Key information association relationship generation method and system in defect text description

Abstract

The invention discloses a key information incidence relation generation method and system in defect text description, and relates to the technical field of software vulnerability analysis. The method comprises the following steps of: generating a plurality of candidate association relationships among key information in defect description by adopting a large language model; performing semantic extension on all key information and candidate association relationships by adopting a large language model; adopting a large language model to obtain a logical thinking chain between each candidate association relationship and the key information based on a chain reasoning method; verifying whether the logical thinking chain of each candidate association relationship is valid or not; and if the logical thinking chain verification is valid, taking the corresponding candidate association relationship as the correct association relationship between the key information. According to the method, the logical thinking chain is generated by adopting the LLM and is verified by self-checking the logical thinking chain, and the incidence relation most suitable for the current defect text and the key information can be found and output.

Description

Technical Field

[0001] The present invention belongs to the field of software vulnerability analysis, and in particular relates to a method and system for generating key information association relationships in defect text descriptions. Background Art

[0002] During the use or maintenance of software, software users or software maintainers will find various vulnerabilities, which will be recorded by users or software maintainers in text form. For example, the following vulnerabilities are recorded: "Defect text description: SAP NetWeaver has a permission acquisition vulnerability, allowing remote attackers to obtain access rights through unspecified vectors", and "Defect text description: There is a security vulnerability in the host memory mapping path function of multiple NVIDIA GPU graphics card drivers. The vulnerability is caused by the program's failure to properly restrict access to third-party IO memory. Attackers can use the follow_pfn kernel-mode API to exploit this vulnerability to obtain permissions and cause denial of service (resource consumption)." The purpose of these records is to allow subsequent developers or software vulnerability fixers to use them as a reference, so that they can quickly understand whether there is a solution or inspiration for the solution to the vulnerability they are currently facing during development or software vulnerability repair.

[0003] However, in these vulnerability text descriptions, the study found that it is difficult to understand the relationship between key information. In the above two defect text descriptions, the key information is the same "access to permissions", but it leads to different results "access to permissions" and "denial of service (resource consumption)". If the relationship between key information is not understood, it will also greatly increase the difficulty of vulnerability repair for subsequent developers or vulnerability repair personnel. For the discovery of the correlation relationship of key information in defect texts, solutions based on semantic vector retrieval, rule matching and templates, knowledge graphs, and NLP text similarity analysis have emerged.

[0004] For the solution based on semantic vector retrieval: 0. Use LLM to generate corresponding association relationships based on key information; 1. Convert key information and association relationships into vector representations through LLM; 2. In the pre-built vulnerability description knowledge base, all descriptions are also converted into vector representations; 3. Use vector similarity (such as cosine similarity) to search to find the existing vulnerability description that is most similar to the generated association relationship and confirm the validity of the association relationship.

[0005] For solutions based on knowledge graphs: 0. Use LLM to generate corresponding association relationships based on key information; 1. Build a software vulnerability knowledge graph, in which nodes represent key information and association relationships, and edges represent the associations between vulnerability behaviors; 2. Map the association relationships generated by LLM to the knowledge graph to retrieve whether there are matching paths or relationship patterns; 3. If an existing path is matched, the rationality of the association relationship is verified.

[0006] For solutions based on rule matching and templates: 0. Use LLM to generate corresponding association relationships based on key information; 1. Define a set of association relationship rules and templates based on existing vulnerability descriptions (such as "authorization acquisition → access permission acquisition"); 2. Match the association relationships generated by LLM with these rules; 3. If the generated association relationship meets an existing rule or template, it is considered valid.

[0007] For solutions based on NLP text similarity analysis: 0. Use LLM to generate corresponding association relationships based on key information; 1. Use traditional NLP technology (such as TF-IDF, BM25) or deep learning models (such as BERT) to textualize key information and association relationships; 2. Search for similar text in the vulnerability description database. If the retrieved text contains similar association relationships, the generated association relationships are considered reasonable.

[0008] All of the above solutions first use LLM to input key information into LLM, and then LLM generates associations. These solutions compare the associations with all existing defect text descriptions found in the network. As long as there is an association in a defect text description, the association is generated. Its essence is knowledge base retrieval.

