Method, device, electronic device and storage medium for constructing a logical vulnerability knowledge base based on a large language model

Abstract

The present invention provides a method, device, electronic device, and storage medium for constructing a logical vulnerability knowledge base based on a large language model. The method comprises: using a large language model to collect logical vulnerability data; extracting natural language-level and code semantic-level information related to the vulnerability principle from the logical vulnerability data, and constructing vulnerability detection logic prompt words, vulnerability cause prompt words, and business constraint prompt words in sequence based on the information; passing the vulnerability detection logic prompt words, vulnerability cause prompt words, and business constraint prompt words to the large language model to summarize the vulnerability detection logic, vulnerability cause, and business constraint; constructing vulnerability knowledge prompt words based on the vulnerability cause, and passing the vulnerability knowledge prompt words to the large language model to summarize the vulnerability knowledge; and constructing a logical vulnerability knowledge base based on the vulnerability detection logic, vulnerability cause, business constraint, and vulnerability knowledge. The present invention can realize the automated integration and systematic summary of cross-source and multi-dimensional vulnerability information.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, device, electronic device and storage medium for constructing a logic vulnerability knowledge base based on a large language model. Background Art

[0002] With the continuous development of the internet industry and the increasing number of various network applications, logic vulnerabilities are becoming increasingly serious. Unlike traditional memory overflow or injection vulnerabilities, logic vulnerabilities are rooted in design flaws in business rules. Their causes are often strongly coupled with business scenarios and code implementations, showing significant environmental dependence and hidden characteristics.

[0003] Traditional vulnerability discovery tools lack a deep understanding of business semantics and still rely primarily on pattern-matching detection mechanisms, making them less than ideal for detecting logical vulnerabilities. The development of large language models, with their powerful semantic understanding and contextual reasoning capabilities, has provided an innovative technical path for logical vulnerability discovery.

[0004] However, current large language models still face technical bottlenecks in the field of business logic vulnerability detection. Specifically, in complex business scenarios, the models struggle to effectively deconstruct the mapping between code implementation and business processes, making it difficult to accurately identify deep-seated logical defects. While the contextual learning capabilities of large language models enable them to improve logic defect detection through knowledge-enhanced prompts, building a knowledge system for vulnerability detection and designing efficient knowledge indexes remain key challenges hindering technological breakthroughs.

[0005] It should be noted that the information disclosed in the background technology section of the invention is only intended to deepen the understanding of the general background technology of the invention, and should not be regarded as an admission or any form of implication that the information constitutes prior art already known to those skilled in the art. Summary of the Invention

[0006] The purpose of the present invention is to provide a method, device, electronic device and storage medium for constructing a logical vulnerability knowledge base based on a large language model, which can realize the automatic integration and systematic summary of cross-source multi-dimensional vulnerability information, and lay a good foundation for improving the logical vulnerability detection capability of the model.

[0007] To achieve the above-mentioned objectives, the present invention provides a method for constructing a logical vulnerability knowledge base based on a large language model, comprising: using a large language model to collect logical vulnerability data from public vulnerability databases and open source code repositories; extracting natural language level and code semantic level information related to vulnerability principles from the logical vulnerability data; based on the natural language level and code semantic level information related to vulnerability principles, sequentially constructing vulnerability detection logic prompt words, vulnerability cause prompt words, and business constraint prompt words, and passing the vulnerability detection logic prompt words, the vulnerability cause prompt words, and the business constraint prompt words to the large language model to summarize the vulnerability detection logic, vulnerability causes, and business constraints; constructing vulnerability knowledge prompt words based on the vulnerability causes, and passing the vulnerability knowledge prompt words to the large language model to summarize the corresponding vulnerability knowledge; and constructing a logical vulnerability knowledge base based on the vulnerability detection logic, the vulnerability causes, the business constraints, and the vulnerability knowledge.

[0008] Optionally, the use of a large language model to collect logical vulnerability data from a public vulnerability database and an open source code repository includes: collecting standard vulnerability information entries and related vulnerability code information from the public vulnerability database and the open source code repository; extracting required vulnerability information from the standard vulnerability information entries and the related vulnerability code information; constructing vulnerability screening prompt words based on the extracted required vulnerability information and the corresponding large language model prompt word template; passing the vulnerability screening prompt words to the large language model to filter out initial vulnerability data related to logical vulnerabilities; and filtering out logical vulnerability data based on the results of manual verification of the initial vulnerability data by experts.

[0009] Optionally, the required vulnerability information includes semantic information related to the vulnerability cause, semantic information related to the vulnerability patch, and code modification snippets submitted by users.

