A method and system for generating open source vulnerability repair solutions based on LLM

Abstract

The present invention relates to a method for generating an open source vulnerability repair solution based on LLM, which specifically includes collecting SCA scan results, real-time component official document information, and historical repair cases within an organization, and processing the collected data; using LLM for training, including a pre-training stage and a fine-tuning stage; wherein the pre-training stage uses the SCA scan results and the real-time component official document information to train a model; the fine-tuning stage is to further train the model using historical repair cases within the organization; after the training is completed, LLM generates a recommended version with compatibility instructions and customized repair requirements based on the new round of SCA scan results, and pushes the recommended version generated by LLM to developers in a friendly manner for selection and application. The present invention uses LLM technology, combined with information from SCA tools and component official websites, to provide a comprehensive, efficient, and flexible method for outputting open source vulnerability repair solutions.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, system, electronic device, readable storage medium, and program product for generating an open source vulnerability repair solution based on LLM. Background Art

[0002] Prior art CN 117032782 A discloses a software security version identification method, system and processing equipment based on SCA, which relates to the field of software security technology and solves the technical problem that existing SCA tools are difficult to quickly and accurately identify security versions from multiple versions of a software package, thereby reducing development efficiency. Specifically, the method includes obtaining the version numbers of all public versions of the target software to obtain a version data set; sorting all versions of the target software according to preset rules to obtain a version sequence set; analyzing the component data of each public version through SCA and obtaining the vulnerability data of the component data, correlating and matching the version sequence set, component data and vulnerability data to obtain the vulnerable version affected by the vulnerability in the version sequence set; adding marking information to the vulnerable version and treating the unmarked version as a safe version.

[0003] SCA scanning tools offer fixes that involve upgrading third-party components to secure versions, often lacking compatibility information. Compatibility issues can cause application system failures, making upgrading open source component vulnerabilities a challenge for developers. Only official third-party component websites contain compatibility information, but SCA scanning tools rely on numerous sources, requiring significant effort to compile and maintaining comprehensiveness and timeliness. Summary of the Invention

[0004] To address the shortcomings of existing technologies in addressing the security of open source components, this paper cleverly utilizes Large Language Model (LLM) technology. By deeply integrating existing Software Composition Analysis (SCA) tools with compatibility information from each component's official website, this paper provides a comprehensive and efficient method for outputting open source vulnerability remediation solutions.

[0005] This approach not only uniformly outputs fixes for detected open source vulnerabilities, but also provides a comprehensive set of upgrade versions and compatibility information between them. This means developers no longer need to spend a lot of time and effort manually searching, comparing, and verifying compatibility information between different versions; instead, they can obtain accurate and reliable compatibility information directly from the system, allowing them to make decisions faster and more accurately.

[0006] Furthermore, the method of the present invention is highly flexible and customizable. It can be flexibly integrated with an organization's customized repair solutions based on its specific needs and internal standards. This flexibility allows the method to better adapt to the specific circumstances of different organizations and mitigate the potential adverse effects of upgraded version compatibility issues on application systems.

[0007] Furthermore, the method of this invention can be easily applied to an organization's development platforms, enabling flexible access. Whether integrated into an existing development environment or used as a standalone tool, it provides developers with convenient and efficient security support. This not only helps improve development efficiency and code quality, but also significantly enhances an organization's security capabilities.

[0008] To achieve the above objectives, the technical solutions adopted by the present invention include:

[0009] A method for generating an open source vulnerability repair solution based on LLM, characterized by comprising:

[0010] S1. Collect SCA scan results, real-time component official documentation, and historical remediation cases within the organization.

[0011] S2. Clean, format, and annotate the collected data to meet the input requirements of LLM;

[0012] S3. Training using LLM includes a pre-training phase and a fine-tuning phase; wherein the pre-training phase uses the SCA scan results and the real-time component official documentation information to train the model; and the fine-tuning phase uses historical repair cases within the organization to further train the model;

[0013] S4. After the training is completed, LLM generates a recommended version with compatibility instructions and customized repair requirements based on the results of the new round of SCA scanning, and pushes the recommended version generated by LLM to developers in a friendly manner for selection and application.

[0014] Furthermore, the S3 utilizes LLM to perform training in a set fixed cycle.

[0015] Furthermore, the recommended version in S4 includes a set of upgraded versions and a description of the compatibility between the versions.

[0016] Furthermore, the method also includes connecting the SCA scanning tool with the devsecops process.

[0017] Furthermore, the method also includes integrating the method into a development environment, inputting component information and outputting development vulnerability information.

