A neural-symbolic fusion interrupt-driven program defect detection method

Abstract

The present invention discloses a neural symbol fusion interrupt driven program defect detection method, which relates to the field of interrupt driven program defect detection technology, including the following steps: Step 1, support interrupt concurrent analysis phase, this phase is for the program to be analyzed P , identify the set of program points S where defects occur through preliminary static analysis and collect information sets that are difficult to accurately process through static analysis Q , laying the foundation for subsequent analysis; specifically including the following three sub-steps: Sensitive point analysis: according to the type of defect to be detected T , using data flow analysis technology to locate the set of program points where defects occur in the program S This neural-symbolic fusion interrupt-driven program defect detection method fully combines the semantic understanding capabilities of a large language model with the comprehensive path coverage capabilities of static analysis, effectively overcoming the limitations of traditional detection methods in processing loop logic, array subscript analysis, and bitwise operation solving.

Description

Technical Field

[0001] The present invention relates to the technical field of interrupt-driven program defect detection, and in particular to an interrupt-driven program defect detection method using neural-symbolic fusion. Background Art

[0002] Interrupt-driven programs are widely used in safety-critical fields such as aerospace, medical devices, and autonomous driving. For example, in aerospace, the control systems of various aircraft utilize interrupt-driven programs extensively to ensure rapid response to emergencies. These programs utilize interrupt mechanisms to rapidly respond to external events. Their operational logic often incorporates complex interrupt handling, preemption behavior, and dynamic control flow features. The occurrence of interrupt events is often uncertain, and the preemption behavior they trigger can cause dynamic changes in the program's execution sequence, further complicating program logic analysis. Due to these characteristics, interrupt-driven programs are prone to various types of defects during development and operation, including array out-of-bounds errors, use of uninitialized variables, and atomicity violations. These defects can not only affect the functional correctness of the program but also pose a serious threat to the security and reliability of the system.

[0003] Currently, mainstream program defect detection methods fall into two main categories: static analysis and dynamic testing. Static analysis analyzes the syntax and semantics of program code, attempting to discover potential defects without executing the program. Its theoretical advantage lies in its ability to fully explore all possible paths through the program. However, static analysis often proves inadequate when dealing with complex control flows, nested loops, and dynamic context dependencies, prone to false positives or omissions due to overly conservative or overly abstract analysis. Furthermore, static analysis tools often struggle to accurately analyze program sections involving bitwise operations and complex logical expressions. Dynamic testing, on the other hand, detects defects by running the program and monitoring its behavior, capable of catching issues during actual program execution. However, the coverage of dynamic testing is limited by the test inputs, and it cannot cover all possible execution paths, making it prone to missing hidden defects. Furthermore, dynamic testing can be difficult to reproduce and exhibits poor repeatability for intermittent errors or defects that rely on specific paths to trigger. Furthermore, dynamic testing's environment simulation and path traversal capabilities are significantly limited in highly complex interrupt scenarios.

[0004] The characteristics of interrupt-driven programs further magnify the limitations of traditional detection methods. The dynamic nature of control flow and path uncertainty significantly complicate defect detection. Interrupts and preemption complicate path exploration. Furthermore, expressions involving bitwise operations and nested loops often struggle to be accurately processed by traditional static analysis tools. Existing detection tools often struggle to fully cover critical logical points in interrupt-driven programs, failing to accurately capture potential defects. Therefore, new research is urgently needed to address the challenges of defect detection in interrupt-driven environments.

[0005] Therefore, in view of this, we study and improve the existing structural deficiencies and propose an interrupt-driven program defect detection method based on neural-symbolic fusion. Summary of the Invention

[0006] The purpose of the present invention is to provide an interrupt-driven program defect detection method based on neural-symbolic fusion to solve the problems raised in the above-mentioned background technology.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a neural-symbolic fusion interrupt-driven program defect detection method, comprising the following steps:

[0008] Step 1: Support interruption concurrent analysis phase. This phase targets the program to be analyzed. P , identify the set of program points S where defects occur through preliminary static analysis and collect information sets that are difficult to accurately process through static analysis Q , laying the foundation for subsequent analysis; specifically including the following three sub-steps:

[0009] (1) Sensitive point analysis: according to the type of defect to be detected T , using data flow analysis technology to locate the set of program points where defects occur in the program S For array out-of-bounds defects, analyze the access operations of the task queue array and mark possible array out-of-bounds points; for data competition defects, analyze the read and write operations of shared variables, mark concurrent write points as possible defect points, and define the program point set S for: in s It is an instruction or code snippet in a program;

