A human-machine collaborative static vulnerability mining method and system based on large model

Abstract

The present invention provides a human-machine collaborative static vulnerability mining method and system based on a large model, including: using a large model in combination with an external knowledge base to identify dangerous functions in the program code to be tested; using a human-machine collaborative method to analyze the extracted dangerous function call trajectory to obtain the target function call trajectory suspected of having vulnerabilities; extracting context information related to the vulnerability from the target function call trajectory suspected of having vulnerabilities, and filling it into the vulnerability rule template, using the rules generated after filling to scan the program to complete vulnerability mining. The present invention adopts a human-machine collaborative approach to incorporate vulnerability miners into the loop of static vulnerability mining, giving full play to the vulnerability miner's cognitive advantage in the mechanism of vulnerability generation to improve the efficiency and accuracy of vulnerability mining.

Description

Technical Field

[0001] The present invention relates to the field of static analysis vulnerability mining, and in particular to a large model-based human-machine collaborative static vulnerability mining method and system. Background Art

[0002] With the rapid development of computer and Internet technology, various software and applications have brought great convenience to people's production and life, but also brought security risks caused by hidden security vulnerabilities in software. Many security vulnerabilities are related to unsafe function calls, including misuse of standard library functions and APIs. By analyzing the trajectory of function calls, unsafe function call patterns can be found, thereby discovering vulnerabilities. At present, there are two main methods for analyzing the trajectory of function calls: static and dynamic. The dynamic analysis method requires running the program. Although the accuracy is high, it has the problem of low code coverage and it is difficult to find vulnerabilities in time. The static analysis method can quickly analyze all function call trajectories in the program based on pre-defined security rules, but because the definition of security rules is difficult to be complete enough, a large number of missed reports and false positives often occur during vulnerability mining, and there are certain difficulties in applying it in actual engineering. Summary of the invention

[0003] The present invention mainly solves the problem of incomplete vulnerability discovery related to unsafe function calls.

[0004] The first aspect of the present invention proposes a human-machine collaborative static vulnerability mining method based on a large model, comprising:

[0005] Use the big model combined with external knowledge base to identify dangerous functions in the program code to be tested;

[0006] The human-computer collaborative method is used to analyze the extracted dangerous function call traces to obtain the target function call traces that are suspected to have vulnerabilities;

[0007] Extract context information related to the vulnerability from the target function call trace that is suspected to have a vulnerability, and fill it into the vulnerability rule template. Use the rules generated after filling to scan the program and complete vulnerability mining.

[0008] As a preferred solution, the method of using a large model in combination with an external knowledge base to identify dangerous functions in the program code to be tested specifically includes:

[0009] Find all function calls in the program code to be tested and filter out standard library functions;

[0010] Perform component analysis on the program code to be tested and determine the development framework and dependent libraries used by the program to be analyzed;

[0011] Use a large model to analyze the development framework and dependent libraries, identify the APIs related to the vulnerability, and filter out the main calling functions of the corresponding APIs from all function calls;

[0012] Use a large model to identify the functions of the selected standard library functions and API main calling functions to determine whether they are sensitive functions in the program to be tested;

[0013] Summarize the selected standard library functions, API main calling functions and sensitive functions to obtain all dangerous functions.

[0014] As a preferred solution, the method of using human-computer collaboration to analyze the extracted dangerous function call traces to obtain the target function call traces suspected of having vulnerabilities specifically includes:

[0015] Generate a function call graph and determine the entry point and execution scope of symbolic execution with the target function call as the center;

[0016] Generate target function call traces using constrained symbolic execution;

[0017] Perform feature encoding on the generated target function call trace;

[0018] Active learning is used to learn feature vectors and score the possibility of vulnerabilities in the target function call trace;

[0019] Function call traces with scores higher than a preset threshold are regarded as target function call traces suspected of having vulnerabilities.

