Intelligent vulnerability mining platform construction method and system based on large model

Abstract

The invention provides an intelligent vulnerability mining platform construction method and system based on a large model. The intelligent vulnerability mining platform systematically identifies and analyzes potential security risks, collects and identifies code snippets with the security risks, arranges the code snippets into risk code paragraphs, identifies target code paragraphs, determines known vulnerabilities, generates context information, captures key events in actual operation, and records real execution paths and state changes. The method comprises the steps of generating a dynamic execution track, simulating different paths, generating an attack vector path, predicting unknown vulnerabilities and credibility scores of the unknown vulnerabilities, testing prediction results of high-credibility scores, confirming and generating real vulnerability information, recording the information to a vulnerability knowledge base, and generating a security report containing vulnerability description, influence ranges, risk levels and repair suggestions. According to the technical scheme provided by the embodiment of the invention, the detection accuracy and efficiency of the security vulnerabilities in the software system are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of large model technology, and in particular to a method and system for constructing an intelligent vulnerability mining platform based on a large model. Background Art

[0002] As code bases continue to grow in size and complexity, ensuring the security of software systems becomes critical. Whether it is an enterprise application or an open source project, the existence of security vulnerabilities may lead to serious data leakage, system crashes, or the risk of malicious exploitation.

[0003] Currently, there are many vulnerability detection tools and technologies on the market, such as static code analysis tools, dynamic analysis tools, and fuzz testing tools. These tools use different methods to detect potential security issues in the code. Static code analysis tools are mainly based on rule matching and pattern recognition, and can find some common programming errors without running the code; dynamic analysis tools capture abnormal behaviors by monitoring the actual operation of the program; fuzz testing tools try to trigger unforeseen behaviors by inputting random or mutated data into the program.

[0004] Although existing solutions can help identify some security issues to a certain extent, they still have several significant flaws. First, static analysis tools rely on predefined rule sets and have limited ability to identify unknown or complex vulnerability features, which can easily generate a large number of false positives and false negatives. Second, although dynamic analysis tools can capture abnormal behaviors in actual operation, their coverage is limited and they cannot fully simulate all possible execution paths, resulting in some hidden vulnerabilities not being discovered. Finally, although fuzz testing tools can improve coverage through a large number of mutation tests, they rely heavily on test case generation and optimization, making it difficult to effectively predict and verify deep unknown vulnerabilities. Summary of the invention

[0005] The embodiments of the present application provide a method and system for constructing an intelligent vulnerability mining platform based on a large model, so as to solve the problems of insufficient detection accuracy and low efficiency in the prior art.

[0006] In a first aspect, an embodiment of the present application provides a method for constructing an intelligent vulnerability mining platform based on a large model, comprising: Analyze the code snippets collected from different source code repositories, identify the code snippets with security risks and organize them into risky code sections; Analyze the risk code segments to identify target code segments that match common vulnerability features, obtain known vulnerabilities of the target code segments, generate context information based on the known vulnerabilities, and capture key events during the actual runtime of the target code segments to generate dynamic execution traces; Using a large-scale pre-trained model combined with a reinforcement learning algorithm to simulate the context information and different paths in the dynamic execution trajectory, and defining a state space, an action space, and a reward function, optimizing execution path exploration through an adversarial training mechanism to simulate attack vector paths in different environments, and predicting and analyzing unknown vulnerabilities in the target code segment based on the attack vector path to generate a prediction result and a credibility score; Based on the preset mutation operation and coverage-oriented strategy, the prediction results whose credibility scores exceed the preset threshold are tested to confirm and generate real vulnerability information; The real vulnerability information is recorded in the vulnerability knowledge base to generate a security report.

[0007] Optionally, the use of a large-scale pre-trained model in combination with a reinforcement learning algorithm to simulate the context information and different paths in the dynamic execution trajectory, and to define a state space, an action space, and a reward function, optimizes the execution path exploration through an adversarial training mechanism to simulate attack vector paths under different environments, and predicts and analyzes unknown vulnerabilities in the target code segment according to the attack vector path to generate a prediction result and a credibility score, including: The context information is encoded and processed using a large-scale pre-trained model to obtain a context feature representation, and a vulnerability monitoring tool is used to capture key events during the actual operation of the target code segment, and the actual execution path and state changes of the target code segment are recorded to generate a dynamic execution trajectory, and the dynamic execution trajectory is refined and processed using a time series analysis technology to generate a dynamic execution trajectory feature representation; A multimodal fusion method is used to fuse the context feature representation and the dynamic execution trajectory feature representation, and a graph neural network is combined to capture the dependency relationship in the structure of the target code segment to obtain a comprehensive feature representation; Using a reinforcement learning algorithm, based on the comprehensive feature representation, the execution path of the target code segment is explored and optimized to obtain the execution path exploration, and the state space, action space and reward function are defined, and the execution path exploration is optimized through an adversarial training mechanism to simulate the attack vector path under different environments; According to the attack vector path, potential known vulnerabilities are implicitly modeled in combination with a variational autoencoder, and unknown vulnerabilities of the attack vector path in the target code segment are analyzed to obtain a prediction result; Based on the prediction results, a Bayesian optimization algorithm is used to evaluate the success probability of the attack vector path and the confidence of the prediction of the large-scale pre-trained model to generate a credibility score.

[0008] Optionally, the use of a reinforcement learning algorithm to explore and optimize the execution path of the target code segment based on the comprehensive feature representation, obtain execution path exploration, define a state space, an action space and a reward function, and optimize the execution path exploration through an adversarial training mechanism to simulate attack vector paths under different environments, including: Using a reinforcement learning algorithm, based on the comprehensive feature representation, a state space, an action space and a reward function are defined to obtain an initial execution path framework, wherein the state space represents various states of the program of the target code segment when it is running, and the action space represents the operations that can be executed in the program of the target code segment; Based on the state space, the action space and the reward function, an adversarial training mechanism is introduced to enhance the execution path exploration through the mutual game between the generator and the discriminator in the generative adversarial network, thereby improving the robustness and diversity of the path exploration and obtaining preliminary execution path exploration results; According to the preliminary execution path exploration result, in combination with a deep Q-net or a policy gradient method, the execution path of the target code segment is optimized, and the execution path is adjusted through multiple iterations to generate an optimized execution path; The optimized execution path is tested in a simulation environment, and environmental parameters are adjusted to verify the performance of the optimized execution path under different conditions to simulate attack vector paths in different environments, wherein the environmental parameters include input data and system configuration.

[0009] Optionally, it also includes: Using diversified simulation environment construction technology, modeling the actual application scenario of the target code segment to obtain a simulation environment including configuration parameters and input data; Based on the simulation environment, a dynamic adversarial sample generation mechanism is introduced to test the optimized execution path to obtain attack vector path performance data; Applying a multi-round iterative feedback loop method to analyze the attack vector path performance data to evaluate the success rate and impact range of the attack vector path to obtain an evaluation result; Based on the evaluation results, complex attack vector paths are guided and annotated to obtain annotated samples, and active learning is used to select the annotated samples with large amounts of information for training to generate prediction results; The prediction results are used to analyze the attack vector paths in different environments, and generate a comprehensive security assessment report including attack vector path description, success probability, impact range and repair suggestions.

[0010] Optionally, the predictive results whose credibility scores exceed a preset threshold are tested based on a preset mutation operation and coverage-oriented strategy to confirm and generate real vulnerability information, including: By screening the results whose credibility scores exceed a preset threshold, target code sections with real vulnerabilities are obtained; Analyze the target code segment with real vulnerabilities according to the differential fuzz testing environment technology to obtain an initial test case; The initial test cases are mutated to generate key test cases, and the execution path and coverage of the monitoring code are introduced by using a coverage-oriented strategy, so that the key test cases touch different branches and conditional statements in the code and generate vulnerability detection results, wherein the mutation process includes randomly changing input data, inserting abnormal characters, and changing data structures; The target code segment is analyzed according to the vulnerability detection result to check whether there is a suspicious behavior pattern and verify whether the behavior pattern represents a real vulnerability to generate real vulnerability information, wherein the real vulnerability information includes the specific location, triggering conditions and impact range of the real vulnerability.

[0011] Optionally, analyzing the target code segment according to the vulnerability detection result, checking whether there is a suspicious behavior pattern, and verifying whether the behavior pattern represents a real vulnerability to generate real vulnerability information includes: Based on the vulnerability detection results collected by the differential fuzz test, the actual behavior data of the target code segment is analyzed to obtain security problem data, wherein the security problem data includes system crash, abnormal output and memory leak; Analyze and process the security problem data, identify suspicious behavior patterns that may lead to security problems, and obtain a list of suspicious behaviors; Verify the suspicious behavior list by repeated testing, using different input conditions and reproducing in different environments to confirm whether the suspicious behavior pattern represents a real vulnerability and obtain a real vulnerability candidate; The real vulnerability candidates are evaluated to determine whether they constitute actual security vulnerabilities, and combined with the definition and standard of the real vulnerability, the severity and impact scope of the real vulnerability are predicted to obtain real vulnerability information.

[0012] Optionally, analyzing the risky code segments to identify target code segments that match common vulnerability features, obtaining known vulnerabilities of the target code segments, and generating context information based on the known vulnerabilities include: Scan the risky code segments in combination with formal verification methods, identify target code segments that match common vulnerability characteristics, and determine known vulnerabilities existing in the target code segments; Based on the known vulnerabilities, in combination with natural language processing technology, an in-depth semantic analysis of the comment text and variable names in the target code segments is performed to construct a correlation map between the target code segments, enhance context understanding, and generate an analysis report, wherein the analysis report includes semantic and correlation information; Based on the analysis report, information including the functional description, logical structure and behavior pattern of the target code segment is integrated to generate context information.

