Neural symbol fused interrupt-driven program defect detection method

Abstract

The invention discloses an interrupt-driven program defect detection method based on neural symbol fusion, and relates to the technical field of interrupt-driven program defect detection, which comprises the following steps: step 1, a concurrent analysis stage of supporting interrupt: aiming at a program P to be analyzed, carrying out parallel analysis on the program P; a program point set S with defects is recognized through preliminary static analysis, an information set Q which is difficult to process accurately through static analysis is collected, and a foundation is laid for subsequent analysis; the method specifically comprises the following three sub-steps: sensitive point analysis: positioning a program point set S with defects in a program by utilizing a data flow analysis technology according to a defect type T to be detected; according to the interrupt-driven program defect detection method based on neural symbol fusion, the semantic comprehension ability of a large language model and the comprehensive path coverage ability of static analysis are fully combined, and the limitation of a traditional detection method in the aspects of processing loop logic, array subscript analysis, bit operation solving and the like is effectively overcome.

Description

Technical Field

[0001] The present invention relates to the technical field of interrupt-driven program defect detection, and in particular to an interrupt-driven program defect detection method of neural-symbolic fusion. Background Art

[0002] Interrupt-driven programs are widely used in key safety fields such as aerospace, medical equipment, and autonomous driving. For example, in aerospace, the control systems of various aircraft use a large number of interrupt-driven programs to ensure rapid response to emergencies. This type of program uses the interrupt mechanism to achieve rapid response to external events, and its operating logic usually includes complex interrupt processing, preemption behavior, and dynamic control flow characteristics. The occurrence of interrupt events is often uncertain, and the preemption behavior triggered by it will cause the execution sequence of the program to change dynamically, thereby increasing the complexity of analyzing the program logic. Due to these characteristics, interrupt-driven programs are prone to introduce various types of defects during development and operation, including array out-of-bounds, use of uninitialized variables, and atomicity violations. These defects may not only affect the functional correctness of the program, but also pose a serious threat to the security and reliability of the system.

[0003] At present, the mainstream program defect detection methods are mainly divided into two categories: static analysis and dynamic testing. Static analysis analyzes the syntax and semantics of program code and tries to find potential defects without executing the program. Its theoretical advantage is that it can fully explore all possible paths of the program. However, static analysis often shows insufficient capabilities when facing complex control flows, nested loops, and dynamic context dependencies, and is prone to false positives or false negatives due to overly conservative or overly abstract analysis. At the same time, static analysis tools are usually difficult to accurately handle program parts involving bit operations and complex logical expressions. On the other hand, dynamic testing detects defects by running the program and monitoring its behavior, which can capture problems in the actual operation of the program. However, the coverage of dynamic testing is restricted by the test input, and it cannot cover all possible execution paths, and it is easy to miss hidden defects. In addition, dynamic testing shows the shortcomings of difficulty in reproducing intermittent errors or defects that rely on specific paths to trigger, and poor repeatability. At the same time, in highly complex interrupt scenarios, the environmental simulation and path traversal capabilities of dynamic testing are significantly limited.

[0004] The characteristics of interrupt-driven programs further magnify the limitations of traditional detection methods. The dynamic changes in control flow and the uncertainty of paths significantly increase the difficulty of defect detection; the occurrence and preemption of interrupts also make path exploration more complicated; in addition, expressions involving bit operations, loop nesting and other characteristics are often difficult to be accurately processed by traditional static analysis tools. When dealing with interrupt-driven programs, existing detection tools often find it difficult to fully cover their logical key points and cannot accurately capture potential defects. Therefore, we urgently need to carry out new research to meet the challenges of defect detection methods in interrupt-driven environments.

[0005] Therefore, in view of this, the existing structural deficiencies are studied and improved, and a neural-symbolic fusion interrupt-driven program defect detection method is proposed. Summary of the invention

[0006] The purpose of the present invention is to provide a neural-symbolic fusion interrupt-driven program defect detection method to solve the problems raised in the above-mentioned background technology.

