Logical vulnerability knowledge base construction method and device based on large language model, electronic equipment and storage medium

Abstract

The invention provides a logic vulnerability knowledge base construction method and device based on a large language model, electronic equipment and a storage medium. The method comprises the steps that the large language model is used for collecting logic vulnerability data; extracting information of a natural language level and a code semantic level related to a vulnerability principle from the logic vulnerability data, sequentially constructing a vulnerability detection logic cue word, a vulnerability reason cue word and a service constraint cue word according to the information, and transmitting the vulnerability detection logic cue word, the vulnerability reason cue word and the service constraint cue word to a large language model; summarizing vulnerability detection logic, vulnerability reasons and business constraints; building vulnerability knowledge cue words according to vulnerability reasons, and transmitting the vulnerability knowledge cue words to the large language model to summarize vulnerability knowledge; and constructing a logic vulnerability knowledge base according to the vulnerability detection logic, the vulnerability reasons, the business constraints and the vulnerability knowledge. According to the method, automatic integration and systematic summarization of cross-source multi-dimensional vulnerability information can be realized.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and particularly relates to a method, device, electronic device and storage medium for constructing a logical vulnerability knowledge base based on a large language model. Background Art

[0002] With the continuous development of the Internet industry, the number of various network applications has been increasing, and the problem of logical vulnerabilities has become increasingly severe. Different from traditional memory overflow or injection vulnerabilities, logical vulnerabilities are rooted in design defects of business rules, and their causes are often strongly coupled with business scenarios and code implementations, showing significant characteristics of environmental dependence and concealment.

[0003] Traditional vulnerability mining tools lack the ability to deeply understand business semantics and still mainly rely on pattern matching-based detection mechanisms, which makes such tools perform poorly in the mining of logical vulnerabilities. With the development of large language models, their powerful semantic understanding and context reasoning capabilities provide an innovative technical path for logical vulnerability mining.

[0004] However, current large language models still face technical bottlenecks in the field of business logic vulnerability mining, that is, in complex business scenarios, it is difficult for the model to effectively deconstruct the mapping relationship between code implementation and business processes, resulting in deep logical defects being difficult to accurately identify. Although the context learning ability of large language models enables large language models to improve the logical defect detection ability through knowledge-enhanced prompt words, how to construct a knowledge system for vulnerability mining and how to design an efficient knowledge index have become the key challenges restricting technological breakthroughs.

[0005] It should be noted that the information disclosed in the background art part of this invention is only intended to deepen the understanding of the general background technology of this invention, and should not be regarded as an admission or any form of suggestion that this information constitutes the prior art known to those skilled in the art. Summary of the Invention

[0006] The purpose of the present invention is to provide a method, device, electronic device and storage medium for constructing a logical vulnerability knowledge base based on a large language model, which can realize the automatic integration and systematic summary of cross-source multi-dimensional vulnerability information, and lay a good foundation for improving the logical vulnerability detection ability of the model.

[0007] To achieve the above object, the present invention provides a method for constructing a logical vulnerability knowledge base based on a large language model, including: collecting logical vulnerability data from public vulnerability databases and open source code repositories using a large language model; extracting information at the natural language level and code semantic level related to the vulnerability principle from the logical vulnerability data; based on the information at the natural language level and code semantic level related to the vulnerability principle, constructing a vulnerability detection logic prompt, a vulnerability cause prompt, and a business constraint prompt in sequence, and transmitting the vulnerability detection logic prompt, the vulnerability cause prompt, and the business constraint prompt to the large language model to summarize the vulnerability detection logic, vulnerability cause, and business constraint; constructing a vulnerability knowledge prompt according to the vulnerability cause and transmitting the vulnerability knowledge prompt to the large language model to summarize the corresponding vulnerability knowledge; constructing a logical vulnerability knowledge base according to the vulnerability detection logic, the vulnerability cause, the business constraint, and the vulnerability knowledge.

[0008] Optionally, the collecting logical vulnerability data from public vulnerability databases and open source code repositories using a large language model includes: collecting standard vulnerability information entries and related vulnerability code information from the public vulnerability databases and the open source code repositories; extracting the required vulnerability information from the standard vulnerability information entries and the related vulnerability code information; constructing a vulnerability screening prompt according to the extracted required vulnerability information and the corresponding large language model prompt template; transmitting the vulnerability screening prompt to the large language model to screen out initial vulnerability data related to logical vulnerabilities; and screening out logical vulnerability data according to the manual verification results of experts on the initial vulnerability data.

[0009] Optionally, the required vulnerability information includes semantic information related to vulnerability causes, semantic information related to vulnerability patches, and code modification fragments submitted by users.