[0013] Optionally, the method of deeply semantically analyzing the annotation text and variable names in the target code segments based on the known vulnerabilities in combination with natural language processing technology, constructing a correlation map between the target code segments, enhancing context understanding, and generating an analysis report includes: Analyze the comment text and variable names in the target code segment to generate a semantic analysis result; Based on the semantic analysis results, a relationship extraction technique is applied to construct a relationship graph between code elements; The semantic analysis results, the association map and the known vulnerabilities are integrated to generate an analysis report, wherein the analysis report covers the functional description, logical structure, behavior pattern of the target code segment and the specific location and characteristics of the known vulnerabilities.

[0014] In a second aspect, the embodiment of the present application provides a system for constructing an intelligent vulnerability mining platform based on a large model, including: The analysis module is used to analyze the code snippets collected from different source code repositories, identify the code snippets with security risks and organize them into risky code sections; an identification module, configured to analyze the risk code segments to identify target code segments that match common vulnerability features, obtain known vulnerabilities of the target code segments, generate context information based on the known vulnerabilities, and capture key events during the actual runtime of the target code segments to generate dynamic execution traces; A processing module, used to simulate the context information and different paths in the dynamic execution trajectory by using a large-scale pre-training model combined with a reinforcement learning algorithm, and define a state space, an action space, and a reward function, optimize the execution path exploration through an adversarial training mechanism to simulate the attack vector path under different environments, and predict and analyze the unknown vulnerabilities in the target code segment according to the attack vector path to generate a prediction result and a credibility score; A testing module, for testing the prediction results whose credibility scores exceed a preset threshold value based on a preset mutation operation and coverage-oriented strategy, so as to confirm and generate real vulnerability information; The recording module is used to record the real vulnerability information into the vulnerability knowledge base to generate a security report.

[0015] In a third aspect, an embodiment of the present application provides a computing device, comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a method for building an intelligent vulnerability mining platform based on a large model as described in the first aspect above.

[0016] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing a computer program. When the computer program is executed by a computer, it implements a method for constructing an intelligent vulnerability mining platform based on a large model as described in the first aspect.

[0017] In an embodiment of the present application, code snippets collected from different source code repositories are analyzed to identify code snippets with security risks and organize them into risky code segments; the risky code segments are analyzed to identify target code segments that match common vulnerability features, obtain known vulnerabilities of the target code segments, generate context information based on the known vulnerabilities, and capture key events during the actual runtime of the target code segments to generate dynamic execution trajectories, wherein the key events include function calls, system calls, and memory accesses; a large-scale pre-trained model is used in combination with a reinforcement learning algorithm to simulate different paths in the context information and the dynamic execution trajectory, and a state space, an action space, and a reward function are defined; the execution path exploration is optimized through an adversarial training mechanism to simulate attack vector paths under different environments; based on the attack vector path, unknown vulnerabilities in the target code segments are predicted and analyzed to generate prediction results and credibility scores; based on preset mutation operations and coverage-oriented strategies, the prediction results whose credibility scores exceed a preset threshold are tested to confirm and generate real vulnerability information; the real vulnerability information is recorded in the vulnerability knowledge base to generate a security report.

[0018] The technical solution of this application has the following beneficial effects: The embodiment of the present application not only realizes the systematic identification and analysis of potential security risks in the source code library, but also combines a variety of advanced technologies such as natural language processing, large-scale pre-training models and reinforcement learning algorithms through an intelligent vulnerability mining platform, which greatly improves the accuracy and efficiency of vulnerability detection. In addition, the reliability of the prediction results is ensured through actual testing of differential fuzz testing and coverage-oriented strategies. Ultimately, a detailed security report is generated to provide clear repair guidance for the development team, effectively reducing the security risks of the software system and enhancing overall security. This method is not only suitable for the review of existing code bases, but also provides real-time security protection during the development of new code, greatly reducing potential security risks.

[0019] Furthermore, the embodiment of the present application also uses a large-scale pre-trained model combined with a reinforcement learning algorithm to deeply process and fuse context information and dynamic execution trajectories, generate a comprehensive feature representation, and simulate different paths to generate an attack vector path. The specific steps include: using a pre-trained model to deeply encode context information and generate a context feature representation; using a vulnerability monitoring tool to capture key events during actual runtime, generate a dynamic execution trajectory, and refine the processing through time series analysis; using a multimodal fusion method combined with a graph neural network to capture dependencies in the code structure and obtain a comprehensive feature representation; using a reinforcement learning algorithm to explore and optimize possible execution paths, introducing adversarial training to improve the robustness and diversity of path exploration; combining a variational autoencoder to implicitly model potential known vulnerabilities, predict unknown vulnerabilities and their credibility scores. In addition, through the introduction of mutation operations and coverage-oriented strategies through differential fuzz testing technology, the prediction results of high-credibility scores are actually tested, and real vulnerability information is confirmed and generated to ensure that the detected vulnerabilities are highly accurate.

[0020] The above method significantly improves the accuracy and efficiency of detecting known and unknown security vulnerabilities in software systems. Through intelligent and automated means, it can not only comprehensively identify potential security risks, but also effectively verify the prediction results and reduce false positives and false negatives. In particular, the combination of differential fuzz testing technology and mutation operations ensures that the prediction results of high-confidence scores are effectively verified in the actual operating environment, generating detailed and real vulnerability information. This method is not only suitable for the review of existing code bases, but also provides real-time security protection during the development of new code, greatly reducing potential security risks and enhancing the overall security of the system.

[0021] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0023] Figure 1 A flowchart of a method for constructing an intelligent vulnerability mining platform based on a large model provided by the present application is shown; Figure 2 A schematic diagram of the structure of a system for building an intelligent vulnerability mining platform based on a large model provided by the present application is shown; Figure 3 A schematic diagram of the structure of a computing device provided by the present application is shown. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0025] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0026] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0027] Figure 1 A flowchart of a method for constructing an intelligent vulnerability mining platform based on a large model is provided for an embodiment of the present application, such as Figure 1 As shown, the method includes: 101. Analyze the code snippets collected from different source code repositories, identify the code snippets with security risks and organize them into risky code sections; Among them, risky code segments refer to code snippets that are collected from multiple source code repositories and are considered to have potential security issues after preliminary screening. These code snippets may contain unsafe function calls, improper exception handling, or memory management errors. By organizing these code snippets into risky code segments, subsequent security analysis can be carried out more systematically.

[0028] A source code repository is a centralized repository that stores software project code, usually hosted on a version control system such as Git, including platforms such as GitHub and GitLab. These repositories contain the entire history and current status of the project and are the basis for developer collaboration and version control.

[0029] A code snippet is a specific portion of code extracted from a source code repository, which may be part of a function, class, or module. These snippets are used for evaluation and analysis to determine if there are potential security risks.

[0030] In actual operation, code snippets are widely collected from different source code repositories, and those that may pose security risks are identified using automated tools and rule matching technology. Subsequently, these snippets are classified and organized to form a structured collection of risky code segments for further in-depth analysis.

[0031] For example, in a large model domain implementation, assume that the code base of a large deep learning framework is being evaluated. First, an automated script is used to capture relevant code snippets from open source repositories on multiple platforms such as GitHub and GitLab. Next, a pre-trained natural language processing model combined with a keyword matching algorithm is used to identify code snippets containing high-risk function calls such as "eval" and "exec" and mark them as risky code paragraphs. These paragraphs are organized into database entries and prepared for detailed analysis in subsequent steps.

[0032] 102. Analyze the risky code segments to identify target code segments that match common vulnerability features, obtain known vulnerabilities of the target code segments, generate context information based on the known vulnerabilities, and capture key events during the actual runtime of the target code segments to generate dynamic execution traces.

[0033] The key events include function calls, system calls and memory accesses.

[0034] The security pattern matching engine is a pre-configured set of rules used to identify vulnerability characteristics of specific patterns in the code. It detects possible security vulnerabilities in the code through regular expressions or other pattern matching algorithms.

[0035] Context information contains the environmental background of the code, such as variable values, function call chains, etc., which helps to understand the code behavior. This information is crucial for simulating attack vector paths and predicting unknown vulnerabilities.

[0036] Dynamic execution traces refer to serialized event records generated during program execution, which reflect the actual execution path and state changes of the code. These trace data can help identify specific execution paths that may lead to vulnerabilities.

[0037] Key events are significant events that occur during code execution, such as function calls, system calls, and memory accesses. These events are the basis for building dynamic execution traces, which can reveal the behavior patterns of code runtime.

[0038] In actual operation, the built-in security pattern matching engine and natural language processing technology of the intelligent vulnerability mining platform are used to analyze the comment text and variable names in the risky code sections to identify the target code sections that match the common vulnerability characteristics. At the same time, the known vulnerability types are determined and detailed context information is generated.

[0039] For example, continuing the implementation of the previous step, in the detected risk code segment, a preset security pattern matching engine is applied to find common vulnerability features such as SQL injection and buffer overflow. For each successfully matched code segment, detailed context information is generated, including function call chains and variable assignments. Next, the code is run in a controlled environment to capture function calls, system calls, and memory access events during its actual runtime, and a dynamic execution trajectory is generated. These trajectory data are stored for use in subsequent steps.

[0040] 103. Using a large-scale pre-trained model combined with a reinforcement learning algorithm to simulate the context information and different paths in the dynamic execution trajectory, and defining a state space, an action space, and a reward function, optimizing the execution path exploration through an adversarial training mechanism to simulate attack vector paths under different environments, and predicting and analyzing unknown vulnerabilities in the target code segment based on the attack vector path to generate a prediction result and a credibility score; Among them, large-scale pre-trained models refer to language models trained with large amounts of text data, such as BERT, GPT, etc. These models have powerful semantic understanding and generation capabilities and can be used for a variety of natural language processing tasks.

