A Method and System for Constructing an Intelligent Vulnerability Mining Platform Based on a Large Model

Abstract

This application provides a method and system for constructing an intelligent vulnerability mining platform based on a large model. The intelligent vulnerability mining platform systematically identifies and analyzes potential security risks, collects and identifies code segments with security risks, organizes them into risky code segments, identifies target code segments, determines known vulnerabilities, generates context information, captures key events during actual runtime, records real execution paths and state changes, generates dynamic execution trajectories, simulates different paths, generates attack vector paths, predicts unknown vulnerabilities and their credibility scores, tests the prediction results of high-credibility scores, confirms and generates real vulnerability information, records this information in a vulnerability knowledge base, and generates a security report containing vulnerability descriptions, impact scope, risk levels, and remediation suggestions. The technical solution provided in this application improves the accuracy and efficiency of security vulnerability detection in software systems.

Description

Technical Field

[0001] This application relates to the field of large model technology, and in particular to a method and system for constructing an intelligent vulnerability mining platform based on large models. Background Technology

[0002] As codebases continue to grow in size and complexity, ensuring the security of software systems becomes paramount. Whether in enterprise applications or open-source projects, security vulnerabilities can lead to serious risks such as data breaches, system crashes, or malicious exploitation.

[0003] Currently, various vulnerability detection tools and technologies exist on the market, such as static code analysis tools, dynamic analysis tools, and fuzzing tools. These tools detect potential security issues in code using different methods. Static code analysis tools are primarily based on rule matching and pattern recognition, enabling them to discover some common programming errors without running the code; dynamic analysis tools monitor the actual execution of the program to capture abnormal behavior; and fuzzing tools attempt to trigger unforeseen behaviors by inputting random or mutated data into the program.

[0004] While existing solutions can help identify some security issues to a certain extent, they still have several significant drawbacks. First, static analysis tools rely on predefined rule sets, limiting their ability to identify unknown or complex vulnerability characteristics and easily generating a large number of false positives and false negatives. Second, while dynamic analysis tools can capture anomalous behavior in actual operation, their coverage is limited and cannot fully simulate all possible execution paths, resulting in some hidden vulnerabilities going undetected. Finally, although fuzzing tools can improve coverage through extensive mutation testing, their heavy reliance on test case generation and optimization makes it difficult to effectively predict and verify deep-seated, unknown vulnerabilities. Summary of the Invention

[0005] This application provides a method and system for constructing an intelligent vulnerability mining platform based on a large model, in order to solve the problems of insufficient detection accuracy and low efficiency in the prior art.

[0006] In a first aspect, embodiments of this application provide a method for constructing an intelligent vulnerability mining platform based on a large model, including:

[0007] Analyze code snippets collected from different source code repositories, identify code snippets with security risks, and organize them into risky code segments;

[0008] The risky code segment is analyzed to identify target code segments that match common vulnerability characteristics, the known vulnerabilities of the target code segment are obtained, context information is generated based on the known vulnerabilities, and key events of the actual runtime of the target code segment are captured to generate a dynamic execution trajectory.

[0009] A large-scale pre-trained model is used in conjunction with reinforcement learning algorithms to simulate different paths in the context information and the dynamic execution trajectory. A state space, action space and reward function are defined. The execution path exploration is optimized through an adversarial training mechanism to simulate attack vector paths in different environments. Based on the attack vector paths, unknown vulnerabilities in the target code segment are predicted and analyzed to generate prediction results and credibility scores.

[0010] Based on preset mutation operations and coverage-oriented strategies, the prediction results of the confidence score exceeding the preset threshold are tested to confirm and generate real vulnerability information.

[0011] The actual vulnerability information is recorded in the vulnerability knowledge base to generate a security report.

[0012] Optionally, the step of using a large-scale pre-trained model combined with reinforcement learning algorithms to simulate different paths in the context information and the dynamic execution trajectory, and defining a state space, action space, and reward function, optimizes the execution path exploration through an adversarial training mechanism to simulate attack vector paths under different environments, and predicts and analyzes unknown vulnerabilities in the target code segment based on the attack vector paths to generate prediction results and credibility scores, including:

[0013] The context information is processed by encoding a large-scale pre-trained model to obtain a context feature representation. The vulnerability monitoring tool is used to capture key events during the actual execution of the target code segment, record the actual execution path and state changes of the target code segment, generate a dynamic execution trajectory, and refine the dynamic execution trajectory using time series analysis technology to generate a dynamic execution trajectory feature representation.

[0014] A multimodal fusion method is used to fuse the context feature representation and the dynamic execution trajectory feature representation, and a graph neural network is used to capture the dependencies in the structure of the target code segment to obtain a comprehensive feature representation;

[0015] Based on the comprehensive feature representation, the execution path of the target code segment is explored and optimized using reinforcement learning algorithms to obtain the execution path exploration. The state space, action space and reward function are defined, and the execution path exploration is optimized through an adversarial training mechanism to simulate attack vector paths under different environments.

[0016] Based on the attack vector path, the potential known vulnerabilities are implicitly modeled using a variational autoencoder, and the unknown vulnerabilities in the target code segment are analyzed using the attack vector path to obtain the prediction results.

[0017] Based on the prediction results, a Bayesian optimization algorithm is used to evaluate the success probability of the attack vector path and the confidence level of the prediction by the large-scale pre-trained model, and a confidence score is generated.

[0018] Optionally, the step of using reinforcement learning algorithms to explore and optimize the execution path of the target code segment based on the comprehensive feature representation, obtaining the execution path exploration, defining the state space, action space, and reward function, and optimizing the execution path exploration through an adversarial training mechanism to simulate attack vector paths under different environments, includes:

[0019] Using reinforcement learning algorithms, based on the comprehensive feature representation, a state space, an action space, and a reward function are defined to obtain an initial execution path framework. The state space represents the various states of the program running the target code segment, and the action space represents the operations that can be executed in the program of the target code segment.

[0020] Based on the state space, the action space, and the reward function, an adversarial training mechanism is introduced. By having the generator and discriminator in the generative adversarial network play against each other, the execution path exploration is enhanced, improving the robustness and diversity of the path exploration, and obtaining preliminary execution path exploration results.

[0021] Based on the preliminary execution path exploration results, combined with deep Q-network or policy gradient methods, the execution path of the target code segment is optimized, and the execution path is adjusted through multiple iterations to generate an optimized execution path;

[0022] The optimized execution path is tested in a simulated environment, and the environment parameters are adjusted to verify the performance of the optimized execution path under different conditions, so as to simulate attack vector paths under different environments. The environment parameters include input data and system configuration.

[0023] Optionally, it also includes:

[0024] By utilizing diverse simulation environment construction techniques, the actual application scenarios of the target code segment are modeled to obtain a simulation environment containing configuration parameters and input data;

[0025] Based on the simulated environment, a dynamic adversarial sample generation mechanism is introduced to test the optimized execution path and obtain attack vector path performance data.

[0026] The attack vector path performance data is analyzed using a multi-round iterative feedback loop method to evaluate the success rate and impact range of the attack vector path and obtain the evaluation results.

[0027] Based on the evaluation results, complex attack vector paths are guided and labeled to obtain labeled samples. Active learning is then used to select labeled samples with a large amount of information for training to generate prediction results.

[0028] Using the prediction results, attack vector paths under different environments are analyzed, and a comprehensive security assessment report is generated that includes attack vector path descriptions, success probabilities, impact ranges, and remediation suggestions.

[0029] Optionally, the step of testing the prediction results where the confidence score exceeds a preset threshold based on preset mutation operations and coverage-oriented strategies to confirm and generate real vulnerability information includes:

[0030] By filtering the results whose credibility scores exceed a preset threshold, the target code segments containing real vulnerabilities are obtained;

[0031] Based on differential fuzzy testing environment technology, the target code segment containing the real vulnerability is analyzed to obtain initial test cases;

[0032] The initial test cases are mutated to generate key test cases. A coverage-oriented strategy is used to introduce the execution path and coverage of the monitoring code, so that the key test cases touch different branches and conditional statements in the code, and generate vulnerability detection results. The mutation process includes randomly changing the input data, inserting abnormal characters, and changing the data structure.

[0033] Based on the vulnerability detection results, the target code segment is analyzed to check for suspicious behavior patterns and verify whether the behavior patterns represent real vulnerabilities, so as to generate real vulnerability information. The real vulnerability information includes the specific location, triggering conditions, and scope of impact of the real vulnerability.

[0034] Optionally, the step of analyzing the target code segment based on the vulnerability detection results, checking for suspicious behavior patterns, and verifying whether the behavior patterns represent real vulnerabilities to generate real vulnerability information includes:

[0035] Based on the vulnerability detection results collected by the differential fuzz test, the actual behavior data of the target code segment is analyzed to obtain security issue data, which includes system crashes, abnormal outputs, and memory leaks.

[0036] The security issue data is analyzed and processed to identify suspicious behavioral patterns that lead to security issues, resulting in a list of suspicious behaviors.

[0037] By repeatedly testing, using different input conditions, and reproducing the behavior in different environments, the list of suspicious behaviors is verified to confirm whether the suspicious behavior patterns represent real vulnerabilities and to obtain real vulnerability candidates.

[0038] The candidate vulnerabilities are evaluated to determine whether they constitute actual security vulnerabilities. Based on the definition and standards of actual vulnerabilities, the severity and scope of impact of the actual vulnerabilities are predicted to obtain actual vulnerability information.

[0039] Optionally, the step of analyzing the risky code segment to identify target code segments that match common vulnerability characteristics, obtaining known vulnerabilities in the target code segment, and generating context information based on the known vulnerabilities includes:

[0040] By combining formal verification methods to scan the risky code segments, target code segments that match common vulnerability characteristics are identified, and known vulnerabilities existing in the target code segments are determined.

[0041] Based on the known vulnerabilities, natural language processing technology is used to conduct in-depth semantic analysis of the comment text and variable names in the target code segments, construct a correlation graph between the target code segments, enhance contextual understanding, and generate an analysis report, wherein the analysis report includes semantic and correlation information;

[0042] Based on the analysis report, information including the functional description, logical structure, and behavioral patterns of the target code segment is integrated to generate contextual information.

