A code vulnerability repair method based on static program analysis

Abstract

The present application provides a code vulnerability repair method based on static program analysis, which relates to the technical field of code vulnerability repair, and obtains basic vulnerability information of a target code; extracts a vulnerability pollution path, performs node extraction on the vulnerability pollution path, obtains multiple pollution propagation nodes, and determines the logical code information of each pollution propagation node through the target code; performs semantic extraction on each logical code information, obtains a code semantic feature vector of each pollution propagation node, performs neighborhood encoding on each code semantic feature vector, obtains a corresponding code context representation, and generates a logical code context of the target code according to all the code context representations; performs vulnerability repair on the target code based on a large language model, a vulnerability pollution path, and a logical code context. The present application can use static program analysis to improve the context quality required for vulnerability repair, so as to improve the quality of the generation result of the large language model in the process of code vulnerability repair.

Description

Technical Field

[0001] The present application relates to the technical field of code vulnerability repair, and more specifically, to a code vulnerability repair method based on static program analysis. Background Art

[0002] Code vulnerability repair based on static program analysis is a technical means to identify potential vulnerabilities in the code through comprehensive static analysis of the source code and provide corresponding repair suggestions. Using static analysis technology, developers can discover and repair potential vulnerabilities in the early stages of software development, thereby reducing the risks of later testing and runtime.

[0003] With the development of large language models in recent years, their application in the field of software engineering has become more and more extensive. One of the important applications is to use large language models to repair code vulnerabilities. In the process of using large language models, in addition to the model's own capabilities, the quality of the generated results depends largely on the quality of the input. Therefore, how to use static program analysis to improve the quality of the context required for vulnerability repair, so as to improve the quality of the generated results of large language models in the process of code vulnerability repair, is a difficult problem faced by the industry. Summary of the invention

[0004] The present application provides a code vulnerability repair method based on static program analysis, which can utilize static program analysis to improve the quality of context required for vulnerability repair, so as to improve the quality of generation results of a large language model during the code vulnerability repair process.

[0005] The present application provides a code vulnerability repair method based on static program analysis, the repair method comprising the following steps:

[0006] Use static program analysis tools to scan the target code for vulnerabilities and obtain basic vulnerability information of the target code;

[0007] Extracting a vulnerability contamination path from the basic vulnerability information, performing node extraction on the vulnerability contamination path to obtain a plurality of contamination propagation nodes of the vulnerability contamination path, and determining logic code information of each contamination propagation node through a target code;

[0008] Semantically extract the logical code information of each pollution propagation node, and then obtain the code semantic feature vector of each pollution propagation node. Perform neighborhood encoding on each code semantic feature vector to obtain the code context representation corresponding to each pollution propagation node. Generate the logical code context of the target code based on all the code context representations.

[0009] A pre-trained large language model is obtained, and vulnerability repair is performed on the target code based on the large language model, the vulnerability contamination path, and the logic code context.

[0010] In this embodiment, a static program analysis tool is selected according to the language type of the target code.

[0011] In this embodiment, the basic vulnerability information of the target code includes the source of the pollution point, the vulnerability pollution path, the filtering function and the pollution outbreak point.

[0012] In this embodiment, the node extraction is performed on the vulnerability contamination path to obtain multiple contamination propagation nodes of the vulnerability contamination path, specifically including:

[0013] For each propagation node in the vulnerability pollution path, obtaining a processing function of the propagation node;

[0014] Extracting the processing result of the processing function on the contaminated data;

[0015] Determine the node outlier value corresponding to the propagation node according to the processing result, and then obtain the node outlier value of each propagation node in the vulnerability contamination path;

[0016] A plurality of pollution propagation nodes of the vulnerability pollution path are screened out according to all node outliers.

[0017] In this embodiment, determining the logic code information of each pollution propagation node through the target code specifically includes:

[0018] For each pollution propagation node, the logic code of the pollution propagation node is extracted from the target code, and the logic code is used as the logic code information of the pollution propagation node, thereby obtaining the logic code information of each pollution propagation node.