[0010] Optionally, the information at the natural language level and code semantic level related to the vulnerability principle includes semantic information related to vulnerability causes, official patch file URL links, patch description documents, version numbers of affected software projects, relative paths of files to which patch functions belong in open source projects, function name identifiers, starting line numbers and ending line numbers of function codes, vulnerability descriptions, patch descriptions, vulnerability type descriptions, code before patching, and code after patching.

[0011] Optionally, based on the information at the natural language level and the code semantics level related to the vulnerability principle, the vulnerability detection logic prompt, the vulnerability cause prompt, and the business constraint prompt are constructed in sequence, including: filling the information at the natural language level and the code semantics level related to the vulnerability principle into the vulnerability detection logic prompt template, the vulnerability cause prompt template, and the business constraint prompt template in sequence to construct the vulnerability detection logic prompt, the vulnerability cause prompt, and the business constraint prompt; constructing the vulnerability knowledge prompt according to the vulnerability cause, including: filling the vulnerability cause into the vulnerability knowledge prompt template to construct the vulnerability knowledge prompt.

[0012] Optionally, the vulnerability detection logic prompt can guide the large language model to focus on the vulnerable code and the vulnerability type before patching to summarize the vulnerability detection logic; the vulnerability cause prompt can guide the large language model to focus on the code before and after patching, the vulnerability description and the patch description, and guide the large language model to first think about the logical difference between the code before patching and the code after patching, and then think about the reason for adding the patch to summarize the corresponding vulnerability cause; the business constraint prompt can guide the large language model to focus on the code before and after patching, and guide the large language model to first think about the function of the code, and then think about the constraint conditions based on the difference between the code before patching and the code after patching to summarize the function and the constraint conditions, and the function and the constraint conditions together constitute the business constraint; the vulnerability knowledge prompt can guide the large language model to focus on the vulnerability cause and abstract the vulnerability cause to summarize the corresponding vulnerability knowledge.

[0013] Optionally, the method for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention further includes: using a text embedding model to convert the vulnerability detection logic and the business constraint from a natural language form to a vector form.

[0014] To achieve the above object, the present invention further provides a device for constructing a logical vulnerability knowledge base based on a large language model, including a data collection module, an information extraction module, a prompt word construction module, a knowledge summary module, and a knowledge base construction module; the data collection module is configured to collect logical vulnerability data from a public vulnerability database and an open source code repository using the large language model; the information extraction module is configured to extract information at the natural language level and the code semantics level related to the vulnerability principle from the logical vulnerability data; the prompt word construction module is configured to sequentially construct a vulnerability detection logic prompt word, a vulnerability cause prompt word, and a business constraint prompt word based on the information at the natural language level and the code semantics level related to the vulnerability principle; the knowledge summary module is configured to transfer the vulnerability detection logic prompt word, the vulnerability cause prompt word, and the business constraint prompt word to the large language model to summarize the vulnerability detection logic, the vulnerability cause, and the business constraint; the prompt word construction module is further configured to construct a vulnerability knowledge prompt word according to the vulnerability cause; the knowledge summary module is further configured to transfer the vulnerability knowledge prompt word to the large language model to summarize the corresponding vulnerability knowledge; The knowledge base construction module is configured to construct a logical vulnerability knowledge base according to the vulnerability detection logic, the vulnerability cause, the business constraint, and the vulnerability knowledge.

[0015] To achieve the above object, the present invention further provides an electronic device, including at least one processor and at least one memory, with a computer program stored on the memory, and when the computer program is executed by the processor, the method for constructing a logical vulnerability knowledge base based on a large language model described above is implemented.

[0016] To achieve the above object, the present invention further provides a readable storage medium, with a computer program stored therein, and when the computer program is executed by a processor, the method for constructing a logical vulnerability knowledge base based on a large language model described above is implemented.