[0020] As a preferred solution, the method of generating a target function call trace by using symbolic execution under constraints specifically includes:

[0021] Symbolic execution starts from the entry point function, using symbolic variables as function parameters; when encountering a function call, if the function is within the specified symbolic execution range, the function is entered; otherwise, the call instruction is ignored and a symbolic value is generated as the return value of the call, thereby generating a call trace of the target function.

[0022] As a preferred solution, the active learning method is used to learn the feature vector and score the possibility of vulnerabilities in the target function call trace, which specifically includes:

[0023] Before finding a positive sample, the feature vector of the most remote negative sample is fed back to the user to determine whether it has a vulnerability, thereby changing the probability distribution of the vulnerability sample in the feature space;

[0024] After finding the positive sample, select the sample closest to the positive sample and farthest from the negative sample and feed it back to the user to determine whether it has a vulnerability, thereby changing the probability distribution of the vulnerability sample in the feature space;

[0025] Repeat the process of changing the probability distribution of vulnerability samples in the feature space until the required number of samples are analyzed;

[0026] The probability of a vulnerability existing in each function call trace is calculated and scored based on the probability distribution of the vulnerability samples.

[0027] As a preferred solution, the vulnerability rule template includes:

[0028] Vulnerability verification templates, corresponding verification templates written for different types of vulnerabilities;

[0029] Taint analysis template, which defines taint propagation rules and is used to verify the accessibility of vulnerabilities.

[0030] As a preferred solution, the verification of the vulnerability verification template includes:

[0031] Make a preliminary judgment on the vulnerability type of the target function call trace that is suspected to have a vulnerability;

[0032] Select a corresponding vulnerability verification template and fill it in according to the context information of the target function call trace that is suspected to have a vulnerability;

[0033] Use the filled vulnerability verification template to generate customized vulnerability mining rules to scan the program and confirm the existence of the vulnerability.

[0034] As a preferred solution, verification using the stain analysis template includes:

[0035] Fill in the sources and drains in the taint analysis template based on the context information of the target function call trace that is suspected to have a vulnerability;

[0036] Run the filled taint analysis rules to determine whether there is a taint propagation path between the source and the drain, so as to determine whether the target function call with suspected vulnerability will be affected by untrusted user input and complete the accessibility verification of the vulnerability.

[0037] As a preferred solution, the standard library function is a standard library function defined in the C language standard document that implements memory allocation and copying, string operations, and file operations; the API's main calling function includes the API's main calling function related to functions such as data reading, network communication, and system calls; the sensitive function is a sensitive function that implements network communication and data interaction functions.

[0038] The second aspect of the present invention proposes a large-model-based function call trace vulnerability human-machine collaborative mining system, including a memory and a processor, wherein the memory stores a computer program corresponding to the large-model-based human-machine collaborative static vulnerability mining method described in the first aspect that can be loaded and executed by the processor.

[0039] The present invention uses the call trace of dangerous functions as the starting point for vulnerability mining, uses a large model, and adopts a human-computer collaborative approach to incorporate vulnerability miners into the loop of static vulnerability mining, giving full play to the vulnerability miners' cognitive advantages in the mechanism of vulnerability generation to improve the efficiency and accuracy of vulnerability mining. It can cover vulnerability types such as buffer overflow, null pointer reference, memory leak, etc. Compared with the existing technology, it has the following beneficial effects and advantages:

[0040] 1. Use the big model to accurately identify dangerous functions in the program and select the functions that need to be focused on in the later vulnerability mining process, thereby effectively improving the efficiency of vulnerability mining;

[0041] 2. Introducing the idea of ​​human-computer collaboration, with the assistance of active learning algorithms, fully utilizing the user's experience and knowledge to screen out function calls in the program that may cause vulnerabilities with the least number of steps, which not only ensures the accuracy of vulnerability mining, but also improves the efficiency of vulnerability mining;

[0042] 3. The vulnerability miner extracts key information related to the vulnerability from the dangerous function call path where the vulnerability is suspected to exist and fills in the pre-defined vulnerability rule template to form customized vulnerability mining rules for vulnerability confirmation, which can effectively alleviate the problem of high false alarm rate of traditional rule-based static vulnerability detection methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is a flow chart of the large-model-based human-machine collaborative static vulnerability mining method proposed in the present invention.

