An automatic verification method for deep learning defect alerts

Abstract

The application discloses an automatic verification method for deep learning defect alarms, which comprises the following steps: firstly, a trained deep learning model is used to predict a to-be-tested program to obtain a defect alarm, the defect alarm containing the type and position of potential defects; then, a reachable path set P from the entrance of the to-be-tested program to each potential defect position is generated, and context information of each defect variable is collected; then, reachable paths in each reachable path set P are sorted; then, according to the sorting of the reachable paths, trigger constraints and path constraints of each reachable path in the reachable path set P are constructed according to a self-defined defect mode library and the collected defect variable context information; finally, the trigger constraints and the path constraints of each reachable path are sent to a z3 constraint solver for solving, and the authenticity of each potential defect is determined according to the solving result of the reachable path. The application can automatically verify the authenticity of deep learning defect alarms, and reduces the false alarm rate of deep learning defect prediction.

Description

Technical Field

[0001] This invention relates to the field of defect detection methods, specifically an automatic verification method for deep learning defect alerts. Background Technology

[0002] Deep learning for vulnerability prediction has become a popular research area in recent years. However, while it offers high efficiency, it also results in a high false positive rate, making the predictions unreliable. Vulnerability alerts generated by deep learning often require manual verification. To reduce the false positive rate of deep learning-based vulnerability prediction and decrease the time required for manual verification, an automated verification method for deep learning-based vulnerability alerts is urgently needed. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide an automatic verification method for deep learning defect alarms, which automatically verifies the authenticity of deep learning defect alarms and reduces the false alarm rate of deep learning prediction defects.

[0004] The technical solution of this invention is as follows:

[0005] An automated verification method for deep learning defect alerts includes the following steps:

[0006] (1) Use the trained deep learning model to predict the program under test and obtain defect alerts. The defect alerts contain the type and location of potential defects.

[0007] (2) Generate a set of reachable paths P from the entry point of the program under test to each potential defect location;

[0008] (3) Collect contextual information about defect variables at each potential defect location;

[0009] (4) Sort the reachable paths in each reachable path set P. Specifically, assign weights to each reachable path based on the size of the interval corresponding to each reachable path, the number of variables related to the defect variables in the path constraints, and the variable dependencies in the path constraints. Then sort the reachable paths according to the weights of each reachable path in the reachable path set P.

[0010] (5) According to the order of the reachable paths in the reachable path set P, based on the custom defect pattern library and the collected defect variable context information, construct the trigger constraints and path constraints for each reachable path in the reachable path set P. The path constraints are the constraint information that exists in the reachable path, and the trigger constraints are the constraint information added to trigger the defect.

[0011] (6) Send the triggering constraints and path constraints of each reachable path into the z3 constraint solver for solving, and use the solution results to confirm whether the reachable path is a safe path, a path that can trigger defects, or an unknown path.

[0012] (7) Determine each potential defect as a real defect, a false alarm defect, or an undetermined defect based on the solution results of the z3 constraint solver.

[0013] The specific steps for generating the set of reachable paths P from the entry point of the program under test to each potential defect location are as follows:

[0014] S21. Collect the control flow graph of all functions called from the entry point of the program under test to each potential defect location;

[0015] S22. Modify the IDs of all basic blocks in the control flow graph that are called to the function, and update the predecessor and successor relationships between all basic blocks in the control flow graph that are called to the function according to the correspondence between the IDs before and after the modification, so as to construct the inter-procedural bidirectional control flow graph InterProceduralCFG.

[0016] S23. Use the depth-first search method to reverse search the InterProceduralCFG to obtain all paths from the entry point of the program under test to each potential defect location, and construct the path set from the entry point of the program under test to each potential defect location.

[0017] S24. Use a static detection method based on interval operations to remove unreachable paths from the path set and construct a reachable path set P.