[0009] However, there are many types of defects and a large number of defect text descriptions. The knowledge base includes a variety of defects and a variety of defect associations. In principle, the essence of these solutions is to retrieve knowledge from the knowledge base for support. However, for each key information, there is evidence in the knowledge base to prove it, so all the results generated by LLM are supported by evidence. Because of the diversity of evidence, the associations output by these solutions are relatively random. This kind of association does not reduce the difficulty of vulnerability repair for subsequent developers or vulnerability repair personnel.

[0010] Different from the existing method of checking using knowledge base, the present invention has a chain of thoughts for key information and associated relationships. The chain of thoughts can be understood as a logical relationship. Considering that from the perspective of experts, key information must be associated with associated relationships, LLM is used to simulate the process of this connection and output this logical relationship, and then LLM is used to check the logical relationship. This method of generating associated relationships can replace the previous knowledge matching method. Therefore, the present invention uses LLM to generate a logical chain of thoughts and self-checks the logical chain of thoughts to check the associated relationship, and proposes a method and system for generating key information associated relationships in defect text descriptions. Summary of the invention

[0011] The purpose of the present invention is to provide a method and system for generating key information association relationships in defect text descriptions, so as to solve the problem that the existing technology solution proposed in the above background technology retrieves knowledge from the knowledge base to support the generation of association relationships, resulting in the output of random association relationships.

[0012] To achieve the above object, the present invention adopts the following technical solutions:

[0013] The first aspect of the present invention provides a method for generating a key information association relationship in a defect text description, which is characterized by comprising the following steps:

[0014] S1. Generation of candidate association relationships: using a large language model to generate several candidate association relationships between key information in the defect description;

[0015] S2, semantic expansion of key information: using a large language model to semantically expand all key information and candidate associations;

[0016] S3, logical thinking chain generation: using a large language model based on chain reasoning to gradually deduce the connection between each candidate association relationship and key information after semantic expansion, and obtain the logical thinking chain between each candidate association relationship and key information through multi-step reasoning;

[0017] S4, logical thinking chain check: verify the logical thinking chain of each candidate association relationship by inputting the corresponding logical thinking chain and key information into the large language model, the large language model predicts the association relationship, and judges the similarity between the predicted association relationship of the large language model and the corresponding candidate association relationship, to verify whether the logical thinking chain is valid;

[0018] S5. Determine the association relationship; if the logical thinking chain is verified to be valid, the corresponding candidate association relationship will be used as the correct association relationship between the key information.

[0019] Preferably, the semantic extension of the key information in S2 includes background knowledge, occurrence conditions, attack methods and related protection measures of the key information.

[0020] Preferably, S3 is specifically as follows:

[0021] The chain reasoning method is used to generate the corresponding logical thinking chain for each known combination of key information and different candidate association relationships; that is, a logical thinking chain is generated for n groups of triples [key information 1, candidate association relationship i, key information 2], 1≤i≤n, n is the number of candidate association relationships; the logical thinking chain generated by any triple [key information 1, association relationship i, key information 2] is as follows:

[0022] Key information 1 → Reasoning connection 1;

[0023] Reasoning connection 1 → Reasoning connection 2; ...

[0025] Reasoning connection x-1→reasoning connection x;

[0026] Inferred relation x → candidate relation i;

[0027] Candidate association relationship i→key information 2.

[0028] Preferably, the S4 is specifically as follows:

[0029] First, determine whether [key information 1, candidate association relationship i] has a logical relationship;

[0030] By inputting the defect description, key information 1 and the corresponding logical thinking chain into the large language model, the large language model outputs the predicted association relationship; the similarity between the predicted association relationship and the candidate association relationship i is compared;

[0031] Secondly, determine whether [candidate association relationship i, key information 2] has a logical relationship;

[0032] By inputting defect description, key information 2 and the corresponding logical thinking chain into the large language model, the large language model outputs the predicted association relationship; and compares the similarity between the predicted association relationship and the candidate association relationship i.

[0033] Preferably, the verification of whether the logical thinking chain is valid is as follows:

[0034] If [key information 1, candidate association i] and [candidate association i, key information 2] both have a logical relationship, that is, the similarity between the obtained predicted association and the candidate association exceeds the preset threshold, then the logical thinking chain is judged to be valid.