[0041] Reinforcement learning algorithm is a machine learning method that uses a reward mechanism to allow intelligent agents to take optimal actions in the environment. In vulnerability mining, it can be used to explore and optimize possible execution paths and improve the diversity and robustness of path exploration.

[0042] Attack vector paths are code execution paths that simulate what an attacker might exploit, showing how an attacker can trigger a vulnerability through a specific sequence of operations. These paths can help identify potential unknown vulnerabilities.

[0043] The confidence score is a quantification of the confidence level of the forecast results, which helps to judge the reliability of the forecast. A high confidence score means that the forecast results are more likely to reflect the actual situation.

[0044] In actual operation, a large-scale pre-trained model is combined with a reinforcement learning algorithm to explore and optimize possible execution paths and generate attack vector paths based on previously generated context information and dynamic execution trajectories. Then, a variational autoencoder is used to implicitly model potential known vulnerabilities, predict unknown vulnerabilities that may exist in the target code segment, and finally generate prediction results and their credibility scores.

[0045] For example, based on the above embodiments, the BERT model is used to deeply encode context information and generate high-quality context feature representations. Then, the graph neural network is combined to capture the dependencies in the code structure and obtain a comprehensive feature representation. Next, the reinforcement learning algorithm is used to explore and optimize possible execution paths, and adversarial training is introduced to improve the robustness and diversity of path exploration, simulating multiple attack vector paths in different environments. Finally, the variational autoencoder is combined to implicitly model potential known vulnerabilities, predict unknown vulnerabilities and their credibility scores. For example, the prediction results show that a certain section of code may have an unauthorized access vulnerability, and the credibility score is 0.85, indicating that this prediction has a high reliability.

[0046] 104. Based on the preset mutation operation and coverage-oriented strategy, test the prediction results whose credibility scores exceed the preset threshold value to confirm and generate real vulnerability information; Mutation refers to modifying the initial test case to generate a new test case. These modifications can include randomly changing input data, inserting abnormal characters, and changing data structures, etc., in order to trigger potential vulnerability behaviors.

[0047] The coverage-oriented strategy is a method to guide the fuzz testing process. It monitors the execution path and coverage of the code to ensure that the test cases touch different branches and conditional statements in the code, thereby improving the effectiveness and comprehensiveness of the test.

[0048] Real vulnerability information refers to the details of vulnerabilities that have been verified and confirmed to exist, including the specific location of the vulnerability, triggering conditions, and impact range. This information is crucial for fixing the vulnerability.

[0049] In actual operation, for prediction results whose credibility scores exceed the preset threshold, these prediction results are actually tested based on the preset mutation operation and coverage-oriented strategy. The purpose is to confirm the authenticity of the prediction and generate detailed real vulnerability information to ensure that the detected vulnerabilities are highly accurate.

[0050] For example, continuing with the above embodiment, based on the high-confidence score prediction results generated in the previous steps, the prediction results with a credibility score exceeding 0.8 are screened out as key test objects. For each prediction result, different versions of the target code segment and a set of initial test cases designed to trigger potential vulnerability behaviors are obtained according to the differential fuzz testing environment technology. Next, these initial test cases are mutated to generate new test cases. In the process of using coverage-oriented strategies to guide differential fuzz testing, the execution path and coverage of the monitoring code are introduced so that the test cases touch different branches and conditional statements in the code to generate vulnerability detection results. For example, through mutation processing, it was discovered that a certain API endpoint would cause a server crash when processing JSON input in a specific format, which was confirmed as a real vulnerability.

[0051] 105. Record the real vulnerability information into the vulnerability knowledge base to generate a security report.

[0052] The security report includes vulnerability description, impact scope, risk level and repair suggestions.

[0053] The vulnerability knowledge base is a database that centrally stores confirmed vulnerability information and is used to manage and track all discovered security issues. It not only contains the specific location and triggering conditions of the vulnerability, but also includes repair suggestions and patch information.

[0054] Security reports are documents summarizing the results of vulnerability detection and analysis, usually including vulnerability description, impact scope, risk level, and repair suggestions. These reports provide clear repair guidance for development teams to ensure that security issues are resolved in a timely manner.

[0055] In actual operation, the confirmed real vulnerability information is recorded in the vulnerability knowledge base pre-set in the intelligent vulnerability mining platform, and a security report containing vulnerability description, impact scope, risk level and repair suggestions is generated. These reports provide clear repair guidance for the development team to ensure that security issues are resolved in a timely manner.

[0056] For example, after completing the steps of the aforementioned embodiment, all confirmed real vulnerability information is recorded in the vulnerability knowledge base of the intelligent vulnerability mining platform. Each vulnerability entry records in detail the specific location of the vulnerability, trigger conditions, scope of impact, risk level and repair suggestions. For example, in response to the API endpoint crash problem mentioned above, a new record was added to the vulnerability knowledge base, describing the details of the vulnerability and providing repair suggestions, such as adding input validation logic and improving error handling mechanisms. Subsequently, the generated security report was sent to the development team to guide them in the repair work.

[0057] Through the implementation of steps 101 to 105, this solution significantly improves the accuracy and efficiency of detecting known and unknown security vulnerabilities in software systems. The use of large-scale pre-trained models combined with reinforcement learning algorithms can not only comprehensively identify potential security risks, but also effectively verify the prediction results and reduce false positives and false negatives. In particular, the combination of differential fuzz testing technology and mutation operations ensures that the prediction results of high-confidence scores are effectively verified in the actual operating environment, generating detailed real vulnerability information. This method is not only suitable for the review of existing code bases, but also provides real-time security protection during the development of new code, greatly reducing potential security risks and enhancing the overall security of the system.

[0058] In order to solve the problem that traditional vulnerability detection methods are difficult to discover unknown vulnerabilities and complex code paths, and further improve the prediction accuracy and reliability of unknown security vulnerabilities in software systems, in some embodiments, step 103 uses a large-scale pre-training model combined with a reinforcement learning algorithm to simulate the context information and different paths in the dynamic execution trajectory, and defines a state space, an action space, and a reward function. The execution path exploration is optimized through an adversarial training mechanism to simulate attack vector paths under different environments. According to the attack vector path, the unknown vulnerabilities in the target code segment are predicted and analyzed to generate a prediction result and a credibility score, including: The context information is encoded and processed using a large-scale pre-trained model to obtain a context feature representation, and a vulnerability monitoring tool is used to capture key events during the actual operation of the target code segment, record the actual execution path and state changes of the target code segment, generate a dynamic execution trajectory, and use time series analysis technology to refine the dynamic execution trajectory to generate a dynamic execution trajectory feature representation; a multimodal fusion method is used to fuse the context feature representation and the dynamic execution trajectory feature representation, and a graph neural network is combined to capture the dependency in the structure of the target code segment to obtain a comprehensive feature representation; a reinforcement learning algorithm is used to explore and optimize the execution path of the target code segment on the basis of the comprehensive feature representation to obtain an execution path exploration, and a state space, an action space and a reward function are defined, and the execution path exploration is optimized through an adversarial training mechanism to simulate attack vector paths under different environments; according to the attack vector path, a variational autoencoder is combined to implicitly model potential known vulnerabilities, and unknown vulnerabilities of the attack vector path in the target code segment are analyzed to obtain a prediction result; based on the prediction result, a Bayesian optimization algorithm is used to evaluate the success probability of the attack vector path and the confidence of the prediction of the large-scale pre-trained model to generate a credibility score.

[0059] In this embodiment, the context feature representation is a feature vector obtained by deeply encoding the context information in the code snippet through a large-scale pre-trained model. These feature vectors capture the semantic information of the code environment, such as variable values, function call chains, etc., which helps to understand the behavior patterns and potential risks of the code.

[0060] Dynamic execution trace feature representation refers to the feature vector generated by refining the dynamic execution trace through time series analysis technology. These feature vectors describe the key events (such as function calls, system calls, and memory accesses) and their sequence when the code is actually running, which can reveal the real execution path and state changes of the code.

[0061] The multimodal fusion method is a technology that integrates data from different sources (such as text, images, time series, etc.). In this step, it is used to deeply fuse the context feature representation and the dynamic execution trajectory feature representation to obtain a more comprehensive comprehensive feature representation.

[0062] Graph Neural Network (GNN) is a neural network model specifically designed to process graph structured data. In this step, GNN is used to capture dependencies in code structure and help identify complex code logic and potential security vulnerabilities.

[0063] Adversarial training is a training method to improve the robustness of a model by introducing adversarial examples (i.e., intentionally designed misleading inputs) so that the model can maintain high prediction accuracy when facing complex and diverse attack vector paths.

[0064] Variational autoencoders are generative models that implicitly model potential known vulnerabilities and help predict the likelihood of unknown vulnerabilities.

[0065] The Bayesian Optimization Algorithm is a global optimization algorithm based on Bayesian reasoning, which is used to evaluate the success probability of the attack vector path and the confidence score of the prediction result, thereby providing a reliable credibility assessment.

[0066] In an embodiment of the present application, a large-scale pre-trained model is first used to deeply encode context information to generate context feature representations, and a vulnerability monitoring tool is used to capture key events during the actual runtime of the target code segment to generate a dynamic execution trajectory.

[0067] Next, the dynamic execution trajectory is refined through time series analysis technology to generate dynamic execution trajectory feature representation. Then, the context feature representation and dynamic execution trajectory feature representation are deeply integrated by multimodal fusion method, and the graph neural network is combined to capture the dependencies in the code structure to obtain a comprehensive feature representation. On this basis, the reinforcement learning algorithm is used to explore and optimize possible execution paths, define the state space, action space and reward function, introduce adversarial training to improve the robustness and diversity of path exploration, and simulate multiple attack vector paths in different environments.

