Intelligent code maintenance method and system based on large model and static analysis fusion
By constructing a global program graph and using hybrid defect detection, combined with static analysis and large model inference, the problems of high false alarm rate and limited detection range in existing technologies are solved, achieving high-precision and automated code defect management and repair, and improving software security.
Patent Information
- Application Number
- CN202511385441.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-26
- Publication Date
- 2025-12-26
AI Technical Summary
In existing technologies, static analysis tools lack the ability to understand the deep semantics and global context of code, resulting in a high false positive rate. Dynamic analysis technology has a limited detection range and cannot fully audit the code library. Furthermore, large language models are not reliable enough in terms of code understanding. Existing solutions fail to effectively combine program analysis and semantic understanding, resulting in limited detection accuracy and practicality.
By constructing a global program graph, combining a static analysis engine and a large model inference engine for hybrid defect detection, and employing multiple verification mechanisms and deep knowledge-enhanced detection, the system automatically generates remediation suggestions and code patches, achieving closed-loop management from vulnerability discovery to remediation.
It significantly improves the accuracy and efficiency of defect detection, can accurately identify complex vulnerabilities and automatically generate remediation suggestions, reduces the false alarm rate, achieves comprehensive analysis across modules and languages, reduces security operation costs, and has the ability to continuously learn and evolve.
Smart Images
Figure CN121210285A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of software security technology, specifically to an intelligent code inspection method and system based on the fusion of large models and static analysis. Background Technology
[0002] Currently, code defect detection primarily relies on static and dynamic application security testing techniques. Static analysis can discover potential vulnerabilities before code execution through rule matching and pattern recognition, but its semantic understanding capabilities are insufficient, making it difficult to handle complex business logic and cross-module call scenarios, resulting in high false positive and false negative rates. Dynamic analysis discovers defects through runtime testing, but its effectiveness heavily depends on test case coverage, cannot comprehensively audit the codebase, and intervenes late, leading to high remediation costs. In recent years, large-scale language models have shown potential in code understanding, but existing applications are mostly in the exploratory stage, and a mature technical system that organically integrates deep semantic understanding with program structure analysis has not yet been formed.
[0003] Existing technologies have significant limitations: traditional static analysis tools lack the ability to understand deep semantics and global context of code, making it difficult to effectively track complex data flows across modules and languages. Furthermore, their rule bases are updated slowly, failing to flexibly adapt to rapidly evolving security threats and personalized needs. Dynamic analysis techniques have limited detection scope and do not align with the "shift left" principle for security. While large language models offer new possibilities, directly applying general models for code analysis suffers from reliability issues. Existing solutions fail to systematically combine the advantages of program analysis and semantic understanding, resulting in limited detection accuracy and practicality. Summary of the Invention
[0004] The purpose of this invention is to provide an intelligent code inspection method and system based on the fusion of large models and static analysis, thereby solving the above-mentioned technical problems:
[0005] The objective of this invention can be achieved through the following technical solutions:
[0006] The intelligent code inspection method based on the fusion of large models and static analysis includes the following steps:
[0007] S1. The data parsing step includes: receiving multi-source heterogeneous code input and converting it into a program representation rich in structured information that can be understood and processed by the subsequent detection engine; the multi-source heterogeneous code input includes code repositories, local files, and analysis rules;
[0008] S2. Construct a global program graph. Based on the abstract syntax tree, construct a global program graph. The global program graph includes a control flow graph, a data flow graph, and a function call dependency graph, which are used to depict the call relationships between functions, variable passing paths, and program execution logic.
[0009] S3. Hybrid defect detection steps, including: defect detection through a hybrid analysis engine, which includes a static analysis engine and a large model inference engine; the static analysis engine performs pattern matching and rule query based on the program graph; the large model inference engine is based on the Transformer architecture and fine-tuned by instructions from real vulnerability samples, receives the preliminary results of the static analysis engine and the complete program graph as input, and performs context-aware analysis and deep knowledge-enhanced detection based on retrieval enhancement.
[0010] S4. A multi-verification mechanism is adopted to perform intelligent post-processing on potential defects discovered by the detection engine. The intelligent post-processing includes secondary verification through a large model inference engine and providing a confidence score for each vulnerability.
[0011] S5. For confirmed real vulnerabilities, automatically generate repair suggestions and code patches based on the code context; output the intelligent post-processing results in a preset standardized format.
[0012] As a further technical solution, the data parsing step also includes:
[0013] Multi-source input acquisition includes: incremental or full fetching of code repositories via API integration with version control systems; direct reading of locally stored code files or project folders; and using natural language as input, with users directly describing their detection intent.