[0019] In this embodiment, semantic extraction is performed on the logic code information of each pollution propagation node, and the code semantic feature vector of each pollution propagation node is obtained, which specifically includes:

[0020] For the logic code information of each pollution propagation node, the logic code information is structurally transformed to obtain the logic code information after the structural transformation;

[0021] Extracting semantic features from the logic code information after the structural conversion, and then obtaining data flow features, control flow features and security features corresponding to the pollution propagation nodes;

[0022] The code semantic feature vector of the pollution propagation node is constructed by using the data flow feature, the control flow feature and the security feature, and then the code semantic feature vector of each pollution propagation node is obtained.

[0023] In this embodiment, neighborhood coding is performed on each code semantic feature vector to obtain the code context representation corresponding to each pollution propagation node, which specifically includes:

[0024] Get the deep learning model;

[0025] For each pollution propagation node, inputting the code semantic feature vector of the pollution propagation node into the deep learning model to encode neighborhood information, thereby obtaining a code neighborhood representation of the pollution propagation node;

[0026] The decoder in the deep learning model is used to decode the code neighborhood representation to obtain the code context representation corresponding to the pollution propagation node, and then the code context representation corresponding to each pollution propagation node is obtained.

[0027] In this embodiment, generating the logical code context of the target code according to all the code context representations is to use the information set composed of all the code context representations as the logical code context of the target code.

[0028] In this embodiment, the large language model refers to the Codex large language model.

[0029] In this embodiment, performing vulnerability repair on the target code based on the large language model, the vulnerability contamination path and the logical code context is to input the vulnerability contamination path and the logical code context into the large language model to generate vulnerability repair suggestions for the target code.

[0030] The technical solution provided by the embodiments disclosed in this application has the following beneficial effects:

[0031] The target code is scanned for vulnerabilities by using a static program analysis tool to obtain basic vulnerability information of the target code; the vulnerability contamination path is extracted from the basic vulnerability information, nodes are extracted from the vulnerability contamination path, multiple contamination propagation nodes of the vulnerability contamination path are obtained, and the logical code information of each contamination propagation node is determined through the target code; semantic extraction is performed on the logical code information of each contamination propagation node to obtain the code semantic feature vector of each contamination propagation node, neighborhood encoding is performed on each code semantic feature vector to obtain the code context representation corresponding to each contamination propagation node, and the logical code context of the target code is generated according to all the code context representations; a pre-trained large language model is obtained, and the target code is repaired based on the large language model, the vulnerability contamination path and the logical code context.

[0032] It can be seen that in this application, firstly, extracting the vulnerability contamination path and identifying the contamination propagation nodes through static program analysis helps to accurately locate the vulnerability, and by extracting the logical code information of the contamination propagation nodes in detail, it is ensured that the large language model can obtain the specific operations, data dependencies, potential risks and other information of each contamination propagation node; then, using semantic extraction and neighborhood coding technology to ensure that the semantic information of all contamination propagation nodes is accurately transmitted, the loss of vulnerability context can be avoided, and by combining all code context representations into an overall logical code context, the large language model can be provided with information on the entire vulnerability propagation chain; finally, by inputting the vulnerability contamination path and logical code context into the large language model, it can help understand the vulnerability propagation chain and code logic, and ensure that the generated repair suggestions match the actual situation of the target code, so as to improve the quality of the generation results of the large language model during the code vulnerability repair process.

[0033] In summary, the technical solution adopted in this application can use static program analysis to improve the quality of the context required for vulnerability repair, so as to improve the quality of the generation results of the large language model during the code vulnerability repair process. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0035] Figure 1 is an exemplary flow chart of a code vulnerability repair method based on static program analysis provided by the present application;

[0036] Figure 2 is an exemplary flow chart of determining multiple pollution propagation nodes of a vulnerability pollution path provided by the present application;

[0037] Figure 3 It is an exemplary flow chart for determining the code semantic feature vector of each pollution propagation node provided by the present application. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0039] The embodiment of the present application provides a code vulnerability repair method based on static program analysis, the core of which is to use a static program analysis tool to perform vulnerability scanning on the target code to obtain basic vulnerability information of the target code; extract the vulnerability pollution path from the basic vulnerability information, perform node extraction on the vulnerability pollution path, obtain multiple pollution propagation nodes of the vulnerability pollution path, and determine the logical code information of each pollution propagation node through the target code; perform semantic extraction on the logical code information of each pollution propagation node respectively, and then obtain the code semantic feature vector of each pollution propagation node, perform neighborhood encoding on each code semantic feature vector, obtain the code context representation corresponding to each pollution propagation node, and generate the logical code context of the target code according to all the code context representations; obtain a pre-trained large language model, and perform vulnerability repair on the target code based on the large language model, the vulnerability pollution path and the logical code context. The above scheme can be used to improve the context quality required for vulnerability repair by using static program analysis, so as to improve the quality of the generation result of the large language model in the process of code vulnerability repair.