[0010] (2) Interrupt concurrency analysis: For the main task and interrupt program, construct the abstract syntax tree, function call graph and control dependency graph one by one, and generate the program dependency graph based on this. According to the interrupt priority and interrupt switch operation, perform interrupt enable analysis and preemption analysis, mark the key program points that may be affected by the interrupt, and capture the dynamic characteristics of the interrupt behavior. On this basis, combine the sensitive point set S and defect types T, using a bottom-up modular analysis method, gradually tracing back from the called function to the calling function, generating all paths that trigger sensitive points P S , and collect the path constraint set C :

[0011]

[0012] (3) Path pruning: To reduce the false alarm rate, the SMT solver is used to verify the feasibility of the path. If the constraint condition If the conditions are met, the corresponding path is retained; otherwise, the path is marked as untriggerable and pruned:

[0013] ;

[0014] Step 2: Information enhancement based on large language models. This stage targets the set of uncertain information marked in static analysis. Q , using the semantic understanding ability of the large language model to perform supplementary analysis and obtain a high-quality supplementary information set A, which specifically includes the following sub-steps:

[0015] Context extraction and prompt word construction, for each uncertain information in the uncertain information set Q Extract context and construct semantically complete and targeted prompt words, which are then input into the large language model in natural language form.

[0016] (1) Semantic reasoning and result generation: The large language model uses prompt words to reason and analyze complex loop logic, array index relationships, and bitwise operation expressions to generate a high-quality set of supplementary information. A The results include the range of loop variables, the range of array subscripts, and the results of bitwise operation expressions, and are output in a structured form to provide support for subsequent static analysis. The large language model analyzes the loop variables at / *ALERT* / based on the input prompt word information. length The value of is 7;

[0017] (2) Static analysis enhancement: Feed the high-quality supplementary information set A back to the static analysis engine, combine the supplementary constraint information with the program context, and perform a secondary static analysis on the marked sensitive paths and fragments. In the first round of static analysis, it is difficult to analyze the bitwise operation and thus the variable length However, after receiving information feedback from a large language model, this information is used as a known condition to input into static analysis, thereby achieving more accurate analysis. This multi-round collaborative analysis mechanism significantly improves the accuracy and comprehensiveness of defect detection and obtains the final defect detection results.

[0018] Step 3: False positive elimination based on the large language model. This stage uses the large language model to optimize the defect detection results generated by static analysis to resolve possible false positives. This includes the following sub-steps:

[0019] Context building and prompt design: Context building and prompt design are performed for each defect detection result of static analysis.

[0020] Multi-round reasoning and verification: The large language model performs multi-round reasoning and analysis on the defect path and context based on the input prompt word to verify whether the defect actually exists. Paths that are falsified during the reasoning process are marked as false positives and removed.

[0021] (3) Optimized result output: The final detection result includes verified real defects, related paths and trigger conditions.

[0022] Furthermore, during the static analysis process, for program fragments involving complex loop structures, array subscript calculations, or complex bitwise operation expressions, since they are difficult to parse directly, they will be specially marked and context information will be collected. After normalization, they will be output as a JSON uncertain information set Q.

[0023] Furthermore, based on the information to be analyzed q Based on the type of prompt, targeted prompt design is carried out to construct the final prompt word.

[0024] Further, in step 2, according to the provided q Some contextual information context , combined with the function call graph and program dependency graph obtained in step 1, trace context All dependencies in the context for a complete build context':

[0025] .

[0026] Furthermore, in step 3, the entire function fragment where the defect is located is extracted as the context , and design prompt words according to the defect type T.

[0027] Furthermore, in the environment containerization configuration and creation module, users complete the basic environment, computing resources, and model version for running the evaluation algorithm, and generate an independent container with the corresponding configuration.

[0028] Furthermore, in step three, when the large language model does not provide sufficient contextual information, it can autonomously seek more contextual information until it can perform accurate analysis, thereby ensuring the accuracy of the inference results.

[0029] Furthermore, in step three, a high-quality defect report is generated and given in JSON format, providing developers and testers with accurate repair basis.