[0014] Deep syntax and semantic analysis includes: high-precision syntax parsing of source code from multiple mainstream programming languages to generate abstract syntax trees.
[0015] As a further technical solution, in the process of constructing a global program graph, all source code is systematically analyzed, and the control flow graph, data flow graph, and function call dependency graph are associated and integrated. The global program graph is used to depict the call relationships between functions, variable passing paths, and program execution logic.
[0016] As a further technical solution, in the hybrid defect detection step:
[0017] The static analysis engine is based on the constructed program graph, performs pattern matching and rule query in parallel, and uses the built-in coding rule library and general defect enumeration rule library for preliminary scanning.
[0018] The large model inference engine performs context-aware analysis, accurately tracing the complete lifecycle of tainted data along the data flow graph based on the global program graph; and performs RAG-based deep knowledge enhancement detection, retrieving relevant historical vulnerability cases or code patterns from the vectorized vulnerability knowledge base as contextual hints to guide the large model in inference and judgment.
[0019] As a further technical solution, the RAG-based deep knowledge augmentation detection process includes:
[0020] Build and maintain a continuously updated vectorized vulnerability knowledge base in the background, storing verified real vulnerability samples, remediation cases, and secure coding standards;
[0021] When performing vulnerability detection, the code segment to be analyzed is first used as a query to quickly retrieve the most relevant and similar historical vulnerability cases or code patterns from the knowledge base, which serve as contextual hints to guide the large model in reasoning and judgment.
[0022] As a further technical solution, each potential vulnerability scanned by the static analysis engine is submitted to the large model inference engine for secondary verification. The authenticity of the vulnerability is analyzed in depth by combining the complete program context, and a confidence score is provided for each detected vulnerability.
[0023] An intelligent code inspection system based on the fusion of large models and static analysis includes:
[0024] The data parsing module is used to receive multi-source heterogeneous code input and transform it into a program representation rich in structured information that the subsequent detection engine can understand and process;
[0025] The global program graph construction module is used to build a global program graph based on the abstract syntax tree;
[0026] A hybrid defect detection module, comprising a static analysis engine and a large model inference engine, is used for defect detection;
[0027] The intelligent false alarm elimination module is used to intelligently post-process potential defects found by the detection engine using a multi-verification mechanism.
[0028] The automated remediation module is used to automatically generate remediation suggestions and code patches for confirmed real vulnerabilities;
[0029] The output integration module is used to output the processing results in a standardized format.
[0030] As a further technical solution, the system also includes:
[0031] The dynamic rule generation module allows users to describe their detection intent using natural language, which is then converted into executable query rules by a large language model.
[0032] The deep knowledge-enhanced detection module is used to retrieve relevant historical vulnerability cases or code patterns from the vectorized vulnerability knowledge base, and use them as contextual hints to guide the large model in reasoning and judgment.
[0033] The beneficial effects of this invention are:
[0034] (1) This invention significantly improves the accuracy of defect detection and effectively solves the technical problem of high false alarm rate. Traditional static analysis tools often generate a large number of false alarms due to a lack of understanding of the deep semantics and business logic of the code. This invention combines the accurate program structure provided by static analysis with the deep semantic reasoning ability of large language models through a hybrid analysis engine, enabling the system to accurately distinguish between benign coding patterns and real security vulnerabilities in the complete program context, fundamentally eliminating the "alarm noise" problem of traditional tools, and improving the ability to detect hidden vulnerabilities while greatly reducing the false alarm rate;
[0035] (2) This invention breaks through the limitations of traditional tools in terms of analysis depth, and achieves effective tracking of complex cross-domain vulnerabilities. Addressing the characteristics of high module coupling and complex call relationships in modern software systems, this invention provides the analysis engine with unprecedented context awareness capabilities by constructing a global program graph. The system can trace the complete propagation path of tainted data within the system end-to-end, even if the path spans multiple modules, files, or different programming languages, thereby reliably discovering complex security vulnerabilities that rely on the complete data propagation path.
[0036] (3) This invention realizes closed-loop intelligent management from vulnerability discovery to repair, which greatly improves the efficiency of security operation and maintenance. The system can not only accurately identify vulnerabilities, but also automatically generate detailed repair suggestions and directly applicable code patches through in-depth analysis of large models, freeing developers from tedious vulnerability repair work. Through seamless integration with development process tools, it realizes the automated flow of security auditing and vulnerability management, truly implements the "security shift left" concept, and significantly reduces the security operation costs of enterprises;
[0037] (4) This invention constructs a flexible and scalable adaptive detection system with continuous learning and evolution capabilities. Through natural language-driven dynamic rule generation technology, the threshold for customizing security rules is significantly reduced. The innovative application of retrieval-enhanced generation technology enables the system to analyze massive amounts of real-world vulnerability cases in real time, maintaining extremely high identification capabilities when facing rare, complex, or domain-specific logical vulnerabilities. This design ensures that the system's detection capabilities can keep pace with the times, providing enterprises with a future-oriented intelligent code auditing solution. Attached Figure Description
[0038] The invention will now be further described with reference to the accompanying drawings.