[0044] Figure 2 The figure is a flowchart of risk function identification in one embodiment of the present invention.

[0045] Figure 3 This is a schematic diagram of function call trajectory analysis based on human-computer collaboration in one embodiment of the present invention.

[0046] Figure 4 Schematic diagram of vulnerability existence and reachability confirmation in one embodiment of the present invention. DETAILED DESCRIPTION

[0047] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar modules or modules with the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be construed as limitations on the present application. On the contrary, the embodiments of the present application include all changes, modifications and equivalents that fall within the spirit and connotation of the appended claims.

[0048] Detecting and repairing possible vulnerabilities in software at various stages of the software development life cycle is of great significance to improving the security of software. By analyzing the function call trace, it is possible to timely discover vulnerabilities caused by unsafe function calls, and discover a series of security issues such as buffer overflows, null pointer references, and memory leaks that may exist in the program. The embodiment of the present invention proposes a human-machine collaborative static vulnerability mining method based on a large model. First, a large model is used to identify dangerous functions related to known vulnerabilities in the source code, and then a static analysis algorithm is used to learn the function call characteristics of the above dangerous functions when the vulnerabilities are caused from human feedback. Since the learning process of the algorithm is based on human feedback during the analysis process, there is no need to provide a large number of unsafe function call samples in advance to train the model. The algorithm can score the possibility of vulnerabilities in the function call trace based on human feedback, thereby discovering suspected vulnerabilities. In addition, in order to further ensure the accuracy of the vulnerability mining results, for function call traces with a high possibility of vulnerabilities, context information is extracted from them to fill in the vulnerability rule template, and the program is scanned using the rules generated after filling, so as to further confirm the existence and accessibility of the vulnerability. Please refer to Figure 1 , the specific plan is as follows:

[0049] Step 1: Use the big model in combination with the external knowledge base to identify dangerous functions in the program code under test that may cause vulnerabilities.

[0050] Before exploring vulnerabilities related to unsafe function calls, we first need to conduct a preliminary analysis of which functions may cause vulnerabilities during the calling process. In the subsequent vulnerability mining process, we should focus on analyzing the calling trajectories of these functions to avoid the problem of path explosion.

[0051] Please refer to Figure 2 , this embodiment provides a specific risk function identification process:

[0052] (1) Find all function calls in the program.

[0053] (2) Screen out standard library functions that are likely to cause security vulnerabilities from all function calls. In this embodiment, the standard library functions defined in the C language standard document that implement functions such as memory allocation and copying, string operations, and file operations are mainly included.

[0054] (3) Perform component analysis on the program to be analyzed, determine the development framework and dependent libraries used by the program to be analyzed, and obtain the development framework and dependent library documentation.

[0055] (4) Use the big model to analyze the above development framework and dependent library documents to determine the main calling functions of the vulnerability-related APIs. In this embodiment, the main calling functions of the vulnerability-related APIs mainly include the main calling functions of APIs related to functions such as data reading, network communication, and system calls. The main calling functions of such APIs are prone to cause security vulnerabilities. The main calling functions of general standard library functions and APIs refer to the custom functions in the program that call standard library functions or APIs.

[0056] (5) Use the large model to perform functional identification on the selected standard library functions and API main calling functions, determine whether they are sensitive functions that implement network communication, data interaction, etc. in the program to be analyzed, and filter out sensitive function calls from all function calls. In this embodiment, sensitive functions are a subset of standard library functions and API main calling functions, and their functions are usually network communication, data interaction, etc.

[0057] (6) According to different vulnerability mining requirements, the function calls screened in (2), (4), and (5) are summarized to form dangerous functions as the analysis object of the human-computer collaborative algorithm. That is, in this embodiment, the dangerous functions used for subsequent analysis include standard library functions that are prone to cause security vulnerabilities, main calling functions of APIs that are prone to cause security vulnerabilities, and sensitive functions customized in the program.