[0017] Compared with the prior art, the method, apparatus, electronic device, and storage medium for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention have the following beneficial effects: By using the large language model to collect logical vulnerability data from public vulnerability databases and open source code repositories, the present invention can effectively collect and expand the scale of vulnerability samples in the logical vulnerability knowledge base; By extracting information at the natural language level and code semantic level related to the vulnerability principle from the logical vulnerability data, the causes, impacts, and repair logics of vulnerabilities can be captured more comprehensively; By constructing a vulnerability detection logic prompt, a vulnerability cause prompt, and a business constraint prompt in sequence based on the information at the natural language level (such as vulnerability descriptions and patch instructions) and code semantic level (such as code differences before and after patching) related to the vulnerability principle, the pertinence and accuracy of large language model analysis can be improved; By passing the vulnerability detection logic prompt, the vulnerability cause prompt, and the business constraint prompt to the large language model, the large language model can quickly and accurately summarize the detection logic (vulnerability detection logic) of the vulnerable code for sensitive parameters, the vulnerability cause, and the business constraints for each vulnerability; By constructing a vulnerability knowledge prompt according to the vulnerability cause and passing the vulnerability knowledge prompt to the large language model, the large language model can be guided to quickly and accurately summarize vulnerability knowledge with better generalization ability than the vulnerability cause for application to different code libraries or business scenarios; By constructing a logical vulnerability knowledge base according to the vulnerability detection logic, the vulnerability cause, the business constraint, and the vulnerability knowledge, prior knowledge can be provided for subsequent logical vulnerability mining to improve the comprehensiveness, efficiency, and generalization ability of the model's logical vulnerability detection, and provide guarantee for security protection in complex business scenarios. In summary, the present invention conducts intelligent analysis and knowledge refinement on multi-dimensional vulnerability information such as information at the natural language level and code semantic level related to the vulnerability principle based on the large language model, can realize automatic integration and systematic summary of cross-source multi-dimensional vulnerability information, and lay a good foundation for improving the logical vulnerability detection ability of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a flowchart of a method for constructing a logical vulnerability knowledge base based on a large language model provided by an embodiment of the present invention.

[0019] Figure 2 It is a flowchart of collecting logical vulnerability data provided by an embodiment of the present invention.

[0020] Figure 3 It is a schematic block diagram of a device for constructing a logical vulnerability knowledge base based on a large language model provided by an embodiment of the present invention.

[0021] Figure 4 It is a schematic block diagram of an electronic device provided by an embodiment of the present invention.

[0022] Among them, the description of the attached drawing reference numerals is as follows: data acquisition module - 110; information extraction module - 120; prompt word construction module - 130; knowledge summary module - 140; knowledge base construction module - 150; processor - 210; communication interface - 220; memory - 230; communication bus - 240. Detailed implementation manners

[0023] The following further elaborates in detail on the method, device, electronic device, and storage medium for constructing a logical vulnerability knowledge base based on a large language model proposed by the present invention in combination with the attached drawings and specific implementation manners. According to the following description, the advantages and features of the present invention will be clearer. It should be noted that the attached drawings are in a very simplified form and all use non-precise scales, only for conveniently and clearly assisting in explaining the purpose of the present invention.

[0024] It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the term "comprising", "including", or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article, or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such process, method, article, or device. Without further limitation, an element defined by the statement "including one..." does not exclude the existence of additional identical elements in the process, method, article, or device including the said element.

[0025] The core idea of the present invention is to provide a method, device, electronic device, and storage medium for constructing a logical vulnerability knowledge base based on a large language model, which can realize the automatic integration and systematic summary of cross-source and multi-dimensional vulnerability information, and lay a good foundation for improving the logical vulnerability detection ability of the model.

[0026] It should be noted that the method for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention can be applied to the device for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention. The device for constructing a logical vulnerability knowledge base based on a large language model can be configured on an electronic device. Among them, the electronic device can be a personal computer, a mobile terminal, etc. The mobile terminal can be a hardware device such as a mobile phone, a tablet computer, etc. with various operating systems. It should also be noted that as understood by those skilled in the art, the "large language model" referred to in the present invention can be, but is not limited to, models well-known to those skilled in the art such as ChatGPT, Claude, DeepSeek, etc.

[0027] To implement the above idea, the present invention provides a method for constructing a logical vulnerability knowledge base based on a large language model. Please refer to Figure 1 , which is a flowchart of the method for constructing a logical vulnerability knowledge base based on a large language model provided by an embodiment of the present invention. As Figure 1 shown, the method for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention includes the following steps: Step S100, collecting logical vulnerability data from a public vulnerability database and an open source code repository using a large language model; Step S200, extracting information at the natural language level and the code semantic level related to the vulnerability principle from the logical vulnerability data; Step S300, based on the information at the natural language level and the code semantic level related to the vulnerability principle, constructing a vulnerability detection logic prompt, a vulnerability cause prompt, and a business constraint prompt in sequence, and transmitting the vulnerability detection logic prompt, the vulnerability cause prompt, and the business constraint prompt to the large language model to summarize the vulnerability detection logic, the vulnerability cause, and the business constraint; Step S400, constructing a vulnerability knowledge prompt according to the vulnerability cause, and transmitting the vulnerability knowledge prompt to the large language model to summarize the corresponding vulnerability knowledge; Step S500, constructing a logical vulnerability knowledge base according to the vulnerability detection logic, the vulnerability cause, the business constraint, and the vulnerability knowledge.