[0043] Optionally, the step of using natural language processing techniques to perform in-depth semantic analysis of the comment text and variable names in the target code segment based on the known vulnerability, constructing a relationship graph between the target code segments, enhancing contextual understanding, and generating an analysis report includes:

[0044] Analyze the comment text and variable names in the target code segment to generate semantic analysis results;

[0045] Based on the semantic analysis results, a relation extraction technique is applied to construct a relation graph between code elements;

[0046] The semantic analysis results, the correlation graph, and the known vulnerabilities are combined to generate an analysis report, which includes a functional description, logical structure, behavioral patterns of the target code segment, and the specific location and characteristics of the known vulnerabilities.

[0047] Secondly, embodiments of this application provide an intelligent vulnerability mining platform construction system based on a large model, comprising:

[0048] The analysis module is used to analyze code snippets collected from different source code repositories, identify code snippets with security risks, and organize them into risky code segments.

[0049] The identification module is used to analyze the risky code segment to identify the target code segment that matches the characteristics of common vulnerabilities, obtain the known vulnerabilities of the target code segment, generate context information based on the known vulnerabilities, and capture key events in the actual runtime of the target code segment to generate a dynamic execution trajectory.

[0050] The processing module is used to simulate different paths in the context information and the dynamic execution trajectory by using a large-scale pre-trained model combined with reinforcement learning algorithms, and to define the state space, action space and reward function. It optimizes the execution path exploration through an adversarial training mechanism to simulate attack vector paths in different environments. Based on the attack vector paths, it predicts and analyzes unknown vulnerabilities in the target code segment to generate prediction results and credibility scores.

[0051] The testing module is used to test the prediction results where the confidence score exceeds a preset threshold based on preset mutation operations and coverage-oriented strategies, so as to confirm and generate real vulnerability information.

[0052] The recording module is used to record the actual vulnerability information into the vulnerability knowledge base to generate a security report.

[0053] Thirdly, embodiments of this application provide a computing device, including a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are invoked and executed by the processing component to implement the intelligent vulnerability mining platform construction method based on a large model as described in the first aspect above.

[0054] Fourthly, embodiments of this application provide a computer storage medium storing a computer program, which, when executed by a computer, implements a method for constructing an intelligent vulnerability mining platform based on a large model as described in the first aspect.

[0055] In this embodiment, code snippets collected from different source code repositories are analyzed to identify code snippets with security risks and organize them into risky code segments. These risky code segments are then analyzed to identify target code segments that match common vulnerability characteristics, revealing known vulnerabilities in the target code segments. Based on these known vulnerabilities, context information is generated, and key events during the actual runtime of the target code segments are captured to generate a dynamic execution trajectory. These key events include function calls, system calls, and memory accesses. A large-scale pre-trained model combined with reinforcement learning algorithms is used to simulate different paths in the context information and the dynamic execution trajectory. A state space, action space, and reward function are defined, and an adversarial training mechanism is used to optimize execution path exploration, simulating attack vector paths under different environments. Based on these attack vector paths, unknown vulnerabilities in the target code segments are predicted and analyzed to generate prediction results and a credibility score. Based on preset mutation operations and coverage-oriented strategies, prediction results with credibility scores exceeding a preset threshold are tested to confirm and generate real vulnerability information. This real vulnerability information is recorded in the vulnerability knowledge base to generate a security report.

[0056] The technical solution of this application has the following beneficial effects:

[0057] This application not only achieves systematic identification and analysis of potential security risks in source code repositories, but also significantly improves the accuracy and efficiency of vulnerability detection by combining an intelligent vulnerability mining platform with various advanced technologies, such as natural language processing, large-scale pre-trained models, and reinforcement learning algorithms. Furthermore, practical testing using differential fuzzing and coverage-oriented strategies ensures the reliability of the prediction results. Finally, a detailed security report is generated, providing clear remediation guidance for the development team, effectively reducing the security risks of the software system and enhancing overall security. This method is not only suitable for reviewing existing code repositories but also provides real-time security assurance during new code development, significantly reducing potential security vulnerabilities.

[0058] Furthermore, this embodiment of the application utilizes a large-scale pre-trained model combined with reinforcement learning algorithms to deeply process and fuse contextual information and dynamic execution trajectories, generating comprehensive feature representations and simulating different paths to generate attack vector paths. Specific steps include: using a pre-trained model to deeply encode contextual information and generate contextual feature representations; using vulnerability monitoring tools to capture key events during actual runtime, generating dynamic execution trajectories, and refining them through time series analysis; employing a multimodal fusion method combined with graph neural networks to capture dependencies in the code structure, obtaining comprehensive feature representations; using reinforcement learning algorithms to explore and optimize possible execution paths, introducing adversarial training to improve the robustness and diversity of path exploration; and combining variational autoencoders to implicitly model potential known vulnerabilities and predict unknown vulnerabilities and their credibility scores. In addition, differential fuzzing testing technology is used to introduce mutation operations and coverage-oriented strategies, actually testing the prediction results of high credibility scores to confirm and generate real vulnerability information, ensuring the high accuracy of detected vulnerabilities.

[0059] The methods described above significantly improve the accuracy and efficiency of detecting known and unknown security vulnerabilities in software systems. Through intelligent and automated means, not only can potential security risks be comprehensively identified, but prediction results can also be effectively verified, reducing false positives and false negatives. In particular, the combination of differential fuzzing testing and mutation operations ensures that the prediction results of high-confidence scores are effectively verified in real-world operating environments, generating detailed and realistic vulnerability information. This method is not only suitable for reviewing existing codebases but also provides real-time security assurance during new code development, greatly reducing potential security risks and enhancing the overall security of the system.

[0060] These or other aspects of this application will become more apparent in the following description of the embodiments. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0062] Figure 1 A flowchart illustrating a method for constructing an intelligent vulnerability mining platform based on a large model, as provided in this application, is shown.

[0063] Figure 2 A schematic diagram of the structure of an intelligent vulnerability mining platform construction system based on a large model provided in this application is shown.

[0064] Figure 3A schematic diagram of the structure of a computing device provided in this application is shown. Detailed Implementation

[0065] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0066] In some of the processes described in the specification, claims, and accompanying drawings of this application, multiple operations appearing in a specific order are included. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or may be executed in parallel. The operation numbers, such as 101, 102, etc., are merely used to distinguish different operations and do not themselves represent any execution order. Furthermore, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel. It should be noted that the descriptions such as "first," "second," etc., in this document are used to distinguish different messages, devices, modules, etc., and do not represent a chronological order, nor do they limit "first" and "second" to different types.

[0067] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0068] Figure 1 This application provides a flowchart of a method for constructing an intelligent vulnerability mining platform based on a large model, as shown in the embodiments of this application. Figure 1 As shown, the method includes:

[0069] 101. Analyze code snippets collected from different source code repositories, identify code snippets with security risks, and organize them into risky code segments;

[0070] Risky code segments refer to code snippets collected from multiple source code repositories and initially screened, deemed potentially problematic for security. These snippets may contain unsafe function calls, improper exception handling, or memory management errors. Organizing these code snippets into risky code segments allows for more systematic subsequent security analysis.

[0071] A source code repository is a centralized repository that stores the code of a software project. It is usually hosted on a version control system (such as Git), including platforms like GitHub and GitLab. These repositories contain the entire history and current state of the project and are the foundation for developer collaboration and version control.

[0072] A code snippet is a specific section of code extracted from a source code repository; it may be part of a function, class, or module. These snippets are used for evaluation and analysis to determine if any potential security risks exist.

[0073] In practice, code snippets are collected extensively from various source code repositories, and automated tools and rule-matching techniques are used to identify those that may pose security risks. These snippets are then categorized and organized to form a structured collection of risky code segments, facilitating further in-depth analysis.

[0074] For example, in a large-scale model implementation, suppose we are evaluating the codebase of a large deep learning framework. First, an automated script scrapes relevant code snippets from open-source repositories on multiple platforms such as GitHub and GitLab. Next, a pre-trained natural language processing model combined with a keyword matching algorithm is used to identify code snippets containing high-risk function calls such as "eval" and "exec," and these are marked as high-risk code segments. These segments are compiled into database entries, ready for detailed analysis in subsequent steps.

[0075] 102. Analyze the risky code segment to identify the target code segment that matches the characteristics of common vulnerabilities, obtain the known vulnerabilities of the target code segment, generate context information based on the known vulnerabilities, and capture the key events of the actual runtime of the target code segment to generate a dynamic execution trajectory.

[0076] The key events include function calls, system calls, and memory accesses.

[0077] The security pattern matching engine is a pre-configured set of rules used to identify vulnerability characteristics of specific patterns in code. It uses regular expressions or other pattern matching algorithms to detect potential security vulnerabilities in the code.

[0078] Contextual information, including the code's environmental context such as variable values ​​and function call chains, helps in understanding code behavior. This information is crucial for simulating attack vector paths and predicting unknown vulnerabilities.

[0079] Dynamic execution traces are serialized event records generated during program execution, reflecting the actual execution path and state changes of the code. This trace data can help identify specific execution paths that may lead to vulnerabilities.

[0080] Critical events are significant events that occur during code execution, such as function calls, system calls, and memory accesses. These events form the basis for constructing dynamic execution trails and reveal the behavioral patterns of the code during runtime.

[0081] In practice, the intelligent vulnerability discovery platform utilizes its built-in security pattern matching engine and natural language processing technology to analyze comment text and variable names in risky code segments to identify target code segments that match common vulnerability characteristics. Simultaneously, it determines known vulnerability types and generates detailed contextual information.

[0082] For example, continuing from the previous embodiment, a preset security pattern matching engine is applied to the detected risky code segments to look for common vulnerability features such as SQL injection and buffer overflow. For each successfully matched code segment, detailed context information is generated, including function call chains and variable assignment details. Next, the code is run in a controlled environment, capturing its actual runtime function calls, system calls, and memory access events to generate a dynamic execution trajectory. This trajectory data is stored for use in subsequent steps.

[0083] 103. Utilize a large-scale pre-trained model combined with reinforcement learning algorithms to simulate different paths in the context information and the dynamic execution trajectory, and define a state space, action space and reward function. Optimize execution path exploration through an adversarial training mechanism to simulate attack vector paths under different environments. Based on the attack vector paths, predict and analyze unknown vulnerabilities in the target code segment to generate prediction results and credibility scores.

[0084] Large-scale pre-trained models refer to language models trained on large amounts of text data, such as BERT and GPT. These models possess powerful semantic understanding and generation capabilities and can be used for various natural language processing tasks.