[0035] The second aspect of the present invention proposes a system for generating key information association relationships in defect text descriptions, including:

[0036] Candidate association relationship generation module: using a large language model to generate several candidate association relationships between key information;

[0037] Key information semantic expansion module: uses a large language model to semantically expand key information and candidate association relationships;

[0038] Logical thinking chain generation module: Uses a large language model based on chain reasoning to generate a logical thinking chain between key information and candidate association relationships;

[0039] Logical thinking chain checking module; uses a large language model to verify the logical thinking chain.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] (1) Customized key information expansion: The existing technology usually adopts fixed and unified rules for vulnerability analysis, which lacks flexibility for different defect texts. In contrast, the present invention adopts a key information expansion method based on LLM, which can generate background knowledge customized according to the specific content of the defect text. This method makes the key information expansion more accurate and avoids misjudgment caused by lack of context. Specifically, LLM can generate targeted extensions based on the context when analyzing the defect text, ensuring that the expanded background information is in line with reality and can enhance the semantic expression of key information.

[0042] (2) Adaptive association verification: The existing technology often uses fixed rules or models when verifying associations, which cannot adapt to the diversity of different software or defect scenarios. The present invention adopts a chain reasoning (COT) method, which can flexibly verify the correctness of key information and its association relationship according to the specific situation of each defect text. By simulating the reasoning logic of professional security personnel, chain reasoning can adjust the verification process according to different software types or defect characteristics, thereby improving the accuracy of association verification. In practical applications, COT can generate a reasoning chain based on the specific defect description, thereby avoiding the possible misjudgment of existing methods when faced with complex or ambiguous associations.

[0043] (3) Improve analysis accuracy and reliability: Existing vulnerability analysis methods often ignore the details of the defect description, which can easily lead to insufficient depth in the analysis of complex defects or omission of key factors. In contrast, the present invention customizes and expands key information and relationship verification, and specifically processes the characteristics of each defect text; it can ensure that key details are not missed during analysis, and can accurately infer possible vulnerability paths, significantly improving the accuracy and reliability of vulnerability analysis. Especially when faced with long-tail vulnerabilities or complex defect types, the present invention can flexibly adjust the analysis strategy according to the specific content of the defect text to provide more accurate analysis results.

[0044] (4) Higher context adaptability: Existing technologies often rely on a single analysis framework and cannot flexibly adapt to different software types or defect description methods. However, the present invention introduces an adaptive reasoning method based on LLM, which can dynamically adjust the analysis model according to the specific context of the defect text, so that the analysis results are more in line with actual needs. This context adaptability greatly enhances the wide applicability and flexibility of vulnerability analysis, especially when facing different development environments or software systems, and can provide more targeted analysis support.

[0045] In summary, the present invention overcomes the limitations of the existing technology in the verification of diverse defect texts and complex association relationships by introducing customized key information extension, chain reasoning verification and adaptive analysis strategies, and significantly improves the accuracy, reliability and context adaptability of vulnerability analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 The present invention is a flowchart of a method for generating key information association relationships in a defect text description. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] Embodiment 1:

[0049] See also Figure 1 , a key information association relationship generation system in defect text description, the core of this system lies in the semantic expansion of key information, the generation of thinking chain of key information and association relationship, and the inspection of thinking chain of key information and association relationship.

[0050] The key information association relationship generation system takes as input: defect description, key information 1, key information 2; and finally outputs: triple [key information 1, association relationship, key information 2]. The specific process of generating association relationships is as follows:

[0051] (1) Candidate association generation module:

[0052] Based on the input defect description, key information 1 and key information 2, a plurality of candidate association relationships are generated by using a knowledge base retrieval method.

[0053] The knowledge base retrieval methods used include solutions based on semantic vector retrieval, rule matching and templates, knowledge graphs, and NLP text similarity analysis.

[0054] In this embodiment, a large language model (LLM) is directly used to generate several candidate association relationships.

[0055] (2) Key information and relationship semantic expansion module:

[0056] In the security field, key information and relationships usually involve a lot of professional terms and are concise and compact. These short pieces of information often lack sufficient background and context, making it difficult for the model to fully understand their semantics. Therefore, it is necessary to first semantically expand key information and relationships to increase the completeness and accuracy of their expression. This process can help the model better capture the connotation of key information and improve the effectiveness of subsequent analysis.