[0039] Figure 1 This is a flowchart of the intelligent code inspection method based on the fusion of large model and static analysis in this invention;
[0040] Figure 2 This is a framework diagram of the intelligent code inspection system based on the fusion of large model and static analysis in this invention. Detailed Implementation
[0041] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0042] Please see Figure 1 As shown, the intelligent code inspection method based on the fusion of large models and static analysis includes the following steps:
[0043] S1, the data parsing step, includes: receiving multi-source heterogeneous code input and converting it into a program representation rich in structured information that the subsequent detection engine can understand and process. The multi-source heterogeneous code input includes code repositories, local files, and analysis rules.
[0044] S2. Construct a global program graph. Based on the abstract syntax tree, construct a global program graph. The global program graph includes a control flow graph, a data flow graph, and a function call dependency graph, which are used to depict the call relationships between functions, variable passing paths, and program execution logic.
[0045] S3. A hybrid defect detection step, comprising: defect detection using a hybrid analysis engine, which includes a static analysis engine and a large-scale model inference engine. The static analysis engine performs pattern matching and rule querying based on the program graph. The large-scale model inference engine, based on the Transformer architecture and fine-tuned with instructions from real vulnerability samples, receives the preliminary results from the static analysis engine and the complete program graph as input, and performs context-aware analysis and deep knowledge-enhanced detection based on retrieval enhancement.
[0046] S4. A multi-verification mechanism is adopted to perform intelligent post-processing on potential defects discovered by the detection engine. The intelligent post-processing includes secondary verification through a large model inference engine and providing a confidence score for each vulnerability.
[0047] S5. For confirmed vulnerabilities, automatically generate remediation suggestions and code patches based on the code context. Output the intelligent post-processing results in a preset standardized format.
[0048] Through the above technical solution, this embodiment provides an intelligent code repair method based on the fusion of large models and static analysis. Through a complete process of data parsing, global program graph construction, hybrid defect detection, intelligent false alarm elimination and automated repair, it combines the deep semantic understanding capabilities of large language models with the systematic advantages of static analysis technology, and realizes closed-loop code defect lifecycle management from accurate identification, intelligent filtering to automated repair, effectively improving the accuracy, depth and automation level of code defect detection.
[0049] The data parsing step also includes:
[0050] Multi-source input acquisition includes: incremental or full fetching of code repositories via API integration with version control systems; direct reading of locally stored code files or project folders; and natural language input, where users directly describe their detection intent.
[0051] Deep syntax and semantic analysis includes: high-precision syntax parsing of source code from multiple mainstream programming languages to generate abstract syntax trees.
[0052] Through the above technical solution, this embodiment provides an extension to the data parsing step. The data parsing step, through multi-source input acquisition and deep syntactic and semantic analysis, achieves comprehensive reception and processing of multi-source heterogeneous code inputs from code repositories, local files, and natural language descriptions of detection intent. Furthermore, by generating abstract syntax trees through high-precision syntactic parsing of various mainstream programming languages, it provides a program representation foundation rich in structured information for subsequent hybrid defect detection.
[0053] In constructing the global program graph, all source code is systematically analyzed, and the control flow graph, data flow graph, and function call dependency graph are correlated and integrated. This global program graph depicts the call relationships between functions, variable passing paths, and program execution logic. Through this technical solution, the global program graph construction process systematically analyzes all source code, correlates and integrates the control flow graph, data flow graph, and function call dependency graph, forming a global program graph that comprehensively depicts the call relationships between functions, variable passing paths, and program execution logic. This provides a crucial context-aware foundation for subsequent hybrid defect detection.
[0054] In the hybrid defect detection step:
[0055] The static analysis engine is based on the constructed program graph, performs pattern matching and rule querying in parallel, and uses the built-in encoding rule library and general defect enumeration rule library for preliminary scanning.
[0056] The large-scale model inference engine performs context-aware analysis, accurately tracing the complete lifecycle of tainted data along the data flow graph based on the global program graph. It also performs RAG-based deep knowledge-enhanced detection, retrieving relevant historical vulnerability cases or code patterns from a vectorized vulnerability knowledge base as contextual clues to guide the large-scale model in its inference and judgment.