[0018] The specific steps for collecting the contextual information of defect variables at each potential defect location are as follows:

[0019] S31. Traverse the statements in the source code of the program under test, including variable declaration statement VarDecl and variable reference statement DeclRefExpr;

[0020] S32. For each reachable path in the reachable path set P, traverse each basic block in the interprocedural control flow graph InterProceduralCFG;

[0021] S33. Traverse the basic blocks in units of stmt. When there is a variable declaration statement VarDecl in stmt, collect the declaration information of input parameters, defective variables and related variables, and mark the declaration information of defective variables. When there is a variable reference statement DeclRefExpr in stmt, check whether there is an assignment or function call. If so, update the variable declaration information until the basic blocks on the reachable path are traversed, thereby collecting the context information of each defective variable.

[0022] The specific steps for sorting the reachable paths in each reachable path set P are as follows:

[0023] S41. Collect the interval size after calculating the defect variable interval for each input parameter variable in the entry function of the program under test, and use it as one of the weighting criteria. The larger the interval, the greater the weight. The interval size for the j-th input parameter variable on the i-th reachable path is d. i =[d - ,d + ], where d - Let d be the minimum value in the interval of the j-th input parameter variable. + The maximum value in the interval of the j-th input parameter variable;

[0024] The interval weight of the j-th input parameter variable var_weight j The calculation formula is shown in the following formula (1):

[0025]

[0026] In equation (1), MAX_VALUE and MIN_VALUE are the maximum and minimum values ​​of the j-th input parameter variable type;

[0027] The interval weight of the i-th reachable path is interval_weight i The calculation formula is shown in equation (2) below:

[0028] interval_weight i =∑var_weight j (2);

[0029] S42. Collect the number of variables in the path constraints as one of the weighting criteria. This involves traversing the basic blocks in the program under test to obtain the number of variables in the path constraints. The more variables there are, the smaller the weight.

[0030] The number of variables and weights for the i-th reachable path var_num_weight i The calculation formula is shown in the following formula (3):

[0031]

[0032] In equation (3), var_num i var_sum is the number of constraint variables on the i-th path, and var_sum is the number of constraint variables on all reachable paths for each potential defect;

[0033] S43. Collect the dependencies of variables in the path constraints, and use the number of dependencies as one of the weighting criteria. The more dependencies there are, the smaller the weight.

[0034] The weight of the dependency relationship of the i-th reachable path is dep_num_weight i The calculation formula is shown in equation (4) below:

[0035]

[0036] In equation (4), dep_num i Let be the number of dependencies on the i-th path, and dep_sum be the number of dependencies on all reachable paths for each potential defect;

[0037] S44. Set the interval weight (interval_weight) i Number of variables and weights var_num_weight i and dependency weights dep_num_weight i Perform addition operations to obtain the weight value of each reachable path, then construct a partial order relation for the reachable path set P, and sort the reachable paths in the reachable path set P according to the magnitude of the weight value of each reachable path in the reachable path set P.

[0038] The reachable paths in the reachable path set P are sorted to construct a time-priority sorted set and a test case-priority sorted set. The time-priority sorted set is sorted in descending order of weight, and the test case-priority sorted set is sorted in ascending order of weight.

[0039] The defect pattern library contains six defect patterns: memory leak, use after free, null pointer defect, array out of bounds, illegal calculation, and buffer overflow.

[0040] The process of constructing trigger constraints and path constraints for each reachable path in the reachable path set P first involves determining, based on the context information of the defect variable, which of the six defect pattern libraries the potential defect belongs to. Then, based on the corresponding defect pattern and defect variable in the defect pattern library, a constraint set for each reachable path is constructed. The constraint set contains all trigger constraints and path constraints for each reachable path. Finally, the trigger constraints and path constraints for each reachable path in the reachable path set P are constructed according to the path order after sorting the reachable paths in the reachable path set P.