[0058] Step 2: Use a human-computer collaborative method to analyze the extracted dangerous function call traces to obtain the target function call traces that are suspected to have vulnerabilities.

[0059] After the dangerous functions in the program are identified, in this embodiment, the human-computer collaborative method is used to analyze the function call trace. First, the program is compiled into LLVM bit code, and then the symbolic execution under constraints is used to generate the call trace of the target function and encode these function call traces into feature vectors. Then, the active learning method is used to obtain the target function call trace that is suspected to have vulnerabilities.

[0060] Please refer to Figure 3 ,The trajectory analysis process using the human-computer collaborative method specifically includes:

[0061] (1) Generate a program call graph.

[0062] In this embodiment, a reverse breadth-first search algorithm (ReverseBFS) is used to search for functions within a certain distance from the target function call in the function call graph, with the target function call as the center, so as to determine the entry point and execution range of the symbolic execution.

[0063] (2) Perform symbolic execution starting from the entry point function, using symbolic variables as function parameters.

[0064] When a function call is encountered, if the function is within the determined symbolic execution range, the function is entered; otherwise, the call instruction is ignored and a symbolic value is generated as the return value of the call, thereby generating a call trace of the target function.

[0065] (3) Perform feature encoding on the generated function call trajectory to generate a trajectory feature vector.

[0066] In this embodiment, the meaning of each feature dimension can be pre-defined by vulnerability mining experts, covering most behaviors related to API usage, and supporting user extensions, and can be used to characterize unsafe calls to functions and APIs.

[0067] (4) Use active learning algorithms to learn trajectory feature vectors, and learn the patterns of function call trajectory features that may have vulnerabilities from user feedback. Screen a batch of dangerous function call trajectories that are suspected of having vulnerabilities, and score the possibility of vulnerabilities in the function call trajectories based on user feedback.

[0068] In order to further illustrate the trajectory analysis process, this embodiment also provides a specific scoring process:

[0069] Before finding a positive sample (i.e., a function call trace containing a vulnerability), the feature vector and related code snippet of the most remote negative sample point (i.e., a function call trace that does not contain a vulnerability) are fed back to the user, allowing the vulnerability miner to determine whether it contains a vulnerability, thereby changing the probability distribution of the vulnerability sample in the feature space. After finding a positive sample, select a sample that is as close to the positive sample as possible and as far away from the negative sample as possible and feed it back to the user, allowing the vulnerability miner to determine whether it contains a vulnerability, thereby changing the probability distribution of the vulnerability sample in the feature space.

[0070] Repeat the above process until the required number of samples are analyzed. At this time, the possibility of a vulnerability in each function call trace is calculated and scored according to the probability distribution of the final vulnerability sample. The function call trace with a score higher than the threshold is returned, which is the target function call trace suspected of having a vulnerability.

[0071] Step 3: Extract context information related to the vulnerability from the target function call trace where the vulnerability is suspected to exist, and fill it into the vulnerability rule template. Use the rules generated after filling to scan the program and complete the vulnerability mining.

[0072] After using the human-computer collaborative method to analyze the call traces of dangerous functions and screen out the function call traces suspected of having vulnerabilities, in order to further ensure the accuracy of the vulnerability mining results, please refer to Figure 4 ,This embodiment extracts context information such as file name, code line number and related variables related to the vulnerability from the screened function call traces suspected of having vulnerabilities, fills in the vulnerability rule template, and uses the rules generated after filling to scan the program, so as to further confirm the existence and reachability of the vulnerability.

[0073] When verifying the existence and reachability of vulnerabilities, it is necessary to write a vulnerability rule template. In this embodiment, it mainly includes two types: vulnerability verification template and taint analysis template. The vulnerability miner completes the selection of vulnerability rule template. Among them, the vulnerability verification template is a corresponding verification template written for different types of vulnerabilities. For example, for integer overflow vulnerabilities, the calculation method of the value range of a specific variable in the program can be defined in the template, but the specific variable name and data type are not specified. The taint analysis template is used to verify the reachability of the vulnerability. The taint propagation rules are defined in the template, but the variables corresponding to the source and drain are not specified.