[0085] Reinforcement learning algorithms are a type of machine learning method that uses reward mechanisms to incentivize agents to take optimal actions in an environment. In vulnerability discovery, it can be used to explore and optimize possible execution paths, improving the diversity and robustness of path exploration.

[0086] Attack vector paths are code execution paths that simulate what an attacker might exploit, demonstrating how an attacker could trigger a vulnerability through a specific sequence of operations. These paths can help identify potential, previously unknown vulnerabilities.

[0087] A confidence score quantifies the level of confidence in a prediction, helping to determine its reliability. A high confidence score means the prediction is more likely to accurately reflect reality.

[0088] In practice, a large-scale pre-trained model combined with reinforcement learning algorithms is used to explore and optimize possible execution paths based on previously generated contextual information and dynamic execution trajectories, generating attack vector paths. Then, a variational autoencoder is used to implicitly model potential known vulnerabilities, predict unknown vulnerabilities that may exist in the target code segment, and finally generate prediction results and their credibility scores.

[0089] For example, based on the above embodiments, the BERT model is used to deeply encode contextual information, generating high-quality contextual feature representations. Then, a graph neural network is combined to capture dependencies in the code structure, resulting in a comprehensive feature representation. Next, reinforcement learning algorithms are used to explore and optimize possible execution paths, and adversarial training is introduced to improve the robustness and diversity of path exploration, simulating various attack vector paths under different environments. Finally, a variational autoencoder is used to implicitly model potential known vulnerabilities, predicting unknown vulnerabilities and their credibility scores. For example, the prediction result shows that a certain piece of code may have an unauthorized access vulnerability, and the credibility score is 0.85, indicating that this prediction has high reliability.

[0090] 104. Based on preset mutation operations and coverage-oriented strategies, test the prediction results where the credibility score exceeds a preset threshold to confirm and generate real vulnerability information;

[0091] Mutation operations refer to modifying initial test cases to generate new test cases. These modifications can include randomly changing input data, inserting abnormal characters, and altering data structures, all aimed at triggering potentially vulnerable behaviors.

[0092] Coverage-oriented strategy is a method to guide the fuzzing process. By monitoring the execution path and coverage of the code, it ensures that test cases reach different branches and conditional statements in the code, thereby improving the effectiveness and comprehensiveness of the tests.

[0093] Real-world vulnerability information refers to the details of vulnerabilities that have been verified and confirmed to exist, including the specific location of the vulnerability, the triggering conditions, and the scope of its impact. This information is crucial for patching vulnerabilities.

[0094] In practice, for predictions with a confidence score exceeding a preset threshold, these predictions are tested based on preset mutation operations and coverage-oriented strategies. The aim is to confirm the accuracy of the predictions and generate detailed, real-world vulnerability information, ensuring the high accuracy of the detected vulnerabilities.

[0095] For example, continuing with the above embodiment, based on the high confidence score prediction results generated in the previous steps, prediction results with a confidence score exceeding 0.8 are selected as key test targets. For each prediction result, different versions of the target code segment and a set of initial test cases designed to trigger potential vulnerability behaviors are obtained using differential fuzzing testing environment technology. These initial test cases are then mutated to generate new test cases. During the differential fuzzing process guided by a coverage-oriented strategy, the execution path and coverage of the monitoring code are introduced, ensuring that the test cases reach different branches and conditional statements in the code, generating vulnerability detection results. For example, through mutation processing, it was discovered that a certain API endpoint causes a server crash when processing JSON input of a specific format, which is confirmed as a real vulnerability.

[0096] 105. Record the actual vulnerability information into the vulnerability knowledge base to generate a security report.

[0097] The security report includes a vulnerability description, scope of impact, risk level, and remediation recommendations.

[0098] The vulnerability knowledge base is a centralized database that stores information on confirmed vulnerabilities, used to manage and track all discovered security issues. It includes not only the specific location and triggering conditions of vulnerabilities, but also remediation recommendations and patch information.

[0099] Security reports are documents that summarize the results of vulnerability detection and analysis. They typically include a vulnerability description, scope of impact, risk level, and remediation recommendations. These reports provide development teams with clear remediation guidance, ensuring that security issues are addressed promptly.

[0100] In practice, confirmed vulnerability information is recorded in a pre-configured vulnerability knowledge base within the intelligent vulnerability discovery platform, generating security reports that include vulnerability descriptions, impact scope, risk levels, and remediation recommendations. These reports provide clear remediation guidance for the development team, ensuring timely resolution of security issues.

[0101] For example, after completing the steps of the aforementioned embodiments, all confirmed real vulnerability information is recorded in the vulnerability knowledge base of the intelligent vulnerability mining platform. Each vulnerability entry details the specific location, triggering conditions, scope of impact, risk level, and remediation suggestions. For instance, regarding the API endpoint crash issue mentioned earlier, a new record is added to the vulnerability knowledge base, describing the vulnerability's details and providing remediation suggestions, such as adding input validation logic and improving error handling mechanisms. Subsequently, the generated security report is sent to the development team to guide them in their remediation work.

[0102] By implementing steps 101 to 105, this solution significantly improves the accuracy and efficiency of detecting known and unknown security vulnerabilities in software systems. Utilizing a large-scale pre-trained model combined with reinforcement learning algorithms not only comprehensively identifies potential security risks but also effectively verifies prediction results, reducing false positives and false negatives. In particular, the integration of differential fuzzing testing and mutation operations ensures that the prediction results with high confidence scores are effectively verified in real-world operating environments, generating detailed and realistic vulnerability information. This method is not only suitable for reviewing existing codebases but also provides real-time security assurance during new code development, significantly reducing potential security risks and enhancing the overall security of the system.

[0103] To address the challenge of traditional vulnerability detection methods in identifying unknown vulnerabilities and complex code paths, and to further improve the accuracy and reliability of predicting unknown security vulnerabilities in software systems, some embodiments involve step 103, which utilizes a large-scale pre-trained model combined with reinforcement learning algorithms to simulate different paths within the context information and the dynamic execution trajectory. A state space, action space, and reward function are defined, and an adversarial training mechanism is used to optimize execution path exploration, simulating attack vector paths under different environments. Based on these attack vector paths, unknown vulnerabilities in the target code segment are predicted and analyzed to generate prediction results and a credibility score, including:

[0104] The context information is encoded and processed using a large-scale pre-trained model to obtain a context feature representation. A vulnerability monitoring tool is used to capture key events during the actual execution of the target code segment, recording the actual execution path and state changes of the target code segment to generate a dynamic execution trajectory. Time series analysis is used to refine the dynamic execution trajectory, generating a dynamic execution trajectory feature representation. A multimodal fusion method is employed to fuse the context feature representation and the dynamic execution trajectory feature representation, combined with a graph neural network to capture the dependencies in the structure of the target code segment, resulting in a comprehensive feature representation. Based on this comprehensive feature representation, a reinforcement learning algorithm is used to explore and optimize the execution path of the target code segment, resulting in an execution path exploration. A state space, action space, and reward function are defined, and an adversarial training mechanism is used to optimize the execution path exploration to simulate attack vector paths under different environments. Based on the attack vector paths, a variational autoencoder is used to implicitly model potential known vulnerabilities, analyze unknown vulnerabilities in the target code segment related to the attack vector paths, and obtain prediction results. Based on the prediction results, a Bayesian optimization algorithm is used to evaluate the success probability of the attack vector paths and the confidence level of the predictions made by the large-scale pre-trained model, generating a confidence score.

[0105] In this embodiment, the contextual feature representation is a feature vector obtained by deep encoding the contextual information in the code snippet using a large-scale pre-trained model. These feature vectors capture the semantic information of the code environment, such as variable values ​​and function call chains, which helps to understand the code's behavior patterns and potential risks.

[0106] Dynamic execution trajectory feature representation refers to the feature vectors generated after refining the dynamic execution trajectory through time series analysis techniques. These feature vectors describe the key events (such as function calls, system calls, and memory accesses) and their sequence during actual code execution, revealing the actual execution path and state changes of the code.

[0107] Multimodal fusion is a technique that integrates data from different sources (such as text, images, time series, etc.) in a deep fusion step to obtain a more comprehensive integrated feature representation.

[0108] Graph Neural Networks (GNNs) are neural network models specifically designed for processing graph-structured data. In this step, GNNs are used to capture dependencies in the code structure, helping to identify complex code logic and potential security vulnerabilities.

[0109] Adversarial training is a training method to improve the robustness of a model. By introducing adversarial examples (i.e. deliberately designed misleading inputs), the model can maintain high prediction accuracy when faced with complex and diverse attack vector paths.

[0110] Variational autoencoders are generative models that implicitly model potential known vulnerabilities, helping to predict the likelihood of unknown vulnerabilities.

[0111] Bayesian optimization is a global optimization algorithm based on Bayesian inference, used to evaluate the success probability of attack vector paths and the confidence score of prediction results, thereby providing a reliable confidence assessment.

[0112] In this embodiment, a large-scale pre-trained model is first used to deeply encode the context information to generate a context feature representation, and a vulnerability monitoring tool is used to capture key events during the actual execution of the target code segment to generate a dynamic execution trajectory.

[0113] Next, time series analysis techniques are used to refine the dynamic execution trajectory, generating a feature representation of the dynamic execution trajectory. Then, a multimodal fusion method is employed to deeply fuse the context feature representation and the dynamic execution trajectory feature representation, and a graph neural network is combined to capture dependencies in the code structure, resulting in a comprehensive feature representation. Based on this, reinforcement learning algorithms are used to explore and optimize possible execution paths, defining the state space, action space, and reward function. Adversarial training is introduced to improve the robustness and diversity of path exploration, simulating various attack vector paths under different environments.

[0114] Subsequently, a variational autoencoder is used to implicitly model potential known vulnerabilities, analyze the unknown vulnerabilities that attack vector paths may lead to, and obtain prediction results. Finally, a Bayesian optimization algorithm is used to evaluate the success probability of attack vector paths and the confidence level of prediction results, generating a confidence score.

[0115] Here is a specific example:

[0116] In one implementation of a large-scale model, it is assumed that the security of a large distributed system is being evaluated. First, the contextual information in the collected risky code segments is deeply encoded using the BERT model to generate high-quality contextual feature representations.