[0041] The process of feeding the triggering constraints and path constraints of each reachable path into the z3 constraint solver for solving, and then using the solution results to determine whether the reachable path is a safe path, a path that can trigger defects, or an unknown path, involves the following steps:

[0042] S61. Confirmation of safe path S: All path constraints and triggering constraints of the potential defect are satisfied. Then the reachable path is confirmed as a safe path S;

[0043] S62. Confirmation of the triggerable defect path T: All path constraints and triggering constraints of the potential defect are satisfied. If a solution exists, then the reachable path is confirmed as a defect-triggering path T;

[0044] S63. Confirmation of Unknown Path U: If the defect location cannot be found within the set time or the solution process of S61 and S62 cannot be completed within the set time, then the reachable path is confirmed as an unknown path U.

[0045] in, This represents the path constraint that represents the reachable path corresponding to the potential defect. This indicates the triggering constraint at the potential defect location.

[0046] The specific steps for determining whether each potential defect is a real defect, a false alarm defect, or an undetermined defect based on the solution results of the z3 constraint solver are as follows:

[0047] S71. When the potential defect ω and its corresponding set of reachable paths P are... If p satisfies T and ω is a real defect, then there exists a reachable path p in the reachable path set P where p is a path T that can trigger defects, and the potential defect ω is a real defect.

[0048] S72. When the potential defect ω and its corresponding set of reachable paths P are... If p satisfies S and ω is a false alarm defect, then all reachable paths in the reachable path set P are confirmed as safe paths S, and the potential defect is a false alarm defect.

[0049] S73. When the potential defect ω and its corresponding reachable path set P... p satisfies U, and If p does not satisfy T, and ω is an undeterminable defect, then there exists a reachable path p in the reachable path set P that is confirmed as an unknown path U, and none of the reachable paths in the reachable path set P have been confirmed as paths T that can trigger defects. In this case, the potential defect ω is an undeterminable defect.

[0050] Advantages of this invention:

[0051] (1) The present invention sorts the reachable paths in the reachable path set P, and constructs a time priority sorting set and a test case priority sorting set according to the weight values. The time priority sorting set ensures that the z3 constraint solver has the lowest difficulty and consumes less time; the test case priority sorting set ensures that the most information is provided and the generated test cases have the highest quality.

[0052] (2) When generating the reachable path set P, the present invention uses the depth traversal method to search the InterProceduralCFG in reverse, avoiding the situation where the program exit is reached but the defect location has not been passed, which wastes time. Therefore, the reverse search from the potential defect location to the entry point of the program under test avoids the situation of searching for redundant paths.

[0053] (3) The present invention first determines the type of reachable path, and then determines the authenticity of potential defects based on the path type. As long as one reachable path is found to trigger the defect, it can be proven that the potential defect is a real defect, which reduces the cost of manually verifying defect alarms.

[0054] (4) This invention provides test cases for real deep learning defect alerts through reachability path analysis and constraint solving methods, thereby reducing the false alarm rate of deep learning prediction defects. Attached Figure Description

[0055] Figure 1 This is a flowchart of the present invention.

[0056] Figure 2 This is a list of defect triggering conditions for illegal calculation defect patterns in the defect pattern library of the invention embodiments.

[0057] Figure 3 This is a list of API defect triggering conditions for buffer overflow defect patterns in the defect pattern library of this invention. Detailed Implementation

[0058] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0059] See Figure 1 An automated verification method for deep learning defect alerts includes the following steps:

[0060] (1) Use the trained LSTM+GCN deep learning fusion model to predict the program under test and obtain defect alarms. The defect alarms contain the type and location of potential defects.

[0061] (2) Generate a set of reachable paths P from the entry point of the program under test to each potential defect location. The specific steps are as follows:

[0062] S21. Collect the control flow graph of all functions called from the entry point of the program under test to each potential defect location;

[0063] S22. Modify the IDs of all basic blocks in the control flow graph that are called to the function, and update the predecessor and successor relationships between all basic blocks in the control flow graph that are called to the function according to the correspondence between the IDs before and after the modification, so as to construct the inter-procedural bidirectional control flow graph InterProceduralCFG.