[0040] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods. Figure 1 As shown in FIG. 1 , this figure is an exemplary flow chart of a code vulnerability repair method based on static program analysis according to this embodiment of the present application, and the repair method includes the following steps:

[0041] In step S1, a static program analysis tool is used to scan the target code for vulnerabilities to obtain basic vulnerability information of the target code.

[0042] In the specific implementation, first, a static program analysis tool can be selected according to the language type of the target code; then, the target code is scanned for vulnerabilities using the selected static program analysis tool, that is, all potential sources of contamination points in the target code (such as user input, external data, etc.), the data propagation path in the code is tracked, the validity of the filter function is analyzed, and the outbreak point of the contaminated data in the code is located, so as to obtain the basic vulnerability information of the target code.

[0043] It should be noted that in this application, the basic vulnerability information of the target code includes the source of the pollution point, the vulnerability pollution path, the filter function and the pollution outbreak point; among them, the pollution point source refers to the starting point of untrusted or malicious input data in the program; the vulnerability pollution path refers to the data flow path from the pollution point source to the vulnerability outbreak point; the filter function refers to the function that verifies, cleans or transforms the input data, which is usually used to prevent malicious data from entering the system through the pollution point and causing security vulnerabilities; the pollution outbreak point refers to the place where the polluted data finally triggers a vulnerability or security issue.

[0044] In step S2, a vulnerability contamination path is extracted from the basic vulnerability information, nodes are extracted from the vulnerability contamination path, a plurality of contamination propagation nodes of the vulnerability contamination path are obtained, and the logic code information of each contamination propagation node is determined through the target code.

[0045] In specific implementation, the vulnerability contamination path can be extracted from the basic vulnerability information by traversal.

[0046] Preferably, in this embodiment, reference Figure 2 As shown, this figure is an exemplary flow chart of determining multiple pollution propagation nodes of a vulnerability pollution path in an embodiment of the present application. In this embodiment, node extraction is performed on the vulnerability pollution path to obtain multiple pollution propagation nodes of the vulnerability pollution path, which can be specifically implemented by the following steps:

[0047] First, in step S21, for each propagation node in the vulnerability contamination path, a processing function of the propagation node is obtained;

[0048] Then, in step S22, the processing result of the processing function on the contaminated data is extracted;

[0049] Secondly, in step S23, the node outlier value corresponding to the propagation node is determined according to the processing result, and then the node outlier value of each propagation node in the vulnerability contamination path is obtained;

[0050] Finally, in step S24, multiple pollution propagation nodes of the vulnerability pollution path are screened out according to all node abnormal values.

[0051] In the specific implementation, first, for each propagation node in the vulnerability contamination path, the processing function of the propagation node is obtained, that is, the filtering function of the propagation node can be used as the processing function of the propagation node. Each propagation node usually involves a processing function. Especially in the function call, the data is often passed to the processing function through parameters; then, the processing result of the processing function on the contaminated data can be extracted. The processing result includes the number of times and the processing method of the processing function on the contaminated data. The contaminated data processing process of the processing function can be analyzed through static program analysis tools, that is, whether the processing function verifies, cleans and transforms the contaminated data, for example, check whether there are type conversion, range check, format verification and other operations, and whether unsafe data are filtered out. The node anomaly value corresponding to the propagation node can be determined according to the processing result. The node anomaly value is an indicator for measuring the degree of abnormality of the propagation node. The ratio of the number of times the contaminated data is processed to the total number of times the contaminated data is transmitted in the processing result can be used as the node anomaly value corresponding to the propagation node. The node anomaly value of each propagation node in the vulnerability contamination path can be obtained in the above manner. Finally, multiple contaminated propagation nodes of the vulnerability contamination path can be screened out based on all the node anomaly values. An anomaly threshold can be set through expert knowledge and historical experience, so that the propagation node with a node anomaly value higher than the anomaly threshold can be used as a contaminated propagation node. The contaminated propagation node represents the abnormal propagation node that causes a security vulnerability in the target code.