[0068] Subsequently, the potential known vulnerabilities are implicitly modeled by combining the variational autoencoder, and the unknown vulnerabilities that may be caused by the attack vector path are analyzed to obtain the prediction results. Finally, the Bayesian optimization algorithm is used to evaluate the success probability of the attack vector path and the confidence of the prediction results to generate a credibility score.

[0069] Here is a specific example: In an example of a large model domain, suppose that the security of a large distributed system is being evaluated. First, the BERT model is used to deeply encode the contextual information in the collected risky code paragraphs to generate high-quality contextual feature representations.

[0070] Next, we use vulnerability monitoring tools such as DynamoRIO to capture key events in the actual runtime of the target code segment, generate detailed dynamic execution trajectories, and refine them through time series analysis technology to generate dynamic execution trajectory feature representations. Then, we use a multimodal fusion method to deeply fuse the context feature representation and the dynamic execution trajectory feature representation, and combine it with a graph neural network to capture the dependencies in the code structure to obtain a comprehensive feature representation. On this basis, we use reinforcement learning algorithms to explore and optimize possible execution paths, introduce adversarial training to improve the robustness and diversity of path exploration, and simulate multiple attack vector paths in different environments.

[0071] For example, it simulates the situation where an API endpoint may be maliciously exploited in a high-concurrency environment. Next, the potential known vulnerabilities are implicitly modeled in combination with the variational autoencoder to predict that the API endpoint may have an unauthorized access vulnerability. Finally, the Bayesian optimization algorithm is used to evaluate the success probability of the attack vector path and the confidence of the prediction result to generate a credibility score. The results show that the credibility score of the unauthorized access vulnerability of the API endpoint is 0.87, indicating that this prediction has a high reliability and provides clear guidance for subsequent repair work.

[0072] In order to solve the problem that traditional methods are difficult to fully explore and optimize complex code paths, and further improve the accuracy and robustness of unknown vulnerability detection, in some embodiments, the reinforcement learning algorithm is used to explore and optimize the execution path of the target code segment based on the comprehensive feature representation, obtain the execution path exploration, and define the state space, action space and reward function, and optimize the execution path exploration through the adversarial training mechanism to simulate the attack vector path under different environments, including: Using a reinforcement learning algorithm, on the basis of the comprehensive feature representation, a state space, an action space and a reward function are defined to obtain an initial execution path framework, wherein the state space represents various states of the program of the target code segment when it is running, and the action space represents the operations that can be executed in the program of the target code segment; based on the state space, the action space and the reward function, an adversarial training mechanism is introduced, and the execution path exploration is enhanced by the mutual game between the generator and the discriminator in the generative adversarial network, so as to improve the robustness and diversity of the path exploration and obtain a preliminary execution path exploration result; according to the preliminary execution path exploration result, combined with a deep Q network or a policy gradient method, the execution path of the target code segment is optimized, and the execution path is adjusted through multiple iterations to generate an optimized execution path; the optimized execution path is tested in a simulation environment, and the environmental parameters are adjusted to verify the performance of the optimized execution path under different conditions to simulate the attack vector path in different environments, wherein the environmental parameters include input data and system configuration.

[0073] In this embodiment, the state space refers to the set of all states that the target code segment may be in when the program is running. These states may include variable values, memory allocation, function call stack, etc., which are used to describe the specific running status of the code at a certain moment.

[0074] The action space refers to the set of all operations that can be performed in a program, such as function calls, system calls, conditional judgments, etc. Each action corresponds to a specific step in the code execution process, and the program is guided to a specific path by selecting different actions.

[0075] The reward function is a key component in reinforcement learning algorithms, used to evaluate the effect of each step. It gives a numerical reward based on the current state and the action taken, guiding the algorithm to choose the optimal path with the goal of maximizing the cumulative reward.

[0076] The adversarial training mechanism is a training method to improve the robustness of the model. Through the game between the generator and the discriminator in the Generative Adversarial Network (GAN), the model can still maintain a high prediction accuracy when facing complex and diverse attack vector paths. The generator tries to generate misleading inputs, while the discriminator tries to distinguish between real and generated data. The two promote each other and jointly improve the model performance.

[0077] Deep Q-Net (DQN) or policy gradient methods are two commonly used reinforcement learning optimization algorithms. DQN selects the best action by learning a value function, while policy gradient methods directly optimize the policy itself and are suitable for problems in continuous action space. Both methods can continuously adjust the path selection through multiple iterations to ensure that the best execution path is found.

[0078] The simulation environment is a virtual test platform used to test optimized execution paths under controlled conditions. By adjusting environmental parameters (such as input data and system configuration), the performance of the execution path under different conditions can be verified, thereby simulating multiple attack vector paths and providing a basis for subsequent security analysis.

[0079] In the embodiment of the present application, the reinforcement learning algorithm is used to define the state space, action space and reward function on the basis of comprehensive feature representation, and construct the initial execution path framework. Based on these definitions, an adversarial training mechanism is introduced, and the execution path exploration is enhanced by the mutual game between the generator and the discriminator in the generative adversarial network, the robustness and diversity of the path exploration are improved, and the preliminary execution path exploration results are obtained. Subsequently, the execution path of the target code segment is deeply optimized and processed in combination with the deep Q network or the policy gradient method, and the path selection is continuously adjusted through multiple iterations, so that the large-scale pre-trained model can find the path that causes the vulnerability under different input conditions and generate the optimized execution path. Finally, the optimized execution path is tested in a simulated environment, and the environmental parameters are adjusted to verify its performance under different conditions to simulate a variety of attack vector paths to ensure that the detected vulnerabilities are highly reliable.

[0080] Here is a specific example: Based on the comprehensive feature representation generated by the above embodiment, the state space, action space and reward function are defined, and the initial execution path framework is constructed. The state space covers various states when the program is running, such as memory allocation, variable values ​​and function call stack; the action space contains all possible operations, such as function calls, system calls and conditional judgments; the reward function gives a numerical reward based on the effect of each operation to guide the algorithm to select the optimal path.

[0081] Next, we introduced an adversarial training mechanism to enhance the robustness and diversity of execution path exploration by generating a game between the generator and the discriminator in the adversarial network. For example, the generator tries to construct input data that may lead to vulnerabilities, while the discriminator evaluates the authenticity and validity of these inputs. The two promote each other and jointly improve the performance of the model. After multiple rounds of adversarial training, we obtained preliminary execution path exploration results.

[0082] Then, the execution path of the target code segment is further optimized by combining the deep Q network or policy gradient method. Through multiple iterations, the path selection is continuously adjusted, so that the model can find the path that leads to the vulnerability under different input conditions. For example, for a certain API endpoint, a series of operation sequences that may lead to unauthorized access are found through DQN optimization, and an optimized execution path is generated.

[0083] Finally, the optimized execution path is tested in a simulation environment, and the environment parameters (such as input data and system configuration) are adjusted to verify its performance under different conditions.

[0084] For example, in a high-concurrency environment, we simulated a malicious exploitation of an API endpoint, and verified the performance of the path under different conditions by adjusting the input data and system configuration, and finally confirmed the existence of an unauthorized access vulnerability. This process not only improved the accuracy and robustness of vulnerability detection, but also provided clear guidance for subsequent repair work.

[0085] In order to solve the problem that traditional vulnerability detection methods are difficult to fully simulate the real environment and accurately evaluate the attack vector path, and further improve the accuracy and reliability of unknown vulnerability prediction, some embodiments also include: Using diversified simulation environment construction technology, the actual application scenario of the target code segment is modeled to obtain a simulation environment containing configuration parameters and input data; based on the simulation environment, a dynamic adversarial sample generation mechanism is introduced to test the optimized execution path to obtain attack vector path performance data; a multi-round iterative feedback loop method is applied to analyze the attack vector path performance data to evaluate the success rate and impact range of the attack vector path to obtain an evaluation result; based on the evaluation result, complex attack vector paths are guided and labeled to obtain labeled samples, and active learning is used to select the labeled samples with larger information for training to generate prediction results; using the prediction results, the attack vector paths under different environments are analyzed, and a comprehensive security assessment report containing attack vector path descriptions, success probabilities, impact ranges and repair suggestions is generated.

[0086] In this embodiment, the diversified simulation environment construction technology refers to creating multiple virtual test environments with different configuration parameters and input data by simulating different actual application scenarios. These environments are used to simulate various operating conditions in the real world, such as different operating systems, hardware architectures, network conditions, etc., to ensure the wide applicability and reliability of the test results.

[0087] The dynamic adversarial sample generation mechanism is a method that adaptively generates new input data and abnormal operation sequences, aiming to challenge the optimized execution path in real time. The mechanism can adjust the generation strategy based on test feedback, ensuring that each test can reveal potential security weaknesses and improve the ability to explore attack vector paths.

[0088] The multi-round iterative feedback loop method is a technology that analyzes and processes the attack vector path performance data collected after each round of testing to evaluate its success rate and impact range. Based on this data, the environment parameters and the hyperparameters of the reinforcement learning algorithm are automatically adjusted to further optimize the execution path exploration process, thereby improving the robustness and diversity of path exploration.

[0089] Active learning technology is a method that selects the most informative samples for training to accelerate model convergence and improve prediction accuracy. In this step, combined with the guidance and annotation of expert systems, in-depth analysis of complex or difficult-to-explain attack vector paths is performed to ensure that the model can better understand unknown vulnerabilities.

[0090] The comprehensive security assessment report is a detailed document generated based on the results of multiple simulation tests, including attack vector path description, success probability, impact scope and repair suggestions. These reports not only provide clear repair guidance for the development team, but also provide important basis for subsequent security audits and compliance checks.

[0091] In the embodiment of the present application, the actual application scenario of the target code segment is first modeled using a diversified simulation environment construction technology to obtain a simulation environment containing configuration parameters and input data. Based on these simulation environments, a dynamic adversarial sample generation mechanism is introduced to test the optimized execution path and collect attack vector path performance data.