[0057] The traditional approach is to expand short text into longer descriptions through generative models to provide more contextual information for understanding. However, this approach is not suitable for key information containing professional terms. For example, the key information of many vulnerabilities such as "buffer overflow" or "SQL injection" has strong domain specificity and rich information, which is difficult to replace by simple text expansion. These terms are standard terms in the field of information security and have clear and unique semantic expressions.

[0058] In order to make up for this deficiency, the present invention uses a large language model (LLM) for semantic expansion. Specifically, LLM can generate more detailed background knowledge based on key information, supplementing its possible impact, common scenarios, potential risks, etc. For example, for the key information of "buffer overflow", LLM will not only give a definition, but also expand the description of its common attack methods, conditions for occurrence (such as memory management errors) and related protective measures. This expansion not only allows the model to have a deeper understanding of key information, but also helps the model better grasp its specific performance in different contexts.

[0059] For example, assuming the key information is "Privilege Escalation", LLM may generate the following extension:

[0060] Background: Privilege escalation refers to an attacker elevating his or her privilege level in the system through vulnerabilities or configuration errors. This usually occurs in the operating system or application, where the attacker obtains higher privileges (such as administrator privileges) to perform unauthorized operations.

[0061] Typical scenario: In desktop applications without network connection, attackers may obtain administrator privileges through local vulnerabilities (such as buffer overflow). In network applications, attackers may obtain remote management privileges through vulnerabilities, thereby maliciously controlling the system.

[0062] Protective measures: limit program permissions, regularly check and update system patches, use the principle of least privilege, etc.

[0063] Through such semantic expansion, not only the semantic depth of key information is enhanced, but also the foundation is laid for subsequent association relationship verification.

[0064] (3) Logical thinking chain generation module:

[0065] After the semantic expansion of key information is completed, it is necessary to further generate a chain of thought (COT) related to the key information and its associations. The core purpose of this step is to simulate the reasoning process of professional security personnel, so as to help verify the logic and rationality between key information and associations. Corresponding logical thinking chains are generated for all the candidate associations and key information mentioned above.

[0066] The connection between key information and association relationships is often affected by the specific software environment, vulnerability type and its context. For example, the key information "obtaining permissions" may have different expressions in different software systems. In an operating system, it may mean "obtaining local administrator permissions"; while in a network application, it may mean "obtaining remote control permissions." In order to ensure the correctness of association relationships in various software and scenarios, the present invention introduces the chain reasoning (COT) method.

[0067] Chain of Origin (COT) simulates the thinking logic of professional security analysts and gradually deduces the connection between key information and association relationships. For example, when the key information is "obtaining permissions", COT will help understand how this process is achieved through vulnerabilities or system configuration errors, and clarify the logic behind each step of reasoning.

[0068] Specifically, for each known combination of key information and its associated relationships, a corresponding reasoning chain is generated. For example, for the key information "obtaining permissions", the chain reasoning may be as follows:

[0069] Reasoning step 1: An attacker exploits a vulnerability in the software (such as a buffer overflow) to gain low-privilege access.

[0070] Reasoning step 2: Use a low-privileged account to further explore the system and find vulnerabilities that can escalate privileges.

[0071] Reasoning step 3: Through this vulnerability, the attacker can elevate to administrator or system level privileges.

[0072] Through multi-step reasoning, the logical chain between key information and association relationships can be clearly described, providing strong support for subsequent verification and analysis.

[0073] (4) Logical thinking chain checking module:

[0074] After completing the chain reasoning generation, the logical thinking chain checking phase begins. The goal of this module is to verify the validity of the chain reasoning through the model. Specifically, the generated chain reasoning is input into the large language model, allowing the model to predict the "tail" of the association relationship based on the context of the reasoning, that is, to predict the final association relationship result. The logical thinking chain corresponding to each candidate association relationship is verified.