[0117] Next, vulnerability monitoring tools like DynamoRIO are used to capture key events in the target code segment during actual runtime, generating detailed dynamic execution trajectories. These trajectories are then refined using time series analysis techniques to generate dynamic execution trajectory feature representations. A multimodal fusion method is then employed to deeply integrate the contextual feature representations and the dynamic execution trajectory feature representations, combined with graph neural networks to capture dependencies within the code structure, resulting in a comprehensive feature representation. Based on this, reinforcement learning algorithms are used to explore and optimize possible execution paths. Adversarial training is introduced to improve the robustness and diversity of path exploration, simulating various attack vector paths under different environments.

[0118] For example, a scenario was simulated where an API endpoint might be maliciously exploited under high concurrency. Next, a variational autoencoder was used to implicitly model potential known vulnerabilities, predicting that the API endpoint might have an unauthorized access vulnerability. Finally, a Bayesian optimization algorithm was employed to evaluate the success probability of the attack vector path and the confidence level of the prediction results, generating a confidence score. The results show that the confidence score for the API endpoint having an unauthorized access vulnerability is 0.87, indicating that this prediction has high reliability and provides clear guidance for subsequent remediation efforts.

[0119] To address the challenge of traditional methods in comprehensively exploring and optimizing complex code paths, and to further improve the accuracy and robustness of unknown vulnerability detection, some embodiments utilize reinforcement learning algorithms to explore and optimize the execution path of the target code segment based on the comprehensive feature representation. This results in an execution path exploration, which defines a state space, action space, and reward function. The execution path exploration is then optimized through an adversarial training mechanism to simulate attack vector paths under different environments, including:

[0120] Using reinforcement learning algorithms, based on the comprehensive feature representation, a state space, action space, and reward function are defined to obtain an initial execution path framework. The state space represents the various states of the target code segment during program execution, and the action space represents the executable operations within the target code segment. Based on the state space, action space, and reward function, an adversarial training mechanism is introduced. The generator and discriminator in a generative adversarial network engage in a game to enhance execution path exploration, improving its robustness and diversity, and yielding preliminary execution path exploration results. Based on these preliminary results, the execution path of the target code segment is optimized using a deep Q-network or policy gradient method. The optimized execution path is then iteratively adjusted through multiple iterations to generate a final execution path. The optimized execution path is tested in a simulated environment, and environmental parameters are adjusted to verify its performance under different conditions, simulating attack vector paths in various environments. These environmental parameters include input data and system configuration.

[0121] In this embodiment, the state space refers to the set of all states that the target code segment may be in during program execution. These states may include variable values, memory allocation, function call stacks, etc., and are used to describe the specific running state of the code at a certain moment.

[0122] The action space refers to the set of all operations that can be executed in a program, such as function calls, system calls, and conditional statements. Each action corresponds to a specific step in the code execution process, and different actions are selected to guide the program to a specific path.

[0123] The reward function is a key component in reinforcement learning algorithms, used to evaluate the effect of each action. It provides a numerical reward based on the current state and the action taken, guiding the algorithm to choose the optimal path with the goal of maximizing the cumulative reward.

[0124] Adversarial training is a training method to improve the robustness of a model. It involves the generator and discriminator in a Generative Adversarial Network (GAN) engaging in a game of strategy, enabling the model to maintain high prediction accuracy even when facing complex and diverse attack vector paths. The generator attempts to generate misleading inputs, while the discriminator tries to distinguish between real and generated data; both work together to improve model performance.

[0125] Deep Q-Networks (DQN) and policy gradient methods are two commonly used reinforcement learning optimization algorithms. DQN selects the optimal action by learning a value function, while policy gradient methods directly optimize the policy itself and are suitable for problems with continuous action spaces. Both methods can continuously adjust the path selection through multiple iterations to ensure that the best execution path is found.

[0126] A simulation environment is a virtual testing platform used to test optimized execution paths under controlled conditions. By adjusting environment parameters (such as input data and system configuration), the performance of execution paths under different conditions can be verified, thereby simulating various attack vector paths and providing a basis for subsequent security analysis.

[0127] In this embodiment, reinforcement learning algorithms are used to define a state space, action space, and reward function based on comprehensive feature representations, constructing an initial execution path framework. Based on these definitions, an adversarial training mechanism is introduced. The generator and discriminator in a generative adversarial network engage in a game-like interaction to enhance execution path exploration, improving its robustness and diversity, and yielding preliminary execution path exploration results. Subsequently, deep Q-networks or policy gradient methods are combined to further optimize the execution path of the target code segment. Through multiple iterations, the path selection is continuously adjusted, enabling the large-scale pre-trained model to find paths leading to vulnerabilities under different input conditions, generating optimized execution paths. Finally, the optimized execution paths are tested in a simulation environment, adjusting environmental parameters to verify their performance under different conditions, simulating various attack vector paths to ensure the high reliability of the detected vulnerabilities.

[0128] Here is a specific example:

[0129] Based on the comprehensive feature representation generated in the above embodiments, a state space, action space, and reward function are defined, constructing an initial execution path framework. The state space encompasses various states during program execution, such as memory allocation, variable values, and function call stacks; the action space contains all possible operations, such as function calls, system calls, and conditional judgments; and the reward function provides a numerical reward based on the effect of each operation, guiding the algorithm to select the optimal path.

[0130] Next, an adversarial training mechanism is introduced. The robustness and diversity of execution path exploration are enhanced by the interaction between the generator and discriminator in the generative adversarial network. For example, the generator attempts to construct input data that may lead to vulnerabilities, while the discriminator evaluates the authenticity and validity of these inputs. Both mechanisms mutually reinforce each other, jointly improving model performance. After multiple rounds of adversarial training, preliminary execution path exploration results are obtained.

[0131] Then, the execution path of the target code segment is further optimized by combining Deep Q-Network or Policy Gradient Method. Through multiple iterations, the path selection is continuously adjusted so that the model can find the path leading to the vulnerability under different input conditions. For example, for a certain API endpoint, DQN optimization finds a series of operation sequences that may lead to unauthorized access and generates an optimized execution path.

[0132] Finally, the optimized execution path was tested in a simulation environment, and environmental parameters (such as input data and system configuration) were adjusted to verify its performance under different conditions.

[0133] For example, a scenario where a certain API endpoint was maliciously exploited was simulated in a high-concurrency environment. By adjusting the input data and system configuration, the performance of this path under different conditions was verified, ultimately confirming the existence of an unauthorized access vulnerability. This process not only improved the accuracy and robustness of vulnerability detection but also provided clear guidance for subsequent remediation work.

[0134] To address the limitations of traditional vulnerability detection methods in fully simulating real-world environments and accurately assessing attack vector paths, and to further improve the accuracy and reliability of unknown vulnerability prediction, some embodiments also include:

[0135] By utilizing diverse simulation environment construction techniques, the actual application scenarios of the target code segment are modeled to obtain a simulation environment containing configuration parameters and input data. Based on the simulation environment, a dynamic adversarial sample generation mechanism is introduced to test the optimized execution path and obtain attack vector path performance data. A multi-round iterative feedback loop method is applied to analyze the attack vector path performance data to evaluate the success rate and impact range of the attack vector path and obtain evaluation results. Based on the evaluation results, complex attack vector paths are guided and labeled to obtain labeled samples. Active learning is used to select labeled samples with high information content for training to generate prediction results. Using the prediction results, attack vector paths under different environments are analyzed, and a comprehensive security assessment report containing attack vector path descriptions, success probabilities, impact ranges, and remediation suggestions is generated.

[0136] In this embodiment, the diversified simulation environment construction technology refers to creating multiple virtual test environments with different configuration parameters and input data by simulating different real-world application scenarios. These environments are used to simulate various operating conditions in the real world, such as different operating systems, hardware architectures, and network conditions, to ensure the broad applicability and reliability of the test results.

[0137] The dynamic adversarial sample generation mechanism is a method that adaptively generates new input data and anomalous operation sequences, aiming to challenge optimized execution paths in real time. This mechanism can adjust its generation strategy based on test feedback, ensuring that each test reveals potential security vulnerabilities and improves the ability to explore attack vector paths.

[0138] The multi-round iterative feedback loop method analyzes and processes the attack vector path performance data collected after each round of testing to evaluate its success rate and impact range. Based on this data, environmental parameters and the hyperparameters of the reinforcement learning algorithm are automatically adjusted to further optimize the execution path exploration process, thereby improving the robustness and diversity of path exploration.

[0139] Active learning is a method that selects the most informative samples for training to accelerate model convergence and improve prediction accuracy. In this step, expert guidance and annotation are used to conduct in-depth analysis of complex or difficult-to-interpret attack vector paths, ensuring the model can better understand unknown vulnerabilities.

[0140] The comprehensive security assessment report is a detailed document generated based on the results of multiple simulation tests, including attack vector path descriptions, success probabilities, impact scope, and remediation recommendations. These reports not only provide clear remediation guidance for the development team but also serve as important evidence for subsequent security audits and compliance checks.

[0141] In this embodiment, a diversified simulation environment construction technique is first used to model the actual application scenario of the target code segment, resulting in a simulation environment that includes configuration parameters and input data. Based on these simulation environments, a dynamic adversarial sample generation mechanism is introduced to test the optimized execution path and collect attack vector path performance data.

[0142] Then, a multi-round iterative feedback loop method is applied to analyze these performance data, evaluate the success rate and impact range of the attack vector path, and obtain preliminary evaluation results.

[0143] Next, based on the evaluation results, complex attack vector paths are guided and labeled to obtain labeled samples. Then, active learning is used to select labeled samples with more information for training to generate more accurate prediction results.

[0144] Finally, using these prediction results, attack vector paths in different environments are analyzed to generate a comprehensive security assessment report containing detailed descriptions, success probabilities, impact scope, and remediation recommendations, ensuring the high credibility of the detected attack vector paths. Here is a specific example:

[0145] Based on the above embodiments, firstly, we utilize diverse simulation environment construction techniques to model the actual application scenarios of the target code segment, creating multiple simulation environments with different configuration parameters (such as operating system version and hardware specifications) and input data (such as user requests and API calls). These environments are designed to simulate various operating conditions in the real world, ensuring the broad applicability and reliability of the test results.

[0146] Next, based on these simulated environments, we introduce a dynamic adversarial sample generation mechanism to generate new input data and abnormal operation sequences in real time, and test the optimized execution path. For example, we discovered that a certain API endpoint causes a server crash when processing JSON input in a specific format. Through the dynamic adversarial sample generation mechanism, we continuously generate new abnormal inputs, further revealing other potential security issues with this API endpoint.