[0007] To achieve the above object, the present invention provides the following technical solution: a neural symbol fusion interrupt-driven program defect detection method, comprising the following steps: Step 1: Support interrupted concurrent analysis phase. This phase targets the program to be analyzed. P , through preliminary static analysis, identify the set of program points S where defects occur and collect information sets that are difficult to accurately process with static analysis Q , which lays the foundation for subsequent analysis; specifically includes the following three sub-steps: (1) Sensitive point analysis: based on the type of defect to be detected T , using data flow analysis technology to locate the set of program points where defects occur in the program S For array out-of-bounds defects, analyze the access operations of the task queue array and mark possible array out-of-bounds points; for data competition defects, analyze the read and write operations of shared variables, mark concurrent write points as possible defect points, and define the program point set S for: in s It is an instruction or code snippet in a program; (2) Interrupt concurrency analysis: For the main task and interrupt program, we build an abstract syntax tree, function call graph, and control dependency graph one by one, and generate a program dependency graph based on this. We perform interrupt enable analysis and preemption analysis based on interrupt priority and interrupt switch operation, mark key program points that may be affected by interrupts, and capture the dynamic characteristics of interrupt behavior. On this basis, we combine the sensitive point set S and defect type T , using a bottom-up modular analysis method, gradually tracing back from the called function to the calling function, generating all paths that trigger sensitive pointsP S , and collect the set of path constraints C :

[0008] (3) Path pruning: To reduce the false positive rate, the SMT solver is used to verify the path feasibility. If it is satisfied, the corresponding path is retained; otherwise, the path is marked as untriggerable and trimmed: ; Step 2: Information enhancement based on the large language model. This stage targets the uncertain information set marked in static analysis. Q , using the semantic understanding ability of the large language model to perform supplementary analysis and obtain a high-quality supplementary information set A, which specifically includes the following sub-steps: Context extraction and prompt word construction, for each uncertain information in the uncertain information set Q Extract context and construct semantically complete and targeted prompt words, which are input into the large language model in natural language form; (1) Semantic reasoning and result generation: The large language model performs reasoning and analysis on complex loop logic, array index relationships, and bitwise operation expressions based on prompt words to generate a high-quality set of supplementary information. A The results include the range of loop variables, the range of array subscripts, and the results of bitwise operation expressions, and are output in a structured form to provide support for subsequent static analysis. The large language model analyzes the loop variables at / *ALERT* / based on the input prompt word information. length The value of is 7; (2) Static analysis enhancement: Feed the high-quality supplementary information set A back to the static analysis engine, combine the supplementary constraint information with the program context, and perform a secondary static analysis on the marked sensitive paths and fragments. In the first round of static analysis, it is difficult to analyze bitwise operations and thus cannot obtain the variable length The value of , but after the large language model assists in information feedback, the information is input into the static analysis as a known condition, so as to achieve more accurate analysis. Through this multi-round collaborative analysis mechanism, the accuracy and comprehensiveness of defect detection are significantly improved, and the final defect detection result is obtained; Step 3: Eliminate false positives based on the large language model. In this stage, the large language model is used to optimize the defect detection results generated by static analysis to solve possible false positive problems. The specific steps include the following: Context construction and prompt design: For each defect detection result of static analysis, context construction and prompt design are performed one by one; Multi-round reasoning and verification: The large language model performs multi-round reasoning and analysis on the defect path and context based on the input prompt words to verify whether the defect actually exists. Paths that are falsified during the reasoning process are marked as false positives and removed. (3) Optimized result output: The final detection result includes verified real defects, related paths and trigger conditions.

[0009] Furthermore, during the static analysis process, for program fragments involving complex loop structures, array subscript calculations, or complex bitwise operation expressions, since they are difficult to parse directly, they will be specially marked and context information will be collected, and then output as a JSON uncertain information set Q after normalization.

[0010] Further, according to the information to be analyzed q Based on the type of prompt, targeted prompt design is carried out to construct the final prompt words.

[0011] Further, in step 2, according to the provided q Some context information context , combined with the function call graph and program dependency graph obtained in step 1, trace context All dependencies in the context for a complete build context': .

[0012] Furthermore, in step 3, the entire function fragment where the defect is located is extracted as the context , and design prompt words according to the defect type T.

[0013] Furthermore, in the environment containerization configuration and creation module, the user completes the basic environment, computing resources, and model version for the operation of the evaluation algorithm, and generates an independent container with the corresponding configuration.