[0010] Optionally, the natural language level and code semantic level information related to the vulnerability principle includes semantic information related to the cause of the vulnerability, the official patch file URL link, the patch description document, the version number of the affected software project, the relative path of the file to which the patch function belongs in the open source project, the function name identifier, the starting line number and the ending line number of the function code, the vulnerability description, the patch description, the vulnerability type description, the code before the patch, and the code after the patch.

[0011] Optionally, based on the natural language level and code semantic level information related to the vulnerability principle, vulnerability detection logic prompt words, vulnerability cause prompt words and business constraint prompt words are constructed in sequence, including: filling the natural language level and code semantic level information related to the vulnerability principle into the vulnerability detection logic prompt word template, the vulnerability cause prompt word template and the business constraint prompt word template in sequence to construct the vulnerability detection logic prompt words, the vulnerability cause prompt words and the business constraint prompt words in sequence; constructing vulnerability knowledge prompt words according to the vulnerability cause includes: filling the vulnerability cause into the vulnerability knowledge prompt word template to construct the vulnerability knowledge prompt words.

[0012] Optionally, the vulnerability detection logic prompt words can guide the large language model to focus on the vulnerability code and vulnerability type before patching, so as to summarize the vulnerability detection logic; the vulnerability cause prompt words can guide the large language model to focus on the code before and after patching, the vulnerability description and the patch description, and guide the large language model to first think about the logical difference between the code before patching and the code after patching, and then think about the reason for adding the patch, so as to summarize the corresponding vulnerability cause; the business constraint prompt words can guide the large language model to focus on the code before and after patching, and guide the large language model to first think about the function function of the code, and then think about the constraints based on the difference between the code before patching and the code after patching, so as to summarize the function function and the constraints, and the function function and the constraints together constitute the business constraint; the vulnerability knowledge prompt words can guide the large language model to focus on the vulnerability cause, and abstract the vulnerability cause to summarize the corresponding vulnerability knowledge.

[0013] Optionally, the method for constructing a logic vulnerability knowledge base based on a large language model provided by the present invention further includes: using a text embedding model to convert the vulnerability detection logic and the business constraints from a natural language form into a vector form.

[0014] To achieve the above-mentioned objectives, the present invention also provides a device for constructing a logical vulnerability knowledge base based on a large language model, comprising a data acquisition module, an information extraction module, a prompt word construction module, a knowledge summary module, and a knowledge base construction module; the data acquisition module is configured to use the large language model to collect logical vulnerability data from public vulnerability databases and open source code repositories; the information extraction module is configured to extract natural language level and code semantic level information related to vulnerability principles from the logical vulnerability data; the prompt word construction module is configured to sequentially construct vulnerability detection logic prompt words, vulnerability cause prompt words, and business constraint prompt words based on the natural language level and code semantic level information related to the vulnerability principles; the knowledge summary module is configured to pass the vulnerability detection logic prompt words, the vulnerability cause prompt words, and the business constraint prompt words to the large language model to summarize the vulnerability detection logic, vulnerability cause, and business constraints; the prompt word construction module is further configured to construct vulnerability knowledge prompt words based on the vulnerability cause; and the knowledge summary module is further configured to pass the vulnerability knowledge prompt words to the large language model to summarize the corresponding vulnerability knowledge.

[0015] The knowledge base construction module is configured to construct a logical vulnerability knowledge base according to the vulnerability detection logic, the vulnerability cause, the business constraints and the vulnerability knowledge.

[0016] To achieve the above-mentioned objectives, the present invention also provides an electronic device comprising at least one processor and at least one memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the method for constructing a logic vulnerability knowledge base based on a large language model as described above is implemented.

[0017] To achieve the above-mentioned objectives, the present invention also provides a readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the method for constructing a logical vulnerability knowledge base based on a large language model as described above.

[0018] Compared with the prior art, the method, device, electronic device and storage medium for constructing a logic vulnerability knowledge base based on a large language model provided by the present invention have the following beneficial effects: by using a large language model to collect logic vulnerability data from public vulnerability databases and open source code repositories, the present invention can effectively collect and expand the vulnerability sample size of the logic vulnerability knowledge base; by extracting natural language level and code semantic level information related to the vulnerability principle from the logic vulnerability data, the cause, impact and repair logic of the vulnerability can be captured more comprehensively; by sequentially constructing vulnerability detection logic prompt words, vulnerability cause prompt words and business constraint prompt words based on the natural language level (such as vulnerability description, patch instructions) and code semantic level (such as code differences before and after patching) information related to the vulnerability principle, the pertinence and accuracy of the large language model analysis can be improved; by By passing the logical prompt words, the vulnerability cause prompt words and the business constraint prompt words to the large language model, the large language model can quickly and accurately summarize the vulnerability code detection logic (vulnerability detection logic), vulnerability causes and business constraints of each vulnerability; by constructing vulnerability knowledge prompt words according to the vulnerability causes and passing the vulnerability knowledge prompt words to the large language model, the large language model can be guided to quickly and accurately summarize vulnerability knowledge with better generalization than the vulnerability causes, so as to be applied to different code bases or business scenarios; by constructing a logical vulnerability knowledge base according to the vulnerability detection logic, the vulnerability causes, the business constraints and the vulnerability knowledge, prior knowledge can be provided for subsequent logical vulnerability mining to improve the comprehensiveness, efficiency and generalization ability of the model's logical vulnerability detection, and provide protection for security protection in complex business scenarios. In summary, it can be seen that the present invention uses the large language model to perform intelligent analysis and knowledge extraction on multi-dimensional vulnerability information such as natural language level and code semantic level information related to vulnerability principles, which can realize the automatic integration and systematic summary of cross-source multi-dimensional vulnerability information, laying a good foundation for improving the model's logical vulnerability detection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A flowchart of a method for constructing a logic vulnerability knowledge base based on a large language model provided by one embodiment of the present invention.

