Context enhanced vulnerability detection method based on large language model

Abstract

The invention provides a context enhanced vulnerability detection method based on a large language model, and belongs to the technical field of code security detection. Comprising the following steps: S1, data preprocessing: determining a code analysis range and preprocessing code data; s2, abstract extraction of the primitive API: executing cross-function deep analysis on the basis of code representation obtained by data preprocessing, and extracting an abstract used by the primitive API as context enhancement information of vulnerability detection. And S3, large language model vulnerability detection: inputting the source code of the target function and the additional primitive API abstract into the large language model as prompts, and carrying out automatic vulnerability detection and judgment. According to the method, the accuracy of cross-function vulnerability detection is greatly improved, analysis noise and resource consumption are effectively reduced, and the code vulnerability reasoning capability of a large language model is remarkably enhanced.

Description

TECHNICAL FIELD

[0001] The application provides a context-enhanced vulnerability detection method based on a large language model, belonging to the technical field of code detection. BACKGROUND

[0002] With the development of artificial intelligence, researchers have begun to try to use deep learning to automatically learn vulnerability patterns in code. Representative works include VulDeePecker, SySeVR, Devign, etc. The basic principle of such methods is: first, convert the source code into a structured representation suitable for model learning, and then use a neural network model to predict whether the code has vulnerabilities.

[0003] For example, one typical approach is based on sequence or code slice representation. For example, VulDeePecker introduces the concept of "code gadget", which extracts code lines that may be related to vulnerabilities and several lines above and below them from the source code to form local code gadgets for neural network model analysis. SySeVR uses a similar program slicing technique to extract code snippets containing key syntax and semantic elements from the source code, and then uses a deep neural network model (such as bidirectional LSTM) to classify the snippets.

[0004] Another approach is based on graph structure representation. The representative Devign method uses a CodeProperty Graph to comprehensively represent the syntax structure, control flow, and data flow relationships of the program, and then uses a graph neural network for vulnerability detection.

[0005] The above deep learning detection process generally includes: static analysis preprocessing of the source code (constructing an abstract syntax tree, program slicing, or code property graph, etc.), extracting structural features; then inputting the features into a trained neural network model for inference, and outputting a prediction of whether a vulnerability exists. Typical literature reports that such methods have improved detection accuracy on public datasets, demonstrating the potential of deep learning to automatically extract vulnerability features. However, these methods generally model program logic within a single function or local segment, and fail to fully utilize cross-function call relationships and global context information, making it difficult to cover larger-scale vulnerabilities.

[0006] In recent years, with the emergence of large-scale pre-training models such as GPT-4, vulnerability detection based on large language models (LLM) has become a new direction. Instead of training a specialized vulnerability classification model, this approach uses the powerful code understanding and reasoning capabilities of pre-trained models to guide the model to output vulnerability analysis results through carefully designed prompts (Prompt).

[0007] However, relying solely on large language models for vulnerability detection currently has the following problems: difficulty in handling cross-function dependencies; high context noise; inaccurate reasoning; and large performance fluctuations.

[0008] In summary, existing static code vulnerability detection techniques have obvious defects at different analysis granularities: First, function-level vulnerability detection methods lack context information. Traditional methods usually only analyze a single function (or functions before and after a patch), making it difficult to capture the root cause of vulnerabilities caused by cross-function interactions. For example, the cause of a vulnerability may involve the combined action of multiple function calls, but function-level analysis is limited in scope and may miss or misreport cross-function vulnerabilities. Second, repository-level analysis methods have redundancy and high resource overhead. Analyzing the entire codebase can extract more context, but it also introduces a lot of irrelevant information, making it difficult for the model to distinguish between effective patterns and noise. In addition, large codebases face challenges such as compilation difficulties and path explosion in static analysis, leading to high computational costs and poor scalability. Finally, the reasoning ability of current large language models is limited. Although large models such as GPT-4 and LLaMA have shown potential in code understanding, relying directly on them to infer vulnerability roots in the absence of sufficient context is still difficult. Models often have difficulty accurately locating complex vulnerabilities or providing stable conclusions, which may result in unreliable reasoning and poor consistency. SUMMARY