[0018] Furthermore, the output development vulnerability information includes but is not limited to the impact scope of the vulnerability and known attack vectors.

[0019] The present invention also provides a system for generating an open source vulnerability repair solution based on LLM, which is characterized by including a data collection layer, a preprocessing layer, a model training layer, and an inference output layer. The data collection layer is used to collect SCA scan results, real-time component official document information, and historical repair cases within the organization;

[0020] The preprocessing layer is used to clean, format and annotate the collected data to meet the input requirements of LLM;

[0021] A model training layer is used for training using LLM, including a pre-training phase and a fine-tuning phase; wherein the pre-training phase uses the SCA scan results and the official component documentation to train the model; and the fine-tuning phase uses historical repair cases within the organization to further train the model;

[0022] The reasoning output layer is used to generate a recommended version with compatibility instructions and customized repair requirements based on the new round of SCA scan results after the LLM training is completed, and push the recommended version generated by the LLM to developers in a friendly manner for selection and application.

[0023] The present invention also provides a computer-readable storage medium, characterized in that a readable computer program is stored on the storage medium, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

[0024] The present invention also provides an electronic device, characterized in that it includes a processor and a memory;

[0025] The memory is used to store computer programs;

[0026] The processor is configured to execute the method according to any one of claims 1 to 6 by calling a stored computer program.

[0027] The present invention also relates to a computer program product, comprising a computer program and / or instructions, characterized in that the computer program and / or instructions implement the steps of the above method when executed by a processor.

[0028] The beneficial effects of the present invention are: through the use of LLM technology, the present invention combines existing SCA tools with the compatibility description information of the official websites of each component to uniformly output open source vulnerability repair solutions (including upgrade version sets and compatibility descriptions between each version). It can also flexibly combine customized repair solutions within the organization to reduce the adverse effects of compatibility issues of upgraded versions on the application system. In addition, this method can be applied to the development platform within the organization and can achieve flexible access. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a flow chart of a method for generating an open source vulnerability repair solution based on LLM in the present invention.

[0030] Figure 2 This is a schematic diagram of the system structure for generating an open source vulnerability repair solution based on LLM in the present invention. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. The components of the embodiments of the present invention generally described and shown in the drawings herein can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0032] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of the present invention, the terms "first", "second", etc. are used only to distinguish the description and should not be understood as indicating or implying relative importance.

[0033] The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0034] The first aspect of the present invention relates to a method for generating an open source vulnerability repair solution based on LLM. Figure 1 Shown, including:

[0035] S1. Collect SCA scan results, real-time component official documentation, and historical remediation cases within the organization.

[0036] Specifically, in this step, the main work is to collect data. First, scan the software project using the SCA (Software Composition Analysis) tool to collect information about open source components, their versions, known vulnerabilities, etc. At the same time, obtain the latest information about these components from the official website or documentation of the components, especially those related to compatibility, updates, and fixes. In addition, it is necessary to collect historical repair cases from within the organization. These cases may contain previously encountered security issues and their solutions. Through this step, a comprehensive and up-to-date dataset can be established to provide a basis for subsequent training and recommendations.

[0037] S2. Clean, format, and annotate the collected data to meet the input requirements of LLM;

[0038] Specifically, the collected raw data needs to be processed. Data cleaning is to remove duplicate, erroneous, or incomplete data. Formatting is to convert the data into a format acceptable to the Large Language Model (LLM), such as a specific text structure or encoding method. Annotation is to add additional information to the data, such as classification labels and keywords, to help the LLM better understand and process the data. Processed data is of higher quality and more suitable for training the LLM, thereby improving the accuracy and effectiveness of subsequent recommendations.

[0039] S3. Training using LLM includes a pre-training phase and a fine-tuning phase; wherein the pre-training phase uses the SCA scan results and the real-time component official documentation information to train the model; and the fine-tuning phase uses historical repair cases within the organization to further train the model;

[0040] Specifically, LLM is trained in two phases. The pre-training phase primarily uses SCA scan results and real-time official component documentation to train the model, enabling it to understand and analyze this data. The fine-tuning phase further trains the model using historical remediation cases within the organization, enabling it to more accurately generate recommendations based on the organization's actual situation and needs. Through these two phases of training, LLM can better understand the security issues of open source components and the specific needs of an organization, thereby generating more accurate and practical recommendations.

[0041] S4. After the training is completed, LLM generates a recommended version with compatibility instructions and customized repair requirements based on the results of the new round of SCA scanning, and pushes the recommended version generated by LLM to developers in a friendly manner for selection and application.