[0092] Then, a multi-round iterative feedback loop method is applied to analyze these performance data, evaluate the success rate and impact range of the attack vector path, and obtain preliminary evaluation results.

[0093] Next, based on the evaluation results, complex attack vector paths are guided and annotated to obtain labeled samples, and active learning is used to select labeled samples with larger amounts of information for training to generate more accurate prediction results.

[0094] Finally, using these prediction results, we analyze the attack vector paths in different environments and generate a comprehensive security assessment report containing detailed descriptions, success probability, impact scope, and repair suggestions to ensure that the detected attack vector paths are highly credible. The following is a specific example: According to the above embodiment, first, we use diversified simulation environment construction technology to model the actual application scenarios of the target code segment and create multiple simulation environments with different configuration parameters (such as operating system version, hardware specifications) and input data (such as user requests, API calls). These environments are designed to simulate various operating conditions in the real world to ensure the wide applicability and reliability of the test results.

[0095] Next, based on these simulation environments, we introduced a dynamic adversarial sample generation mechanism to generate new input data and abnormal operation sequences in real time to test the optimized execution path. For example, we found that a certain API endpoint would cause the server to crash when processing JSON input in a specific format. Through the dynamic adversarial sample generation mechanism, we continuously generated new abnormal inputs, further revealing other security issues that may exist in this API endpoint.

[0096] We then applied a multi-round iterative feedback loop approach to analyze the attack vector path performance data collected after each test to evaluate its success rate and impact. Based on this data, we automatically adjusted the parameters of the simulation environment and the hyperparameters of the reinforcement learning algorithm to further optimize the execution path exploration process. For example, we found that increasing network latency would affect the success rate of certain attack vector paths, so we adjusted the corresponding environment parameters to make the test closer to the real scenario.

[0097] Next, based on the evaluation results, we guided and annotated complex attack vector paths, obtained annotated samples, and used active learning to select annotated samples with more information for training. For complex or difficult-to-interpret attack vector paths, we combined the guidance and annotation of the expert system to ensure that the model can better understand these paths. For example, for a certain unauthorized access vulnerability, we selected the most representative attack vector path for annotation and used it to train the model, which improved the prediction accuracy.

[0098] Finally, we use these prediction results to analyze the attack vector paths in different environments and generate a comprehensive security assessment report that includes detailed descriptions, success probability, impact scope, and remediation suggestions. This report not only provides clear remediation guidance for the development team, but also provides an important basis for subsequent security audits and compliance checks. For example, we confirmed the specific location and triggering conditions of an unauthorized access vulnerability and put forward detailed remediation suggestions to ensure that this security risk is resolved in a timely manner.

[0099] In order to solve the problem that traditional vulnerability detection methods are difficult to effectively verify prediction results and confirm real vulnerabilities, and to further improve the accuracy and coverage of vulnerability detection, in some embodiments, the prediction results whose credibility scores exceed a preset threshold are tested based on the preset mutation operation and coverage-oriented strategy in step 104 to confirm and generate real vulnerability information, including: By screening the results whose credibility scores exceed a preset threshold, a target code segment with a real vulnerability is obtained; the target code segment with a real vulnerability is analyzed according to the differential fuzz testing environment technology to obtain an initial test case; the initial test case is mutated to generate a key test case, and the execution path and coverage range of the monitoring code are introduced using a coverage-oriented strategy, so that the key test case touches different branches and conditional statements in the code to generate a vulnerability detection result, wherein the mutation process includes randomly changing input data, inserting abnormal characters, and changing data structure; the target code segment is analyzed according to the vulnerability detection result to check whether there is a suspicious behavior pattern, and verify whether the behavior pattern represents a real vulnerability, so as to generate real vulnerability information, wherein the real vulnerability information includes the specific location, triggering conditions and impact range of the real vulnerability.

[0100] In this embodiment, the confidence score is a quantification of the confidence level of the prediction result, which helps to judge the reliability of the prediction. A high confidence score means that the prediction result is more likely to truly reflect the actual situation.

[0101] Differential fuzz testing environment technology is a technology that detects behavioral differences between two similar but different program versions by comparing them. This method can effectively discover hidden vulnerabilities and is applicable to different code versions.

[0102] Initial test cases refer to a set of basic input data designed to trigger potential vulnerability behaviors. These cases are usually designed based on the understanding of the target code segment and common vulnerability characteristics to start the fuzz testing process.

[0103] Mutation processing refers to modifying the initial test cases to generate new test cases. These modifications can include randomly changing input data, inserting abnormal characters, and changing data structures, etc., in order to trigger potential vulnerability behaviors.

[0104] The coverage-oriented strategy is a method to guide the fuzz testing process. It monitors the execution path and coverage of the code to ensure that the test cases touch different branches and conditional statements in the code, thereby improving the effectiveness and comprehensiveness of the test.

[0105] Real vulnerability information refers to the details of vulnerabilities that have been verified and confirmed to exist, including the specific location of the vulnerability, triggering conditions, and impact range. This information is crucial for fixing the vulnerability.

[0106] In the embodiment of the present application, the prediction results whose credibility scores exceed the preset threshold are first screened out to determine the target code sections where real vulnerabilities exist.

[0107] Then, according to the differential fuzz testing environment technology, different versions of the target code segment and a set of initial test cases designed to trigger potential vulnerability behaviors are obtained.

[0108] Then, these initial test cases are mutated to generate new test cases. In the process of differential fuzz testing, the coverage-oriented strategy is used to guide the execution path and coverage of the monitoring code, so that the test cases touch different branches and conditional statements in the code and generate vulnerability detection results.

[0109] Finally, after completing the mutation processing, the target code segment is deeply analyzed according to the vulnerability detection results to check whether there are suspicious behavior patterns and verify whether these behavior patterns represent real vulnerabilities. If so, real vulnerability information including specific locations, trigger conditions and impact range is generated.

[0110] Here is a specific example: According to the above embodiment, the prediction results with a credibility score of more than 0.8 are selected as the key test objects. For each prediction result, different versions of the target code segment (such as different versions of API endpoint implementations) and a set of initial test cases designed to trigger potential vulnerability behaviors are obtained according to the differential fuzz testing environment technology. These test cases may include regular input data, boundary conditions, and abnormal inputs.

[0111] Next, these initial test cases are mutated to generate new test cases. For example, some field values ​​in the input data are randomly changed, abnormal characters (such as SQL injection strings) are inserted, or the data structure is changed (such as adding additional nesting levels). In the process of differential fuzz testing guided by coverage-oriented strategies, tools such as DynamoRIO are introduced to monitor the execution path and coverage of the code to ensure that the test cases touch different branches and conditional statements in the code. This not only improves the coverage of the test, but also increases the possibility of discovering hidden vulnerabilities.

[0112] After mutation processing is completed and testing is performed, the target code segment is analyzed in depth based on the vulnerability detection results to check for suspicious behavior patterns such as unauthorized access, memory leaks, or crashes.

[0113] For example, it was found that a certain API endpoint would cause the server to crash when processing JSON input in a specific format, and this behavior was confirmed as a real vulnerability. Ultimately, detailed real vulnerability information was generated, including the specific location of the vulnerability (such as a specific line in a function), triggering conditions (such as JSON input in a specific format), and impact range (such as possible service unavailability). This information provides the development team with clear repair guidance to ensure that security issues are resolved in a timely manner.

[0114] In order to solve the problem that traditional vulnerability detection methods are difficult to accurately identify and verify suspicious behavior patterns, and further improve the accuracy and reliability of vulnerability confirmation, in some embodiments, the target code segment is analyzed according to the vulnerability detection result, and whether there is a suspicious behavior pattern is checked, and whether the behavior pattern represents a real vulnerability is verified to generate real vulnerability information, including: Based on the vulnerability detection results collected by the differential fuzz test, the actual behavior data of the target code segment is analyzed to obtain security problem data, wherein the security problem data includes system crashes, abnormal outputs, and memory leaks; the security problem data is analyzed and processed to identify suspicious behavior patterns that lead to security problems and obtain a suspicious behavior list; the suspicious behavior list is verified by repeated testing, using different input conditions, and reproducing in different environments to confirm whether the suspicious behavior patterns represent real vulnerabilities and obtain real vulnerability candidates; the real vulnerability candidates are evaluated to determine whether they constitute actual security vulnerabilities, and combined with the definition and standards of the real vulnerability, the severity and impact range of the real vulnerability are predicted to obtain real vulnerability information.

[0115] In this embodiment, the security problem data refers to the data collected from the differential fuzz test about the actual behavior of the target code segment, mainly including system crashes, abnormal outputs, memory leaks, etc. These data reflect the instability and potential risks of the code under different input conditions.

[0116] Suspicious behavior patterns refer to behavioral features identified after analyzing and processing security issue data, which may indicate potential security vulnerabilities. For example, frequent system crashes or abnormal outputs caused by specific inputs may be part of a suspicious behavior pattern.

[0117] The suspicious behavior list is a series of behavior patterns that may lead to security issues after in-depth analysis of security issue data through a combination of automated tools and manual review. This list provides a clear target for subsequent verification.

[0118] Real vulnerability candidates are behavior patterns that are considered to be likely to constitute actual security vulnerabilities after preliminary verification. These candidates need further evaluation to confirm whether they do represent real vulnerabilities.

[0119] The real vulnerability information is a detailed vulnerability description generated after the final confirmation, including the specific location of the vulnerability, triggering conditions, severity, and impact range. This information is crucial for the development team to fix the vulnerability.

[0120] In the embodiment of the present application, based on the vulnerability detection results collected by differential fuzz testing, the actual behavior data of the target code segment is deeply analyzed to obtain security problem data including system crash, abnormal output and memory leak. Through the analysis and processing of these data, suspicious behavior patterns that lead to security problems are identified and a list of suspicious behaviors is generated.