[0009] To address the above shortcomings, the technical pain points addressed by the present invention are: how to provide sufficient and accurate vulnerability and secure code context information for large language models without significantly increasing the analysis range and computational cost, thereby significantly improving the accuracy and stability of cross-function vulnerability detection. Specifically, the present invention aims to: (1) introduce necessary cross-function call context for vulnerability detection to compensate for the limitations of a single function perspective; (2) avoid scanning the entire code repository globally while extracting key information related to vulnerabilities to reduce analysis noise and overhead; (3) enhance the reasoning ability of large language models by optimizing the prompting strategy to focus on vulnerability-related clues and overcome their limitations in code vulnerability detection tasks.

[0010] The specific technical solutions provided by the present invention are:

[0011] The present invention provides a context-enhanced vulnerability detection method based on a large language model, comprising the following steps: data preprocessing, primitive API abstraction extraction, and large language model vulnerability detection.

[0012] S1: Data preprocessing: determine the code analysis range and preprocess the code data.

[0013] First, the target function to be detected and its related calling context function are selected, and the multi-layer calling analysis depth is set. After determining the scope, static program analysis is performed on the target function and all directly or indirectly called functions to construct the corresponding code property graph (CPG). The CPG of the target function and related called functions is generated using a code parsing tool, and the calling relationship between functions is extracted to lay the foundation for subsequent context analysis. After preprocessing, the code representation set of each function and its calling relationship within the limited scope is obtained.

[0014] S2: Primitive API abstraction extraction: Based on the code representation obtained through data preprocessing, in-depth analysis across functions is performed, and primitive API usage summaries are extracted as context enhancement information for vulnerability detection.

[0015] Specifically, for the target function and its multi-layer called functions, control flow analysis and data flow analysis are performed to mine primitive API calling behaviors related to security vulnerabilities.

[0016] The selection of primitive APIs is based on commonly used standard libraries and system calls, covering memory allocation and release, file / network resource application and closing error-prone operations. Complex multi-layer called functions are represented by corresponding primitive API sequences after abstraction, greatly simplifying the analysis objects.

[0017] During the primitive API abstraction process, API usage features are extracted from the following four dimensions:

[0018] First, fuzzy branching, which does not distinguish between specific execution paths, records whether a primitive API is called in "all branches", "part of the branches", or "no branches" in the calling chain of the target function within the limited calling depth.

[0019] Second, precise path, which further records the specific control conditions and path information that trigger the calling of primitive APIs. By traversing all control flow branches in the calling chain of the target function within the limited calling depth, the conditions under which the corresponding primitive API is called are captured, and these key condition paths are added to the summary.

[0020] Third, call frequency, which counts the number of times each primitive API appears in the calling chain of the target function within the limited calling depth.

[0021] Fourth, key variables, which track the key variables or data objects involved in the operation of primitive APIs. By combining control flow and data flow analysis, when a certain primitive API is detected in a certain control flow branch, the target variable affected by the operation is identified and added to the summary.

[0022] By multi-dimensional primitive API abstraction, highly abstract and closely related to vulnerability primitive API summaries, i.e. vulnerability context information, are extracted. These summary information is then attached or embedded in the code context of the target function as an input prompt for a large language model.

[0023] S3: Large language model vulnerability detection: the source code of the target function and its attached primitive API summary are jointly input as a prompt to a large language model for automatic vulnerability detection and judgment.

[0024] In the model inference stage, a variety of Prompt engineering strategies are used to improve the model's understanding and reasoning ability of code and context. Including: adopting role-playing prompts to let the model work as a "vulnerability detection expert", only giving accurate conclusions and necessary explanations, to ensure that the output is targeted at vulnerability diagnosis and concise and professional. Adopting chain thinking prompts, guiding the model to first analyze the code function and structure in detail, and then judge whether a vulnerability exists based on the analysis results.

[0025] In addition, comparative example prompts are provided, i.e. before formal detection, the model is provided with a number of safe code and vulnerability code and their corresponding context comparison examples, to help the model understand the difference between safe and unsafe code.