[0075] The triple [key information 1, association relationship, key information 2] and the corresponding logical thinking chain are checked in two parts;

[0076] First, verify whether [key information 1, association relationship] has a logical relationship;

[0077] By inputting the defect description, key information 1 and the corresponding logical thinking chain, check the similarity between the LLM output result and the association relationship;

[0078] Secondly, verify whether [association, key information 2] has a logical relationship;

[0079] By inputting the defect description, key information 2 and the corresponding logical thinking chain, check the similarity between the LLM output result and the association relationship.

[0080] For each part, the corresponding reasoning chain is generated by LLM, and LLM is required to predict the "tail" of the chain. For example, if the first part of the reasoning chain is "obtain authority → obtain local authority", the present invention requires LLM to generate further reasoning based on this part to determine whether a reasonable "tail" can be predicted, that is, the specific consequences or risks of local authority.

[0081] (5) Association determination module:

[0082] If the similarity between the tail predicted by LLM and the actual tail exceeds a preset threshold (such as 0.8), the reasoning chain is considered valid. In this way, it can be ensured that the connection between each key information and its associated relationship is reasonable and accurate.

[0083] For example, in the verification of the key information "obtaining permissions", LLM may predict the possible consequences of "remote control permissions" based on the generated reasoning chain and compare it with the actual vulnerability description. If the predicted tail is highly consistent with the actual description, then the reasoning chain is considered correct.

[0084] For the logical thinking chains corresponding to multiple candidate associations, there may be multiple correct verification results. In this case, there are multiple associations between key information 1 and key information 2, and finally each verified correct association is output. That is, the triple [key information 1, association, key information 2] after verification is output.

[0085] The present invention separates and executes semantic information expansion in parallel with logical thinking chain generation and logical thinking chain checking, so that the present invention can ensure that key information and association relationships are fully verified at their respective semantic and logical levels. Semantic information expansion helps to improve the semantic depth of key information, while logical thinking chain generation and checking ensure the logical consistency between key information and its association relationships. This multi-level verification mechanism not only enhances the ability to understand key information, but also improves the accuracy of association relationship judgment, providing reliable support for the enhancement of missing key information and vulnerability analysis.

[0086] Embodiment 2:

[0087] The key information association relationship generation system in Example 1 is used to generate the key information association relationship of the defect description in this embodiment, as follows:

[0088] This example uses CVE-2002-1877 "NETGEAR FM114P allows remote attackers to bypass website access restrictions by using a URL that uses an IP address instead of a host name" as an example.

[0089] System input:

[0090] Flaw description: NETGEAR FM114P allows remote attackers to bypass website access restrictions by using URLs with IP addresses instead of hostnames

[0091] Key Information 1: Remote Attacker

[0092] Key information 2: Bypassing website access restrictions

[0093] (1) After the candidate association generation module, the module processes as follows:

[0094] Input in Large Language Model (LLM):

[0095] Flaw description: NETGEAR FM114P allows remote attackers to bypass website access restrictions by using URLs with IP addresses instead of hostnames

[0096] Key Information 1: Remote Attacker

[0097] Key information 2: Bypassing website access restrictions

[0098] Large Language Model (LLM) output:

[0099] Relationship 1: RCE flaw

[0100] Relationship 2: Buffer Overflow

[0101] Relationship 3: SQL injection

[0102] …

[0103] Relationship 8: Improper input validation

[0104] (2) After the key information and association relationship semantic expansion module, the module processes as follows:

[0105] The background knowledge of both the association relationship and key information is expanded.

[0106] (3) After the logical thinking chain generates modules, the module processing is as follows:

[0107] Taking the association relationship (RCE defect) as an example, we look for the logical thinking chain between the key information (remote attacker) and the association relationship (RCE defect), that is, the logical thinking chain of the triple [remote attacker, RCE, bypassing the access restrictions of the website];

[0108] LLM Input:

[0109] Flaw description: NETGEAR FM114P allows remote attackers to bypass website access restrictions by using URLs with IP addresses instead of hostnames

[0110] Key Information 1: Remote Attacker

[0111] Key information 2: Bypassing website access restrictions

[0112] Relationship 1: RCE flaw

[0113] The steps to generate a logical chain of thinking are as follows:

[0114] 1. This vulnerability allows remote attackers to bypass access restrictions.

[0115] 2. The attacker can start the telnet service, which allows them to remotely access the target system with root privileges.