[0020] Figure 2 A flowchart of collecting logical vulnerability data provided by one embodiment of the present invention.

[0021] Figure 3 A schematic block diagram of a device for constructing a logic vulnerability knowledge base based on a large language model according to an embodiment of the present invention.

[0022] Figure 4 A schematic block diagram of an electronic device according to an embodiment of the present invention.

[0023] The accompanying drawings are described as follows: data acquisition module-110; information extraction module-120; prompt word construction module-130; knowledge summary module-140; knowledge base construction module-150; processor-210; communication interface-220; memory-230; communication bus-240. DETAILED DESCRIPTION

[0024] The following, in conjunction with the accompanying drawings and specific embodiments, further describes in detail the method, device, electronic device, and storage medium for constructing a logical vulnerability knowledge base based on a large language model proposed in the present invention. The advantages and features of the present invention will become more apparent from the following description. It should be noted that the accompanying drawings are highly simplified and not to exact scale, and are intended solely to facilitate and clearly illustrate the purpose of the present invention.

[0025] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0026] The core idea of ​​the present invention is to provide a method, device, electronic device and storage medium for constructing a logical vulnerability knowledge base based on a large language model, which can realize the automatic integration and systematic summary of cross-source and multi-dimensional vulnerability information, laying a good foundation for improving the model's logical vulnerability detection capabilities.

[0027] It should be noted that the method for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention can be applied to the device for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention. The device for constructing a logical vulnerability knowledge base based on a large language model can be configured on an electronic device, wherein the electronic device can be a personal computer, a mobile terminal, etc., and the mobile terminal can be a hardware device with various operating systems such as a mobile phone or a tablet computer. It should also be noted that, as can be understood by those skilled in the art, the "large language model" referred to in the present invention can be, but is not limited to, models known to those skilled in the art such as ChatGPT, Claude, and DeepSeek.

[0028] To realize the above idea, the present invention provides a method for constructing a logical vulnerability knowledge base based on a large language model. Figure 1 , which is a flow chart of a method for constructing a logic vulnerability knowledge base based on a large language model provided by one embodiment of the present invention. Figure 1 As shown, the method for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention includes the following steps: step S100, using a large language model to collect logical vulnerability data from a public vulnerability database and an open source code repository; step S200, extracting natural language level and code semantic level information related to the vulnerability principle from the logical vulnerability data; step S300, based on the natural language level and code semantic level information related to the vulnerability principle, sequentially constructing vulnerability detection logic prompt words, vulnerability cause prompt words and business constraint prompt words, and passing the vulnerability detection logic prompt words, the vulnerability cause prompt words and the business constraint prompt words to the large language model to summarize the vulnerability detection logic, vulnerability cause and business constraint; step S400, constructing vulnerability knowledge prompt words according to the vulnerability cause, and passing the vulnerability knowledge prompt words to the large language model to summarize the corresponding vulnerability knowledge; step S500, constructing a logical vulnerability knowledge base according to the vulnerability detection logic, the vulnerability cause, the business constraint and the vulnerability knowledge.