[0052] In this embodiment, the logic code information of each pollution propagation node can be determined by the target code in the following manner, namely:

[0053] For each pollution propagation node, the logic code of the pollution propagation node is extracted from the target code, and the logic code is used as the logic code information of the pollution propagation node, thereby obtaining the logic code information of each pollution propagation node.

[0054] In the specific implementation, for each pollution propagation node, by locating the specific code position of each pollution propagation node in the target code, use the static innovation analysis tool to extract the logic code of the position, and use the logic code as the logic code information of the pollution propagation node. The logic code information includes code structure, data dependency, data operation and conditional judgment. The logic code information of each pollution propagation node can be obtained in the above way.

[0055] It should be noted that extracting vulnerability contamination paths and identifying contamination propagation nodes through static program analysis helps to accurately locate vulnerabilities, and by extracting the logical code information of contamination propagation nodes in detail, it ensures that the large language model can obtain the specific operations, data dependencies, potential risks and other information of each contamination propagation node.

[0056] In step S3, semantic extraction is performed on the logical code information of each pollution propagation node to obtain the code semantic feature vector of each pollution propagation node, and neighborhood encoding is performed on each code semantic feature vector to obtain the code context representation corresponding to each pollution propagation node. The logical code context of the target code is generated based on all the code context representations.

[0057] Preferably, in this embodiment, reference Figure 3 As shown in FIG. 1 , this figure is an exemplary flow chart of determining the code semantic feature vector of each pollution propagation node in an embodiment of the present application. In this embodiment, the logical code information of each pollution propagation node is semantically extracted respectively, and then the code semantic feature vector of each pollution propagation node is obtained, which can be specifically implemented by the following steps:

[0058] First, in step S31, for the logic code information of each pollution propagation node, the logic code information is structurally transformed to obtain the logic code information after the structural transformation;

[0059] Then, in step S32, semantic features are extracted from the logic code information after the structural conversion, thereby obtaining data flow features, control flow features and security features corresponding to the pollution propagation node;

[0060] Finally, in step S33, the code semantic feature vector of the pollution propagation node is constructed by using the data flow feature, the control flow feature and the security feature, and then the code semantic feature vector of each pollution propagation node is obtained.

[0061] In the specific implementation, first, for the logic code information of each pollution propagation node, the logic code information can be structurally transformed to obtain the logic code information after the structural transformation. The structural transformation is to convert the original logic code information into an abstract structure that is more suitable for semantic extraction. In the present application, the main structural transformation methods include: abstract syntax tree, control flow graph and data flow graph, that is, the logic code information after the structural transformation includes abstract syntax tree, control flow graph and data flow graph; then, semantic feature extraction can be performed on the logic code information after the structural transformation, that is, semantic feature extraction is performed on the data flow graph to obtain the data flow feature corresponding to the pollution propagation node, semantic feature extraction is performed on the control flow graph to obtain the control flow feature corresponding to the pollution propagation node, and the abstract syntax The tree is used to extract semantic features to obtain the security features corresponding to the pollution propagation nodes. Among them, the data flow feature describes how data flows, transfers and transforms in the program. The control flow feature focuses on the selection conditions of different execution paths in the program, especially the control structure of the pollution propagation path (such as if-else, loop, etc.). The security feature mainly involves potential security vulnerabilities and vulnerabilities, especially the security risks related to polluted data. Finally, the code semantic feature vector of the pollution propagation node can be constructed through the data flow features, control flow features and security features. The feature vector composed of data flow features, control flow features and security features is used as the code semantic feature vector of the pollution propagation node. The code semantic feature vector of each pollution propagation node can be obtained in the above way.

[0062] In this embodiment, neighborhood coding is performed on each code semantic feature vector to obtain the code context representation corresponding to each pollution propagation node. Specifically, the following method can be used, namely:

[0063] Get the deep learning model;

[0064] For each pollution propagation node, inputting the code semantic feature vector of the pollution propagation node into the deep learning model to encode neighborhood information, thereby obtaining a code neighborhood representation of the pollution propagation node;

[0065] The decoder in the deep learning model is used to decode the code neighborhood representation to obtain the code context representation corresponding to the pollution propagation node, and then the code context representation corresponding to each pollution propagation node is obtained.

