Software vulnerability mining and POC generation verification method based on thinking chain and agent

Abstract

The invention discloses a software vulnerability mining and POC generation verification method based on a thinking chain and an intelligent agent, and the method comprises the steps: firstly designing corresponding thinking chain model templates for different vulnerability types; according to the thinking chain model template of each vulnerability type, respectively constructing a corresponding thinking chain intelligent agent unit, and constructing a source code preprocessing unit and an intelligent agent system management unit, thereby forming an intelligent agent system; a source code preprocessing unit of the agent system preprocesses a to-be-analyzed software project and then distributes preprocessed codes to thinking chain agent units for parallel processing, the thinking chain agent units analyze the codes step by step along thinking chain steps of the thinking chain agent units, and according to identified potential vulnerabilities, the thinking chain agent units analyze the codes according to the thinking chain steps of the thinking chain agent units. The thinking chain agent unit generates a POC code of the vulnerability by using a natural language processing model to verify the vulnerability; and finally, the agent system automatically generates a detection report containing the detailed vulnerability information, the POC code, the operation result and the repair suggestion.

Description

Technical Field

[0001] The present invention belongs to the technical field of software security, and particularly relates to a software vulnerability mining and POC generation verification method based on the chain of thought and agents. Background Art

[0002] With the increase in the complexity of software systems, the number and types of software vulnerabilities are also growing continuously. Traditional vulnerability mining methods mainly rely on static code analysis and fuzz testing, but these methods are less efficient in the face of complex vulnerability types and it is difficult to automatically generate high-quality POCs. In recent years, large model technologies have made remarkable progress in the fields of natural language processing and code generation, providing new ideas for vulnerability mining and POC generation.

[0003] In the prior art, although the method of using the chain of thought and agent technologies for static software vulnerability mining has made some progress in terms of automation and intelligence, there are still problems such as limited reasoning ability, low efficiency of agent collaboration, unstable quality of POC generation, high false positive rate and false negative rate, strong data dependence, and insufficient automation. These problems limit the actual application effect and promotion scope of this technology. Therefore, there is an urgent need for a more efficient, accurate, and scalable solution to overcome these defects. Summary of the Invention

[0004] The present invention mainly aims to overcome the deficiencies of the prior art and provides a software vulnerability mining and POC generation verification method based on the chain of thought and agents.

[0005] The present invention is realized through the following technical solutions:

[0006] A software vulnerability mining and POC generation verification method based on the chain of thought and agents, the specific steps are as follows:

[0007] Step 1: Design corresponding chain of thought model templates for different vulnerability types;

[0008] Step 2: Construct an agent system, which includes: a source code preprocessing unit, a chain of thought agent unit, and an agent system management unit;

[0009] The constructed source code preprocessing unit is used for extracting the source code of the software project to be analyzed and preprocessing the source code;

[0010] The chain of thought agent unit: According to the chain of thought model templates of each vulnerability type designed in Step 1, construct corresponding chain of thought agent units, which are used for gradually analyzing the software code along the steps of its chain of thought;

[0011] The agent system management unit is used to comprehensively manage all the thought-chain agent units and the source code preprocessing unit;

[0012] Step 3: Analyze the software project to be analyzed by the agent system established in Step 2;

[0013] Step 3.1: The source code preprocessing unit of the agent system obtains the source code of the software project to be analyzed and preprocesses the source code;

[0014] Step 3.2: The agent system distributes the code preprocessed in Step 3.1 to five thought-chain agent units for parallel processing; the thought-chain agent units gradually analyze the code along their thought-chain steps;

[0015] For the identified potential vulnerabilities, the thought-chain agent units use a natural language processing model to generate POC code for the vulnerability to verify the vulnerability. The specific steps are as follows:

[0016] Step 3.21: The thought-chain agent unit extracts key features from the potential vulnerability;

[0017] Step 3.22: According to the vulnerability features, the thought-chain agent unit constructs a conceptual model of the POC and clarifies the functions that the POC needs to implement;

[0018] Step 3.23: The thought-chain agent unit automatically generates POC code according to the POC conceptual model and combines the reasoning logic of the thought chain;

[0019] Step 3.24: The thought-chain agent unit verifies and optimizes the generated POC;

[0020] Step 4: The agent system automatically generates a detection report including detailed vulnerability information, POC code, running results, and repair suggestions.