[0029] The present invention collects logical vulnerability data from public vulnerability databases (such as NVD) and open source code repositories (GitHub) using a large language model, which can effectively collect and expand the vulnerability sample size of the logical vulnerability knowledge base; by extracting natural language level and code semantic level information related to the vulnerability principle from the logical vulnerability data, it can more comprehensively capture the cause, impact and repair logic of the vulnerability; by sequentially constructing vulnerability detection logic prompt words, vulnerability cause prompt words and business constraint prompt words based on the natural language level (such as vulnerability description, patch instructions) and code semantic level (such as code differences before and after patching) information related to the vulnerability principle, it can improve the pertinence and accuracy of the large language model analysis; by combining the vulnerability detection logic prompt words, the vulnerability cause prompt words and the business constraint prompt words By passing constraint prompt words to the large language model, the large language model can quickly and accurately summarize the vulnerability code detection logic (vulnerability detection logic), vulnerability causes and business constraints of each vulnerability; by constructing vulnerability knowledge prompt words based on the vulnerability causes and passing the vulnerability knowledge prompt words to the large language model, the large language model can be guided to quickly and accurately summarize vulnerability knowledge with better generalization than the vulnerability causes, so as to be applied to different code bases or business scenarios; by constructing a logical vulnerability knowledge base based on the vulnerability detection logic, the vulnerability causes, the business constraints and the vulnerability knowledge, prior knowledge can be provided for subsequent logical vulnerability mining to improve the comprehensiveness, efficiency and generalization ability of the model's logical vulnerability detection, and provide guarantees for security protection in complex business scenarios. In summary, it can be seen that the present invention uses a large language model to perform intelligent analysis and knowledge extraction on multi-dimensional vulnerability information such as natural language level and code semantic level information related to vulnerability principles, which can realize the automatic integration and systematic summary of cross-source multi-dimensional vulnerability information, laying a good foundation for improving the model's logical vulnerability detection capabilities.

[0030] Please continue to refer to Figure 2 , which is a flow chart of collecting logic vulnerability data provided by one embodiment of the present invention. Figure 2As shown, in some exemplary embodiments, the step S100, using a large language model to collect logical vulnerability data from a public vulnerability database and an open source code repository, includes: step S110, collecting standard vulnerability information entries and related vulnerability code information from the public vulnerability database and the open source code repository; step S120, extracting required vulnerability information from the standard vulnerability information entries and the related vulnerability code information; step S130, constructing vulnerability screening prompt words based on the extracted required vulnerability information and the corresponding large language model prompt word template; step S140, passing the vulnerability screening prompt words to the large language model to filter out initial vulnerability data related to logical vulnerabilities; step S150, filtering out logical vulnerability data based on the manual verification results of the initial vulnerability data by experts.

[0031] Therefore, vulnerability screening prompt words can guide the large language model to focus on logical vulnerability characteristics and quickly filter out high-confidence initial vulnerability data related to logical vulnerabilities from massive data; by having experts conduct manual screening after the large language model completes the vulnerability data screening, the reliability of the logical vulnerability data finally collected can be ensured.

[0032] Furthermore, the required vulnerability information includes semantic information related to the vulnerability cause, semantic information related to the vulnerability patch, and user-submitted code modification snippets. Thus, by extracting multi-dimensional vulnerability information such as semantic information related to the vulnerability cause, semantic information related to the vulnerability patch, and user-submitted code modification snippets, the accuracy and comprehensiveness of the logical vulnerability data ultimately collected can be effectively guaranteed.

[0033] Specifically, the National Vulnerability Database (NVD) provides standardized vulnerability information (such as CVE numbers and CVSS scores) to support vulnerability analysis and risk management. CVE (Common Vulnerabilities and Exposures) is an internationally recognized standardized vulnerability identification system cataloged by the NVD. It aims to provide unique identifiers and standardized descriptions for publicly disclosed cybersecurity vulnerabilities and exposures. Its core value lies in enabling global interoperability and collaborative governance of cybersecurity threat information through a unified naming convention. CWE (Common Weakness Enumeration) is a software security defect classification standard maintained by the MITRE Corporation. It systematically describes inherent weaknesses in software design, development, and implementation, focusing on the root causes of vulnerabilities. CWE descriptions can be used to filter out CVE vulnerabilities related to logical vulnerabilities, such as CWE-22 for path traversal vulnerabilities, CWE-284 for improper access control, and CWE-863 for improper authentication.

[0034] Open source code repositories include GitHub and Gitee. Taking Issues / Pull Requests as an example, we can first build an automated collection process. Using a targeted crawler system, we can capture data entries on the GitHub platform that meet specific screening criteria (i.e., standard vulnerability information entries): Issues and Pull Requests with the keyword "Path Traversal" and a status marked as Closed. We then use semantic analysis technology driven by a large language model to automatically analyze the GitHub platform to collect relevant vulnerability code information.

[0035] Next, we extract multi-dimensional structured data (the required vulnerability information) from the collected data entries (i.e., standard vulnerability information entries) and related vulnerability code information. This includes, but is not limited to, the conversation text in the issue discussion forum, embedded diagrams and tables, descriptive title text, and user-submitted patch code snippets. These elements together form the complete context of the issue and pull request discussion content.

