the software source code violating each one of multiple secure programming rules based at least in part on the number of occurrences of each error-prone mode;
a second processing module to predict a probability of each one of multiple security flaws that might be present in the software source code according to the probability of the software source code violating each secure programming rule;
an information acquisition module to acquire each one of multiple items of alert information obtained by analysis of the software source code by a static code scanning tool, wherein an item of alert information indicates a potential security flaw in the software source code; and
a third processing module to determine a probability of each item of alert information indicating a true security flaw, according to the probability of each security flaw potentially present in the software source code.
6 . The apparatus as claimed in claim 5 , wherein:
the first processing module is configured to provide the number of occurrences of each error-prone mode into a pre-trained first neural network model to obtain the probability, calculated by the first neural network model, of the software source code violating each secure programming rule; and
the first neural network model indicates a relationship between the number of occurrences of each error-prone mode and the probability of each secure programming rule being violated.
7 . The apparatus as claimed in claim 5 , wherein:
the second processing module is configured to provide the probability of the software source code violating each secure programming rule into a pre-trained second neural network model to obtain the probability, calculated by the second neural model, of occurrence of each security flaw that might be present in the software source code; and
the second neural network model indicates a relationship between the probability of each secure programming rule being violated and the probability of each flaw.
8 . The apparatus as claimed in claim 5 , wherein the third processing module is configured to, if the probability of occurrence of a security flaw potentially present in the software source code is above a threshold, and alert information indicating that said security flaw might occur in the software source code is obtained through analysis of the software source code using the static code scanning tool, then assign the probability of the alert information indicating a true security flaw as high.
9 . A software security flaw prediction apparatus comprising:
at least one memory to store computer-readable code;
at least one processor to call the computer-readable code, to:
scan a segment of software source code to obtain a number of occurrences of each one of multiple error-prone modes present in the software source code;
determine a probability of the software source code violating each one of multiple secure programming rules, based at least in part on the number of occurrences of each error-prone mode;
predict a probability of each one of multiple security flaws potentially present in the software source code based at least in part on the probability of the software source code violating each secure programming rule;
acquire each one of multiple items of alert information obtained by analysis of the software source code by a static code scanning tool, wherein an item of alert information indicates that a security flaw might occur in the software source code; and
determine a probability of each item of alert information indicating a true security flaw, according to the probability of each security flaw potentially present in the software source code.