[0014] Furthermore, in step three, when the large language model does not provide sufficient context information, it can autonomously seek more context information until it can perform accurate analysis, thereby ensuring the accuracy of the inference results.

[0015] Furthermore, in step three, a high-quality defect report is generated and given in JSON format, providing developers and testers with accurate repair basis.

[0016] The present invention provides a neural-symbolic fusion interrupt-driven program defect detection method, which has the following beneficial effects: The present invention fully combines the semantic understanding ability of a large language model with the comprehensive path coverage ability of static analysis, effectively overcoming the limitations of traditional detection methods in processing loop logic, array subscript analysis, and bit operation solution. By introducing a multi-round collaborative analysis mechanism and supplementary information optimization based on a large language model, the present invention significantly improves the efficiency and accuracy of interrupt-driven program defect detection; It can accurately and efficiently detect defects in interrupt-driven programs. This innovation not only provides higher quality assurance for the software development process, but also effectively prevents potential risks caused by defects, especially in high-security scenarios such as aerospace, medical equipment, and autonomous driving. At the same time, the present invention helps developers and testers to quickly identify and resolve potential defects in the early stages of software development, greatly improving the security and reliability of the software and promoting the development of the credibility of embedded software in key areas. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A schematic flow chart of a neural-symbolic fusion interrupt-driven program defect detection method of the present invention; Figure 2 A framework diagram of a neural-symbolic fusion interrupt-driven program defect detection method of the present invention; Figure 3 The code context constructed for the model-based information enhancement phase of the present invention; Figure 4 The prompt words are constructed in the model-based information enhancement stage provided by the present invention. DETAILED DESCRIPTION

[0018] The following embodiments of the present invention are described in further detail in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0019] like Figure 1-Figure 4 As shown in the figure, a neural-symbolic fusion interrupt-driven program defect detection method, step 1, supports the concurrent analysis phase of interrupts. This phase targets the program to be analyzed. P , through preliminary static analysis, identify the set of program points S where defects occur and collect information sets that are difficult to accurately process with static analysis Q , laying the foundation for subsequent analysis. It includes the following three sub-steps (such as Figure 2 as shown).

[0020] (1) Sensitive point analysis. According to the type of defect to be detected T , using data flow analysis technology to locate the set of program points where defects may occur in the program SFor example, for array out-of-bounds defects, analyze the access operations of the task queue array and mark possible array out-of-bounds points; for data competition defects, analyze the read and write operations of shared variables and mark concurrent write points as possible defect points. Define a set of program points S for:

[0021] in s An instruction or snippet of code in a program.

[0022] (2) Interrupt concurrency analysis. For the main task and interrupt program, we build the abstract syntax tree (AST), function call graph (CG) and control dependency graph (CDG) one by one, and generate the program dependency graph (PDG) on this basis. According to the interrupt priority and interrupt switch operation, we perform interrupt enable analysis and preemption analysis, mark the key program points that may be affected by the interrupt, and capture the dynamic characteristics of the interrupt behavior. On this basis, we combine the sensitive point set S and defect type T , using a bottom-up modular analysis method, gradually tracing back from the called function to the calling function, generating all paths that trigger sensitive points P S , and collect the set of path constraints C :

[0023] (3) Path pruning. To reduce the false positive rate, the SMT solver is used to verify the path feasibility. If it is satisfied, the corresponding path is retained; otherwise, the path is marked as untriggerable and trimmed:

[0024] In addition, during the static analysis process, for program fragments involving complex loop structures, array subscript calculations, or complex bitwise operation expressions, since they are difficult to parse directly, they will be specially marked and context information will be collected. After normalization, they will be output as a JSON uncertain information set Q. The example is as follows: [ { "File": "home / data / project / 261 / src / 1.00 / Rss.c", "Func": "fnCANCheckSum", "VarName": "length", "Line": "232", "Column": 6, "Request": "The loop variable value is difficult to determine" }, ...... ] The document contains multiple objects, each of which represents a piece of information that needs further analysis. Each object describes a specific variable or statement in the code, its file, function, line, and column location, and a specific problem that needs to be solved.