[0064] S23. Use the depth-first search method to reverse search the InterProceduralCFG to obtain all paths from the entry point of the program under test to each potential defect location, and construct the path set from the entry point of the program under test to each potential defect location.

[0065] S24. Use a static detection method based on interval operations to remove unreachable paths from the path set and construct a reachable path set P;

[0066] (3) Collect the contextual information of defect variables at each potential defect location. The specific steps are as follows:

[0067] S31. Use the Clang tool to define the AST accessor ASTVisitor, and traverse the statements in the source code of the program under test. The statements include variable declaration statements VarDecl and variable reference statements DeclRefExpr.

[0068] S32. For each reachable path in the reachable path set P, traverse each basic block in the interprocedural control flow graph InterProceduralCFG;

[0069] S33. Traverse the basic blocks in units of stmt. When there is a variable declaration statement VarDecl in stmt, collect the declaration information of input parameters, defective variables, and related variables, and mark the declaration information of defective variables. When there is a variable reference statement DeclRefExpr in stmt, check whether there is an assignment or function call. If so, update the variable declaration information until the basic blocks on the reachable path have been traversed, thereby collecting the context information of each defective variable. Here, stmt, VarDecl, and DeclRefExpr are all node types on the abstract syntax tree generated by Clang.

[0070] (4) Sort the reachable paths in each reachable path set P. The specific steps are as follows:

[0071] S41. Collect the interval size after calculating the defect variable interval for each input parameter variable in the entry function of the program under test, and use it as one of the weighting criteria. The larger the interval, the greater the weight. The interval size for the j-th input parameter variable on the i-th reachable path is d. i =[d - ,d +], where d - Let d be the minimum value in the interval of the j-th input parameter variable. + The maximum value in the interval of the j-th input parameter variable;

[0072] The interval weight of the j-th input parameter variable var_weight j The calculation formula is shown in the following formula (1):

[0073]

[0074] In equation (1), MAX_VALUE and MIN_VALUE are the maximum and minimum values ​​of the j-th input parameter variable type;

[0075] The interval weight of the i-th reachable path is interval_weight i The calculation formula is shown in equation (2) below:

[0076] interval_weight i =∑var_weight j (2);

[0077] S42. Collect the number of variables in the path constraints as one of the weighting criteria. This involves traversing the basic blocks in the program under test to obtain the number of variables in the path constraints. The more variables there are, the smaller the weight.

[0078] The number of variables and weights for the i-th reachable path var_num_weight i The calculation formula is shown in the following formula (3):

[0079]

[0080] In equation (3), var_num i var_sum is the number of constraint variables on the i-th path, and var_sum is the number of constraint variables on all reachable paths for each potential defect;

[0081] S43. Collect the dependencies of variables in the path constraints, and use the number of dependencies as one of the weighting criteria. The more dependencies there are, the smaller the weight.

[0082] The weight of the dependency relationship of the i-th reachable path is dep_num_weight i The calculation formula is shown in equation (4) below:

[0083]

[0084] In equation (4), dep_num i Let be the number of dependencies on the i-th path, and dep_sum be the number of dependencies on all reachable paths for each potential defect;

[0085] S44. Set the interval weight (interval_weight) i Number of variables and weights var_num_weight i and dependency weights dep_num_weight i The weights of each reachable path are obtained by summing the weights. Then, a partial order relation for the reachable path set P is constructed. The reachable paths in the reachable path set P are sorted according to the weight values ​​of each path, resulting in a time-priority sorted set and a test case-priority sorted set. The time-priority sorted set is sorted in descending order of weight to ensure the lowest solution difficulty and the least time consumption. The test case-priority sorted set is sorted in ascending order of weight to ensure the most information is provided and the highest quality test cases are generated.