[0030] This invention provides an interrupt-driven program defect detection method using neural-symbolic fusion, which has the following beneficial effects: It fully combines the semantic understanding capabilities of a large language model with the comprehensive path coverage capabilities of static analysis, effectively overcoming the limitations of traditional detection methods in processing loop logic, array subscript analysis, and bitwise operation solving. By introducing a multi-round collaborative analysis mechanism and supplementary information optimization based on a large language model, the invention significantly improves the efficiency and accuracy of interrupt-driven program defect detection.

[0031] It can accurately and efficiently detect defects in interrupt-driven programs. This innovation not only provides higher quality assurance for the software development process, but also effectively prevents potential risks caused by defects, especially in high-security scenarios such as aerospace, medical equipment, and autonomous driving. At the same time, this invention helps developers and testers quickly identify and resolve potential defects in the early stages of software development, significantly improving the security and reliability of software and promoting the development of trustworthy embedded software in key areas. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 This is a flowchart of a neural-symbolic fusion interrupt-driven program defect detection method of the present invention;

[0033] Figure 2 This is a framework diagram of a neural-symbolic fusion interrupt-driven program defect detection method of the present invention;

[0034] Figure 3 The code context constructed for the model-based information enhancement phase of the present invention;

[0035] Figure 4 These are prompt words constructed in the model-based information enhancement stage provided by the present invention. DETAILED DESCRIPTION

[0036] The following embodiments of the present invention are described in further detail with reference to the accompanying drawings and examples. The following examples are used to illustrate the present invention but are not intended to limit the scope of the present invention.

[0037] like Figure 1-Figure 4 As shown in the figure, a neural symbol fusion interrupt driven program defect detection method, step one, supports the interrupt concurrent analysis phase. This phase targets the program to be analyzed. P , identify the set of program points S where defects occur through preliminary static analysis and collect information sets that are difficult to accurately process through static analysis Q , laying the foundation for subsequent analysis. It specifically includes the following three sub-steps (such as Figure 2 shown).

[0038] (1) Sensitive point analysis. According to the type of defect to be detected T , using data flow analysis technology to locate the set of program points where defects may occur in the program S For example, for array out-of-bounds defects, analyze the access operations of the task queue array and mark possible array out-of-bounds points; for data competition defects, analyze the read and write operations of shared variables and mark concurrent write points as possible defect points. Define the program point set S for:

[0039]

[0040] in s An instruction or snippet of code in a program.

[0041] (2) Interrupt concurrency analysis. For the main task and interrupt program, construct the abstract syntax tree (AST), function call graph (CG) and control dependency graph (CDG) one by one, and generate the program dependency graph (PDG) based on this. According to the interrupt priority and interrupt switch operation, perform interrupt enable analysis and preemption analysis, mark the key program points that may be affected by the interrupt, and capture the dynamic characteristics of the interrupt behavior. On this basis, combined with the sensitive point set S and defect types T , using a bottom-up modular analysis method, gradually tracing back from the called function to the calling function, generating all paths that trigger sensitive points P S , and collect the path constraint set C :

[0042]

[0043] (3) Path pruning. To reduce the false alarm rate, the SMT solver is used to verify the feasibility of the path. If the constraint condition If the conditions are met, the corresponding path is retained; otherwise, the path is marked as untriggerable and pruned:

[0044]

[0045] In addition, during the static analysis process, program fragments involving complex loop structures, array subscript calculations, or complex bitwise operation expressions are difficult to parse directly, so they are specially marked and context information is collected. After normalization, they are output as a JSON uncertainty information set Q. An example is shown below: [

[0047] {

[0048] "File": "home / data / project / 261 / src / 1.00 / Rss.c",

[0049] "Func": "fnCANCheckSum",

[0050] "VarName": "length",

[0051] "Line": "232",

[0052] "Column": 6,

[0053] "Request": "The loop variable value is difficult to determine"

[0054] }, … ]

[0056] The document contains multiple objects, each representing a piece of information that requires further analysis. Each object describes a specific variable or statement in the code, its file, function, line, and column location, and the specific problem that needs to be solved.