[0074] After completing the vulnerability rule template, you can determine whether the function call trace returned by the active learning algorithm contains a vulnerability. The verification process for the vulnerability verification template is as follows:

[0075] Make a preliminary judgment on the vulnerability type, select the corresponding vulnerability verification template, and fill it in according to the context information in the function call trace of the suspected vulnerability. Use the filled rule template to generate customized vulnerability mining rules to scan the program, so as to further confirm the existence of the vulnerability.

[0076] The verification process for the taint analysis template is as follows:

[0077] Fill in the source and drain in the taint analysis template according to the context information in the function call trace of the suspected vulnerability. Run the filled taint analysis rules to determine whether there is a taint propagation path between the source and the drain, so as to determine whether the function call suspected of having a vulnerability can be affected by untrusted user input and verify the accessibility of the vulnerability.

[0078] The present invention uses the call trace of dangerous functions as the starting point for vulnerability mining, uses a large model, and adopts a human-computer collaborative approach to incorporate vulnerability miners into the loop of static vulnerability mining, giving full play to the vulnerability miners' cognitive advantages in the mechanism of vulnerability generation to improve the efficiency and accuracy of vulnerability mining. It can cover vulnerability types such as buffer overflow, null pointer reference, memory leak, etc. Compared with the existing technology, it has the following beneficial effects and advantages:

[0079] 1. Use the big model to accurately identify dangerous functions in the program and select the functions that need to be focused on in the later vulnerability mining process, thereby effectively improving the efficiency of vulnerability mining;

[0080] 2. Introducing the idea of ​​human-computer collaboration, with the assistance of active learning algorithms, fully utilizing experience knowledge to screen out function calls in the program that may cause vulnerabilities with the least steps, which not only ensures the accuracy of vulnerability mining, but also improves the efficiency of vulnerability mining;

[0081] 3. The vulnerability miner extracts key information related to the vulnerability from the dangerous function call path where the vulnerability is suspected to exist and fills in the pre-defined vulnerability rule template to form customized vulnerability mining rules for vulnerability confirmation, which can effectively alleviate the problem of high false alarm rate of traditional rule-based static vulnerability detection methods.

[0082] An embodiment of the present invention also proposes a large-model-based function call trace vulnerability human-machine collaborative mining system, including a memory and a processor, wherein the memory stores a computer program corresponding to the aforementioned large-model-based human-machine collaborative static vulnerability mining method that can be loaded and executed by the processor.

[0083] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer readable medium, and the computer program includes a program code for executing the method shown in the flowchart.

[0084] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0085] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0086] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not constitute limitations on the units themselves in some cases.

[0087] As another aspect, the present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the large model-based human-computer collaborative static vulnerability mining method described in the above embodiment.

[0088] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the large model-based human-computer collaborative static vulnerability mining method described in the above embodiment.

[0089] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0090] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software, or by combining software with necessary hardware. Therefore, the technical solution according to the implementation method of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation method of the present application.