[0086] (5) According to the order of the reachable paths in the reachable path set P, based on the custom defect pattern library and the collected defect variable context information, construct the trigger constraints and path constraints for each reachable path in the reachable path set P. The path constraints are the constraint information that exists in the reachable path, and the trigger constraints are the constraint information added to trigger the defect. For example, the trigger condition for the array out-of-bounds defect is "i<0||i>len(arr)", where i is the array index and len is the length of the array arr.

[0087] The defect pattern library contains six defect patterns: memory leak, use after free, null pointer defect, array out of bounds, illegal computation, and buffer overflow. The memory leak and use after free defect patterns do not require additional defect constraints; simply track the memory allocation and deallocation of the defective variable. The null pointer defect pattern is triggered when *ptr = null. The array out of bounds defect pattern is triggered when index ≥ array_length || index < 0, where index is the array index and array_length is the array length. The illegal computation defect pattern's trigger condition is [see...]. Figure 2 As shown; buffer overflow defect patterns are divided into direct access type and API call type. The defect triggering condition for the direct access type defect pattern is i > size(buffer) || i < 0, where i is the offset from the starting address, and size(buffer) is the size of the buffer. The API defect triggering condition for the API call type defect pattern is shown in [link to API call type defect pattern]. Figure 3 As shown, len represents the string length;

[0088] To construct the trigger constraints and path constraints for each reachable path in the reachable path set P, firstly, based on the context information of the defect variable, determine which of the six defect pattern libraries the potential defect belongs to. Then, based on the corresponding defect pattern and defect variable in the defect pattern library, construct the constraint set for each reachable path. The constraint set contains all the trigger constraints and path constraints for each reachable path. Finally, according to the path order after sorting the reachable paths in the reachable path set P, construct the trigger constraints and path constraints for each reachable path in the reachable path set P.

[0089] (6) Automatically convert the trigger constraints and path constraints of each reachable path into SMT-LIB format, and then send them to the z3 constraint solver for solving. The solution results are used to confirm whether the reachable path is a safe path, a path that can trigger defects, or an unknown path. The specific steps are as follows:

[0090] S61. Confirmation of safe path S: All path constraints and triggering constraints of the potential defect are satisfied. Then the reachable path is confirmed as a safe path S;

[0091] S62. Confirmation of the triggerable defect path T: All path constraints and triggering constraints of the potential defect are satisfied. If a solution exists, the reachable path is confirmed as a defect-triggering path T, and the solution result of the reachable path is the test case that can trigger the defect.

[0092] S63. Confirmation of Unknown Path U: If the defect location cannot be found within the set time or the solution process of S61 and S62 cannot be completed within the set time, then the reachable path is confirmed as an unknown path U.

[0093] in, This represents the path constraint that represents the reachable path corresponding to the potential defect. Indicates triggering constraints at potential defects;

[0094] When determining the path type according to the priority set of test cases, if a path is confirmed to be a defect-triggering path T, the generated test case is added to the test case library, and the confirmation of the current reachable path ends. That is, there is no need to confirm other unconfirmed reachable paths in the reachable path set P. If no reachable path is determined to be a defect-triggering path T, all reachable paths are confirmed sequentially according to the priority set until there is a defect-triggering path T or all paths in the reachable path set P have been confirmed.

[0095] (7) Determine whether each potential defect is a real defect, a false alarm defect, or an undetermined defect based on the solution results of the z3 constraint solver. The specific steps are as follows:

[0096] S71. When the potential defect ω and its corresponding set of reachable paths P are... If p satisfies T and ω is a real defect, then there exists a reachable path p in the reachable path set P where p is a path T that can trigger defects, and the potential defect is a real defect.

[0097] S72. When the potential defect ω and its corresponding set of reachable paths P are... If p satisfies S, and ω is a false alarm defect, then all reachable paths in the reachable path set P are confirmed as safe paths S, and the potential defect ω is a false alarm defect.