[0028] The present invention can effectively collect and expand the scale of vulnerability samples in the logical vulnerability knowledge base by using a large language model to collect logical vulnerability data from public vulnerability databases (such as NVD) and open source code repositories (GitHub); by extracting information at the natural language level and code semantic level related to the vulnerability principle from the logical vulnerability data, it is possible to more comprehensively capture the causes, impacts, and repair logics of vulnerabilities; by successively constructing vulnerability detection logic prompt words, vulnerability cause prompt words, and business constraint prompt words based on the information at the natural language level (such as vulnerability descriptions, patch instructions) and code semantic level (such as code differences before and after patching) related to the vulnerability principle, the pertinence and accuracy of large language model analysis can be improved; by passing the vulnerability detection logic prompt words, the vulnerability cause prompt words, and the business constraint prompt words to the large language model, the large language model can quickly and accurately summarize the detection logic (vulnerability detection logic) of the vulnerable code for sensitive parameters, the vulnerability cause, and the business constraint for each vulnerability; by constructing vulnerability knowledge prompt words according to the vulnerability cause and passing the vulnerability knowledge prompt words to the large language model, the large language model can be guided to quickly and accurately summarize vulnerability knowledge with better generalization ability than the vulnerability cause for application to different code libraries or business scenarios; by constructing a logical vulnerability knowledge base according to the vulnerability detection logic, the vulnerability cause, the business constraint, and the vulnerability knowledge, prior knowledge can be provided for subsequent logical vulnerability mining to improve the comprehensiveness, efficiency, and generalization ability of the model's logical vulnerability detection and provide guarantee for security protection in complex business scenarios. In summary, the present invention conducts intelligent analysis and knowledge refinement on multi-dimensional vulnerability information such as information at the natural language level and code semantic level related to the vulnerability principle based on a large language model, can realize automatic integration and systematic summary of cross-source multi-dimensional vulnerability information, and lay a good foundation for improving the logical vulnerability detection ability of the model.

[0029] Please continue to refer to Figure 2 , which is a flowchart for collecting logical vulnerability data provided by an embodiment of the present invention. As Figure 2As shown, in some exemplary embodiments, the step S100, using the large language model to collect logical vulnerability data from the public vulnerability database and the open source code repository, includes: step S110, collecting standard vulnerability information entries and related vulnerability code information from the public vulnerability database and the open source code repository; step S120, extracting required vulnerability information from the standard vulnerability information entries and the related vulnerability code information; step S130, constructing vulnerability screening prompt words according to the extracted required vulnerability information and the corresponding large language model prompt word template; step S140, passing the vulnerability screening prompt words to the large language model to filter out initial vulnerability data related to logical vulnerabilities; step S150, filtering out logical vulnerability data according to the manual verification results of the initial vulnerability data by experts.

[0030] Therefore, the vulnerability screening prompt words can guide the large language model to focus on the characteristics of logical vulnerabilities, and quickly screen out high-confidence initial vulnerability data related to logical vulnerabilities from massive data; by having experts conduct manual screening after the large language model completes the vulnerability data screening, the reliability of the logical vulnerability data finally collected can be ensured.

[0031] Furthermore, the required vulnerability information includes semantic information related to the vulnerability cause, semantic information related to the vulnerability patch, and code modification snippets submitted by users. Thus, by extracting multi-dimensional vulnerability information such as semantic information related to the vulnerability cause, semantic information related to the vulnerability patch, and code modification snippets submitted by users, the accuracy and comprehensiveness of the logical vulnerability data finally collected can be effectively guaranteed.

[0032] Specifically, NVD (National Vulnerability Database) provides standardized vulnerability information (such as CVE numbers, CVSS scores, etc.) to support vulnerability analysis and risk management. Among them, CVE (Common Vulnerabilities and Exposures) is an internationally recognized vulnerability standardization identification system included in the National Vulnerability Database of the United States, which aims to provide unique identifiers and standardized descriptions for publicly disclosed network security vulnerabilities and exposure risks. Its core value lies in achieving the interoperability and collaborative governance of global network security threat information through unified naming specifications. CWE (Common Weakness Enumeration) is a software security defect classification standard maintained by MITRE Corporation, dedicated to systematically describing inherent defects (Weakness) in software design, development and implementation, and focusing on the root causes of vulnerabilities. According to the description of CWE, CVE vulnerabilities related to logical vulnerabilities can be screened out, such as CWE-22 for path traversal vulnerabilities, CWE-284 for improper access control, and CWE-863 for improper authentication.

[0033] Open-source code repositories include GitHub and Gitee. Taking Issue / Pull Request as an example, first, an automated collection process can be built to capture data entries (i.e., standard vulnerability information entries) that meet specific screening criteria on the GitHub platform through a targeted crawler system: Issue tickets and Pull Request requests with the keyword "Path Traversal" and a status marked as Closed, and use semantic analysis technology driven by large language models to automatically analyze the GitHub platform to collect relevant vulnerability code information.