[0091] For those skilled in the art, the specific meanings of the above terms in the present invention can be understood in specific situations; the drawings in the embodiments are used to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0092] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A human-machine collaborative static vulnerability mining method based on a large model, characterized in that: include: Use the big model combined with external knowledge base to identify dangerous functions in the program code to be tested; The human-computer collaborative method is used to analyze the extracted dangerous function call traces to obtain the target function call traces that are suspected to have vulnerabilities; Extract context information related to the vulnerability from the target function call trace that is suspected to have a vulnerability, and fill it into the vulnerability rule template. Use the rules generated after filling to scan the program and complete vulnerability mining. The method of using a large model in combination with an external knowledge base to identify dangerous functions in the program code to be tested specifically includes: Find all function calls in the program code to be tested and filter out standard library functions; perform component analysis on the program code to be tested and determine the development framework and dependent libraries used by the program to be analyzed; Use the big model to analyze the determined development framework and dependent libraries, determine the APIs related to the vulnerability, and filter out the corresponding API main calling functions from all function calls; use the big model to perform functional identification on the filtered standard library functions and API main calling functions to determine whether they are sensitive functions in the program to be tested; summarize the filtered standard library functions, API main calling functions and sensitive functions to obtain all dangerous functions; The method of adopting human-computer collaboration to analyze the extracted dangerous function call traces to obtain the target function call traces suspected of having vulnerabilities specifically includes: Generate a function call graph, and determine the entry point and execution scope of symbolic execution with the target function call as the center; generate the target function call trajectory using symbolic execution under constraints; perform feature encoding on the generated target function call trajectory; use active learning to learn the feature vector and score the possibility of vulnerabilities in the target function call trajectory; regard the function call trajectory with a score higher than the preset threshold as the target function call trajectory suspected of having vulnerabilities; The generating of the target function call trace by using the symbolic execution under the constraint specifically includes: Symbolic execution starts from the entry point function, using symbolic variables as function parameters; when a function call is encountered, if the function is within the specified symbolic execution scope, the function is entered; otherwise, the call instruction is ignored and a symbolic value is generated as the return value of the call, thereby generating a call trace of the target function; The method adopts active learning to learn feature vectors and scores the possibility of vulnerabilities in target function call traces, specifically including: before finding a positive sample, feeding back the feature vector of the most remote negative sample to a user to determine whether it has a vulnerability, thereby changing the probability distribution of vulnerability samples in the feature space; after finding a positive sample, selecting a sample that is closest to the positive sample and farthest from the negative sample to feed back to the user to determine whether it has a vulnerability, thereby changing the probability distribution of vulnerability samples in the feature space; repeating the process of changing the probability distribution of vulnerability samples in the feature space until the required number of samples is analyzed; and calculating the possibility of vulnerabilities in each function call trace according to the probability distribution of the vulnerability samples for scoring.

2. The method for human-machine collaborative static vulnerability mining based on a large model according to claim 1 is characterized in that: The vulnerability rule template includes: Vulnerability verification templates, corresponding verification templates written for different types of vulnerabilities; Taint analysis template, which defines taint propagation rules and is used to verify the accessibility of vulnerabilities.

3. The method for human-machine collaborative static vulnerability mining based on a large model according to claim 2 is characterized in that: The validation of the exploit validation template includes: Make a preliminary judgment on the vulnerability type of the target function call trace that is suspected to have a vulnerability; Select a corresponding vulnerability verification template and fill it in according to the context information of the target function call trace that is suspected to have a vulnerability; Use the filled vulnerability verification template to generate customized vulnerability mining rules to scan the program and confirm the existence of the vulnerability.

4. The method for human-machine collaborative static vulnerability mining based on a large model according to claim 2 is characterized in that: Validation using the taint analysis template includes: Fill in the sources and drains in the taint analysis template based on the context information of the target function call trace that is suspected to have a vulnerability; Run the filled taint analysis rules to determine whether there is a taint propagation path between the source and the drain, so as to determine whether the target function call with suspected vulnerability will be affected by untrusted user input and complete the accessibility verification of the vulnerability.

5. The method for human-machine collaborative static vulnerability mining based on a large model according to claim 1 is characterized in that: The standard library functions are standard library functions defined in the C language standard document that implement memory allocation and copying, string operations or file operations; the main calling functions of the API include the main calling functions of the API related to data reading, network communication or system call functions; the sensitive functions are sensitive functions that implement network communication or data interaction functions.

6. A human-machine collaborative static vulnerability mining system based on a large model, characterized in that: It includes a memory and a processor, wherein the memory stores a computer program corresponding to the large model-based human-computer collaborative static vulnerability mining method according to any one of claims 1 to 5 that can be loaded and executed by the processor.

Images