[0036] The extracted multi-dimensional structured data (i.e., the required vulnerability information) is then fed into the corresponding large language model prompt template to construct vulnerability screening prompts that incorporate contextual features. The vulnerability screening prompts are then fed into the large language model for intelligent analysis, focusing on two core dimensions: 1) whether the current issue / pull request discussion involves features related to logical vulnerabilities, and 2) whether the patch code included demonstrates a pattern for remediating logical vulnerabilities. This then constructs a set of high-confidence samples (i.e., initial vulnerability data) that the large language model identifies as logically vulnerable.

[0037] After the large language model completes the screening, experts will conduct another screening to ensure that the collected issues and pull requests are all related to logical vulnerabilities.

[0038] It's important to note that Issues are collaborative tools used to track and manage project tasks, issues, or suggestions, allowing users to report bugs, request features, or discuss improvements. Each Issue can include detailed descriptions, labels, milestones, and contributor information, facilitating team collaboration and prioritization, helping project maintainers efficiently handle feedback and drive progress. Pull Requests are a mechanism for developers to submit code changes to a project repository, allowing contributors to merge branch modifications into the main branch. Pull Requests provide code diffs, discussion areas, and automated checks, allowing maintainers to review code, propose modifications, and merge changes after verification. It's not only a code integration process but also a crucial component of quality assurance and knowledge sharing in open source collaboration. It's also important to note that for details on how to collect standard vulnerability information entries and related vulnerability code information from public vulnerability databases and open source code repositories, reference can be made to those skilled in the art for adaptive understanding and will not be further explained here.

[0039] In some exemplary implementations, the natural language-level and code semantic-level information related to vulnerability mechanisms includes semantic information related to the vulnerability cause, official patch file URL, patch description document, affected software project version number, relative path of the patch function file within the open source project, function name identifier, start and end line numbers of the function code, vulnerability description, patch description, vulnerability type description, pre-patch code, and post-patch code. Thus, through this multi-dimensional information fusion, the large language model can effectively summarize vulnerability detection logic, vulnerability causes, and business constraints.

[0040] Specifically, for CVE vulnerabilities, the extracted natural language and code semantic information includes the CVE description of the vulnerability, the description submitted by the developer for the vulnerability patch in GitHub, the CWE type of the vulnerability, all the code of the function involved in the patch before the patch is applied, and all the code of the function involved in the patch after the patch is applied. For the collected Issue / Pull Requests, the extracted natural language and code semantic information includes the Issue / Pull Request title, user discussions, the description submitted by the developer for the vulnerability patch in GitHub, the CWE type of the vulnerability, all the code of the function involved in the patch before the patch is applied, and all the code of the function involved in the patch after the patch is applied.

[0041] Vulnerability-related CVE descriptions, issue / pull request titles, and user discussions typically contain multiple layers of security elements. At the natural language level, they systematically cover key information such as the vulnerability type, the version range of the affected product / codebase, potential attack vectors, and their security impact. The code change logic presented in the patch description (including the code differences before and after the vulnerability fix) provides a parseable vulnerability representation paradigm for the large language model. Vulnerability type labels guide the large language model in establishing a targeted reasoning framework, thereby systematically building a vulnerability knowledge system. This natural language vulnerability feature information effectively assists the large language model in understanding the vulnerability's formation mechanism and the nature of the logical flaw. At the code semantic level, comparative analysis of pre- and post-patch code not only reveals the vulnerability's concrete manifestation but also helps the large language model extract vulnerability pattern features from code semantic differences. Through this multi-dimensional information fusion, the large language model can effectively summarize vulnerability knowledge.

[0042] In some exemplary embodiments, based on the natural language level and code semantic level information related to the vulnerability principle, vulnerability detection logic prompt words, vulnerability cause prompt words and business constraint prompt words are constructed in sequence, including: filling the natural language level and code semantic level information related to the vulnerability principle into the vulnerability detection logic prompt word template, the vulnerability cause prompt word template and the business constraint prompt word template in sequence to construct the vulnerability detection logic prompt words, the vulnerability cause prompt words and the business constraint prompt words in sequence; constructing vulnerability knowledge prompt words according to the vulnerability cause includes: filling the vulnerability cause into the vulnerability knowledge prompt word template to construct the vulnerability knowledge prompt words.

[0043] Therefore, through pre-defined prompt word templates (vulnerability detection logic prompt word template, vulnerability cause prompt word template, business constraint prompt word template and vulnerability knowledge prompt word template), the large language model can be explicitly required to focus on specific analysis dimensions to ensure coverage of key vulnerability features, avoid information omissions, and ensure the integrity of the large language model analysis.

[0044] Specifically, when summarizing the detection logic of the vulnerability code for sensitive parameters (i.e., the vulnerability detection logic), the natural language level and code semantic level information related to the vulnerability principle extracted in step S200 is filled into the vulnerability code detection logic for sensitive parameters prompt word template (i.e., the vulnerability detection logic prompt word template). The prompt word template prompts the large language model to summarize the detection logic of the vulnerability code for sensitive parameters.