[0021] In the above technical solution, in Step 1, the thought-chain model template includes:

[0022] ①. Buffer overflow vulnerability: Identify dangerous functions with buffer overflow through predefined static scanning rules -> Analyze the cause of the vulnerability -> Identify potential vulnerabilities -> Generate POC to verify the existence of the vulnerability;

[0023] ②. SQL injection vulnerability: Identify user input points through predefined static scanning rules -> Analyze the input filtering mechanism -> Construct malicious input -> Identify potential vulnerabilities -> Generate POC to verify the existence of the vulnerability;

[0024] ③. Cross-site scripting attack vulnerability: Identify output points through predefined static scanning rules -> Trace the data flow -> Check output filtering -> Identify potential vulnerabilities -> Generate POC to verify the existence of the vulnerability;

[0025] ④. Command injection vulnerability: Identify system command calls through predefined static scanning rules -> Trace the data flow -> Check the output filtering -> Identify potential vulnerabilities -> Generate a POC to verify the existence of the vulnerability;

[0026] ⑤. File inclusion vulnerability: Identify file inclusion functions through predefined static scanning rules -> Trace the data flow -> Check the input validation -> Identify potential vulnerabilities -> Generate a POC to verify the existence of the vulnerability.

[0027] In the above technical solution, the Belief-Desire-Intention model is adopted as the infrastructure of each thinking chain agent unit.

[0028] In the above technical solution, the preprocessing includes operations such as removing comments and formatting the code structure.

[0029] In the above technical solution, the steps to construct each thinking chain agent unit are as follows:

[0030] Step 2.21: Define the infrastructure of each thinking chain agent unit;

[0031] Step 2.22: Define the functional modules of the thinking chain agent unit, including:

[0032] Perception module: Responsible for obtaining information;

[0033] Initial scanning module: Responsible for identifying a set of possible vulnerability points from the code repository for different types of vulnerabilities through predefined static scanning rules;

[0034] Inference module: Responsible for reasoning based on beliefs and goals;

[0035] Action module: Responsible for performing specific actions;

[0036] Communication module: Responsible for communicating with the source code preprocessing unit, the agent system management unit, or an external system;

[0037] Step 2.23: Implement the thinking chain model template in the thinking chain agent unit, and the specific steps are as follows:

[0038] Step 2.231: Convert the thinking chain steps of the thinking chain model template into corresponding semantic rules;

[0039] Step 2.232: Convert the above semantic rules into an inference state machine. The inference state machine constructs the inference module of the thinking chain agent unit through the preconditions of the semantic rules and the corresponding execution actions, and is used to manage and execute the semantic rules of Step 2.231;

[0040] Step 2.233: Use the natural language processing model as the semantic rule executor in the reasoning module of each chain-of-thought agent unit to generate the reasoning results of the corresponding rules in 2.231;

[0041] Step 2.234: Define the interface of the chain-of-thought agent unit and encapsulate it into an independent agent unit.

[0042] In the above technical solution, step 3.24 includes the following steps:

[0043] Step 3.241: The chain-of-thought agent unit builds a test environment similar to the target software and configures the relevant parameters in the test environment to meet the conditions for vulnerability triggering.

[0044] Step 3.242: Run the generated POC code in the test environment, and the agent verifies the existence of the vulnerability and the effectiveness of the POC based on the execution results of the POC.

[0045] Step 3.243: If the POC fails to successfully trigger the vulnerability, the agent will trace back according to the chain of thought, analyze the reasons, and optimize the POC code.

[0046] The advantages and beneficial effects of the present invention are:

[0047] Improve vulnerability mining efficiency: Utilize the chain-of-thought and agent technologies to achieve automated vulnerability mining, reduce manual intervention, and improve analysis efficiency.

[0048] Reduce false positive and false negative rates: By simulating the thinking process of security experts and combining the reasoning ability of large models, improve the accuracy of vulnerability mining.

[0049] Enhance interpretability: The chain-of-thought model decomposes the vulnerability mining process into interpretable reasoning steps, facilitating security experts to understand and verify the analysis results.

[0050] Automated POC generation and verification: Utilize the natural language large model to automatically generate and verify POC code, reducing the workload of manually writing and debugging POC code.

[0051] Automated detection report generation: Automatically generate detailed and easy-to-understand detection reports, facilitating security experts to analyze and process. Brief Description of the Drawings

[0052] Figure 1 is the flowchart of the present invention.

[0053] For those of ordinary skill in the art, without creative efforts, other relevant drawings can be obtained based on the above drawings. Detailed Embodiments

[0054] To enable those skilled in the art to better understand the solution of the present invention, the technical solution of the present invention will be further described below in conjunction with specific embodiments.