[0034] After that, for the collected data entries (i.e., standard vulnerability information entries) and relevant vulnerability code information, multi-dimensional structured data (i.e., the required vulnerability information) is extracted: including but not limited to the conversation text in the Issue discussion area, embedded schematic diagrams, title descriptive text, and patch code snippets submitted by users. These elements together constitute the complete context environment of the Issue and Pull Request discussion content.

[0035] Then, the multi-dimensional structured data (i.e., the required vulnerability information) extracted above is filled into the corresponding large language model prompt template to construct a vulnerability screening prompt containing context features. The vulnerability screening prompt is input into the large language model for intelligent judgment, requiring the large language model to focus on analyzing two core dimensions: 1) Whether the current Issue / PullRequest discussion content involves features related to logical vulnerabilities, 2) Whether the patch code included shows a logical vulnerability repair pattern. Furthermore, a high-confidence sample set (i.e., initial vulnerability data) determined by the large language model to be related to logical vulnerabilities is constructed.

[0036] After the large language model completes the screening, it is screened by experts again to finally ensure that the collected Issues and Pull Requests are all related to logical vulnerabilities.

[0037] It should be noted that Issue is a collaborative tool for tracking and managing project tasks, issues or suggestions, allowing users to report bugs, submit feature requests or discuss improvements. Each Issue can include detailed descriptions, tags, milestones and participant information, facilitating team collaboration and prioritization, and helping project maintainers efficiently handle feedback and drive progress. Pull Request is a mechanism for developers to submit code changes to a project repository, allowing contributors to merge branch modifications into the main branch. Pull Request provides code diff, discussion area and automated check functions. Maintainers can review the code, provide modification suggestions, and merge the changes after confirmation. It is not only a code integration process, but also an important quality assurance and knowledge sharing link in open source collaboration. It should also be noted that the specific content on how to collect standard vulnerability information entries and related vulnerability code information from public vulnerability databases and open source code repositories can be adaptively understood with reference to the content well-known to those skilled in the art, and will not be elaborated here.

[0038] In some exemplary embodiments, the natural language level and code semantic level information related to the vulnerability principle include semantic information related to the cause of the vulnerability, the URL link of the official patch file, the patch description document, the version number of the affected software project, the relative path of the file to which the patched function belongs in the open source project, the function name identifier, the starting line number and ending line number of the function code, the vulnerability description, the patch description, the vulnerability type description, the code before patching and the code after patching. Thus, through this multi-dimensional information fusion, the large language model can effectively summarize the vulnerability detection logic, the cause of the vulnerability and the business constraints.

[0039] Specifically, for CVE vulnerabilities, the extracted natural language level and code semantic level information includes the CVE description of the vulnerability, the description submitted by the developer for the vulnerability patch in GitHub, the CWE type of the vulnerability, all the code of the function involved in the patch before patching, and all the code of the function involved in the patch after patching. For the collected Issue / Pull Request, the extracted natural language level and code semantic level information includes the Issue / Pull Request title, user discussions, the description submitted by the developer for the vulnerability patch in GitHub, the CWE type of the vulnerability, all the code of the function involved in the patch before patching, and all the code of the function involved in the patch after patching.

[0040] CVE descriptions related to vulnerabilities, Issue / Pull Request titles, and user discussion content usually contain multi-level security elements: At the natural language level, they systematically cover key information such as vulnerability types, the version range of affected products / codebases, potential attack vectors, and their security impacts. The code change logic presented in patch descriptions (including the code differences before and after vulnerability repair) provides a parsable vulnerability representation paradigm for large language models. Vulnerability type tags can guide large language models to establish targeted reasoning frameworks, thereby systematically constructing a vulnerability knowledge system. These natural language vulnerability feature information can effectively assist large language models in understanding the formation mechanism and the essence of logical defects of vulnerabilities. At the code semantics level, the comparative analysis of the code before and after the patch can not only reveal the concrete manifestation forms of vulnerabilities but also help large language models extract vulnerability pattern features from the code semantic differences. Through this multi-dimensional information fusion, large language models can effectively summarize vulnerability knowledge.

[0041] In some exemplary embodiments, based on the information at the natural language level and the code semantics level related to the vulnerability principle, vulnerability detection logic prompt words, vulnerability cause prompt words, and business constraint prompt words are constructed in sequence, including: filling the information at the natural language level and the code semantics level related to the vulnerability principle into the vulnerability detection logic prompt word template, the vulnerability cause prompt word template, and the business constraint prompt word template in sequence to construct the vulnerability detection logic prompt words, the vulnerability cause prompt words, and the business constraint prompt words; constructing vulnerability knowledge prompt words according to the vulnerability cause, including: filling the vulnerability cause into the vulnerability knowledge prompt word template to construct the vulnerability knowledge prompt words.