[0147] Then, we applied a multi-round iterative feedback loop method to analyze the attack vector path performance data collected after each test, evaluating its success rate and impact range. Based on this data, we automatically adjusted the parameters of the simulation environment and the hyperparameters of the reinforcement learning algorithm to further optimize the execution path exploration process. For example, we found that increasing network latency affects the success rate of certain attack vector paths, so we adjusted the corresponding environmental parameters to make the tests more closely resemble real-world scenarios.

[0148] Next, based on the evaluation results, we guide and label complex attack vector paths to obtain labeled samples, and use active learning to select labeled samples with high information content for training. For complex or difficult-to-interpret attack vector paths, we combine expert system guidance and labeling to ensure that the model can better understand these paths. For example, for a certain unauthorized access vulnerability, we selected the most representative attack vector path for labeling and used it to train the model, improving prediction accuracy.

[0149] Finally, we used these predictions to analyze attack vector paths under different environments, generating a comprehensive security assessment report that includes detailed descriptions, success probabilities, impact scope, and remediation recommendations. This report not only provided clear remediation guidance for the development team but also served as a crucial basis for subsequent security audits and compliance checks. For example, we identified the specific location and triggering conditions of an unauthorized access vulnerability and proposed detailed remediation recommendations to ensure timely resolution of this security risk.

[0150] To address the challenge of traditional vulnerability detection methods effectively verifying prediction results and confirming actual vulnerabilities, and to further improve the accuracy and coverage of vulnerability detection, in some embodiments, step 104, based on preset mutation operations and coverage-oriented strategies, tests prediction results whose confidence scores exceed a preset threshold to confirm and generate actual vulnerability information, including:

[0151] By filtering results whose credibility scores exceed a preset threshold, target code segments with real vulnerabilities are obtained. These target code segments are then analyzed using differential fuzz testing technology to generate initial test cases. These initial test cases are then mutated to generate critical test cases. A coverage-oriented strategy is used to introduce the execution path and coverage of the monitoring code, ensuring that the critical test cases reach different branches and conditional statements in the code, generating vulnerability detection results. The mutation process includes randomly changing input data, inserting abnormal characters, and altering data structures. Based on the vulnerability detection results, the target code segments are analyzed to check for suspicious behavior patterns and verify whether these patterns represent real vulnerabilities, generating real vulnerability information. This real vulnerability information includes the specific location, triggering conditions, and impact scope of the real vulnerability.

[0152] In this embodiment, the confidence score quantifies the level of confidence in the prediction result, helping to determine the reliability of the prediction. A high confidence score means that the prediction result is more likely to accurately reflect the actual situation.

[0153] Differential fuzzing is a technique that compares two similar but different versions of a program to detect behavioral differences. This method is effective in discovering hidden vulnerabilities and is applicable to different code versions.

[0154] Initial test cases refer to a set of basic input data designed to trigger the behavior of a potential vulnerability. These test cases are typically designed based on an understanding of the target code segment and common vulnerability characteristics, and are used to initiate the fuzzing process.

[0155] Mutation processing refers to modifying initial test cases to generate new test cases. These modifications can include randomly changing input data, inserting abnormal characters, and altering data structures, with the aim of triggering potential vulnerability behaviors.

[0156] Coverage-oriented strategy is a method to guide the fuzzing process. By monitoring the execution path and coverage of the code, it ensures that test cases reach different branches and conditional statements in the code, thereby improving the effectiveness and comprehensiveness of the tests.

[0157] Real-world vulnerability information refers to the details of vulnerabilities that have been verified and confirmed to exist, including the specific location of the vulnerability, the triggering conditions, and the scope of its impact. This information is crucial for patching vulnerabilities.

[0158] In this embodiment of the application, prediction results with confidence scores exceeding a preset threshold are first screened out to identify target code segments with real vulnerabilities.

[0159] Then, using differential fuzzing testing environment technology, different versions of the target code segment and a set of initial test cases designed to trigger potential vulnerability behaviors are obtained.

[0160] Next, these initial test cases are mutated to generate new test cases. During differential fuzzing guided by a coverage-oriented strategy, the execution path and coverage of the monitoring code are introduced, ensuring that test cases reach different branches and conditional statements in the code, thus generating vulnerability detection results.

[0161] Finally, after completing the mutation process, the target code segment is analyzed in depth based on the vulnerability detection results to check for suspicious behavior patterns and verify whether these behavior patterns represent real vulnerabilities. If so, real vulnerability information containing specific locations, triggering conditions, and scope of impact is generated.

[0162] Here is a specific example:

[0163] Based on the above embodiments, prediction results with a confidence score exceeding 0.8 are selected as key testing targets. For each prediction result, different versions of the target code segment (such as different versions of API endpoint implementations) and a set of initial test cases designed to trigger potential vulnerability behaviors are obtained using differential fuzzing testing environment technology. These test cases may include regular input data, boundary conditions, and abnormal inputs.

[0164] Next, these initial test cases are mutated to generate new test cases. For example, some field values ​​in the input data may be randomly changed, abnormal characters (such as SQL injection strings) may be inserted, or the data structure may be altered (such as adding additional nesting levels). During differential fuzzing, a coverage-oriented strategy is used to guide the process, and tools like DynamoRIO are introduced to monitor the code's execution path and coverage, ensuring that test cases reach different branches and conditional statements in the code. This not only improves test coverage but also increases the likelihood of discovering hidden vulnerabilities.

[0165] After completing the mutation processing and executing the test, the target code segment is analyzed in depth based on the vulnerability detection results to check for suspicious behavior patterns, such as unauthorized access, memory leaks, or crashes.

[0166] For example, it was discovered that an API endpoint would cause a server crash when processing JSON input of a specific format, and this behavior was identified as a real vulnerability. Ultimately, detailed vulnerability information was generated, including the specific location of the vulnerability (e.g., a specific line within a function), the triggering conditions (e.g., specific JSON input format), and the scope of impact (e.g., potential service unavailability). This information provided the development team with clear remediation guidance, ensuring that security issues were addressed promptly.

[0167] To address the challenge of accurately identifying and verifying suspicious behavior patterns using traditional vulnerability detection methods, and to further improve the accuracy and reliability of vulnerability confirmation, some embodiments include analyzing the target code segment based on the vulnerability detection results, checking for the existence of suspicious behavior patterns, and verifying whether the behavior patterns represent real vulnerabilities to generate real vulnerability information. This includes:

[0168] Based on the vulnerability detection results collected by the differential fuzzing test, the actual behavior data of the target code segment is analyzed to obtain security issue data, which includes system crashes, abnormal outputs, and memory leaks. The security issue data is analyzed and processed to identify suspicious behavior patterns that lead to security issues, resulting in a suspicious behavior list. The suspicious behavior list is verified through repeated testing, using different input conditions, and reproduction in different environments to confirm whether the suspicious behavior patterns represent real vulnerabilities, thus obtaining real vulnerability candidates. The real vulnerability candidates are evaluated to determine whether they constitute actual security vulnerabilities, and based on the definition and standards of real vulnerabilities, the severity and scope of impact of the real vulnerabilities are predicted to obtain real vulnerability information.

[0169] In this embodiment, security issue data refers to data collected from differential fuzzing regarding the actual behavior of the target code segment, primarily including system crashes, abnormal outputs, and memory leaks. This data reflects the instability and potential risks of the code under different input conditions.

[0170] Suspicious behavioral patterns refer to behavioral characteristics identified through the analysis and processing of security issue data. These characteristics may indicate the existence of potential security vulnerabilities. For example, frequent system crashes or abnormal outputs caused by specific inputs may be part of a suspicious behavioral pattern.

[0171] The suspicious behavior list is a series of behavioral patterns that may lead to security issues, generated through in-depth analysis of security data using a combination of automated tools and manual review. This list provides clear targets for subsequent verification.

[0172] Real vulnerability candidates refer to behavioral patterns that, after initial verification, are considered potentially to constitute actual security vulnerabilities. These candidates require further evaluation to confirm whether they truly represent real vulnerabilities.

[0173] Real vulnerability information is a detailed vulnerability description generated after final confirmation, including the specific location of the vulnerability, triggering conditions, severity, and scope of impact. This information is crucial for the development team to fix the vulnerability.

[0174] In this embodiment, based on the vulnerability detection results collected by differential fuzzing, the actual behavioral data of the target code segment is analyzed in depth to obtain security issue data including system crashes, abnormal outputs, and memory leaks. Through the analysis and processing of this data, suspicious behavioral patterns that lead to security issues are identified, and a list of suspicious behaviors is generated.

[0175] Subsequently, the list of suspicious behaviors was verified by repeated testing, using different input conditions, and reproducing the behavior under different environments to confirm whether the suspicious behavior patterns represent real vulnerabilities and obtain real vulnerability candidates.

[0176] Finally, these candidates are evaluated to determine whether they constitute actual security vulnerabilities. Based on the definition and standards of real vulnerabilities, their severity and scope of impact are assessed, ultimately generating detailed information on real vulnerabilities.

[0177] Here is a specific example:

[0178] Based on the above embodiments, the vulnerability detection results collected through differential fuzzing were analyzed in depth to obtain a series of security issue data, including multiple system crashes, abnormal outputs, and memory leaks. Through detailed analysis of this data, some suspicious behavioral patterns leading to these problems were identified, such as JSON input in a specific format causing API endpoint crashes, generating a list of suspicious behaviors.

[0179] Next, to verify whether these suspicious behavioral patterns represented a real vulnerability, repeated tests were conducted in different environments, using various input conditions (such as boundary values, abnormal characters, and extremely large data sizes) to trigger these behavioral patterns. For example, it was found that when the input contained a specific SQL injection string, the API endpoint exhibited abnormal output and eventually crashed. This behavior was identified as a real vulnerability candidate.

[0180] Finally, these candidate vulnerabilities were comprehensively evaluated to determine whether they constituted actual security vulnerabilities, and their severity and scope of impact were assessed in accordance with the definition and standards of real vulnerabilities. For example, the aforementioned API endpoint crash issue was confirmed as an unauthorized access vulnerability with high severity because it could lead to a denial-of-service (DoS) attack on the server.

[0181] Ultimately, detailed and realistic vulnerability information was generated, including the specific location of the vulnerability (such as a specific line within a function), the triggering conditions (such as JSON input in a specific format), and the scope of impact (such as the potential for service unavailability). This provided the development team with clear remediation guidance, ensuring that security issues were addressed promptly.