[0066] In the specific implementation, first, it is necessary to select a deep learning model suitable for processing code semantic feature vectors. The deep learning model selected in this application is a two-layer BiLSTM. Other deep learning models can also be selected in actual implementation, which is not limited here; then, for each pollution propagation node, the code semantic feature vector of the pollution propagation node is input into the deep learning model for neighborhood information encoding, so as to obtain the code neighborhood representation of the pollution propagation node. The code neighborhood representation is a comprehensive representation of the pollution propagation node information and the neighborhood context information. In the deep learning model, according to the selected network architecture, through the neighborhood context information, the deep learning model can extract additional information from the neighborhood information. For the code, the neighborhood information is not only the characteristics of the node itself, but also includes the upstream and downstream nodes related to the node, the control flow path, the data dependency, etc.; finally, the decoder in the deep learning model can be used to decode the code neighborhood representation to obtain the code context representation corresponding to the pollution propagation node. The code neighborhood representation can be converted into a more understandable form through decoding, that is, the code context representation. The code context representation is the code neighborhood representation after decoding. The code context representation corresponding to each pollution propagation node can be obtained in the above manner.

[0067] In this embodiment, the logical code context of the target code generated based on all code context representations is an information set composed of all code context representations as the logical code context of the target code; it should be noted that, in this application, the logical code context is context information for vulnerability repair generated for the target code based on static program analysis.

[0068] It should be noted that the use of semantic extraction and neighborhood coding technology ensures that the semantic information of all pollution propagation nodes is accurately transmitted, which can avoid the loss of vulnerability context. The semantic feature vector of each pollution propagation node contains data flow, control flow and security features, ensuring that all core information related to the vulnerability is captured. By combining all code context representations into an overall logical code context, the large language model can be provided with information on the entire vulnerability propagation chain, which helps the large language model generate a repair plan with a global perspective rather than a one-sided local repair.

[0069] In step S4, a pre-trained large language model is obtained, and the target code is repaired based on the large language model, the vulnerability contamination path, and the logic code context.

[0070] In this embodiment, the large language model refers to the Codex large language model; it should be noted that Codex is a large language model developed by OpenAI specifically for code generation and understanding. Codex performs well in code generation tasks in multiple programming languages, especially in code completion, automatic repair, code translation, etc. Codex can analyze existing code and make repair suggestions to help developers correct errors in the code.

[0071] In this embodiment, performing vulnerability repair on the target code based on the large language model, the vulnerability contamination path and the logical code context is to input the vulnerability contamination path and the logical code context into the large language model to generate vulnerability repair suggestions for the target code; in specific implementation, the large language model will analyze the vulnerability contamination path and the logical code context, and combine the vulnerability repair patterns learned from its pre-training data to generate code repair suggestions, for example, adding input verification code to the critical path, introducing filtering functions at the nodes of the propagation path, and modifying the calling logic of the outbreak point to ensure safe execution. Finally, the large language model returns the repair code snippet and modification suggestions, which the developer can directly apply or further modify.

[0072] It should be noted that by inputting the vulnerability pollution path and logical code context into the large language model, it can help understand the vulnerability propagation chain and code logic, and ensure that the generated repair suggestions match the actual situation of the target code.

[0073] It can be seen that in this application, firstly, extracting the vulnerability contamination path and identifying the contamination propagation nodes through static program analysis helps to accurately locate the vulnerability, and by extracting the logical code information of the contamination propagation nodes in detail, it is ensured that the large language model can obtain the specific operations, data dependencies, potential risks and other information of each contamination propagation node; then, using semantic extraction and neighborhood coding technology to ensure that the semantic information of all contamination propagation nodes is accurately transmitted, the loss of vulnerability context can be avoided, and by combining all code context representations into an overall logical code context, the large language model can be provided with information on the entire vulnerability propagation chain; finally, by inputting the vulnerability contamination path and logical code context into the large language model, it can help understand the vulnerability propagation chain and code logic, and ensure that the generated repair suggestions match the actual situation of the target code, so as to improve the quality of the generation results of the large language model during the code vulnerability repair process.