[0121] Subsequently, the suspicious behavior list is verified by repeated testing, using different input conditions and reproducing in different environments to confirm whether the suspicious behavior pattern represents a real vulnerability, thereby obtaining a real vulnerability candidate.

[0122] Finally, these candidates are evaluated to determine whether they constitute actual security vulnerabilities. Combined with the definition and standards of real vulnerabilities, their severity and scope of impact are evaluated, and ultimately detailed real vulnerability information is generated.

[0123] Here is a specific example: According to the above embodiment, based on the vulnerability detection results collected by differential fuzz testing, the actual behavior data of the target code segment is deeply analyzed to obtain a series of security problem data, including multiple system crashes, abnormal outputs and memory leaks. Through detailed analysis of these data, some suspicious behavior patterns that lead to these problems are identified, such as JSON input in a specific format causing the API endpoint to crash, and a list of suspicious behaviors is generated.

[0124] Next, to verify whether these suspicious behavior patterns represent real vulnerabilities, repeated tests were performed in different environments, using a variety of input conditions (such as boundary values, abnormal characters, and data of extreme sizes) to trigger these behavior patterns. For example, it was found that when the input contained a specific SQL injection string, the API endpoint would show abnormal output and eventually crash. This behavior was confirmed as a real vulnerability candidate.

[0125] Finally, these real vulnerability candidates were fully evaluated to determine whether they constitute actual security vulnerabilities, and their severity and impact were evaluated in combination with the definition and standards of real vulnerabilities. For example, for the aforementioned API endpoint crash, it was confirmed that this was an unauthorized access vulnerability with a high severity because it could cause server denial of service (DoS).

[0126] Ultimately, detailed real vulnerability information was generated, including the specific location of the vulnerability (such as a specific line within a function), trigger conditions (such as JSON input in a specific format), and scope of impact (such as possible service unavailability), providing the development team with clear remediation guidance to ensure that security issues are resolved in a timely manner.

[0127] In order to solve the problem that traditional vulnerability detection methods are difficult to accurately identify and understand code semantics, and further improve the accuracy of known vulnerability detection and context understanding capabilities, in some embodiments, the risk code segment is analyzed in step 102 to identify a target code segment that matches common vulnerability features, obtain known vulnerabilities of the target code segment, and generate context information based on the known vulnerabilities, including: The risky code segments are scanned using a preset security pattern matching engine combined with a formal verification method to identify target code segments that match common vulnerability features and determine known vulnerabilities existing in the target code segments; based on the known vulnerabilities, the annotation text and variable names in the target code segments are deeply semantically analyzed in combination with natural language processing technology to construct a correlation map between the target code segments, enhance contextual understanding, and generate an analysis report, wherein the analysis report includes semantic and correlation information; based on the analysis report, information including the functional description, logical structure, and behavior pattern of the target code segments is integrated to generate contextual information.

[0128] In this embodiment, the security pattern matching engine is a set of rules and algorithms preset in the intelligent vulnerability mining platform, which is used to identify vulnerability features of specific patterns in the code. It detects possible security vulnerabilities in the code through regular expressions or other pattern matching algorithms.

[0129] Formal verification is a rigorous mathematical technique used to prove whether a program or system meets its specifications. In vulnerability detection, formal verification can ensure the correctness and security of code logic and discover potential security issues.

[0130] The association graph refers to the semantic association network between target code segments constructed through natural language processing technology and graph neural networks. It not only captures the dependencies in the code structure, but also enhances the understanding of the code context, which helps to identify vulnerabilities more accurately.

[0131] Analysis reports are detailed documents generated based on in-depth semantic analysis, including comment text in target code segments, variable names and information about their associations. These reports provide important background information and guidance for subsequent steps.

[0132] In the embodiment of the present application, the preset security pattern matching engine in the intelligent vulnerability mining platform is first used, combined with the formal verification method to deeply scan the risky code segments, identify the target code segments that match the common vulnerability characteristics, and determine the known vulnerabilities therein.

[0133] Then, based on known vulnerabilities and combined with natural language processing technology, we conduct in-depth semantic analysis of the comment text and variable names in the target code segments, build a correlation map between the target code segments, enhance contextual understanding, and generate a detailed analysis report.

[0134] Finally, based on the analysis report, graph neural network and knowledge graph technology are used to integrate the functional description, logical structure and behavior pattern information of the target code segment to generate high-quality contextual information, providing a solid foundation for subsequent vulnerability prediction and verification.

[0135] Here is a specific example: Continuing with the above embodiment, the preset security pattern matching engine in the intelligent vulnerability mining platform is used to deeply scan the collected risk code segments in combination with the formal verification method to identify the target code segments that match the common vulnerability features, such as SQL injection, buffer overflow, etc., and determine the known vulnerabilities therein. For example, a certain API endpoint is found to have a SQL injection risk.

[0136] Next, based on known vulnerabilities, combined with natural language processing technology, we deeply semantically analyze the comment text and variable names in the target code paragraphs. For example, we noticed that the comment mentioned "user input should be strictly validated", but this requirement was not implemented in the actual code. By building a correlation map between the target code paragraphs, we enhanced our understanding of the code context and generated a detailed analysis report, which included the semantic analysis results of the comment text and the correlation information between the variable names.

[0137] Finally, based on the analysis report, we use graph neural network and knowledge graph technology to integrate the functional description, logical structure and behavior pattern of the target code segment to generate high-quality contextual information. For example, we built a knowledge graph that shows the functional description, internal logical structure and interaction pattern of the API endpoint. This not only deepens the understanding of code behavior, but also provides detailed background information for subsequent vulnerability prediction and verification, ensuring that the development team can accurately fix these problems.

[0138] In order to solve the problem that traditional vulnerability detection methods are difficult to deeply understand and associate code semantics, and further improve the ability to accurately identify known vulnerabilities and understand context, in some embodiments, based on the known vulnerabilities, natural language processing technology is combined to deeply semantically analyze the comment text and variable names in the target code segments, build an association map between the target code segments, enhance context understanding, and generate an analysis report, including: Analyze the comment text and variable names in the target code segment to generate a semantic analysis result; based on the semantic analysis result, apply the relationship extraction technology to construct an association map between code elements; combine the semantic analysis result, the association map and the known vulnerabilities to generate an analysis report, wherein the analysis report covers the functional description, logical structure, behavior pattern of the target code segment and the specific location and characteristics of the known vulnerabilities.

[0139] In this embodiment, the semantic analysis results are data obtained by deeply analyzing the comment text and variable names in the target code segment through natural language processing technology. These results not only capture the surface meaning of code elements, but also reveal the potential relationship between them, which helps to enhance the understanding of the code context.

[0140] Relation extraction is a method to automatically identify entities and their relationships from text. In this step, relation extraction is used to build a relationship graph between code elements, show direct dependencies, and reveal interaction patterns in different contexts. This helps to more fully understand the code structure and behavior.

[0141] In the embodiment of the present application, a natural language processing analysis environment is used to perform semantic analysis on the comment text and variable names in the target code segment to generate detailed semantic analysis results.

[0142] Then, based on these semantic analysis results, relationship extraction techniques are applied to construct association graphs between code elements, showing direct dependencies and revealing interaction patterns in different contexts.

[0143] Finally, by integrating the results of semantic analysis, the results of association graph construction, and information on known vulnerabilities, a detailed analysis report is generated that covers the functional description, logical structure, and behavioral patterns of the target code segments, ensuring that the specific locations and characteristics of known vulnerabilities are accurately revealed.

[0144] Here is a specific example: Continuing with the above example, first, the natural language processing analysis environment is used to perform semantic analysis on the comment text and variable names in the collected risk code paragraphs to generate detailed semantic analysis results. For example, it is noted that the comment of a function mentions "user input should be strictly verified", but this requirement is not implemented in the actual code. Through semantic analysis, the possible SQL injection risk of this code is captured.

[0145] Next, based on these semantic analysis results, we apply relationship extraction technology to build a correlation graph between code elements. For example, we found that there is a direct dependency between an API endpoint and a database query function, and in different contexts, the API endpoint has complex interaction patterns with other modules. By building a correlation graph, we not only show these direct dependencies, but also reveal the interaction patterns in different contexts, further deepening our understanding of code structure and behavior.

[0146] Finally, a detailed analysis report is generated by combining the results of semantic analysis, the results of association graph construction, and the information of known vulnerabilities. This report not only covers the functional description, logical structure, and behavior pattern of the target code segment, but also accurately reveals the specific location and characteristics of known vulnerabilities.

[0147] For example, an unauthorized access vulnerability was identified, specifically located in the input validation part of an API endpoint, and its triggering conditions and impact were described in detail. This information provides the development team with clear repair guidance to ensure that security issues are resolved in a timely manner.