[0042] Specifically, in this step, the trained LLM generates recommendations based on the latest SCA scan results. These recommendations not only include possible remediation solutions but also include compatibility notes and remediation requirements tailored to the organization's internal needs. These recommendations are then presented to developers in an easy-to-understand and actionable manner for selection and application. Developers can more conveniently and quickly access information on the security of open source components and remediation solutions, thereby improving development efficiency and code security. Furthermore, because the recommendations are generated based on the organization's actual situation and needs, they are more practical and targeted.

[0043] The present application also provides an implementation manner, wherein the S3 utilizes LLM to perform training in a set fixed period cycle.

[0044] Specifically, in step S3, the training process using the Large Language Model (LLM) is not a one-time process, but rather a recurring process within a set, fixed period. This means the model is regularly retrained to adapt to new data and situations. Through regular recurring training, the LLM can continuously learn and adapt to new data, thereby improving its accuracy and performance. This is particularly important for addressing the ever-changing security landscape of open source components, as new vulnerabilities and fixes are constantly emerging.

[0045] The present application also provides an implementation manner, wherein the recommended version in S4 includes an upgraded version set and a compatibility description between each version.

[0046] Specifically, the recommended versions generated in step S4 not only include possible upgrade versions but also provide compatibility information between these versions. This means developers can clearly understand the compatibility relationships between different versions and the potential impact of upgrading to a specific version on other components or the entire system. Providing compatibility information helps developers more comprehensively assess the risks and costs of upgrading, allowing them to make more informed decisions. This helps reduce issues caused by version incompatibilities and improves system stability and security.

[0047] The present application also provides an implementation method, wherein the method further includes docking the SCA scanning tool with the devsecops process.

[0048] Specifically, this approach also involves integrating SCA (Software Composition Analysis) scanning tools with the DevSecOps process. This means that SCA scan results can be directly fed into the DevSecOps process, integrating it with other security and development activities. By integrating SCA scanning tools with the DevSecOps process, security vulnerabilities can be discovered and remediated early, improving security and efficiency during the development process. This helps reduce the cost and risk of later remediation efforts and accelerates software delivery.

[0049] The present application also provides an implementation method, wherein the method further includes integrating the method into a development environment, inputting component information and outputting development vulnerability information.

[0050] Specifically, this method can be integrated into development environments, allowing developers to directly input component information and receive information about development vulnerabilities in those components as output. By integrating into development environments, this method can provide developers with real-time security feedback, helping them promptly discover and fix vulnerabilities during the development process. This helps improve code quality and security, and reduces potential security risks.

[0051] The present application also provides an implementation manner, wherein the output development vulnerability information includes but is not limited to the impact scope of the vulnerability and known attack vectors.

[0052] Specifically, the output development vulnerability information includes detailed information such as the vulnerability's impact scope and known attack vectors. This information helps developers more fully understand the nature and potential risks of the vulnerability. Providing detailed vulnerability information allows developers to more accurately assess vulnerability severity and priority, thereby developing more effective remediation strategies. This helps accelerate vulnerability remediation and improve the overall security of the system.

[0053] Another aspect of the present invention also relates to a generation system of an open source vulnerability repair solution based on LLM, the structure of which is as follows: Figure 2 Shown, including:

[0054] Data collection layer, preprocessing layer, model training layer, inference output layer, among which,

[0055] The data collection layer is used to collect SCA scan results, real-time component official documentation information, and historical repair cases within the organization;

[0056] The preprocessing layer is used to clean, format and annotate the collected data to meet the input requirements of LLM;

[0057] A model training layer is used for training using LLM, including a pre-training phase and a fine-tuning phase; wherein the pre-training phase uses the SCA scan results and the official component documentation to train the model; and the fine-tuning phase uses historical repair cases within the organization to further train the model;

[0058] The reasoning output layer is used to generate a recommended version with compatibility instructions and customized repair requirements based on the new round of SCA scan results after the LLM training is completed, and push the recommended version generated by the LLM to developers in a friendly manner for selection and application.

[0059] By using this system, the above-mentioned calculation and processing method can be executed and the corresponding technical effects can be achieved.

[0060] An embodiment of the present invention also provides a computer-readable storage medium capable of implementing all steps of the method in the above embodiment. The computer-readable storage medium stores a computer program that implements all steps of the method in the above embodiment when executed by a processor.

[0061] An embodiment of the present invention also provides an electronic device for executing the above-mentioned method. As an implementation device of the method, the electronic device has at least a processor and a memory, and in particular, the memory stores the data and related computer programs required for executing the method, such as model program software based on LLM training, etc., and the processor calls the data and program in the memory to execute all the steps of the implementation method and obtains the corresponding technical effect.