[0182] To address the challenge of accurately identifying and understanding code semantics in traditional vulnerability detection methods, and to further improve the accuracy and contextual understanding capabilities of known vulnerability detection, in some embodiments, step 102 involves analyzing the risky code segment to identify target code segments that match common vulnerability characteristics, obtaining known vulnerabilities in the target code segment, and generating contextual information based on the known vulnerabilities, including:

[0183] The system uses a pre-defined security pattern matching engine combined with formal verification methods to scan the risky code segments, identify target code segments that match common vulnerability characteristics, and determine the known vulnerabilities present in the target code segments. Based on the known vulnerabilities, it uses natural language processing technology to conduct in-depth semantic analysis of the comment text and variable names in the target code segments, constructs a relationship graph between the target code segments, enhances contextual understanding, and generates an analysis report, which includes semantic and relational information. Based on the analysis report, it integrates information containing the functional description, logical structure, and behavioral patterns of the target code segments to generate contextual information.

[0184] In this embodiment, the security pattern matching engine is a set of pre-defined rules and algorithms within the intelligent vulnerability discovery platform, used to identify vulnerability characteristics of specific patterns in the code. It detects potential security vulnerabilities in the code using regular expressions or other pattern matching algorithms.

[0185] Formal verification is a rigorous mathematical technique used to prove whether a program or system conforms to its specifications. In vulnerability detection, formal verification can ensure the correctness and security of code logic and uncover potential security issues.

[0186] A relational graph is a semantic network of connections between target code segments constructed using natural language processing techniques and graph neural networks. It not only captures dependencies within the code structure but also enhances the understanding of the code context, contributing to more accurate vulnerability identification.

[0187] The analysis reports are detailed documents generated from in-depth semantic analysis, including comment text in the target code segments, variable names, and information on their relationships. These reports provide important background information and guidance for subsequent steps.

[0188] In this embodiment, the security pattern matching engine preset in the intelligent vulnerability mining platform is first used, combined with formal verification methods to deeply scan risky code segments, identify target code segments that match common vulnerability characteristics, and determine the known vulnerabilities present therein.

[0189] Then, based on the known vulnerabilities, and combined with natural language processing technology, we conduct in-depth semantic analysis of the comment text and variable names in the target code segments, construct a relationship graph between the target code segments, enhance contextual understanding, and generate a detailed analysis report.

[0190] Finally, based on this analysis report, graph neural networks and knowledge graph technologies were used to integrate information containing functional descriptions, logical structures, and behavioral patterns of the target code segments, generating high-quality contextual information that provides a solid foundation for subsequent vulnerability prediction and verification.

[0191] Here is a specific example:

[0192] Continuing with the above embodiments, the security pattern matching engine preset in the intelligent vulnerability mining platform is used in conjunction with formal verification methods to deeply scan the collected risky code segments, identify target code segments that match common vulnerability characteristics, such as SQL injection and buffer overflow, and determine the known vulnerabilities present within them. For example, an API endpoint was found to have an SQL injection risk.

[0193] Next, based on known vulnerabilities, and using natural language processing techniques, we conducted in-depth semantic analysis of the comment text and variable names in the target code segments. For example, we noticed that a comment mentioned "user input should be strictly validated," but this requirement was not implemented in the actual code. By constructing a relationship graph between the target code segments, we enhanced our understanding of the code context and generated a detailed analysis report, including the semantic analysis results of the comment text and the relationship information between variable names.

[0194] Finally, based on this analysis report, graph neural networks and knowledge graph technologies were used to integrate information containing functional descriptions, logical structures, and behavioral patterns of the target code segments, generating high-quality contextual information. For example, a knowledge graph was constructed to display the functional descriptions, internal logical structures, and interaction patterns with other modules of the API endpoints. This not only deepened the understanding of code behavior but also provided detailed background information for subsequent vulnerability prediction and verification, ensuring that the development team could accurately fix these issues.

[0195] To address the challenge of traditional vulnerability detection methods' difficulty in deeply understanding and associating code semantics, and to further improve the accurate identification and contextual understanding of known vulnerabilities, some embodiments involve, based on the known vulnerabilities, combining natural language processing techniques to conduct in-depth semantic analysis of the comment text and variable names in the target code segments, constructing a correlation graph between the target code segments, enhancing contextual understanding, and generating an analysis report, including:

[0196] The semantic analysis results are generated by analyzing the comment text and variable names in the target code segment. Based on the semantic analysis results, a relation extraction technique is applied to construct a relationship graph between code elements. The semantic analysis results, the relationship graph, and the known vulnerabilities are combined to generate an analysis report, which covers the functional description, logical structure, and behavioral patterns of the target code segment, as well as the specific location and characteristics of the known vulnerabilities.

[0197] In this embodiment, the semantic analysis results are data obtained through in-depth analysis of comment text and variable names in the target code segment using natural language processing techniques. These results not only capture the surface meaning of code elements but also reveal the potential relationships between them, helping to enhance the understanding of the code context.

[0198] Relation extraction is a method for automatically identifying entities and their relationships from text. In this step, relation extraction is used to construct a graph of relationships between code elements, revealing direct dependencies and interaction patterns in different contexts. This contributes to a more comprehensive understanding of code structure and behavior.

[0199] In this embodiment, a natural language processing analysis environment is used to perform semantic analysis on the comment text and variable names in the target code segment, generating detailed semantic analysis results.

[0200] Then, based on these semantic analysis results, relation extraction techniques are applied to construct a relation graph between code elements, showing direct dependencies and revealing interaction patterns in different contexts.

[0201] Finally, by combining the results of semantic analysis, the results of association graph construction, and information on known vulnerabilities, a detailed analysis report is generated that covers the functional description, logical structure, and behavioral patterns of the target code segment, ensuring that the specific location and characteristics of known vulnerabilities are accurately revealed.

[0202] Here is a specific example:

[0203] Continuing with the above embodiments, firstly, a natural language processing analysis environment is used to perform semantic analysis on the comment text and variable names in the collected risky code segments, generating detailed semantic analysis results. For example, it was noticed that a comment for a certain function mentioned "user input should be strictly validated," but this requirement was not actually implemented in the code. Through semantic analysis, a potential SQL injection risk in this code segment was detected.

[0204] Next, based on these semantic analysis results, relation extraction techniques are applied to construct a graph of relationships between code elements. For example, a direct dependency is found between a certain API endpoint and a database query function, while this API endpoint exhibits complex interaction patterns with other modules in different contexts. By constructing the graph, not only are these direct dependencies revealed, but also the interaction patterns in different contexts are disclosed, further deepening the understanding of code structure and behavior.

[0205] Finally, by combining the results of semantic analysis, the construction of the correlation graph, and information on known vulnerabilities, a detailed analysis report is generated. This report not only covers the functional description, logical structure, and behavioral patterns of the target code segment, but also accurately reveals the specific location and characteristics of known vulnerabilities.

[0206] For example, an unauthorized access vulnerability was identified, specifically in the input validation section of an API endpoint, with its triggering conditions and scope of impact described in detail. This information provided the development team with clear remediation guidance, ensuring that security issues were addressed promptly.

[0207] This application considers combining automated tools and manual review to deeply analyze potential security issues in target code segments and identify suspicious behavioral patterns that lead to these issues. As software complexity increases, traditional vulnerability detection methods often struggle to comprehensively cover all possible security risks; therefore, a new alternative solution is proposed, which includes:

[0208] Based on the vulnerability detection results, a thorough analysis of the target code segment is conducted to check for any suspicious behavioral patterns, including:

[0209] Based on the vulnerability detection results collected by the differential fuzzing test, the actual behavior data of the target code segment is analyzed in depth to obtain security issue data; wherein, the security issue data It is calculated using the following formula:

[0210] ;

[0211] in, Data indicating security issues These represent the weights for system crash, abnormal output, and memory leak, respectively. These represent the adjustment coefficients for the corresponding indicators. Indicates the first The system crashes, abnormal outputs, and memory leaks detected in this test were... Indicates the degree of the expression;

[0212] The following is a detailed explanation of each parameter:

[0213] Security issue data represents the overall assessment result after comprehensively considering various security issues such as system crashes, abnormal outputs, and memory leaks; the system crash, abnormal output, and memory leak indicators in each test are collected through differential fuzzy testing and calculated according to the formula.

[0214] The weight of system crashes reflects their relative importance in the overall security assessment; it is set based on historical data and expert experience, and is usually adjusted according to the actual operating environment and security requirements of the system.

[0215] The weight of abnormal output reflects the relative importance of abnormal output (such as error logs, abnormal return values, etc.) in the overall security assessment; it is also set based on historical data and expert experience, taking into account that abnormal output may indicate potential security problems.

[0216] The weight of memory leaks reflects their relative importance in the overall security assessment; the assessment settings are based on the importance and potential impact of memory management, and are usually determined by analyzing memory usage and performance monitoring data.

[0217] : System crash adjustment coefficient, used to adjust the degree of influence of system crash indicators; it is set according to the specific circumstances and severity of the system crash, and the optimal value can be determined through experiments and simulations;

[0218] : Adjustment coefficient for abnormal output, used to adjust the degree of impact of abnormal output indicators; it is set based on the frequency and type of abnormal output, and is usually determined through statistical analysis and expert review;

[0219] : The adjustment factor for memory leaks is used to adjust the degree of impact of memory leak indicators; it is set according to the specific circumstances of memory leaks and their impact on system performance, and is usually determined through performance testing and monitoring data;

[0220] : No. The system crash indicators detected in this test measure the frequency or severity of system crashes; system crash events in each test are recorded through automated tools and manual review, and their occurrence frequency or severity level is statistically analyzed.

[0221] : No. The abnormal output metrics detected in this test measure the frequency or severity of abnormal outputs; abnormal output events in each test are recorded through automated tools and manual review, and their occurrence frequency or severity level is statistically analyzed.

[0222] : No. The memory leak metrics detected in this test measure the frequency or severity of memory leaks; memory leak events in each test are recorded through automated tools and manual review, and their occurrence frequency or severity level is statistically analyzed.

[0223] Number of tests: This indicates how many tests were conducted to collect enough data to assess potential security issues; it is determined based on the test plan and actual execution, and is usually the result of multiple iterations of testing.

[0224] The following is a brief introduction to the reasons for each sub-item design:

[0225] System crashes are one of the most serious security problems, therefore an exponential function is used. This simulates the phenomenon that as the crash index increases, its contribution to security issues gradually decreases; this helps to capture frequent but minor crashes while avoiding overstating the impact of a single major crash.