[0025] Step 2: Information enhancement based on large language models. This stage targets the uncertain information set marked in static analysis. Q , using the semantic understanding ability of the large language model to perform supplementary analysis and obtain a high-quality supplementary information set A. Specifically, it includes the following sub-steps: (1) Context extraction and prompt word construction. For each piece of uncertain information in the uncertain information set Q Extract context and construct semantically complete and targeted prompt words, which are input into the large language model in natural language form. q Some context information context , combined with the function call graph and program dependency graph obtained in step 1, trace context All dependencies in the context for a complete build context' :

[0026] In addition, according to the information to be analyzed q Type, conduct targeted prompt design, and construct the final prompt word. An example is Figure 3 and Figure 4 As shown, Figure 3 In the example of step 1, the context code is constructed based on the information to be analyzed. Figure 4 is the final design prompt. To simplify the expression, Figure 4 middle <code>Part of the description is Figure 3 The code shown.

[0027] (2) Semantic reasoning and result generation. The large language model uses prompt words to reason and analyze complex loop logic, array index relationships, and bitwise operation expressions to generate a high-quality set of supplementary information. A The results include the value range of loop variables, the value range of array subscripts, and the results of bitwise operation expressions, and are output in a structured form to provide support for subsequent static analysis. The large language model analyzes the loop variable at / *ALERT* / based on the input prompt word information. length The value of is 7.

[0028] (3) Static analysis enhancement. Feed the high-quality supplementary information set A back to the static analysis engine, and combine the supplementary constraint information with the program context to perform secondary static analysis on the marked sensitive paths and fragments. As in the above example, in the first round of static analysis, it is difficult to analyze bitwise operations and thus it is impossible to obtain the variable length However, after the large language model assists in information feedback, the information is input into the static analysis as a known condition, thus achieving more accurate analysis. Through this multi-round collaborative analysis mechanism, the accuracy and comprehensiveness of defect detection are significantly improved, and the final defect detection results are obtained.

[0029] Step 3: Eliminate false positives based on the large language model. In this stage, the large language model is used to optimize the defect detection results generated by static analysis to solve possible false positive problems. It includes the following sub-steps: (1) Context construction and prompt design. For each defect detection result of static analysis, context construction and prompt design are performed one by one. Specifically, the entire function fragment where the defect is located is extracted as the context. , and design prompt words according to the defect type T. In addition, a variety of prompt engineering technologies are used, including thought chain reasoning, task decomposition and self-verification technology, to generate prompt words suitable for the large language model to ensure the accuracy of the reasoning results.

[0030] (2) Multiple rounds of reasoning and verification. The large language model performs multiple rounds of reasoning and analysis on the defect path and context based on the input prompt words to verify whether the defect actually exists. Paths that are falsified during the reasoning process are marked as false positives and removed. When the large language model is unable to provide sufficient context information, it can autonomously seek more context information until it can accurately analyze the situation, thereby ensuring the accuracy of the reasoning results.

[0031] The final test results include verified real defects, related paths and trigger conditions, generate high-quality defect reports and give reports in JSON format, providing developers and testers with accurate repair basis.

[0032] The embodiments of the present invention are given for the purpose of illustration and description, and are not intended to be exhaustive or to limit the invention to the disclosed forms. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiments are selected and described in order to better illustrate the principles and practical applications of the present invention and to enable those of ordinary skill in the art to understand the present invention and thereby design various embodiments with various modifications suitable for specific uses.< / code>