[0055] The present invention designs a software vulnerability mining and POC verification method based on the chain of thought and agent, and the specific steps are as follows:

[0056] Step 1: For different vulnerability types, design corresponding chain-of-thought model templates. Specifically as follows:

[0057] ①. Buffer overflow vulnerability: Identify dangerous functions with buffer overflows through predefined static scanning rules -> Analyze the causes of vulnerabilities -> Identify potential vulnerabilities -> Generate a POC to verify the existence of vulnerabilities.

[0058] ②. SQL injection vulnerability: Identify user input points through predefined static scanning rules -> Analyze the input filtering mechanism -> Construct malicious input -> Identify potential vulnerabilities -> Generate a POC to verify the existence of vulnerabilities.

[0059] ③. Cross-site scripting (XSS) vulnerability: Identify output points through predefined static scanning rules -> Trace the data flow -> Check output filtering -> Identify potential vulnerabilities -> Generate a POC to verify the existence of vulnerabilities.

[0060] ④. Command injection vulnerability: Identify system command calls through predefined static scanning rules -> Trace the data flow -> Check output filtering -> Identify potential vulnerabilities -> Generate a POC to verify the existence of vulnerabilities.

[0061] ⑤. File inclusion vulnerability: Identify file inclusion functions (such as: include, require, etc.) through predefined static scanning rules -> Trace the data flow -> Check input validation -> Identify potential vulnerabilities -> Generate a POC to verify the existence of vulnerabilities.

[0062] Step 2: Build an agent system, which includes: a source code preprocessing unit, a chain-of-thought agent unit, and an agent system management unit.

[0063] Step 2.1, build a source code preprocessing unit for extracting the source code of the software project to be analyzed and preprocessing the source code. The preprocessing includes operations such as removing comments and formatting the code structure.

[0064] Step 2.2, according to the five chain-of-thought model templates designed in Step 1, build corresponding chain-of-thought agent units respectively for gradually analyzing the software code along the steps of its chain of thought. The specific steps for building the chain-of-thought agent units are as follows:

[0065] Step 2.21: Define the basic architecture of each chain-of-thought agent unit.

[0066] In this embodiment, the Belief-Desire-Intention (BDI) model is adopted as the infrastructure for each thinking chain agent unit, where:

[0067] Belief: The understanding of the environment and its own state by the agent unit, such as code attributes, vulnerability patterns, etc.;

[0068] Desire: The goal of the agent unit, such as discovering specific types of vulnerabilities;

[0069] Intention: The action plan taken by the agent unit to achieve the goal, such as executing specific thinking chain steps.

[0070] Step 2.22: Define the functional modules of the thinking chain agent unit. Specifically, each thinking chain agent unit includes the following functional modules:

[0071] Perception module: Responsible for obtaining information, such as parsing code, extracting code attributes, etc.

[0072] Initial scanning module: Responsible for identifying a set of possible vulnerability points from the code repository according to predefined static scanning rules for different types of vulnerabilities, such as: dangerous functions, user input points, output points, system command calls, file inclusion functions, etc.

[0073] Inference module: Responsible for reasoning based on beliefs and goals, such as executing thinking chain steps, judging vulnerability risks, etc.

[0074] Action module: Responsible for executing specific actions, such as generating POC code, verifying vulnerabilities, etc.

[0075] Communication module: Responsible for communicating with the source code preprocessing unit, the agent system management unit, or an external system.

[0076] Step 2.23: Implement the thinking chain model template in the thinking chain agent unit. The specific steps are as follows:

[0077] Step 2.231: Convert the thinking chain steps of the thinking chain model template into corresponding semantic rules, for example:

[0078] Rule 1: If the target function strcpy is recognized (precondition), then trigger the "trace data flow" step (execution action).

[0079] Rule 2: If the user input data continues to be unverified (precondition), then trigger the "judge vulnerability risk" step (execution action).

[0080] Step 2.232: Transform the above semantic rules into an inference state machine. This inference state machine constructs an inference module of the thinking chain intelligent agent unit through the preconditions of the semantic rules and the corresponding execution actions, and is used to manage and execute the semantic rules in Step 2.231. Each state in the state machine corresponds to a specific inference stage, such as "identifying the objective function", "tracking the data flow", "judging the vulnerability risk", etc. When the specific preconditions are met, the state machine will switch to the corresponding next state internally and execute the corresponding inference operations.

[0081] Step 2.233: Use the natural language processing model as the semantic rule executor in the inference module of each thinking chain intelligent agent unit to generate the inference results of the corresponding rules in 2.231.

[0082] Step 2.234: Define the interface of the thinking chain intelligent agent unit and encapsulate it into an independent intelligent agent unit.