[0148] This application considers combining automated tools and manual review to deeply analyze potential security issues in target code segments and identify suspicious behavior patterns that lead to these issues. As software complexity increases, traditional vulnerability detection methods often find it difficult to fully cover all possible security risks, so a new alternative is proposed, which includes: According to the vulnerability detection results, the target code segment is analyzed in depth to check whether there are suspicious behavior patterns, including: Based on the vulnerability detection results collected by the differential fuzz test, the actual behavior data of the target code segment is deeply analyzed to obtain security problem data; wherein the security problem data Calculated by the following formula: ; in, Indicates security issue data, denote the weights of system crash, abnormal output and memory leak respectively, They are the adjustment coefficients of the corresponding indicators, Indicates The system crash, abnormal output and memory leak indicators detected in this test are Indicates the number of tests; The following is a detailed explanation of each parameter: : Security issue data, which represents the overall evaluation result after comprehensively considering various security issues such as system crash, abnormal output and memory leak. The system crash, abnormal output and memory leak indicators in each test are collected through differential fuzz testing and calculated according to the formula; : The weight of system crash reflects the relative importance of system crash in the overall security assessment; it is set based on historical data and expert experience, and is usually adjusted according to the actual operating environment and security requirements of the system; : The weight of abnormal output reflects the relative importance of abnormal output (such as error logs, abnormal return values, etc.) in the overall security assessment; it is also set based on historical data and expert experience, considering that abnormal output may indicate potential security issues; : The weight of the memory leak reflects the relative importance of the memory leak in the overall security assessment; it is based on the assessment of the importance and potential impact of memory management, usually determined by analyzing memory usage and performance monitoring data; : The adjustment coefficient of system crash is used to adjust the impact of system crash indicators. It is set according to the specific situation and severity of the system crash, and the optimal value can be determined through experiments and simulations; : The adjustment coefficient of abnormal output is used to adjust the impact of abnormal output indicators; it is set based on the frequency and type of abnormal output, usually determined through statistical analysis and expert review; : The memory leak adjustment coefficient is used to adjust the impact of the memory leak indicator. It is set according to the specific situation of the memory leak and the impact on system performance, and is usually determined through performance testing and monitoring data. : No. The system crash indicators detected in the test measure the frequency or severity of system crashes; the system crash events in each test are recorded through automated tools and manual review, and their occurrence or severity level are counted; : No. The abnormal output indicators detected in each test measure the frequency or severity of abnormal outputs. The abnormal output events in each test are recorded through automated tools and manual review, and their occurrence frequency or severity level are counted. : No. The memory leak indicators detected in each test measure the frequency or severity of memory leaks. The memory leak events in each test are recorded through automated tools and manual review, and their occurrence or severity level is counted. : Number of tests, which indicates how many times the test is performed to collect enough data to evaluate potential security issues; determined based on the test plan and actual execution, usually the result of multiple iterative tests.

[0149] The following is a brief introduction to the design reasons of each sub-item: : System crash is one of the most serious security issues, so use an exponential function To simulate the phenomenon that as the crash metric increases, its contribution to safety issues gradually decreases; this helps capture those frequent but minor crash events while avoiding over-amplifying the impact of a single major crash; : Exception output is usually manifested as log records or exception return values, using logarithmic functions It can smooth the impact of abnormal outputs, ensuring that even a large number of abnormal outputs will not lead to excessive evaluation results, while still reflecting their cumulative effects; : The impact of a memory leak is usually gradual, using the square root function It can better reflect the accumulation process of memory leaks over time, ensuring that early small leaks will not be ignored and the impact of large leaks will not be overly magnified.

[0150] This formula adds up the sub-items to comprehensively consider different types of potential security issues (system crashes, abnormal outputs, and memory leaks) and balance them according to their respective weights and adjustment coefficients; each sub-item represents a different type of security issue, and the addition method makes the final security issue data It can fully reflect the overall security of the code section, rather than unilaterally emphasizing a certain type of problem; The overall design of the formula is to provide a comprehensive evaluation framework. By quantitatively evaluating three common security issues: system crashes, abnormal outputs, and memory leaks, a comprehensive indicator is generated that can fully reflect the security of the code segment. ; This method not only takes into account the specific manifestations of each problem, but also ensures that the evaluation results can adapt to different application scenarios and security requirements by introducing weights and adjustment coefficients; Ultimately, the formula helps the R&D team to efficiently identify and prioritize the most pressing security issues, thereby improving the overall security of the software system.

[0151] Here is a specific example: Suppose that the security of a large deep learning framework is being evaluated. The framework consists of multiple modules and involves complex system calls and memory management. To ensure its security, the framework is tested multiple times using a differential fuzz testing tool and relevant data is collected.

[0152] Parameter setting and data preparation: Number of tests Second-rate.

[0153] Weight parameters: (weight of system crash); (weight of abnormal output); (Weight of memory leak); Adjustment factor: , , ; Weighting ratio between automated tools and manual review (more dependent on automated tools); Test result example ( The specific data of the test data) are shown in Table 1 below: Table 1

[0154] Calculation process: Take the first test as an example: ; ; ; Repeat the above steps to calculate the results of all 50 tests and sum them up to get : ; The final calculation is: ; Through differential fuzz testing, the target code segment is tested multiple times and relevant data is collected, and the security problem data is finally calculated. This result shows that during the 50 tests, security issues such as system crashes, abnormal outputs, and memory leaks were more frequent and significant. Specifically, the higher The value reflects that there are more system crash events detected in the test, abnormal output is also more common, and although the impact of memory leakage is relatively small, it still exists. This suggests that the R&D team should attach great importance to these potential security risks, especially those that may cause system instability or abnormal behavior. Further analysis and optimization of these high-risk areas will help improve the overall security of the system and reduce the risks brought by potential security vulnerabilities.

[0155] Analyze and process the security problem data by combining automated tools and manual review, identify suspicious behavior patterns that may lead to security problems, and obtain a list of suspicious behaviors; wherein the list of suspicious behaviors Calculated by the following formula: ; in, Indicates a list of suspicious behaviors, Indicates the weight ratio of automated tools and manual review, It is the system crash, abnormal output and memory leak indicators detected in the comprehensive test, which can be the average or maximum value; The following is a detailed explanation of each parameter: : Suspicious behavior list, which represents the behavior patterns that are most likely to cause security issues after comprehensive evaluation; it is calculated based on the results of automated tools and manual review, combined with formulas, and is used to guide subsequent security reinforcement work; : The weight ratio of automated tools and manual review determines their relative contribution to the final evaluation; it is set according to the specific application scenario and the degree of trust, usually determined by historical data and expert experience; higher Values ​​indicate greater reliance on automated tool results, with lower The value emphasizes the importance of manual review; : They are the system crash, abnormal output and memory leak indicators detected in the comprehensive test, which can be the average value or the maximum value; they are obtained by statistical analysis of multiple test results to ensure that the evaluation results are representative and reliable.

[0156] The following is a brief introduction to the design reasons of each sub-item: :This part reflects the evaluation results of the automated tool on security issues. Through weighted summation, the impact of system crashes, abnormal outputs and memory leaks is comprehensively considered and given appropriate weights. The automated tool can quickly process large amounts of data and provide objective and consistent evaluation results. :This part reflects the results of manual review of security issues; manual review can catch subtle problems that automated tools may miss, especially in complex and unstructured environments; using different activation functions (such as Sum square term ) to enhance sensitivity to serious problems and ensure that assessment results are more comprehensive and accurate.

[0157] This formula adds up the sub-items to take into account the different focuses of automated tools and manual review. Automated tools focus on efficiently processing large amounts of data and providing objective evaluations, while manual review is better at discovering potential problems in complex environments. , we can find the best balance between the two to ensure that the final evaluation results are both comprehensive and reliable. The multiplication part is used to adjust the contribution of each sub-item to ensure that different types of evaluation results can be reasonably integrated into the overall evaluation framework.

[0158] The overall design of the formula is to generate a comprehensive evaluation framework by combining the results of automated tools and manual review to identify the behavior patterns that are most likely to cause security issues. This approach not only improves the accuracy of vulnerability detection, but also better adapts to complex software environments. ,The formula can flexibly adjust the contribution of automated tools and manual review in different application scenarios, ensuring that the evaluation results are both scientific and practical. Ultimately, the formula helps the R&D team to efficiently identify and prioritize the most pressing security issues, thereby improving the overall security of the software system.

[0159] According to the above A specific example of calculating a list of suspicious behaviors : Assume that the average indicators detected in the synthetic test are: ; Substituting into the formula: ; Step by step calculation: Automation tools section: ; Manual review part: ; final: ; The final list of suspicious behaviors is calculated by combining the results of automated tools and manual review. This result shows that when evaluating the security of the target code segment, the combination of the efficient data processing capabilities of the automated tool and the careful capture of complex issues by manual review has identified several behavioral patterns with a high probability of causing security issues. The value reflects the existence of some significant suspicious behaviors, especially those that manifest themselves in system crashes and abnormal outputs. This suggests that the R&D team should give priority to these behavior patterns, conduct in-depth analysis and repair to eliminate potential security risks. At the same time, considering that the impact of memory leaks is relatively small but still exists, it is recommended to optimize them appropriately to ensure that the overall security of the system is effectively improved. Through this method, not only the accuracy of vulnerability detection is improved, but also a scientific basis is provided for subsequent security reinforcement, thereby effectively reducing the security risks of the system.

[0160] Figure 2 A schematic diagram of the structure of a device (or system) for constructing an intelligent vulnerability mining platform based on a large model is provided for the embodiment of the present application, such as Figure 2 As shown, the device comprises: An analysis module 21 is used to analyze the code snippets collected from different source code repositories, identify the code snippets with security risks and organize them into risky code segments; The identification module 22 is used to analyze the risk code segments to identify target code segments that match common vulnerability features, obtain known vulnerabilities of the target code segments, generate context information based on the known vulnerabilities, and capture key events during the actual runtime of the target code segments to generate dynamic execution traces; A processing module 23 is used to use a large-scale pre-training model combined with a reinforcement learning algorithm to simulate the context information and different paths in the dynamic execution trajectory, and define a state space, an action space and a reward function, optimize the execution path exploration through an adversarial training mechanism to simulate the attack vector path under different environments, and predict and analyze the unknown vulnerabilities in the target code segment according to the attack vector path to generate a prediction result and a credibility score; A testing module 24, configured to test the prediction results whose credibility scores exceed a preset threshold value based on a preset mutation operation and coverage-oriented strategy, so as to confirm and generate real vulnerability information; The recording module 25 is used to record the real vulnerability information into the vulnerability knowledge base to generate a security report.

[0161] Figure 2 The intelligent vulnerability mining platform construction device based on the large model can be executed Figure 1The implementation principle and technical effect of the method for constructing an intelligent vulnerability mining platform based on a large model described in the illustrated embodiment will not be described in detail. The specific manner in which each module and unit performs operations in the intelligent vulnerability mining platform construction device based on a large model in the above embodiment has been described in detail in the embodiment of the method, and will not be elaborated here.