Claims

1. A neural-symbolic fusion interrupt-driven program defect detection method, characterized in that: The following steps are involved: Step 1: Support interrupted concurrent analysis phase. This phase targets the program to be analyzed. P , through preliminary static analysis, identify the set of program points S where defects occur and collect information sets that are difficult to accurately process with static analysis Q , which lays the foundation for subsequent analysis; specifically includes the following three sub-steps: (1) Sensitive point analysis: based on the type of defect to be detected T , using data flow analysis technology to locate the set of program points where defects occur in the program S For array out-of-bounds defects, analyze the access operations of the task queue array and mark possible array out-of-bounds points; for data competition defects, analyze the read and write operations of shared variables, mark concurrent write points as possible defect points, and define the program point set S for: in s It is an instruction or code snippet in a program; (2) Interrupt concurrency analysis: For the main task and interrupt program, we build an abstract syntax tree, function call graph, and control dependency graph one by one, and generate a program dependency graph based on this. We perform interrupt enable analysis and preemption analysis based on interrupt priority and interrupt switch operation, mark key program points that may be affected by interrupts, and capture the dynamic characteristics of interrupt behavior. On this basis, we combine the sensitive point set S and defect type T , using a bottom-up modular analysis method, gradually tracing back from the called function to the calling function, generating all paths that trigger sensitive points P S , and collect the set of path constraints C : ； (3) Path pruning: To reduce the false positive rate, the SMT solver is used to verify the path feasibility. If it is satisfied, the corresponding path is retained; Otherwise, mark the path as untriggerable and clip it: ； Step 2: Information enhancement based on the large language model. This stage targets the uncertain information set marked in static analysis. Q , using the semantic understanding ability of the large language model to perform supplementary analysis and obtain a high-quality supplementary information set A, which specifically includes the following sub-steps: Context extraction and prompt word construction: extract the context of each piece of uncertain information in the uncertain information set Q, and construct semantically complete and targeted prompt words, which are input into the large language model in the form of natural language; (1) Semantic reasoning and result generation: The large language model performs reasoning and analysis on complex loop logic, array index relationships, and bitwise operation expressions based on prompt words to generate a high-quality set of supplementary information. A The results include the range of loop variables, the range of array subscripts, and the results of bitwise operation expressions, and are output in a structured form to provide support for subsequent static analysis. The large language model analyzes the loop variables at / *ALERT* / based on the input prompt word information. length The value of is 7; (2) Static analysis enhancement: Feed the high-quality supplementary information set A back to the static analysis engine, combine the supplementary constraint information with the program context, and perform a secondary static analysis on the marked sensitive paths and fragments. In the first round of static analysis, it is difficult to analyze bitwise operations and thus cannot obtain the variable length The value of , but after the large language model assists in information feedback, the information is input into the static analysis as a known condition, so as to achieve more accurate analysis. Through this multi-round collaborative analysis mechanism, the accuracy and comprehensiveness of defect detection are significantly improved, and the final defect detection result is obtained; Step 3: Eliminate false positives based on the large language model. In this stage, the large language model is used to optimize the defect detection results generated by static analysis to solve possible false positive problems. The specific steps include the following: Context construction and prompt design: For each defect detection result of static analysis, context construction and prompt design are performed one by one; Multi-round reasoning and verification: The large language model performs multi-round reasoning and analysis on the defect path and context based on the input prompt words to verify whether the defect actually exists. Paths that are falsified during the reasoning process are marked as false positives and removed. (3) Optimized result output: The final detection result includes verified real defects, related paths and trigger conditions.

2. The interrupt-driven program defect detection method of neural symbol fusion according to claim 1 is characterized in that: During the static analysis process, for program fragments involving complex loop structures, array subscript calculations, or complex bitwise operation expressions, since they are difficult to parse directly, they will be specially marked and context information will be collected. After normalization, they will be output as a JSON uncertain information set Q.

3. The interrupt-driven program defect detection method of neural symbol fusion according to claim 2 is characterized in that: According to the information to be analyzed q Based on the type of prompt, targeted prompt design is carried out to construct the final prompt words.

4. The interrupt-driven program defect detection method of neural symbol fusion according to claim 3 is characterized in that: In step 2, according to the provided q Some context information context , combined with the function call graph and program dependency graph obtained in step 1, trace context All dependencies in the context for a complete build context': .

5. The interrupt-driven program defect detection method of neural symbol fusion according to claim 4 is characterized in that: Step 3: Extract the entire function fragment where the defect is located as context , and design prompt words according to the defect type T.

6. The interrupt-driven program defect detection method of neural symbol fusion according to claim 5, characterized in that: In the environment containerization configuration and creation module, the user completes the basic environment, computing resources, and model version for the running of the evaluation algorithm, and generates an independent container with the corresponding configuration.

7. The interrupt-driven program defect detection method of neural symbol fusion according to claim 6 is characterized in that: In step three, when the large language model provides insufficient context information, it can autonomously seek more context information until it can perform accurate analysis, thereby ensuring the accuracy of the inference results.

8. The interrupt-driven program defect detection method of neural symbol fusion according to claim 7 is characterized in that: In step 3, a high-quality defect report is generated and given in JSON format, providing developers and testers with accurate repair basis.

Images