[0057] Through the above technical solution, this embodiment provides a hybrid defect monitoring process. Specifically, the hybrid defect detection process uses a static analysis engine to perform preliminary scanning based on the program graph through pattern matching and rule querying. Combined with the context-aware analysis capabilities of a large model inference engine, it achieves full lifecycle tracking of tainted data based on the global program graph. At the same time, it employs deep knowledge-enhanced detection technology based on retrieval enhancement, which retrieves relevant cases from a vectorized vulnerability knowledge base as contextual hints, significantly improving the detection accuracy and semantic understanding capabilities of complex vulnerabilities.
[0058] The RAG-based deep knowledge augmentation detection process includes:
[0059] In the background, a continuously updated vectorized vulnerability knowledge base is built and maintained, storing verified real vulnerability samples, remediation cases, and secure coding standards.
[0060] When performing vulnerability detection, the code segment to be analyzed is first used as a query to quickly retrieve the most relevant and similar historical vulnerability cases or code patterns from the knowledge base, which serve as contextual hints to guide the large model in reasoning and judgment.
[0061] Through the above technical solution, this embodiment provides a deep knowledge-enhanced detection process based on RAG. Specifically, the RAG-based deep knowledge-enhanced detection process builds and maintains a continuously updated vectorized vulnerability knowledge base in the background, stores verified real vulnerability samples and remediation cases, and uses the code fragment to be analyzed as a query to quickly retrieve the most relevant historical vulnerability cases from the knowledge base as contextual hints. This effectively guides the large model to make accurate reasoning and judgments, and significantly enhances the ability to identify unknown vulnerabilities and complex business logic defects.
[0062] Each potential vulnerability identified by the static analysis engine is submitted to the large model inference engine for secondary verification. A deep semantic analysis of the vulnerability's authenticity is performed, incorporating the complete program context. A confidence score is provided for each detected vulnerability.
[0063] Through the above technical solution, in this embodiment, the intelligent verification mechanism submits each potential vulnerability scanned by the static analysis engine to the large model inference engine for secondary verification. By combining the complete program context, it performs in-depth semantic analysis on the authenticity of the vulnerability and provides a confidence score for each detected vulnerability that comprehensively considers the severity of the vulnerability pattern, the triggering conditions, and the strength of the code context association, thereby significantly improving the credibility and usability of the detection results.
[0064] Please see Figure 2 As shown, the intelligent code inspection system based on the fusion of large model and static analysis includes:
[0065] The data parsing module is used to receive heterogeneous code input from multiple sources and transform it into a program representation rich in structured information that the subsequent detection engine can understand and process.
[0066] The Global Program Graph Construction Module is used to build a global program graph based on the Abstract Syntax Tree.
[0067] A hybrid defect detection module is used for defect detection, which includes a static analysis engine and a large model inference engine.
[0068] The intelligent false alarm elimination module is used to intelligently post-process potential defects discovered by the detection engine using a multi-verification mechanism.
[0069] The automated remediation module is used to automatically generate remediation suggestions and code patches for confirmed real vulnerabilities.
[0070] The output integration module is used to output the processing results in a standardized format.
[0071] Through the above technical solution, this embodiment provides an intelligent code inspection system based on the fusion of large model and static analysis. By working collaboratively with the data parsing module, global program graph construction module, hybrid defect detection module, intelligent false alarm elimination module, automated repair module and output integration module, it realizes closed-loop management of the entire process from receiving multiple source code inputs, program structure parsing, hybrid defect detection, intelligent false alarm filtering to generating automated repair suggestions, effectively improving the accuracy, efficiency and automation level of code defect detection.
[0072] The system also includes:
[0073] The dynamic rule generation module allows users to describe their detection intent using natural language, which is then converted into executable query rules by a large language model.
[0074] The deep knowledge-enhanced detection module is used to retrieve relevant historical vulnerability cases or code patterns from the vectorized vulnerability knowledge base, and use them as contextual hints to guide the large model in reasoning and judgment.
[0075] Through the above technical solutions, this embodiment integrates a dynamic rule generation module and a deep knowledge-enhanced detection module, realizing the intelligent conversion of user natural language intent into executable query rules. It can also retrieve relevant cases from the vectorized vulnerability knowledge base as contextual hints, significantly improving the system's ability to detect new vulnerabilities and its adaptability to specific business scenarios, thus forming a continuously evolving intelligent code auditing solution.
[0076] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.