[0162] In one possible design, Figure 2 The apparatus for constructing an intelligent vulnerability mining platform based on a large model in the embodiment shown can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32; The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0163] The processing component 32 is used for the above Figure 1 The embodiment provides a method for constructing an intelligent vulnerability mining platform based on a large model.

[0164] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0165] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0166] Of course, the computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0167] The input / output interface provides an interface between the processing component and the peripheral interface module, which may be an output device, an input device, etc.

[0168] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0169] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0170] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 The illustrated embodiment is a method for constructing an intelligent vulnerability mining platform based on a large model.

[0171] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0172] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0173] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0174] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for constructing an intelligent vulnerability mining platform based on a large model, characterized in that: include: Analyze the code snippets collected from different source code repositories, identify the code snippets with security risks and organize them into risky code sections; Analyze the risk code segments to identify target code segments that match common vulnerability features, obtain known vulnerabilities of the target code segments, generate context information based on the known vulnerabilities, and capture key events during the actual runtime of the target code segments to generate dynamic execution traces; Using a large-scale pre-trained model combined with a reinforcement learning algorithm to simulate the context information and different paths in the dynamic execution trajectory, and defining a state space, an action space, and a reward function, optimizing execution path exploration through an adversarial training mechanism to simulate attack vector paths in different environments, and predicting and analyzing unknown vulnerabilities in the target code segment based on the attack vector path to generate a prediction result and a credibility score; Based on the preset mutation operation and coverage-oriented strategy, the prediction results whose credibility scores exceed the preset threshold are tested to confirm and generate real vulnerability information; The real vulnerability information is recorded in the vulnerability knowledge base to generate a security report.

2. The method according to claim 1, characterized in that The large-scale pre-training model is combined with a reinforcement learning algorithm to simulate the context information and different paths in the dynamic execution trajectory, and the state space, action space and reward function are defined. The execution path exploration is optimized through an adversarial training mechanism to simulate the attack vector path under different environments. According to the attack vector path, the unknown vulnerabilities in the target code segment are predicted and analyzed to generate prediction results and credibility scores, including: The context information is encoded and processed using a large-scale pre-trained model to obtain a context feature representation, and a vulnerability monitoring tool is used to capture key events during the actual operation of the target code segment, and the actual execution path and state changes of the target code segment are recorded to generate a dynamic execution trajectory, and the dynamic execution trajectory is refined and processed using a time series analysis technology to generate a dynamic execution trajectory feature representation; A multimodal fusion method is used to fuse the context feature representation and the dynamic execution trajectory feature representation, and a graph neural network is combined to capture the dependency relationship in the structure of the target code segment to obtain a comprehensive feature representation; Using a reinforcement learning algorithm, based on the comprehensive feature representation, the execution path of the target code segment is explored and optimized to obtain the execution path exploration, and the state space, action space and reward function are defined, and the execution path exploration is optimized through an adversarial training mechanism to simulate the attack vector path under different environments; According to the attack vector path, potential known vulnerabilities are implicitly modeled in combination with a variational autoencoder, and unknown vulnerabilities of the attack vector path in the target code segment are analyzed to obtain a prediction result; Based on the prediction results, a Bayesian optimization algorithm is used to evaluate the success probability of the attack vector path and the confidence of the prediction of the large-scale pre-trained model to generate a credibility score.

3. The method according to claim 2, characterized in that The use of the reinforcement learning algorithm to explore and optimize the execution path of the target code segment based on the comprehensive feature representation, obtain the execution path exploration, and define the state space, action space and reward function, optimize the execution path exploration through the adversarial training mechanism to simulate the attack vector path under different environments, including: Using a reinforcement learning algorithm, based on the comprehensive feature representation, a state space, an action space and a reward function are defined to obtain an initial execution path framework, wherein the state space represents various states of the program of the target code segment when it is running, and the action space represents the operations that can be executed in the program of the target code segment; Based on the state space, the action space and the reward function, an adversarial training mechanism is introduced to enhance the execution path exploration through the mutual game between the generator and the discriminator in the generative adversarial network, thereby improving the robustness and diversity of the path exploration and obtaining preliminary execution path exploration results; According to the preliminary execution path exploration result, in combination with a deep Q-net or a policy gradient method, the execution path of the target code segment is optimized, and the execution path is adjusted through multiple iterations to generate an optimized execution path; The optimized execution path is tested in a simulation environment, and environmental parameters are adjusted to verify the performance of the optimized execution path under different conditions to simulate attack vector paths in different environments, wherein the environmental parameters include input data and system configuration.

4. The method according to claim 3, characterized in that: Also includes: Using diversified simulation environment construction technology, modeling the actual application scenario of the target code segment to obtain a simulation environment including configuration parameters and input data; Based on the simulation environment, a dynamic adversarial sample generation mechanism is introduced to test the optimized execution path to obtain attack vector path performance data; Applying a multi-round iterative feedback loop method to analyze the attack vector path performance data to evaluate the success rate and impact range of the attack vector path to obtain an evaluation result; Based on the evaluation results, complex attack vector paths are guided and annotated to obtain annotated samples, and active learning is used to select the annotated samples with large amounts of information for training to generate prediction results; The prediction results are used to analyze the attack vector paths in different environments, and generate a comprehensive security assessment report including attack vector path description, success probability, impact range and repair suggestions.

5. The method according to claim 1, characterized in that The prediction results whose credibility scores exceed a preset threshold are tested based on the preset mutation operation and coverage-oriented strategy to confirm and generate real vulnerability information, including: By screening the results whose credibility scores exceed a preset threshold, target code sections with real vulnerabilities are obtained; Analyze the target code segment with real vulnerabilities according to the differential fuzz testing environment technology to obtain an initial test case; The initial test cases are mutated to generate key test cases, and the execution path and coverage of the monitoring code are introduced by using a coverage-oriented strategy, so that the key test cases touch different branches and conditional statements in the code and generate vulnerability detection results, wherein the mutation process includes randomly changing input data, inserting abnormal characters, and changing data structures; The target code segment is analyzed according to the vulnerability detection result to check whether there is a suspicious behavior pattern and verify whether the behavior pattern represents a real vulnerability to generate real vulnerability information, wherein the real vulnerability information includes the specific location, triggering conditions and impact range of the real vulnerability.

6. The method according to claim 5, characterized in that Analyzing the target code segment according to the vulnerability detection result, checking whether there is a suspicious behavior pattern, and verifying whether the behavior pattern represents a real vulnerability to generate real vulnerability information, includes: Based on the vulnerability detection results collected by the differential fuzz test, the actual behavior data of the target code segment is analyzed to obtain security problem data, wherein the security problem data includes system crash, abnormal output and memory leak; Analyze and process the security problem data, identify suspicious behavior patterns that may lead to security problems, and obtain a list of suspicious behaviors; Verify the suspicious behavior list by repeated testing, using different input conditions and reproducing in different environments to confirm whether the suspicious behavior pattern represents a real vulnerability and obtain a real vulnerability candidate; The real vulnerability candidates are evaluated to determine whether they constitute actual security vulnerabilities, and combined with the definition and standard of the real vulnerability, the severity and impact scope of the real vulnerability are predicted to obtain real vulnerability information.

7. The method according to claim 1, characterized in that The analyzing the risk code segments to identify target code segments matching common vulnerability features, obtaining known vulnerabilities of the target code segments, and generating context information based on the known vulnerabilities, includes: Scan the risky code segments in combination with formal verification methods, identify target code segments that match common vulnerability characteristics, and determine known vulnerabilities existing in the target code segments; Based on the known vulnerabilities, in combination with natural language processing technology, an in-depth semantic analysis of the comment text and variable names in the target code segments is performed to construct a correlation map between the target code segments, enhance context understanding, and generate an analysis report, wherein the analysis report includes semantic and correlation information; Based on the analysis report, information including the functional description, logical structure and behavior pattern of the target code segment is integrated to generate context information.

8. The method according to claim 7, characterized in that According to the known vulnerabilities, the annotation text and variable names in the target code segments are deeply semantically analyzed in combination with natural language processing technology, a correlation map between the target code segments is constructed, context understanding is enhanced, and an analysis report is generated, including: Analyze the comment text and variable names in the target code segment to generate a semantic analysis result; Based on the semantic analysis results, a relationship extraction technique is applied to construct a relationship graph between code elements; The semantic analysis results, the association map and the known vulnerabilities are integrated to generate an analysis report, wherein the analysis report covers the functional description, logical structure, behavior pattern of the target code segment and the specific location and characteristics of the known vulnerabilities.

9. A system for constructing an intelligent vulnerability mining platform based on a large model, characterized in that: include: The analysis module is used to analyze the code snippets collected from different source code repositories, identify the code snippets with security risks and organize them into risky code sections; an identification module, configured to analyze the risk code segments to identify target code segments that match common vulnerability features, obtain known vulnerabilities of the target code segments, generate context information based on the known vulnerabilities, and capture key events during the actual runtime of the target code segments to generate dynamic execution traces; A processing module, used to simulate the context information and different paths in the dynamic execution trajectory by using a large-scale pre-training model combined with a reinforcement learning algorithm, and define a state space, an action space, and a reward function, optimize the execution path exploration through an adversarial training mechanism to simulate the attack vector path under different environments, and predict and analyze the unknown vulnerabilities in the target code segment according to the attack vector path to generate a prediction result and a credibility score; A testing module, for testing the prediction results whose credibility scores exceed a preset threshold value based on a preset mutation operation and coverage-oriented strategy, so as to confirm and generate real vulnerability information; The recording module is used to record the real vulnerability information into the vulnerability knowledge base to generate a security report.

Images