[0042] Thus, through predefined prompt word templates (vulnerability detection logic prompt word template, vulnerability cause prompt word template, business constraint prompt word template, and vulnerability knowledge prompt word template), it is possible to clearly require large language models to focus on specific analysis dimensions, ensure coverage of key vulnerability features, and avoid information omission to ensure the integrity of large language model analysis.

[0043] Specifically, when summarizing the detection logic of vulnerable code for sensitive parameters (i.e., the vulnerability detection logic), the information at the natural language level and the code semantics level related to the vulnerability principle extracted in step S200 is filled into the detection logic prompt word template for vulnerable code for sensitive parameters (i.e., the vulnerability detection logic prompt word template), and this prompt word template prompts the large language model to summarize the detection logic of vulnerable code for sensitive parameters.

[0044] When summarizing the vulnerability causes, fill the natural language level and code semantic level information related to the vulnerability principle extracted in step S200 into the vulnerability cause prompt template. This prompt template prompts the large language model to compare the differences between the code before patching and the code after patching, and summarizes the vulnerability causes in combination with other vulnerability information.

[0045] When summarizing the business constraints, fill the natural language level and code semantic level information related to the vulnerability principle extracted in step S200 into the business constraint prompt template. This prompt template prompts the large language model to focus on the function functions in the code fragments, and summarizes the function business functions and constraint conditions in combination with other vulnerability information. These two parts together constitute the business constraints of the vulnerability.

[0046] In some exemplary embodiments, the vulnerability detection logic prompt can guide the large language model to focus on the vulnerable code and the vulnerability type before patching, so as to summarize the vulnerability detection logic; the vulnerability cause prompt can guide the large language model to focus on the code before and after patching, the vulnerability description and the patch description, and guide the large language model to first think about the logical differences between the code before patching and the code after patching, and then think about the reasons for adding the patch, so as to summarize the corresponding vulnerability causes; the business constraint prompt can guide the large language model to focus on the code before and after patching, and guide the large language model to first think about the function functions of the code, and then think about the constraint conditions according to the differences between the code before patching and the code after patching, so as to summarize the function functions and constraint conditions, and the function functions and the constraint conditions together constitute the business constraints; the vulnerability knowledge prompt can guide the large language model to focus on the vulnerability causes and abstract the vulnerability causes, so as to summarize the corresponding vulnerability knowledge. Thus, this setting can ensure the standardization of the analysis process and reduce manual intervention.

[0047] Specifically, the vulnerability detection logic includes the detection operations performed by the vulnerable code on sensitive parameters and the execution order of these detection operations. The vulnerability causes include the defects in the detection logic of the vulnerable code for sensitive parameters, how these defects will be exploited, and the harms caused by the existence of these defects. The business function is the operation implemented by the function code, and the constraint condition is the purpose of the developer to implement this operation. By abstracting the vulnerability causes, information with obvious vulnerability characteristics in the vulnerability causes, such as function names, variable names, etc., can be removed.

[0048] In some exemplary embodiments, the method for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention further includes: using a text embedding model to convert the vulnerability detection logic and the business constraints from a natural language form into a vector form.

[0049] Thus, by converting vulnerability detection logic and business constraints from natural language form to vector form, vulnerability detection logic and business constraints that cannot be directly calculated can perform mathematical operations such as similarity comparison, clustering, and classification in a high-dimensional space, thereby providing support for downstream tasks.

[0050] Specifically, a text embedding model is a model that converts discrete objects (such as text, code, images, nodes, etc.) into continuous vector representations, and the text embedding model can be but is not limited to text-embedding-ada-002.

[0051] Please continue to refer to Figure 3 , which is a schematic block diagram of a logic vulnerability knowledge base construction device based on a large language model provided by an embodiment of the present invention. As Figure 3 shown, the logic vulnerability knowledge base construction device based on a large language model provided by the present invention includes a data collection module 110, an information extraction module 120, a prompt word construction module 130, a knowledge summary module 140, and a knowledge base construction module 150; the data collection module 110 is configured to collect logic vulnerability data from a public vulnerability database and an open source code repository using a large language model; the information extraction module 120 is configured to extract natural language level and code semantic level information related to vulnerability principles from the logic vulnerability data; the prompt word construction module 130 is configured to sequentially construct a vulnerability detection logic prompt word, a vulnerability cause prompt word, and a business constraint prompt word based on the natural language level and code semantic level information related to vulnerability principles; the knowledge summary module 140 is configured to pass the vulnerability detection logic prompt word, the vulnerability cause prompt word, and the business constraint prompt word to the large language model to summarize the vulnerability detection logic, the vulnerability cause, and the business constraint; the prompt word construction module 130 is further configured to construct a vulnerability knowledge prompt word according to the vulnerability cause; the knowledge summary module 140 is further configured to pass the vulnerability knowledge prompt word to the large language model to summarize the corresponding vulnerability knowledge; the knowledge base construction module 150 is configured to construct a logic vulnerability knowledge base according to the vulnerability detection logic, the vulnerability cause, the business constraint, and the vulnerability knowledge.