[0083] Define a clear interface for each thinking chain intelligent agent unit, including: input, output, function description, etc. According to the defined interface and architecture, implement the specific functions of each thinking chain intelligent agent unit; and conduct sufficient testing and verification on each thinking chain intelligent agent unit to ensure the correctness and reliability of its functions.

[0084] Step 2.3: Establish an intelligent agent system management unit to comprehensively manage all thinking chain intelligent agent units and the source code preprocessing unit, thereby forming an intelligent agent system.

[0085] Step 2.31: Establish a cooperation mechanism among the thinking chain intelligent agent units, including:

[0086] Task allocation: Allocate the vulnerability mining tasks to each thinking chain intelligent agent unit.

[0087] Information sharing: Share information such as code attributes and vulnerability patterns among the thinking chain intelligent agent units.

[0088] Result integration: Integrate the mining results of each intelligent agent unit to generate a final vulnerability report.

[0089] Step 2.32: Establish system management functions, such as:

[0090] Intelligent agent monitoring: Monitor the running status and performance of each thinking chain intelligent agent unit.

[0091] Task management: Manage the creation, allocation, and execution of vulnerability mining tasks.

[0092] Log recording: Record the system operation logs to facilitate problem troubleshooting and analysis.

[0093] Step 3: The agent system established in Step 2 analyzes the software project to be analyzed.

[0094] Step 3.1: The source code preprocessing unit of the agent system obtains the source code of the software project to be analyzed and preprocesses the source code.

[0095] The preprocessing includes operations such as removing comments and formatting the code structure to provide more standardized context information in the inference stage.

[0096] Step 3.2: The agent system distributes the code preprocessed in Step 3.1 to five chain-of-thought agent units for parallel processing; the chain-of-thought agent units gradually analyze the code along their chain-of-thought steps.

[0097] For the identified potential vulnerabilities, the chain-of-thought agent units use a natural language processing model to generate POC code (Proof of Concept, POC is a piece of code used to prove the existence of a vulnerability) for verifying the vulnerability. The specific steps are as follows:

[0098] Step 3.21: The chain-of-thought agent units extract key features from the potential vulnerabilities, such as vulnerability trigger conditions, input data formats, etc.

[0099] Step 3.22: According to the vulnerability features, the chain-of-thought agent units construct a conceptual model of the POC and clarify the functions that the POC needs to implement.

[0100] Step 3.23: The chain-of-thought agent units automatically generate POC code according to the POC conceptual model and the reasoning logic of the chain of thought.

[0101] Step 3.24: The chain-of-thought agent units verify and optimize the generated POC. The specific steps are as follows:

[0102] Step 3.241: The chain-of-thought agent units set up a test environment similar to the target software and configure the relevant parameters in the test environment to meet the conditions for triggering the vulnerability.

[0103] Step 3.242: Run the generated POC code in the test environment, and the agent verifies the existence of the vulnerability and the effectiveness of the POC according to the execution result of the POC.

[0104] Step 3.243: If the POC fails to successfully trigger the vulnerability, the agent will trace back according to the chain of thought, analyze the reasons and optimize the POC code.

[0105] Step 4: The agent system automatically generates a detection report containing detailed vulnerability information, POC code, running results, and repair suggestions.

[0106] The verification report includes the execution process of the POC, evidence of vulnerability triggering, impact assessment of the vulnerability, etc.

[0107] Summarize the discovered vulnerabilities and the generated POCs, and analyze the distribution patterns and type characteristics of the vulnerabilities.

[0108] Evaluate the efficiency and accuracy of the entire vulnerability discovery and POC generation process, and summarize the experiences and lessons.

[0109] Feed back the summarized results to the agent to optimize its thinking chain and analysis strategy.

[0110] According to the feedback information, train and adjust the agent to improve its performance in subsequent tasks.

[0111] The above has made an exemplary description of the present invention. It should be noted that without departing from the core of the present invention, any simple deformation, modification, or equivalent replacement that can be made by those skilled in the art without creative labor falls within the protection scope of the present invention.