Claims
1. An intelligent code inspection method based on the fusion of large models and static analysis, characterized in that, The method includes the following steps: S1. The data parsing step includes: receiving multi-source heterogeneous code input and converting it into a program representation rich in structured information that can be understood and processed by the subsequent detection engine; the multi-source heterogeneous code input includes code repositories, local files, and analysis rules; S2. Construct a global program graph. Based on the abstract syntax tree, construct a global program graph. The global program graph includes a control flow graph, a data flow graph, and a function call dependency graph, which are used to depict the call relationships between functions, variable passing paths, and program execution logic. S3. Hybrid defect detection steps, including: defect detection through a hybrid analysis engine, which includes a static analysis engine and a large model inference engine; the static analysis engine performs pattern matching and rule query based on the program graph; the large model inference engine is based on the Transformer architecture and fine-tuned by instructions from real vulnerability samples, receives the preliminary results of the static analysis engine and the complete program graph as input, and performs context-aware analysis and deep knowledge-enhanced detection based on retrieval enhancement. S4. A multi-verification mechanism is adopted to perform intelligent post-processing on potential defects discovered by the detection engine. The intelligent post-processing includes secondary verification through a large model inference engine and providing a confidence score for each vulnerability. S5. For confirmed real vulnerabilities, automatically generate repair suggestions and code patches based on the code context; output the intelligent post-processing results in a preset standardized format.
2. The intelligent code inspection method based on the fusion of large model and static analysis according to claim 1, characterized in that, The data parsing step also includes: Multi-source input acquisition includes: incremental or full fetching of code repositories via API integration with version control systems; direct reading of locally stored code files or project folders; and using natural language as input, with users directly describing their detection intent. Deep syntax and semantic analysis includes: high-precision syntax parsing of source code from multiple mainstream programming languages to generate abstract syntax trees.
3. The intelligent code inspection method based on the fusion of large model and static analysis according to claim 2, characterized in that, In the process of constructing a global program graph, all source code is systematically analyzed, and the control flow graph, data flow graph, and function call dependency graph are associated and integrated. The global program graph is used to depict the call relationships between functions, variable passing paths, and program execution logic.
4. The intelligent code inspection method based on the fusion of large model and static analysis according to claim 3, characterized in that, In the hybrid defect detection step: The static analysis engine is based on the constructed program graph, performs pattern matching and rule query in parallel, and uses the built-in coding rule library and general defect enumeration rule library for preliminary scanning. The large model inference engine performs context-aware analysis, accurately tracing the complete lifecycle of tainted data along the data flow graph based on the global program graph; and performs RAG-based deep knowledge enhancement detection, retrieving relevant historical vulnerability cases or code patterns from the vectorized vulnerability knowledge base as contextual hints to guide the large model in inference and judgment.
5. The intelligent code inspection method based on the fusion of large model and static analysis according to claim 4, characterized in that, The RAG-based deep knowledge augmentation detection process includes: Build and maintain a continuously updated vectorized vulnerability knowledge base in the background, storing verified real vulnerability samples, remediation cases, and secure coding standards; When performing vulnerability detection, the code segment to be analyzed is first used as a query to quickly retrieve the most relevant and similar historical vulnerability cases or code patterns from the knowledge base, which serve as contextual hints to guide the large model in reasoning and judgment.
6. The intelligent code inspection method based on the fusion of large model and static analysis according to claim 5, characterized in that, Each potential vulnerability detected by the static analysis engine is submitted to the large model inference engine for secondary verification. The engine performs in-depth semantic analysis of the vulnerability's authenticity based on the complete program context and provides a confidence score for each detected vulnerability.
7. An intelligent code inspection system based on the fusion of large models and static analysis, characterized in that, The system is used to execute the intelligent code inspection method based on the fusion of large model and static analysis as described in any one of claims 1-6, and the system includes: The data parsing module is used to receive multi-source heterogeneous code input and transform it into a program representation rich in structured information that the subsequent detection engine can understand and process; The global program graph construction module is used to build a global program graph based on the abstract syntax tree; A hybrid defect detection module, comprising a static analysis engine and a large model inference engine, is used for defect detection; The intelligent false alarm elimination module is used to intelligently post-process potential defects found by the detection engine using a multi-verification mechanism. The automated remediation module is used to automatically generate remediation suggestions and code patches for confirmed real vulnerabilities; The output integration module is used to output the processing results in a standardized format.
8. The intelligent code inspection method based on the fusion of large model and static analysis according to claim 7, characterized in that, The system also includes: The dynamic rule generation module allows users to describe their detection intent using natural language, which is then converted into executable query rules by a large language model. The deep knowledge-enhanced detection module is used to retrieve relevant historical vulnerability cases or code patterns from the vectorized vulnerability knowledge base, and use them as contextual hints to guide the large model in reasoning and judgment.