[0045] When summarizing the cause of the vulnerability, the natural language level and code semantic level information related to the vulnerability principle extracted in step S200 is filled into the vulnerability cause prompt word template. The prompt word template prompts the large language model to compare the differences between the pre-patch code and the post-patch code, and summarize the vulnerability cause in combination with other vulnerability information.

[0046] When summarizing business constraints, the natural language level and code semantic level information related to the vulnerability principle extracted in step S200 is filled into the business constraint prompt word template. The prompt word template prompts the large language model to pay attention to the function function in the code snippet, and combines other vulnerability information to summarize the function business function and constraint conditions. These two parts together constitute the business constraint of the vulnerability.

[0047] In some exemplary embodiments, the vulnerability detection logic prompt can guide the large language model to focus on the vulnerability code and vulnerability type before patching to summarize the vulnerability detection logic; the vulnerability cause prompt can guide the large language model to focus on the code before and after patching, the vulnerability description and the patch description, and guide the large language model to first think about the logical difference between the code before and after patching, and then think about the reason for adding the patch to summarize the corresponding vulnerability cause; the business constraint prompt can guide the large language model to focus on the code before and after patching, and guide the large language model to first think about the function of the code, and then think about the constraint conditions based on the difference between the code before and after patching to summarize the function function and the constraint conditions, which together constitute the business constraint; the vulnerability knowledge prompt can guide the large language model to focus on the vulnerability cause, and abstract the vulnerability cause to summarize the corresponding vulnerability knowledge. Therefore, this setting can ensure the standardization of the analysis process and reduce manual intervention.

[0048] Specifically, vulnerability detection logic includes the detection operations performed by the vulnerability code on sensitive parameters and the order in which these detection operations are performed. Vulnerability causes include flaws in the vulnerability code's detection logic for sensitive parameters, how these flaws can be exploited, and the potential harm caused by these flaws. Business functions are the operations implemented by the function code, and constraints are the developer's purpose for performing these operations. By abstracting the vulnerability cause, we can remove information that clearly represents a vulnerability, such as function names and variable names.

[0049] In some exemplary embodiments, the method for constructing a logic vulnerability knowledge base based on a large language model provided by the present invention further includes: using a text embedding model to convert the vulnerability detection logic and the business constraints from a natural language form into a vector form.

[0050] Therefore, by converting vulnerability detection logic and business constraints from natural language form to vector form, vulnerability detection logic and business constraints that cannot be directly calculated can be used to perform mathematical operations such as similarity comparison, clustering, and classification in high-dimensional space, thereby providing support for downstream tasks.

[0051] Specifically, a text embedding model is a model that converts discrete objects (such as text, code, image, node, etc.) into continuous vector representations. The text embedding model may be, but is not limited to, text-embedding-ada-002.

[0052] Please continue to refer to Figure 3 , which is a block diagram of a device for constructing a logic vulnerability knowledge base based on a large language model according to an embodiment of the present invention. Figure 3 As shown, the logic vulnerability knowledge base construction device based on the large language model provided by the present invention includes a data acquisition module 110, an information extraction module 120, a prompt word construction module 130, a knowledge summary module 140 and a knowledge base construction module 150; the data acquisition module 110 is configured to use the large language model to collect logic vulnerability data from public vulnerability databases and open source code repositories; the information extraction module 120 is configured to extract natural language level and code semantic level information related to vulnerability principles from the logic vulnerability data; the prompt word construction module 130 is configured to construct vulnerability detection logic prompt words based on the natural language level and code semantic level information related to vulnerability principles, and the knowledge base construction module 150 is configured to construct vulnerability detection logic prompt words based on the natural language level and code semantic level information related to vulnerability principles. The knowledge summary module 140 is configured to pass the vulnerability detection logic prompt words, the vulnerability cause prompt words and the business constraint prompt words to the large language model to summarize the vulnerability detection logic, vulnerability causes and business constraints; the prompt word construction module 130 is also configured to construct vulnerability knowledge prompt words according to the vulnerability causes; the knowledge summary module 140 is also configured to pass the vulnerability knowledge prompt words to the large language model to summarize the corresponding vulnerability knowledge; the knowledge base construction module 150 is configured to construct a logical vulnerability knowledge base according to the vulnerability detection logic, the vulnerability causes, the business constraints and the vulnerability knowledge.

[0053] It should be noted that the logical vulnerability knowledge base construction device based on a large language model provided by the present invention can be used to execute the logical vulnerability knowledge base construction method based on a large language model described above. The technical principles, technical problems solved and technical effects produced by the two are similar. Technical personnel in this technical field can clearly understand that for the convenience and conciseness of description, for more content about the logical vulnerability knowledge base construction device based on a large language model provided by the present invention, please refer to the content described above about the logical vulnerability knowledge base construction method based on a large language model provided by the present invention, and will not be repeated here.