[0057] Step 2: Information enhancement based on large language model. This stage targets the uncertain information set marked in static analysis. Q , using the semantic understanding ability of the large language model to perform supplementary analysis and obtain a high-quality supplementary information set A. Specifically, it includes the following sub-steps:

[0058] (1) Context extraction and prompt word construction. For each piece of uncertain information in the uncertain information set Q Extract context and construct semantically complete and targeted prompt words, which are input into the large language model in natural language form. q Some contextual information context , combined with the function call graph and program dependency graph obtained in step 1, trace context All dependencies in the context for a complete build context' :

[0059]

[0060] In addition, according to the information to be analyzed q Type, carry out targeted prompt design, and construct the final prompt word. An example is Figure 3 and Figure 4 As shown, Figure 3 In the example of step 1, the context code is constructed based on the information to be analyzed. Figure 4 is the final design prompt. To simplify the expression, Figure 4 middle <code>Part of the description is Figure 3 The code shown.

[0061] (2) Semantic reasoning and result generation. The large language model uses prompt words to reason and analyze complex loop logic, array index relationships, and bitwise operation expressions to generate a high-quality set of supplementary information. A The results include the range of loop variables, the range of array subscripts, and the results of bitwise operation expressions, and are output in a structured form to support subsequent static analysis. The large language model analyzes the loop variables at / *ALERT* / based on the input prompt word information. length The value of is 7.

[0062] (3) Static analysis enhancement. Feed the high-quality supplementary information set A back to the static analysis engine, combine the supplementary constraint information with the program context, and perform a secondary static analysis on the marked sensitive paths and fragments. As in the above example, in the first round of static analysis, it is difficult to analyze the bit operation and thus cannot obtain the variable length However, after using the large language model to assist with information feedback, this information is used as a known condition for static analysis, enabling more accurate analysis. This multi-round collaborative analysis mechanism significantly improves the accuracy and comprehensiveness of defect detection, resulting in the final defect detection results.

[0063] Step 3: False positive elimination based on the large language model. This stage uses the large language model to optimize the defect detection results generated by static analysis to resolve possible false positives. This includes the following sub-steps:

[0064] (1) Context construction and prompt design. For each defect detection result of static analysis, context construction and prompt design are performed one by one. Specifically, the entire function fragment where the defect is located is extracted as the context. , and design prompt words based on the defect type T. In addition, a variety of prompt engineering technologies, including thought chain reasoning, task decomposition, and self-verification technology, are used to generate prompt words that are suitable for large language models to ensure the accuracy of reasoning results.

[0065] (2) Multi-round reasoning and verification. The large language model performs multi-round reasoning analysis on the defect path and context based on the input prompt word to verify whether the defect actually exists. Paths that are falsified during the reasoning process are marked as false positives and removed. When the large language model is unable to provide sufficient contextual information, it can autonomously seek more contextual information until it can accurately analyze the problem, thereby ensuring the accuracy of the reasoning results.

[0066] Optimized output of results. The final test results contain verified real defects, related paths, and trigger conditions. High-quality defect reports are generated and presented in JSON format, providing developers and testers with accurate repair basis.

[0067] The embodiments of the present invention are presented for purposes of illustration and description and are not intended to be exhaustive or to limit the invention to the disclosed forms. Many modifications and variations will be apparent to those skilled in the art. The embodiments are chosen and described in order to better illustrate the principles of the invention and its practical application and to enable those skilled in the art to understand the invention and design various embodiments with various modifications as suited for specific applications.< / code>