[0098] S73. When the potential defect ω and its corresponding reachable path set P... p satisfies U, and If p does not satisfy T, and ω is an undeterminable defect, then there exists a reachable path p in the reachable path set P that is confirmed as an unknown path U, and none of the reachable paths in the reachable path set P have been confirmed as paths T that can trigger defects. In this case, the potential defect is an undeterminable defect.

[0099] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An automatic verification method for deep learning defect alerts, characterized in that: It includes the following steps: (1) Use the trained deep learning model to predict the program under test and obtain defect alerts. The defect alerts include the type and location of potential defects. (2) Generate a set of reachable paths P from the entry point of the program under test to each potential defect location; (3) Collect contextual information about defect variables at each potential defect location; (4) Sort the reachable paths in each reachable path set P. The specific steps are as follows: S41. Collect the interval size after calculating the defect variable interval for each input parameter variable in the entry function of the program under test, and use it as one of the weighting criteria. The larger the interval, the greater the weight. The interval size for the j-th input parameter variable on the i-th reachable path is... ,in, The minimum value in the interval of the j-th input parameter variable. The maximum value in the interval of the j-th input parameter variable; The weight of the j-th input parameter variable interval The calculation formula is shown in the following formula (1): （1）； In equation (1), MAX_VALUE and MIN_VALUE are the maximum and minimum values ​​of the j-th input parameter variable type; Weight of the i-th reachable path interval The calculation formula is shown in the following formula (2): （2）； S42. Collect the number of variables in the path constraints as one of the weighting criteria. This involves traversing the basic blocks in the program under test to obtain the number of variables in the path constraints. The more variables there are, the smaller the weight. The number and weight of variables for the i-th reachable path The calculation formula is shown in the following formula (3): （3）； In equation (3), Let be the number of constraint variables on the i-th path. The number of constraint variables on all reachable paths for each potential defect; S43. Collect the dependencies of variables in the path constraints, and use the number of dependencies as one of the weighting criteria. The more dependencies there are, the smaller the weight. Weight of the i-th reachable path dependency relationship The calculation formula is shown in the following formula (4): （4）； In equation (4), Let be the number of dependencies on the i-th path. The number of dependencies on all reachable paths for each potential defect; S44. Adjust the interval weights Number of variables and weights Dependency weights Perform addition operations to obtain the weight value of each reachable path, then construct a partial order relation for the reachable path set P, and sort the reachable paths in the reachable path set P according to the magnitude of the weight value of each reachable path in the reachable path set P. (5) According to the order of the reachable paths in the reachable path set P, and based on the custom defect pattern library and the collected defect variable context information, construct the trigger constraints and path constraints for each reachable path in the reachable path set P. The path constraints are the constraint information that exists in the reachable path, and the trigger constraints are the constraint information added to trigger the defect. (6) Send the triggering constraints and path constraints of each reachable path into the z3 constraint solver for solving, and use the solution results to confirm whether the reachable path is a safe path, a path that can trigger defects, or an unknown path; (7) Determine each potential defect as a real defect, a false alarm defect, or an undetermined defect based on the solution results of the z3 constraint solver.

2. The automatic verification method for deep learning defect alerts according to claim 1, characterized in that: The specific steps for generating the set of reachable paths P from the entry point of the program under test to each potential defect location are as follows: S21. Collect the control flow graph of all functions called from the entry point of the program under test to each potential defect location; S22. Modify the IDs of all basic blocks in the control flow graph that are called to the function, and update the predecessor and successor relationships between all basic blocks in the control flow graph that are called to the function according to the correspondence between the IDs before and after the modification, so as to construct the inter-procedural bidirectional control flow graph InterProceduralCFG. S23. Use the depth-first search method to reverse search the InterProceduralCFG to obtain all paths from the entry point of the program under test to each potential defect location, and construct the path set from the entry point of the program under test to each potential defect location. S24. Use a static detection method based on interval operations to remove unreachable paths from the path set and construct a reachable path set P.