[0062] Preferably, the electronic device may include a bus architecture, which may include any number of interconnected buses and bridges, and the bus will include various circuits linked together by one or more processors and memories. The bus may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are all well known in the art and, therefore, will not be described further herein. The bus interface provides an interface between the bus and the receiver and transmitter. The receiver and transmitter can be the same component, namely a transceiver, which provides a unit for communicating with various other systems over a transmission medium. The processor is responsible for managing the bus and general processing, while the memory can be used to store data used by the processor when performing operations.

[0063] Additionally, the electronic device may further include components such as a communication module, an input unit, an audio processor, a display, and a power supply. The processor (or controller, operating control) employed may include a microprocessor or other processor device and / or logic device, which receives input and controls the operation of various components of the electronic device. The memory may be one or more of a cache, flash memory, a hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices, and may store the aforementioned data and information. It may also store programs for executing the relevant information, and the processor may execute the programs stored in the memory to implement information storage or processing. The input unit is used to provide input to the processor, and may, for example, be a keypad or touch input device. The power supply is used to provide power to the electronic device. The display is used to display objects such as images and text, and may, for example, be an LCD display. The communication module is a transmitter / receiver that sends and receives signals via an antenna. The communication module (transmitter / receiver) is coupled to the processor to provide input signals and receive output signals, similar to the case of a conventional mobile communication terminal. Based on different communication technologies, multiple communication modules can be provided in the same electronic device, such as a cellular network module, a Bluetooth module, and / or a wireless local area network module. The communication module (transmitter / receiver) is also coupled to a speaker and a microphone via an audio processor to provide audio output via the speaker and receive audio input from the microphone, thereby implementing common telecommunications functions. The audio processor may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor is also coupled to a central processing unit, enabling local recording via the microphone and playback of stored audio via the speaker.

[0064] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0065] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or boxes.

[0066] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction system that is implemented in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0067] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The present invention is described in detail below. ...

[0068] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention are intended to be covered by the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A method for generating an open source vulnerability repair solution based on LLM, characterized in that: include: S1. Collect SCA scan results, real-time component official documentation information, and historical remediation cases within the organization; S2. Clean, format, and annotate the collected data to meet the input requirements of the LLM; S3. Train LLM, Including, pre-training stage and fine-tuning stage; The pre-training phase uses the SCA scan results and the real-time component official documentation information to train the model; the fine-tuning phase uses historical repair cases within the organization to further train the model; S4. After training is complete, LLM generates a recommended version with compatibility specifications and customized fix requirements based on the results of the new round of SCA scans. The recommended version generated by LLM is pushed to developers in a friendly manner for selection and application. The recommended version includes a set of upgraded versions and compatibility specifications between each version.

2. The method according to claim 1, wherein The S3 trains the LLM in a set fixed cycle.

3. The method according to claim 1, wherein The method also includes connecting the SCA scanning tool to the devsecops process.

4. The method according to claim 3, wherein The method also includes integrating the method into a development environment, inputting component information and outputting development vulnerability information.

5. The method according to claim 4, wherein The output development vulnerability information includes but is not limited to the impact scope of the vulnerability and known attack vectors.

6. A multi-party real-time reconciliation system based on message queue, characterized in that: Including data collection layer, preprocessing layer, model training layer, and inference output layer, among which, The data collection layer is used to collect SCA scan results, real-time component official documentation information, and historical repair cases within the organization; The preprocessing layer is used to clean, format and annotate the collected data to meet the input requirements of LLM; The model training layer is used to train the LLM, including a pre-training phase and a fine-tuning phase; wherein the pre-training phase uses the SCA scan results and the official component documentation to train the model; and the fine-tuning phase uses historical repair cases within the organization to further train the model; The reasoning output layer is used to generate a recommended version with compatibility instructions and customized repair requirements based on the results of a new round of SCA scanning after the LLM training is completed, and push the recommended version generated by the LLM to developers in a friendly manner for selection and application. The recommended version includes a set of upgraded versions and compatibility instructions between each version.

7. A computer-readable storage medium, characterized in that The storage medium stores a computer program, which implements the method according to any one of claims 1 to 5 when executed by a processor.

8. An electronic device, characterized in that: including processor and memory; The memory is used to store computer programs; The processor is configured to execute the method according to any one of claims 1 to 5 by calling a stored computer program.

9. A computer program product comprising a computer program and / or instructions, characterized in that When the computer program and / or instructions are executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images