Claims

1. A software vulnerability mining and POC verification method based on the chain of thought and agent, characterized in that: The specific steps are as follows: Step 1: Design corresponding thought chain model templates for different vulnerability types; Step 2: Build an agent system, which includes: a source code preprocessing unit, a thought chain agent unit, and an agent system management unit; The built source code preprocessing unit is used to extract the source code of the software project to be analyzed and preprocess the source code; The thought chain agent unit: According to the thought chain model templates of each vulnerability type designed in Step 1, construct corresponding thought chain agent units respectively, which are used to gradually analyze the software code along the steps of its thought chain; The agent system management unit is used to comprehensively manage all the thought chain agent units and the source code preprocessing unit; Step 3: Analyze the software project to be analyzed by the agent system established in Step 2; Step 3.1: The source code preprocessing unit of the agent system obtains the source code of the software project to be analyzed and preprocesses the source code; Step 3.2: The agent system distributes the code preprocessed in Step 3.1 to five thought chain agent units for parallel processing; the thought chain agent units gradually analyze the code along the steps of their thought chains; For the identified potential vulnerabilities, the thought chain agent units use a natural language processing model to generate POC code for the vulnerability to verify the vulnerability. The specific steps are as follows: Step 3.21: The thought chain agent unit extracts key features from the potential vulnerabilities; Step 3.22: According to the vulnerability features, the thought chain agent unit constructs a conceptual model of the POC and clarifies the functions that the POC needs to implement; Step 3.23: The thought chain agent unit automatically generates POC code according to the POC conceptual model and combines the reasoning logic of the thought chain; Step 3.24: The thought chain agent unit verifies and optimizes the generated POC; Step 4: The agent system automatically generates a detection report containing detailed vulnerability information, POC code, running results, and repair suggestions.

2. The software vulnerability mining and POC verification method based on the chain of thought and the agent according to claim 1, characterized in that: In Step 1, the thought chain model template includes: ①. Buffer overflow vulnerability: Identify dangerous functions with buffer overflows through predefined static scanning rules -> Analyze the cause of the vulnerability -> Identify potential vulnerabilities -> Generate POC to verify the existence of the vulnerability; ②. SQL injection vulnerability: Identify user input points through predefined static scanning rules -> Analyze the input filtering mechanism -> Construct malicious input -> Identify potential vulnerabilities -> Generate POC to verify the existence of the vulnerability; ③. Cross-site scripting attack vulnerability: Identify output points through predefined static scanning rules -> Trace the data flow -> Check the output filtering -> Identify potential vulnerabilities -> Generate POC to verify the existence of the vulnerability; ④. Command injection vulnerability: Identify system command calls through predefined static scanning rules -> Trace the data flow -> Check the output filtering -> Identify potential vulnerabilities -> Generate POC to verify the existence of the vulnerability; ⑤. File inclusion vulnerability: Identify file inclusion functions through predefined static scanning rules -> Trace the data flow -> Check the input validation -> Identify potential vulnerabilities -> Generate POC to verify the existence of the vulnerability.

3. The software vulnerability mining and POC verification method based on the chain of thought and agent according to claim 1, characterized in that: The Belief-Desire-Intention model is adopted as the infrastructure for each thinking-chain agent unit.

4. The software vulnerability mining and POC verification method based on the chain of thought and agent according to claim 1, wherein: The preprocessing includes: removing comments and formatting the code structure.

5. The software vulnerability mining and POC verification method based on the chain of thought and agent according to claim 1, characterized in that: The steps to construct each thinking-chain agent unit are as follows: Step 2.21: Define the infrastructure of each thinking-chain agent unit; Step 2.22: Define the functional modules of the thinking-chain agent unit, including: Perception module: responsible for obtaining information; Initial scanning module: responsible for identifying a set of possible vulnerability points from the code repository for different types of vulnerabilities according to predefined static scanning rules; Inference module: responsible for reasoning based on beliefs and goals; Action module: responsible for executing specific actions; Communication module: responsible for communicating with the source code preprocessing unit, the agent system management unit or an external system; Step 2.23: Implement the thinking-chain model template in the thinking-chain agent unit. The specific steps are as follows: Step 2.231: Convert the thinking-chain steps of the thinking-chain model template into corresponding semantic rules; Step 2.232: Convert the above semantic rules into an inference state machine. The inference state machine constructs the inference module of the thinking-chain agent unit through the preconditions of the semantic rules and the corresponding execution actions, and is used to manage and execute the semantic rules in Step 2.231; Step 2.233: Use the natural language processing model as the semantic rule executor in the inference module of each thinking-chain agent unit to generate the inference results of the corresponding rules in 2.231; Step 2.234: Define the interface of the thinking-chain agent unit and encapsulate it into an independent agent unit.

6. The software vulnerability mining and POC verification method based on the chain of thought and agent according to claim 1, characterized in that: Step 3.24 includes the following steps: Step 3.241: The thinking-chain agent unit builds a test environment similar to the target software and configures the relevant parameters in the test environment to meet the conditions for vulnerability triggering. Step 3.242: Run the generated POC code in the test environment. The agent verifies the existence of the vulnerability and the effectiveness of the POC according to the execution results of the POC. Step 3.243: If the POC fails to successfully trigger the vulnerability, the agent will backtrack according to the thinking-chain, analyze the reasons and optimize the POC code.

Images