3. The automatic verification method for deep learning defect alerts according to claim 1, characterized in that: The specific steps for collecting the contextual information of defect variables at each potential defect location are as follows: S31. Traverse the statements in the source code of the program under test, including variable declaration statement VarDecl and variable reference statement DeclRefExpr; S32. For each reachable path in the reachable path set P, traverse each basic block in the interprocedural control flow graph InterProceduralCFG; S33. Traverse the basic blocks in units of stmt. When there is a variable declaration statement VarDecl in stmt, collect the declaration information of input parameters, defective variables and related variables, and mark the declaration information of defective variables. When there is a variable reference statement DeclRefExpr in stmt, check whether there is an assignment or function call. If so, update the variable declaration information until the basic blocks on the reachable path are traversed, thereby collecting the context information of each defective variable.

4. The automatic verification method for deep learning defect alerts according to claim 1, characterized in that: The reachable paths in the reachable path set P are sorted to construct a time-priority sorted set and a test case-priority sorted set. The time-priority sorted set is sorted in descending order of weight, and the test case-priority sorted set is sorted in ascending order of weight.

5. The automatic verification method for deep learning defect alarms according to claim 1, characterized in that: The defect pattern library contains six defect patterns: memory leak, use after free, null pointer defect, array out of bounds, illegal calculation, and buffer overflow.

6. The automatic verification method for deep learning defect alarms according to claim 5, characterized in that: The process of constructing trigger constraints and path constraints for each reachable path in the reachable path set P first involves determining, based on the context information of the defect variable, which of the six defect modes the potential defect belongs to. Then, based on the corresponding defect mode and defect variable in the defect mode library, a constraint set for each reachable path is constructed. The constraint set contains all trigger constraints and path constraints for each reachable path. Finally, the trigger constraints and path constraints for each reachable path in the reachable path set P are constructed according to the path order after sorting the reachable paths in the reachable path set P.

7. The automatic verification method for deep learning defect alerts according to claim 1, characterized in that: The process of feeding the triggering constraints and path constraints of each reachable path into the z3 constraint solver for solving, and then using the solution results to determine whether the reachable path is a safe path, a path that can trigger defects, or an unknown path, involves the following steps: S61. Confirmation of safe path S: All path constraints and triggering constraints of the potential defect are satisfied. If so, then the reachable path is confirmed as a safe path S; S62. Confirmation of the triggerable defect path T: All path constraints and triggering constraints of the potential defect are satisfied. If a solution exists, then the reachable path is confirmed as a defect-triggering path T; S63. Confirmation of Unknown Path U: If the defect location cannot be found within the set time or the solution process of S61 and S62 cannot be completed within the set time, then the reachable path is confirmed as an unknown path U. in, This represents the path constraint that represents the reachable path corresponding to the potential defect. This indicates the triggering constraint at the potential defect location.

8. The automatic verification method for deep learning defect alarms according to claim 7, characterized in that: The specific steps for determining whether each potential defect is a real defect, a false alarm defect, or an undetermined defect based on the solution results of the z3 constraint solver are as follows: S71, When a potential defect and its corresponding set of reachable paths P, p satisfies T. If the defect is real, then there exists a reachable path in the reachable path set P. If the defect path T is a triggerable defect path, then the potential defect is... This is a genuine defect; S72, When a potential defect and its corresponding set of reachable paths P, p satisfies S. If a potential defect is identified as a false alarm, then all reachable paths in the reachable path set P are confirmed as safe paths S. S73, When a potential defect and its corresponding set of reachable paths P, p satisfies U, and Neither p satisfies T. If the defect cannot be determined, then there exists a reachable path in the reachable path set P. If a path is identified as an unknown path U, and none of the reachable paths in the reachable path set P have been identified as a path T that can trigger a defect, then the potential defect... The defect could not be determined.

Images