[0054] Based on the same inventive concept, the present invention also provides an electronic device, please refer to Figure 4 , which is a block diagram of an electronic device provided by one embodiment of the present invention. Figure 4 As shown, the electronic device includes at least one processor 210 and at least one memory 230, and a computer program is stored on the memory 230. When the computer program is executed by the processor 210, the method for constructing a logic vulnerability knowledge base based on a large language model described above is implemented. Since the electronic device provided by the present invention and the method for constructing a logic vulnerability knowledge base based on a large language model provided by the present invention belong to the same inventive concept, the electronic device provided by the present invention at least has all the beneficial effects of the method for constructing a logic vulnerability knowledge base based on a large language model provided by the present invention. Therefore, for the beneficial effects of the electronic device provided by the present invention, reference can be made to the relevant description of the beneficial effects of the method for constructing a logic vulnerability knowledge base based on a large language model provided by the present invention, and no further details will be given here.

[0055] Please continue to refer to Figure 4 ,like Figure 4 As shown, the electronic device further includes a communication interface 220 and a communication bus 240. The processor 210, the communication interface 220, and the memory 230 communicate with each other via the communication bus 240. The communication bus 240 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, for example. The communication bus 240 can be divided into an address bus, a data bus, a control bus, and the like. For ease of illustration, only one thick line is used in the figure, but this does not mean that there is only one bus or only one type of bus. The communication interface 220 is used for communication between the electronic device and other devices.

[0056] The present invention also provides a readable storage medium having a computer program stored therein, and when the computer program is executed by a processor, it can implement the method for constructing a logical vulnerability knowledge base based on a large language model described above. Since the readable storage medium provided by the present invention and the method for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention belong to the same inventive concept, the readable storage medium provided by the present invention at least has all the beneficial effects of the method for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention. Therefore, for the beneficial effects of the readable storage medium provided by the present invention, reference can be made to the relevant description of the beneficial effects of the method for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention above, and no further details will be given here.

[0057] In summary, compared with the existing technology, the method, device, electronic device and storage medium for constructing a logical vulnerability knowledge base based on a large language model provided by the present invention have the following beneficial effects: based on the large language model, the present invention performs intelligent analysis and knowledge extraction on multi-dimensional vulnerability information such as natural language level and code semantic level information related to vulnerability principles, which can realize the automatic integration and systematic summary of cross-source multi-dimensional vulnerability information, laying a good foundation for improving the model's logical vulnerability detection capabilities.

[0058] It should be noted that the above description is only a description of the preferred embodiment of the present invention and is not any limitation to the scope of the present invention. Any changes and modifications made by ordinary technicians in the field of the present invention based on the above disclosure are within the scope of protection of the present invention.

Claims

1. A method for constructing a logic vulnerability knowledge base based on a large language model, characterized in that: include: Use large language models to collect logical vulnerability data from public vulnerability databases and open source code repositories; Extracting natural language level and code semantic level information related to the vulnerability principle from the logical vulnerability data; Based on the natural language level and code semantic level information related to the vulnerability principle, vulnerability detection logic prompt words, vulnerability cause prompt words, and business constraint prompt words are sequentially constructed, and the vulnerability detection logic prompt words, the vulnerability cause prompt words, and the business constraint prompt words are passed to the large language model to summarize the vulnerability detection logic, vulnerability cause, and business constraints; Construct vulnerability knowledge prompt words according to the vulnerability cause, and pass the vulnerability knowledge prompt words to the large language model to summarize the corresponding vulnerability knowledge; Building a logical vulnerability knowledge base according to the vulnerability detection logic, the vulnerability cause, the business constraints and the vulnerability knowledge; The vulnerability detection logic prompt words can guide the large language model to focus on the vulnerability code and vulnerability type before patching, so as to summarize the vulnerability detection logic; The vulnerability cause prompt can guide the large language model to focus on the code before and after patching, the vulnerability description, and the patch description. It can also guide the large language model to first think about the logical differences between the code before and after patching, and then think about the reason for adding the patch, so as to summarize the corresponding vulnerability cause. The business constraint prompt can guide the large language model to focus on the code before and after the patch, and guide the large language model to first think about the functional functions of the code, and then think about the constraints based on the differences between the code before and after the patch, so as to summarize the functional functions and constraints. The functional functions and constraints together constitute the business constraints. The vulnerability knowledge prompt words can guide the large language model to focus on the vulnerability causes and abstract the vulnerability causes to summarize the corresponding vulnerability knowledge.