[0052] It should be noted that the logic vulnerability knowledge base construction device based on a large language model provided by the present invention can be used to execute the logic vulnerability knowledge base construction method based on a large language model described above. The technical principles, the technical problems solved, and the technical effects produced by the two are similar. Those skilled in the art of this technology can clearly understand that for the convenience and brevity of description, for more content about the logic vulnerability knowledge base construction device based on a large language model provided by the present invention, reference can be made to the content described in the above-mentioned logic vulnerability knowledge base construction method based on a large language model provided by the present invention, and details will not be described here again.

[0053] Based on the same inventive concept, the present invention also provides an electronic device. Please refer to Figure 4 , which is a schematic block diagram of the electronic device provided by an embodiment of the present invention. As Figure 4 shown, the electronic device includes at least one processor 210 and at least one memory 230. A computer program is stored on the memory 230. When the computer program is executed by the processor 210, the method for constructing a logical vulnerability knowledge base based on a large language model described above is implemented. Since the electronic device provided by the present invention and the method for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention belong to the same inventive concept, the electronic device provided by the present invention has at least all the beneficial effects of the method for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention. Therefore, for the beneficial effects of the electronic device provided by the present invention, reference can be made to the relevant descriptions of the beneficial effects of the method for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention above, and details will not be repeated here.

[0054] Please continue to refer to Figure 4 , as Figure 4 shown, the electronic device further includes a communication interface 220 and a communication bus 240. Among them, the processor 210, the communication interface 220, and the memory 230 complete mutual communication through the communication bus 240. The communication bus 240 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus 240 can be divided into an address bus, a data bus, a control bus, etc. For the sake of simplicity, only a thick line is used in the figure to represent it, but it does not mean that there is only one bus or one type of bus. The communication interface 220 is used for communication between the above-mentioned electronic device and other devices.

[0055] The present invention also provides a readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the method for constructing a logical vulnerability knowledge base based on a large language model described above can be implemented. Since the readable storage medium provided by the present invention and the method for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention belong to the same inventive concept, the readable storage medium provided by the present invention has at least all the beneficial effects of the method for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention. Therefore, for the beneficial effects of the readable storage medium provided by the present invention, reference can be made to the relevant descriptions of the beneficial effects of the method for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention in the above text, and no further elaboration will be made here.

[0056] In summary, compared with the prior art, the method, device, electronic device, and storage medium for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention have the following beneficial effects: The present invention conducts intelligent analysis and knowledge extraction on multi-dimensional vulnerability information such as natural language level and code semantic level information related to vulnerability principles based on a large language model, and can realize automatic integration and systematic summary of cross-source multi-dimensional vulnerability information, laying a good foundation for improving the logical vulnerability detection ability of the model.

[0057] It should be noted that the above description is only a description of the preferred embodiments of the present invention and does not limit the scope of the present invention in any way. Any changes and modifications made by those of ordinary skill in the art of the present invention based on the above disclosure shall fall within the protection scope of the present invention.

Claims

1. A method for constructing a logical vulnerability knowledge base based on a large language model, characterized in that, Including: Collecting logical vulnerability data from public vulnerability databases and open-source code repositories using a large language model; Extracting information at the natural language level and code semantic level related to the vulnerability principle from the logical vulnerability data; Based on the information at the natural language level and code semantic level related to the vulnerability principle, constructing a vulnerability detection logic prompt, a vulnerability cause prompt, and a business constraint prompt in sequence, and passing the vulnerability detection logic prompt, the vulnerability cause prompt, and the business constraint prompt to the large language model to summarize the vulnerability detection logic, the vulnerability cause, and the business constraint; Constructing a vulnerability knowledge prompt according to the vulnerability cause and passing the vulnerability knowledge prompt to the large language model to summarize the corresponding vulnerability knowledge; Constructing a logical vulnerability knowledge base according to the vulnerability detection logic, the vulnerability cause, the business constraint, and the vulnerability knowledge.