[0226] Exceptional output typically manifests as log entries or exception return values, and is handled using logarithmic functions. It can smooth out the impact of abnormal outputs, ensuring that even with a large number of abnormal outputs, the evaluation results will not be too large, while still reflecting their cumulative effect.

[0227] The effects of memory leaks are usually gradual, and the square root function can be used to describe them. It can better reflect the process of memory leaks accumulating over time, ensuring that early small-scale leaks are not ignored, and that the impact of large-scale leaks is not over-amplified.

[0228] This formula adds up the various components to comprehensively consider different types of potential security issues (system crashes, abnormal outputs, and memory leaks), and balances them according to their respective weights and adjustment coefficients. Each component represents a different type of security issue, and the summation method ensures a comprehensive security issue data. It can comprehensively reflect the overall security of a code segment, rather than unilaterally emphasizing a certain type of problem;

[0229] The overall design of the formula is to provide a comprehensive evaluation framework. By quantitatively evaluating three common security issues—system crashes, abnormal outputs, and memory leaks—it generates a comprehensive indicator that can fully reflect the security of a code segment. This approach not only considers the specific manifestations of each problem, but also ensures that the evaluation results can adapt to different application scenarios and security requirements by introducing weights and adjustment coefficients. Ultimately, the formula helps the R&D team efficiently identify and prioritize the most pressing security issues, thereby improving the overall security of the software system.

[0230] Here is a specific example:

[0231] Suppose we are evaluating the security of a large deep learning framework that consists of multiple modules and involves complex system calls and memory management. To ensure its security, we have conducted multiple tests on the framework using a differential fuzzing tool and collected relevant data.

[0232] Parameter settings and data preparation:

[0233] Number of tests Second-rate.

[0234] Weight parameters:

[0235] (Weight of system failure);

[0236] (Weight of abnormal outputs);

[0237] (The weight of memory leaks);

[0238] Adjustment coefficient: , , ;

[0239] Weighting of automated tools and human review (More reliant on automation tools);

[0240] Test result example (the first one) The specific data from this test are shown in Table 1 below:

[0241] Table 1

[0242]

[0243] Calculation process:

[0244] Taking the first test as an example:

[0245] ;

[0246] ;

[0247] ;

[0248] Repeat the above steps to calculate the results of all 50 tests and sum them up. :

[0249] ;

[0250] The final calculation yielded:

[0251] ;

[0252] The target code segment was tested multiple times using differential fuzzing and relevant data was collected. The final security issue data was then calculated. This result indicates that during the 50 tests, security issues such as system crashes, abnormal output, and memory leaks were frequent and significant, specifically, a high percentage of these issues were observed. The values ​​reflect the high number of system crashes detected during the test and the prevalence of abnormal outputs. Although the impact of memory leaks is relatively small, they still exist. This suggests that the R&D team should pay close attention to these potential security risks, especially those that may lead to system instability or abnormal behavior. Further analysis and optimization of these high-risk areas will help improve the overall security of the system and reduce the risks posed by potential security vulnerabilities.

[0253] By combining automated tools with manual review, the security issue data is analyzed and processed to identify suspicious behavioral patterns that lead to security issues, resulting in a list of suspicious behaviors; wherein, the list of suspicious behaviors... It is calculated using the following formula:

[0254] ;

[0255] in, This indicates a list of suspicious behaviors. This indicates the weighting ratio between automated tools and human review. These are indicators of system crashes, abnormal outputs, and memory leaks detected during comprehensive testing; they can be averages or maximum values.

[0256] The following is a detailed explanation of each parameter:

[0257] The Suspicious Behavior List represents the behavioral patterns most likely to cause security problems, generated after comprehensive evaluation. It is calculated using formulas based on the results of automated tools and manual review, and is used to guide subsequent security hardening work.

[0258] The weighting of automated tools and human review determines their relative contribution to the final evaluation; this weighting is set based on the specific application scenario and level of trust, and is typically determined through historical data and expert experience; a higher weighting... The value indicates a greater reliance on the results of automated tools; a lower value indicates a greater reliance on the results of automated tools. The value emphasizes the importance of manual review;

[0259] These are the system crashes, abnormal outputs, and memory leaks detected during comprehensive testing. They can be averages or maximum values. They are derived through statistical analysis of multiple test results to ensure the representativeness and reliability of the evaluation results.

[0260] The following is a brief introduction to the reasons for each sub-item design:

[0261] This section reflects the assessment results of security issues by automated tools; it comprehensively considers the impact of system crashes, abnormal outputs, and memory leaks through weighted summation, assigning appropriate weights; automated tools can quickly process large amounts of data, providing objective and consistent assessment results.

[0262] This section reflects the assessment results of security issues by human review; human review can capture subtle issues that automated tools may miss, especially in complex and unstructured environments; using different activation functions (such as...) Sum of squares This enhances sensitivity to serious issues and ensures that assessment results are more comprehensive and accurate.

[0263] This formula adds up the components to comprehensively consider the different focuses of automated tools and human review. Automated tools emphasize efficiently processing large amounts of data and providing objective assessments, while human review excels at identifying potential problems in complex environments. Weighting is introduced to achieve this. This allows for finding the optimal balance between the two, ensuring that the final evaluation results are both comprehensive and reliable. The multiplication component is used to adjust the contribution of each sub-item, ensuring that different types of evaluation results can be reasonably integrated into the overall evaluation framework.

[0264] The overall design of the formula is based on combining the results of automated tools and manual review to generate a comprehensive evaluation framework that identifies behavioral patterns most likely to cause security issues. This approach not only improves the accuracy of vulnerability detection but also better adapts to complex software environments. This is achieved by introducing weighted proportions. The formula allows for flexible adjustments to the contributions of automated tools and manual review in different application scenarios, ensuring that evaluation results are both scientific and practical. Ultimately, the formula helps R&D teams efficiently identify and prioritize the most pressing security issues, thereby improving the overall security of the software system.

[0265] According to the above Specific examples of calculating a list of suspicious behaviors :

[0266] Assume the average index detected in the comprehensive test is: ;

[0267] Substitute into the formula:

[0268] ;

[0269] Step-by-step calculation:

[0270] Automation tools section:

[0271] ;

[0272] Manual review section:

[0273] ;

[0274] final:

[0275] ;

[0276] The final list of suspicious behaviors is calculated by combining the results of automated tools and manual review. This result demonstrates that, when assessing the security of target code segments, combining the efficient data processing capabilities of automated tools with the meticulous capture of complex issues by human review identifies several behavioral patterns that are highly probable to lead to security problems. The values ​​reflect some significant suspicious behaviors, particularly those exhibiting issues related to system crashes and abnormal output. This suggests that the development team should prioritize these behavioral patterns, conduct in-depth analysis and remediation to eliminate potential security vulnerabilities. Meanwhile, considering that the impact of memory leaks, although relatively small, still exists, it is recommended to optimize them appropriately to ensure an effective improvement in the overall system security. This approach not only improves the accuracy of vulnerability detection but also provides a scientific basis for subsequent security hardening, thereby effectively reducing the system's security risks.

[0277] Figure 2 This application provides a schematic diagram of the structure of an intelligent vulnerability mining platform construction device (or system) based on a large model, as shown in the embodiments of this application. Figure 2 As shown, the device includes:

[0278] Analysis module 21 is used to analyze code snippets collected from different source code repositories, identify code snippets with security risks, and organize them into risky code segments;

[0279] The identification module 22 is used to analyze the risky code segment to identify the target code segment that matches the characteristics of common vulnerabilities, obtain the known vulnerabilities of the target code segment, generate context information based on the known vulnerabilities, and capture key events in the actual runtime of the target code segment to generate a dynamic execution trajectory.

[0280] Processing module 23 is used to simulate different paths in the context information and the dynamic execution trajectory by using a large-scale pre-trained model combined with reinforcement learning algorithm, and to define state space, action space and reward function. It optimizes execution path exploration through adversarial training mechanism to simulate attack vector paths in different environments. Based on the attack vector paths, it predicts and analyzes unknown vulnerabilities in the target code segment to generate prediction results and credibility scores.

[0281] Test module 24 is used to test the prediction results of the confidence score exceeding a preset threshold based on preset mutation operations and coverage-oriented strategies, so as to confirm and generate real vulnerability information.

[0282] The recording module 25 is used to record the actual vulnerability information into the vulnerability knowledge base to generate a security report.

[0283] Figure 2 The aforementioned intelligent vulnerability mining platform construction device based on large models can execute... Figure 1 The implementation principle and technical effects of the intelligent vulnerability mining platform construction method based on a large model described in the illustrated embodiment will not be repeated here. The specific methods by which each module and unit of the intelligent vulnerability mining platform construction device based on a large model performs its operations have been described in detail in the embodiments related to this method, and will not be elaborated upon here.

[0284] In one possible design, Figure 2 The intelligent vulnerability mining platform construction device based on a large model shown in the embodiment can be implemented as a computing device, such as... Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32;

[0285] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are invoked and executed by the processing component 32.

[0286] The processing component 32 is used for the above Figure 1 The embodiment describes a method for constructing an intelligent vulnerability mining platform based on a large model.

[0287] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above-described method. Alternatively, the processing component may be implemented as one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above-described method.

[0288] Storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0289] Of course, computing devices may also include other components, such as input / output interfaces, display components, communication components, etc.

[0290] Input / output interfaces provide interfaces between processing components and peripheral interface modules, which can be output devices, input devices, etc.

[0291] The communication components are configured to facilitate wired or wireless communication between computing devices and other devices.

[0292] The computing device can be a physical device or an elastic computing host provided by a cloud computing platform. In this case, the computing device can refer to a cloud server, and the aforementioned processing components, storage components, etc., can be basic server resources rented or purchased from the cloud computing platform.

[0293] This application also provides a computer storage medium storing a computer program, which, when executed by a computer, can perform the above-described functions. Figure 1 The embodiment shown illustrates a method for constructing an intelligent vulnerability mining platform based on a large model.