Claims

1. A neural-symbolic fusion interrupt-driven program defect detection method, characterized by: The following steps are involved: Step 1: The interrupt-supported concurrent analysis phase. This phase targets the program P to be analyzed. Initial static analysis is performed to identify the set of program points S where defects occur and to collect information sets Q that are difficult to accurately process through static analysis. This lays the foundation for subsequent analysis. This phase includes the following three sub-steps: (1) Sensitive point analysis: Based on the defect type T to be detected, the data flow analysis technology is used to locate the set of program points S where the defect occurs in the program. For array out-of-bounds defects, the access operations of the task queue array are analyzed and possible array out-of-bounds points are marked. For data race defects, the read and write operations of shared variables are analyzed and concurrent write points are marked as possible defect points. The program point set S is defined as: S={s|s∈P, and satisfies the initial judgment condition of defect type T} Where s is an instruction or code snippet in the program; (2) Interrupt concurrency analysis: For the main task and interrupt program, we build an abstract syntax tree, function call graph, and control dependency graph one by one, and generate a program dependency graph based on this. We perform interrupt enable analysis and preemption analysis based on interrupt priority and interrupt switch operation, mark key program points that may be affected by interrupts, and capture the dynamic characteristics of interrupt behavior. On this basis, we combine the sensitive point set S and defect type T, adopt a bottom-up modular analysis method, and gradually trace back from the called function to the calling function to generate all paths P that trigger sensitive points. S , and collect the path constraint set C: C = {c|c is a path condition, and the feasibility of the triggered path depends on its truth value} (3) Path pruning: To reduce the false alarm rate, the SMT solver is used to verify the feasibility of the path. If the constraint condition c∈C is satisfied, the corresponding path is retained; otherwise, the path is marked as untriggerable and pruned: C′={c|c satisfies} P s ={p|p corresponds to c∈C′}; Step 2: Information enhancement based on the large language model. This stage uses the semantic understanding capabilities of the large language model to perform supplementary analysis on the uncertain information set Q marked in the static analysis to obtain the supplementary information set A. This specifically includes the following sub-steps: Context extraction and prompt word construction: extract the context of each uncertain information q∈Q in the uncertain information set Q, and construct semantically complete and targeted prompt words, which are input into the large language model in the form of natural language; (1) Semantic reasoning and result generation: Based on the prompt word, the large language model performs reasoning and analysis on complex loop logic, array index relationships, and bitwise operation expressions, and generates a supplementary information set A. The results include the value range of the loop variable, the value range of the array subscript, and the result of the bitwise operation expression, and are output in a structured form to support subsequent static analysis. Based on the input prompt word information, the large language model analyzes that the value of the loop variable length at / *ALERT* / is 7; (2) Static analysis enhancement: The supplementary information set A is fed back to the static analysis engine. Combined with the supplementary constraint information and program context, a secondary static analysis is performed on the marked sensitive paths and fragments. In the first round of static analysis, the value of the variable length cannot be obtained due to the difficulty in analyzing bitwise operations. However, after the large language model assists in information feedback, this information is input as a known condition to the static analysis, thereby achieving more accurate analysis. Through this multi-round collaborative analysis mechanism, the accuracy and comprehensiveness of defect detection are significantly improved, and the final defect detection results are obtained; Step 3: False positive elimination based on the large language model. This stage uses the large language model to optimize the defect detection results generated by static analysis to resolve possible false positives. This includes the following sub-steps: (1) Context construction and prompt design: For each defect detection result of static analysis, context construction and prompt design are performed one by one; (2) Multi-round reasoning and verification: The large language model performs multi-round reasoning analysis on the defect path and context based on the input prompt words to verify whether the defect actually exists. Paths that are falsified during the reasoning process are marked as false positives and removed. (3) Optimized result output: The final detection result includes verified real defects, related paths and trigger conditions.

2. The interrupt-driven program defect detection method based on neural-symbolic fusion according to claim 1, characterized in that: During the static analysis process, program fragments involving complex loop structures, array subscript calculations, or complex bitwise operation expressions are difficult to parse directly, so they will be specially marked and context information will be collected. After normalization, they will be output as a JSON uncertain information set Q.

3. The interrupt-driven program defect detection method for neural-symbolic fusion according to claim 2, characterized in that: According to the type of information q to be analyzed, targeted prompt design is carried out to construct the final prompt word.

4. The interrupt-driven program defect detection method based on neural-symbolic fusion according to claim 3, characterized in that: In step 2, based on the partial context information of q provided, combined with the function call graph and program dependency graph obtained in step 1, all dependencies in the context are traced, thereby constructing a complete context context': context' = context∪{r|r is a dependency related to q}.

5. The interrupt-driven program defect detection method based on neural-symbolic fusion according to claim 4 is characterized in that: In step 3, the entire function fragment where the defect is located is extracted as the context "context", and prompt words are designed according to the defect type T.

6. The interrupt-driven program defect detection method based on neural-symbolic fusion according to claim 5, characterized in that: In the environment containerization configuration and creation module, users complete the basic environment, computing resources, and model version for running the evaluation algorithm, and generate an independent container with the corresponding configuration.

7. The interrupt-driven program defect detection method based on neural-symbolic fusion according to claim 6, characterized in that: In step three, when the large language model is not able to provide sufficient contextual information, it can autonomously seek more contextual information until it can perform accurate analysis, thereby ensuring the accuracy of the inference results.

8. The interrupt-driven program defect detection method based on neural-symbolic fusion according to claim 7, characterized in that: In step 3, a defect report is generated and given in JSON format, providing developers and testers with accurate repair basis.

Images