[0116] 3. An attacker can exploit this vulnerability to execute arbitrary operating system commands, which indicates a potential remote code execution (RCE) vulnerability.

[0117] 4. The vulnerability is triggered through an unspecified vector and may involve several attack methods such as buffer overflow, SQL injection, or cross-site scripting5.

[0118] 5. Overall, this vulnerability allows an attacker to remotely compromise the target system and execute arbitrary code with root privileges, which is a clear sign of an RCE vulnerability.

[0119] This module uses LLM based on the chain reasoning method to complete the reasoning from remote attackers to RCE flaws step by step. The steps in the above logical thinking chain are not unique, because the logical relationship itself does not determine how many steps to reason out.

[0120] (4) After checking the module through the logical thinking chain, the module processing is as follows:

[0121] This module mainly verifies whether the triple [remote attacker, RCE, bypassing website access restrictions] is correct by verifying the logical chain output by the logical thinking chain generation module.

[0122] First, determine whether [remote attacker, RCE] has a logical relationship;

[0123] By directly inputting the defect description into LLM, then inputting the key information 1 “remote attacker”, and then inputting this logical chain, LLM can predict the association relationship that can be inferred from the key information 1 and the logical chain.

[0124] For LLM input:

[0125] Flaw description: NETGEAR FM114P allows remote attackers to bypass website access restrictions by using URLs with IP addresses instead of hostnames

[0126] Key Information 1: Remote Attacker

[0127] Logical chain:

[0128] 1. This vulnerability allows remote attackers to bypass access restrictions.

[0129] 2. The attacker can start the telnet service, which allows them to remotely access the target system with root privileges.

[0130] 3. An attacker can exploit this vulnerability to execute arbitrary operating system commands, which indicates a potential remote code execution (RCE) vulnerability.

[0131] 4. The vulnerability is triggered through an unspecified vector and may involve several attack methods such as buffer overflow, SQL injection, or cross-site scripting5.

[0132] 5. Overall, this vulnerability allows an attacker to remotely compromise the target system and execute arbitrary code with root privileges, which is a clear sign of an RCE vulnerability.

[0133] Requirements: What key information can be generated from key information 1 and relationship 1?

[0134] LLM generates: "RCE".

[0135] The generated result proves that [remote attacker, RCE] has a logical relationship.

[0136] Secondly, determine whether [RCE, bypassing website access restrictions] has a logical relationship;

[0137] Similarly, by directly inputting the defect description into LLM, then inputting the key information 2 "bypassing the access restrictions of the website", and then inputting this logical chain, LLM can predict the association relationship that can be inferred from the key information 2 and the logical chain.

[0138] If LLM generates: “RCE”.

[0139] The generated result proves that [RCE, bypassing website access restrictions] has a logical relationship.

[0140] (5) After the association relationship is determined, the module is processed as follows:

[0141] Compare the similarity between the LLM generated result "RCE" in the logical thinking chain check module and the association relationship "RCE defect" used in the logical thinking chain generation module. If they are similar, it means that RCE is the correct association relationship. Finally, it is proved that the triple [remote attacker, RCE, bypassing the access restrictions of the website] is correct.

[0142] Similarly, for other relationships in the candidate relationship generation module:

[0143] Relationship 2: Buffer Overflow

[0144] Relationship 3: SQL injection

[0145] …

[0146] Relationship 8: Improper input validation

[0147] It is necessary to determine whether the following triple is correct:

[0148]

Remote attacker, buffer overflow, bypass website access restrictions

[0149] [Remote attacker, SQL injection, bypassing website access restrictions]

[0150]

Remote attacker,..., bypass the website's access restrictions

[0151] [Remote attacker, improper input validation, bypassing website access restrictions]

[0152] These associations are also verified by reasoning according to the association "RCE defect" in the logical thinking chain generation module to the association determination module, and finally the correct association is retained. If there are multiple associations, multiple associations are retained, because there may also be multiple associations between two key information. The correct triple is output as the final result.

[0153] In summary, the key technical points of the present invention include the following aspects:

[0154] First, the present invention achieves a deep understanding and accurate reasoning of security vulnerability information by introducing a key information semantic expansion and association relationship verification method based on a large language model (LLM). Compared with the prior art, the present invention combines chain reasoning (COT) with LLM, which not only improves the semantic parsing ability of key information, but also enhances the accuracy of association relationship reasoning, especially in complex environments.

