融合静态和动态信息特征的代码漏洞检测研究OA

In view of the fact that the solutions to DL-based learning program representation cannot capture deep and accurate program semantic information,resulting in false positive during prediction,this paper proposes a model CL-Mamba which combines contrastive learning and Mamba.This model optimizes the code semantic representation and context understanding capabilities by integrating static information such as abstract syntax tree(AST),data-flow graph(DFG),and control-flow graph(CFG)with dynamic information of symbolic execution paths,and combining contrastive learning and Mamba architecture.Unsupervised active learning technology is used to determine the subset of important paths for collecting dynamic symbolic execution trajectories,so as to reduce the overhead of symbolic execution.The model performance is verified experimentally on three datasets and compared with multiple methods,which proves that the proposed model has significant advantages in eliminating false positive and improving detection accuracy.To sum up,this method is an efficient software security analysis tool.