[0074] In summary, the technical solution adopted in this application can use static program analysis to improve the quality of the context required for vulnerability repair, so as to improve the quality of the generation results of the large language model during the code vulnerability repair process.

[0075] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0076] A person skilled in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, the storage medium including a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically-erasable programmable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0077] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

Claims

1. A code vulnerability repair method based on static program analysis, characterized in that: The repair method comprises the following steps: Use static program analysis tools to scan the target code for vulnerabilities and obtain basic vulnerability information of the target code; Extracting a vulnerability contamination path from the basic vulnerability information, performing node extraction on the vulnerability contamination path to obtain a plurality of contamination propagation nodes of the vulnerability contamination path, and determining logic code information of each contamination propagation node through a target code; Semantically extract the logical code information of each pollution propagation node, and then obtain the code semantic feature vector of each pollution propagation node. Perform neighborhood encoding on each code semantic feature vector to obtain the code context representation corresponding to each pollution propagation node. Generate the logical code context of the target code based on all the code context representations. Obtain a pre-trained large language model, and perform vulnerability repair on the target code based on the large language model, the vulnerability contamination path, and the logic code context; The node extraction of the vulnerability contamination path to obtain multiple contamination propagation nodes of the vulnerability contamination path specifically includes: For each propagation node in the vulnerability pollution path, obtaining a processing function of the propagation node; Extracting the processing result of the processing function on the contaminated data; Determine the node outlier value corresponding to the propagation node according to the processing result, and then obtain the node outlier value of each propagation node in the vulnerability contamination path; Filter out multiple contamination propagation nodes of the vulnerability contamination path based on all node outliers; Among them, each code semantic feature vector is subjected to neighborhood encoding to obtain the code context representation corresponding to each pollution propagation node, which specifically includes: Get the deep learning model; For each pollution propagation node, inputting the code semantic feature vector of the pollution propagation node into the deep learning model to encode neighborhood information, thereby obtaining a code neighborhood representation of the pollution propagation node; The decoder in the deep learning model is used to decode the code neighborhood representation to obtain the code context representation corresponding to the pollution propagation node, and then the code context representation corresponding to each pollution propagation node is obtained.

2. A code vulnerability repair method based on static program analysis as claimed in claim 1, characterized in that: Choose a static program analysis tool based on the language type of the target code.

3. A code vulnerability repair method based on static program analysis as claimed in claim 1, characterized in that: The basic vulnerability information of the target code includes the source of the pollution point, the vulnerability pollution path, the filtering function and the pollution outbreak point.

4. A code vulnerability repair method based on static program analysis as claimed in claim 1, characterized in that: The logical code information of each pollution propagation node determined by the target code specifically includes: For each pollution propagation node, the logic code of the pollution propagation node is extracted from the target code, and the logic code is used as the logic code information of the pollution propagation node, thereby obtaining the logic code information of each pollution propagation node.

5. A code vulnerability repair method based on static program analysis as claimed in claim 1, characterized in that: Semantic extraction is performed on the logical code information of each pollution propagation node, and the code semantic feature vector of each pollution propagation node is obtained, which specifically includes: For the logic code information of each pollution propagation node, the logic code information is structurally transformed to obtain the logic code information after the structural transformation; Extracting semantic features from the logic code information after the structural conversion, and then obtaining data flow features, control flow features and security features corresponding to the pollution propagation nodes; The code semantic feature vector of the pollution propagation node is constructed by using the data flow feature, the control flow feature and the security feature, and then the code semantic feature vector of each pollution propagation node is obtained.

6. A code vulnerability repair method based on static program analysis as claimed in claim 1, characterized in that: The logical code context of the target code is generated according to all the code context representations, that is, the information set composed of all the code context representations is used as the logical code context of the target code.

7. A code vulnerability repair method based on static program analysis as claimed in claim 1, characterized in that: The large language model refers to the Codex large language model.

8. A code vulnerability repair method based on static program analysis as claimed in claim 1, characterized in that: Repairing vulnerabilities in the target code based on the large language model, the vulnerability contamination path and the logical code context is to input the vulnerability contamination path and the logical code context into the large language model to generate vulnerability repair suggestions for the target code.

Images