[0155] Secondly, another key point of the present invention is to customize the key information expansion and correlation verification according to the characteristics of different defect texts. Existing technologies mostly rely on fixed and unified rules for vulnerability analysis, while the present invention can flexibly adjust the reasoning process according to the specific content of different defect texts, thereby avoiding the risk of misjudgment and lack of versatility in existing methods. Through customized processing of different types of defect texts, the present invention can more accurately identify and infer key information and correlations, effectively improving the accuracy and reliability of vulnerability analysis.

[0156] The above description is only used to help understand the method of the present invention and its core essence, but the protection scope of the present invention is not limited thereto. For those skilled in the art in the art, equivalent replacement or change according to the technical solution and inventive concept of the present invention within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A method for generating key information association relationships in defect text descriptions, characterized in that: The steps include: S1. Generation of candidate association relationships: using a large language model to generate several candidate association relationships between key information in the defect description; S2, semantic expansion of key information: using a large language model to semantically expand all key information and candidate associations; S3, logical thinking chain generation; A large language model is used to gradually deduce the connection between each candidate association relationship and key information after semantic expansion based on the chain reasoning method, and the logical thinking chain between each candidate association relationship and key information is obtained through multi-step reasoning; S4, logical thinking chain check: verify the logical thinking chain of each candidate association relationship by inputting the corresponding logical thinking chain and key information into the large language model, the large language model predicts the association relationship, and judges the similarity between the predicted association relationship of the large language model and the corresponding candidate association relationship, to verify whether the logical thinking chain is valid; S5. Determine the association relationship; if the logical thinking chain is verified to be valid, the corresponding candidate association relationship will be used as the correct association relationship between the key information.

2. The method for generating key information association relationships in defect text description according to claim 1, characterized in that: The semantic extension of the key information in S2 includes the background knowledge, occurrence conditions, attack methods and related protection measures of the key information.

3. The method for generating key information association relationships in defect text description according to claim 2, characterized in that: The S3 is as follows: The chain reasoning method is used to generate the corresponding logical thinking chain for each known combination of key information and different candidate association relationships; that is, a logical thinking chain is generated for n groups of triples [key information 1, candidate association relationship i, key information 2], 1≤i≤n, n is the number of candidate association relationships; the logical thinking chain generated by any triple [key information 1, association relationship i, key information 2] is as follows: Key information 1 → Reasoning connection 1; Reasoning connection 1 → Reasoning connection 2; ... Reasoning connection x-1→reasoning connection x; Inferred relation x → candidate relation i; Candidate association relationship i→key information 2.

4. The method for generating key information association relationships in defect text description according to claim 2, characterized in that: The S4 is specifically as follows: First, determine whether [key information 1, candidate association relationship i] has a logical relationship; By inputting the defect description, key information 1 and the corresponding logical thinking chain into the large language model, the large language model outputs the predicted association relationship; the similarity between the predicted association relationship and the candidate association relationship i is compared; Secondly, determine whether [candidate association relationship i, key information 2] has a logical relationship; By inputting defect description, key information 2 and the corresponding logical thinking chain into the large language model, the large language model outputs the predicted association relationship; and compares the similarity between the predicted association relationship and the candidate association relationship i.

5. The method for generating key information association relationships in defect text description according to claim 4, characterized in that: The verification logic chain is valid as follows: If [key information 1, candidate association i] and [candidate association i, key information 2] both have a logical relationship, that is, the similarity between the obtained predicted association and the candidate association exceeds the preset threshold, then the logical thinking chain is judged to be valid.

6. A system for generating key information association relationships in defect text descriptions used in the method of any one of claims 1 to 5, characterized in that: include: Candidate association relationship generation module; A large language model is used to generate several candidate associations between key information; Key information semantic expansion module; Use a large language model to semantically expand key information and candidate associations; Logical thinking chain generation module; A large language model is used to generate a logical thinking chain between key information and candidate association relationships based on chain reasoning; Logical thinking chain checking module; uses a large language model to verify the logical thinking chain.

Images