2. The method for constructing a logic vulnerability knowledge base based on a large language model according to claim 1, wherein The collecting of logical vulnerability data from public vulnerability databases and open-source code repositories using a large language model includes: Collecting standard vulnerability information entries and related vulnerability code information from the public vulnerability database and the open-source code repository; Extracting the required vulnerability information from the standard vulnerability information entries and the related vulnerability code information; Constructing a vulnerability screening prompt according to the extracted required vulnerability information and the corresponding large language model prompt template; Passing the vulnerability screening prompt to the large language model to screen out initial vulnerability data related to logical vulnerabilities; Screening out logical vulnerability data according to the manual verification results of experts on the initial vulnerability data.

3. The method for constructing a logical vulnerability knowledge base based on a large language model according to claim 2, wherein The required vulnerability information includes semantic information related to vulnerability causes, semantic information related to vulnerability patches, and code modification fragments submitted by users.

4. The method for constructing a logical vulnerability knowledge base based on a large language model according to claim 1, wherein The information at the natural language level and code semantic level related to the vulnerability principle includes semantic information related to vulnerability causes, the URL link of the official patch file, the patch description document, the version number of the affected software project, the relative path of the file to which the patched function belongs in the open-source project, the function name identifier, the starting line number and ending line number of the function code, the vulnerability description, the patch description, the vulnerability type description, the code before patching, and the code after patching.

5. The method for constructing a logical vulnerability knowledge base based on a large language model according to claim 1, wherein The constructing of a vulnerability detection logic prompt, a vulnerability cause prompt, and a business constraint prompt in sequence based on the information at the natural language level and code semantic level related to the vulnerability principle includes: Filling the information at the natural language level and code semantic level related to the vulnerability principle into the vulnerability detection logic prompt template, the vulnerability cause prompt template, and the business constraint prompt template in sequence to construct the vulnerability detection logic prompt, the vulnerability cause prompt, and the business constraint prompt in sequence; The constructing of a vulnerability knowledge prompt according to the vulnerability cause includes: Filling the vulnerability cause into the vulnerability knowledge prompt template to construct the vulnerability knowledge prompt.

6. The method for constructing a logical vulnerability knowledge base based on a large language model according to claim 1, wherein The vulnerability detection logic prompt can guide the large language model to focus on the vulnerable code before patching and the vulnerability type to summarize the vulnerability detection logic; The vulnerability cause prompt words can guide the large language model to focus on the code before and after patching, the vulnerability description and the patch description, and guide the large language model to first think about the logical differences between the code before patching and the code after patching, and then think about the reasons for adding the patch, so as to summarize the corresponding vulnerability causes; The business constraint prompt words can guide the large language model to focus on the code before and after patching, and guide the large language model to first think about the function of the code, and then think about the constraint conditions based on the differences between the code before patching and the code after patching, so as to summarize the function of the code and the constraint conditions, and the function of the code and the constraint conditions jointly constitute the business constraint; The vulnerability knowledge prompt words can guide the large language model to focus on the vulnerability causes and abstract the vulnerability causes, so as to summarize the corresponding vulnerability knowledge.

7. The method for constructing a logical vulnerability knowledge base based on a large language model according to claim 1, wherein The method further includes: Using a text embedding model to convert the vulnerability detection logic and the business constraint from natural language form to vector form.

8. A device for constructing a logical vulnerability knowledge base based on a large language model, characterized in that, Including: A data collection module, an information extraction module, a prompt word construction module, a knowledge summary module, and a knowledge base construction module; The data collection module is configured to collect logical vulnerability data from a public vulnerability database and an open source code repository using a large language model; The information extraction module is configured to extract natural language level and code semantic level information related to the vulnerability principle from the logical vulnerability data; The prompt word construction module is configured to sequentially construct vulnerability detection logic prompt words, vulnerability cause prompt words, and business constraint prompt words based on the natural language level and code semantic level information related to the vulnerability principle; The knowledge summary module is configured to pass the vulnerability detection logic prompt words, the vulnerability cause prompt words, and the business constraint prompt words to the large language model to summarize the vulnerability detection logic, the vulnerability causes, and the business constraints; The prompt word construction module is further configured to construct vulnerability knowledge prompt words according to the vulnerability causes; The knowledge summary module is further configured to pass the vulnerability knowledge prompt words to the large language model to summarize the corresponding vulnerability knowledge; The knowledge base construction module is configured to construct a logical vulnerability knowledge base according to the vulnerability detection logic, the vulnerability causes, the business constraints, and the vulnerability knowledge.

9. An electronic device, characterized in that, Including at least one processor and at least one memory, and a computer program is stored on the memory. When the computer program is executed by the processor, the method for constructing a logical vulnerability knowledge base based on a large language model according to any one of claims 1 to 7 is implemented.

10. A readable storage medium, characterized in that, A computer program is stored in the readable storage medium. When the computer program is executed by the processor, the method for constructing a logical vulnerability knowledge base based on a large language model according to any one of claims 1 to 7 is implemented.

Images