2. The method for constructing a logic vulnerability knowledge base based on a large language model according to claim 1, characterized in that: The use of large language models to collect logical vulnerability data from public vulnerability databases and open source code repositories includes: Collecting standard vulnerability information entries and related vulnerability code information from the public vulnerability database and the open source code repository; Extracting required vulnerability information from the standard vulnerability information entry and the related vulnerability code information; Construct vulnerability screening prompt words based on the extracted required vulnerability information and the corresponding large language model prompt word template; Passing the vulnerability screening prompt words to the large language model to screen out initial vulnerability data related to logical vulnerabilities; Based on the manual verification results of the initial vulnerability data by experts, logical vulnerability data is screened out.

3. The method for constructing a logic vulnerability knowledge base based on a large language model according to claim 2, characterized in that: The required vulnerability information includes semantic information related to the vulnerability cause, semantic information related to the vulnerability patch, and code modification snippets submitted by users.

4. The method for constructing a logic vulnerability knowledge base based on a large language model according to claim 1, characterized in that: The natural language level and code semantic level information related to the vulnerability principle include semantic information related to the cause of the vulnerability, the official patch file URL link, the patch description document, the affected software project version number, the relative path of the file to which the patch function belongs in the open source project, the function name identifier, the starting line number and the ending line number of the function code, the vulnerability description, the patch description, the vulnerability type description, the code before and after the patch.

5. The method for constructing a logic vulnerability knowledge base based on a large language model according to claim 1, characterized in that: Based on the natural language level and code semantic level information related to the vulnerability principle, vulnerability detection logic prompt words, vulnerability cause prompt words and business constraint prompt words are sequentially constructed, including: Filling the natural language level and code semantic level information related to the vulnerability principle into the vulnerability detection logic prompt word template, the vulnerability cause prompt word template, and the business constraint prompt word template in sequence to construct the vulnerability detection logic prompt word, the vulnerability cause prompt word, and the business constraint prompt word in sequence; The step of constructing vulnerability knowledge prompt words according to the vulnerability cause includes: Fill the vulnerability cause into the vulnerability knowledge prompt word template to construct the vulnerability knowledge prompt word.

6. The method for constructing a logic vulnerability knowledge base based on a large language model according to claim 1, characterized in that: The method further comprises: The vulnerability detection logic and the business constraints are converted from natural language form into vector form using a text embedding model.

7. A device for constructing a logic vulnerability knowledge base based on a large language model, characterized in that: include: Data collection module, information extraction module, prompt word construction module, knowledge summary module and knowledge base construction module; The data collection module is configured to collect logical vulnerability data from public vulnerability databases and open source code repositories using a large language model; The information extraction module is configured to extract natural language level and code semantic level information related to the vulnerability principle from the logical vulnerability data; The prompt word construction module is configured to construct vulnerability detection logic prompt words, vulnerability cause prompt words and business constraint prompt words in sequence based on the natural language level and code semantic level information related to the vulnerability principle; The knowledge summarization module is configured to pass the vulnerability detection logic prompt words, the vulnerability cause prompt words and the business constraint prompt words to the large language model to summarize the vulnerability detection logic, vulnerability cause and business constraint; The prompt word construction module is further configured to construct vulnerability knowledge prompt words according to the vulnerability cause; The knowledge summarizing module is further configured to pass the vulnerability knowledge prompt words to the large language model to summarize the corresponding vulnerability knowledge; The knowledge base construction module is configured to construct a logical vulnerability knowledge base according to the vulnerability detection logic, the vulnerability cause, the business constraints and the vulnerability knowledge; The vulnerability detection logic prompt words can guide the large language model to focus on the vulnerability code and vulnerability type before patching, so as to summarize the vulnerability detection logic; The vulnerability cause prompt can guide the large language model to focus on the code before and after patching, the vulnerability description, and the patch description. It can also guide the large language model to first think about the logical differences between the code before and after patching, and then think about the reason for adding the patch, so as to summarize the corresponding vulnerability cause. The business constraint prompt can guide the large language model to focus on the code before and after the patch, and guide the large language model to first think about the functional functions of the code, and then think about the constraints based on the differences between the code before and after the patch, so as to summarize the functional functions and constraints. The functional functions and constraints together constitute the business constraints. The vulnerability knowledge prompt words can guide the large language model to focus on the vulnerability causes and abstract the vulnerability causes to summarize the corresponding vulnerability knowledge.

8. An electronic device, characterized in that: The method comprises at least one processor and at least one memory, wherein a computer program is stored on the memory, and when the computer program is executed by the processor, the method for constructing a logic vulnerability knowledge base based on a large language model according to any one of claims 1 to 6 is implemented.

9. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by the processor, the method for constructing a logic vulnerability knowledge base based on a large language model according to any one of claims 1 to 6 is implemented.

Images