[0294] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0295] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0296] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0297] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for constructing an intelligent vulnerability mining platform based on a large model, characterized in that, include: Analyze code snippets collected from different source code repositories, identify code snippets with security risks, and organize them into risky code segments; The risky code segment is analyzed to identify target code segments that match common vulnerability characteristics, the known vulnerabilities of the target code segment are obtained, context information is generated based on the known vulnerabilities, and key events of the actual runtime of the target code segment are captured to generate a dynamic execution trajectory. A large-scale pre-trained model is used in conjunction with reinforcement learning algorithms to simulate different paths in the context information and the dynamic execution trajectory. A state space, action space and reward function are defined. The execution path exploration is optimized through an adversarial training mechanism to simulate attack vector paths in different environments. Based on the attack vector paths, unknown vulnerabilities in the target code segment are predicted and analyzed to generate prediction results and credibility scores. Based on preset mutation operations and coverage-oriented strategies, the prediction results of the confidence score exceeding the preset threshold are tested to confirm and generate real vulnerability information. The actual vulnerability information is recorded in the vulnerability knowledge base to generate a security report; The method utilizes a large-scale pre-trained model combined with reinforcement learning algorithms to simulate different paths in the context information and dynamic execution trajectory, and defines a state space, action space, and reward function. It optimizes execution path exploration through an adversarial training mechanism to simulate attack vector paths under different environments. Based on the attack vector paths, it predicts and analyzes unknown vulnerabilities in the target code segment to generate prediction results and credibility scores, including: The context information is processed by encoding a large-scale pre-trained model to obtain a context feature representation. The vulnerability monitoring tool is used to capture key events during the actual execution of the target code segment, record the actual execution path and state changes of the target code segment, generate a dynamic execution trajectory, and refine the dynamic execution trajectory using time series analysis technology to generate a dynamic execution trajectory feature representation. A multimodal fusion method is used to fuse the context feature representation and the dynamic execution trajectory feature representation, and a graph neural network is used to capture the dependencies in the structure of the target code segment to obtain a comprehensive feature representation; Based on the comprehensive feature representation, the execution path of the target code segment is explored and optimized using reinforcement learning algorithms to obtain the execution path exploration. The state space, action space and reward function are defined, and the execution path exploration is optimized through an adversarial training mechanism to simulate attack vector paths under different environments. Based on the attack vector path, the potential known vulnerabilities are implicitly modeled using a variational autoencoder, and the unknown vulnerabilities in the target code segment are analyzed using the attack vector path to obtain the prediction results. Based on the prediction results, a Bayesian optimization algorithm is used to evaluate the success probability of the attack vector path and the confidence level of the prediction by the large-scale pre-trained model, and a confidence score is generated.

2. The method according to claim 1, characterized in that, The process involves using reinforcement learning algorithms to explore and optimize the execution path of the target code segment based on the comprehensive feature representation, resulting in an execution path exploration. A state space, action space, and reward function are defined, and the execution path exploration is optimized through an adversarial training mechanism to simulate attack vector paths under different environments. This includes: Using reinforcement learning algorithms, based on the comprehensive feature representation, a state space, an action space, and a reward function are defined to obtain an initial execution path framework. The state space represents the various states of the program running the target code segment, and the action space represents the operations that can be executed in the program of the target code segment. Based on the state space, the action space, and the reward function, an adversarial training mechanism is introduced. By having the generator and discriminator in the generative adversarial network play against each other, the execution path exploration is enhanced, improving the robustness and diversity of the path exploration, and obtaining preliminary execution path exploration results. Based on the preliminary execution path exploration results, combined with deep Q-network or policy gradient methods, the execution path of the target code segment is optimized, and the execution path is adjusted through multiple iterations to generate an optimized execution path; The optimized execution path is tested in a simulated environment, and the environment parameters are adjusted to verify the performance of the optimized execution path under different conditions, so as to simulate attack vector paths under different environments. The environment parameters include input data and system configuration.

3. The method according to claim 2, characterized in that, Also includes: By utilizing diverse simulation environment construction techniques, the actual application scenarios of the target code segment are modeled to obtain a simulation environment containing configuration parameters and input data; Based on the simulated environment, a dynamic adversarial sample generation mechanism is introduced to test the optimized execution path and obtain attack vector path performance data. The attack vector path performance data is analyzed using a multi-round iterative feedback loop method to evaluate the success rate and impact range of the attack vector path and obtain the evaluation results. Based on the evaluation results, complex attack vector paths are guided and labeled to obtain labeled samples. Active learning is then used to select labeled samples with a large amount of information for training to generate prediction results. Using the prediction results, attack vector paths under different environments are analyzed, and a comprehensive security assessment report is generated that includes attack vector path descriptions, success probabilities, impact ranges, and remediation suggestions.

4. The method according to claim 1, characterized in that, The method, based on preset mutation operations and coverage-oriented strategies, tests the prediction results where the confidence score exceeds a preset threshold to confirm and generate real vulnerability information, including: By filtering the results whose credibility scores exceed a preset threshold, the target code segments containing real vulnerabilities are obtained; Based on differential fuzzy testing environment technology, the target code segment containing the real vulnerability is analyzed to obtain initial test cases; The initial test cases are mutated to generate key test cases. A coverage-oriented strategy is used to introduce the execution path and coverage of the monitoring code, so that the key test cases touch different branches and conditional statements in the code, and generate vulnerability detection results. The mutation process includes randomly changing the input data, inserting abnormal characters, and changing the data structure. Based on the vulnerability detection results, the target code segment is analyzed to check for suspicious behavior patterns and verify whether the behavior patterns represent real vulnerabilities, so as to generate real vulnerability information. The real vulnerability information includes the specific location, triggering conditions, and scope of impact of the real vulnerability.

5. The method according to claim 4, characterized in that, The step of analyzing the target code segment based on the vulnerability detection results, checking for suspicious behavior patterns, and verifying whether the behavior patterns represent real vulnerabilities to generate real vulnerability information includes: Based on the vulnerability detection results collected by the differential fuzz test, the actual behavior data of the target code segment is analyzed to obtain security issue data, which includes system crashes, abnormal outputs, and memory leaks. The security issue data is analyzed and processed to identify suspicious behavioral patterns that lead to security issues, resulting in a list of suspicious behaviors. By repeatedly testing, using different input conditions, and reproducing the behavior in different environments, the list of suspicious behaviors is verified to confirm whether the suspicious behavior patterns represent real vulnerabilities and to obtain real vulnerability candidates. The candidate vulnerabilities are evaluated to determine whether they constitute actual security vulnerabilities. Based on the definition and standards of actual vulnerabilities, the severity and scope of impact of the actual vulnerabilities are predicted to obtain actual vulnerability information.

6. The method according to claim 1, characterized in that, The analysis of the risky code segment identifies target code segments that match common vulnerability characteristics, yields known vulnerabilities in the target code segment, and generates context information based on the known vulnerabilities, including: By combining formal verification methods to scan the risky code segments, target code segments that match common vulnerability characteristics are identified, and known vulnerabilities existing in the target code segments are determined. Based on the known vulnerabilities, natural language processing technology is used to conduct in-depth semantic analysis of the comment text and variable names in the target code segments, construct a correlation graph between the target code segments, enhance contextual understanding, and generate an analysis report, wherein the analysis report includes semantic and correlation information; Based on the analysis report, information including the functional description, logical structure, and behavioral patterns of the target code segment is integrated to generate contextual information.

7. The method according to claim 6, characterized in that, Based on the known vulnerabilities, the method combines natural language processing techniques to conduct in-depth semantic analysis of the comment text and variable names in the target code segments, constructs a relationship graph between the target code segments, enhances contextual understanding, and generates an analysis report, including: Analyze the comment text and variable names in the target code segment to generate semantic analysis results; Based on the semantic analysis results, a relation extraction technique is applied to construct a relation graph between code elements; The semantic analysis results, the correlation graph, and the known vulnerabilities are combined to generate an analysis report, which includes a functional description, logical structure, behavioral patterns of the target code segment, and the specific location and characteristics of the known vulnerabilities.

8. A system for constructing an intelligent vulnerability mining platform based on a large model, characterized in that, include: The analysis module is used to analyze code snippets collected from different source code repositories, identify code snippets with security risks, and organize them into risky code segments. The identification module is used to analyze the risky code segment to identify the target code segment that matches the characteristics of common vulnerabilities, obtain the known vulnerabilities of the target code segment, generate context information based on the known vulnerabilities, and capture key events in the actual runtime of the target code segment to generate a dynamic execution trajectory. The processing module is used to simulate different paths in the context information and the dynamic execution trajectory by using a large-scale pre-trained model combined with reinforcement learning algorithms, and to define the state space, action space and reward function. It optimizes the execution path exploration through an adversarial training mechanism to simulate attack vector paths in different environments. Based on the attack vector paths, it predicts and analyzes unknown vulnerabilities in the target code segment to generate prediction results and credibility scores. The testing module is used to test the prediction results where the confidence score exceeds a preset threshold based on preset mutation operations and coverage-oriented strategies, so as to confirm and generate real vulnerability information. The recording module is used to record the actual vulnerability information into the vulnerability knowledge base to generate a security report; The method utilizes a large-scale pre-trained model combined with reinforcement learning algorithms to simulate different paths in the context information and dynamic execution trajectory, and defines a state space, action space, and reward function. It optimizes execution path exploration through an adversarial training mechanism to simulate attack vector paths under different environments. Based on the attack vector paths, it predicts and analyzes unknown vulnerabilities in the target code segment to generate prediction results and credibility scores, including: The context information is processed by encoding a large-scale pre-trained model to obtain a context feature representation. The vulnerability monitoring tool is used to capture key events during the actual execution of the target code segment, record the actual execution path and state changes of the target code segment, generate a dynamic execution trajectory, and refine the dynamic execution trajectory using time series analysis technology to generate a dynamic execution trajectory feature representation. A multimodal fusion method is used to fuse the context feature representation and the dynamic execution trajectory feature representation, and a graph neural network is used to capture the dependencies in the structure of the target code segment to obtain a comprehensive feature representation; Based on the comprehensive feature representation, the execution path of the target code segment is explored and optimized using reinforcement learning algorithms to obtain the execution path exploration. The state space, action space and reward function are defined, and the execution path exploration is optimized through an adversarial training mechanism to simulate attack vector paths under different environments. Based on the attack vector path, the potential known vulnerabilities are implicitly modeled using a variational autoencoder, and the unknown vulnerabilities in the target code segment are analyzed using the attack vector path to obtain the prediction results. Based on the prediction results, a Bayesian optimization algorithm is used to evaluate the success probability of the attack vector path and the confidence level of the prediction by the large-scale pre-trained model, and a confidence score is generated.

Images