[0026] Different large language model characteristics are adjusted to adjust the prompt method and model parameter configuration. After receiving the prompt input, the model performs inference analysis. The model uses a locally deployed CodeLLaMA model or calls a cloud LLM service of DeepSeek and GPT model, and then outputs the vulnerability detection result.

[0027] The key technology of the present application is:

[0028] 1. Multi-layer call analysis framework: The present application establishes a multi-layer function call analysis framework with a limited depth, which can accurately extract cross-function context information related to vulnerability detection without performing global code repository scanning. In particular, three-layer call depth is used as the default analysis range, which can cover about 75% of cross-program vulnerabilities and avoid excessive consumption of analysis resources.

[0029] 2. Primitive API abstraction extraction mechanism: The primitive API abstraction extraction proposed by the present application is the most innovative core technology point, which systematically captures the API usage patterns related to security in the function call chain from four dimensions (fuzzy branch, precise path, call frequency, and key variable), simplifies complex code into highly abstract API usage summaries, and effectively filters code details unrelated to vulnerabilities.

[0030] 3. Large language model context enhancement technology: The application designs a special context providing mechanism, which integrates the extracted API summary into the model input in a structured form, and uses role playing, chain thinking, comparison example and other Prompt engineering strategies to greatly improve the reasoning ability and result accuracy of the large language model in the vulnerability detection task.

[0031] The technical solution provided by the application is different from the prior art in that:

[0032] 1. Context enhanced vulnerability detection framework

[0033] The context enhanced vulnerability detection method proposed by the application has a complete process formed by sequentially connecting three key components: a data preprocessing module, a primitive API abstraction extraction module, and a large language model vulnerability detection module. The method first determines the code analysis range and constructs a code attribute graph, then extracts cross-function security related API usage features from multiple dimensions, and finally makes intelligent vulnerability judgment based on enhanced context.

[0034] The application combines static program analysis technology with the reasoning ability of a large language model, and realizes efficient connection between the two through an intermediate primitive API abstraction layer, breaking through the limitations of traditional methods that either only use static analysis or directly use a large model and can only perform function-level vulnerability detection. Through the architecture design of the three-module collaborative work, the context deficiency problem of cross-function vulnerability detection is solved without significantly increasing the computing overhead.

[0035] The application covers the combination and collaborative work mechanism of the three modules, including various possible module variant implementations and connection methods. Regardless of how the specific implementation of the three modules changes (such as using different static analysis techniques or tools, different static analysis ranges, different API abstraction strategies, different large language models or prompt strategies), as long as the overall framework structure is maintained, it belongs to the coverage range of the present protection point.

[0036] 2. Data preprocessing

[0037] The application includes three core technologies: one is a method for determining target functions and their related call contexts, especially a multi-layer call analysis depth (default three-layer call depth) strategy based on vulnerability distribution characteristics; two is a method for performing static program analysis on target functions and functions in their call chains to construct a unified representation (code attribute graph) that integrates abstract syntax trees, control flow graphs, data flow graphs and other code attributes; three is a method for extracting function call relationships to form a call graph.

[0038] The application proposes a limited-depth call chain analysis strategy. Based on empirical research, it is found that about 75% of cross-function vulnerabilities do not exceed three layers of call depth. By limiting the analysis range, an optimal balance between analysis depth and resource consumption is achieved. Compared with global code analysis, it avoids resource waste, and compared with single-function analysis, it provides sufficient context information.

[0039] The application includes a multi-layer call analysis method implemented based on any static analysis technology, regardless of the specific tool (such as Joern, CodeQL, Clang, etc.) used to build the code property graph. It covers various call depth determination strategies and static analysis implementation mechanisms. It also covers various variant implementations of call graph construction and representation.

[0040] 3. Primitive API abstraction extraction

[0041] The application includes the following techniques: a method for defining a corresponding primitive API set for different vulnerability types; a method for extracting API call features from fuzzy branch dimensions; a method for capturing control conditions and path information that trigger API calls from precise path dimensions; a method for counting API usage frequency and identifying abnormal patterns from call frequency dimensions; a method for tracking data objects involved in API operations from key variable dimensions; and a method for integrating multi-dimensional API usage features into context summaries.

[0042] The application proposes the concept of primitive API abstraction and a four-dimensional feature extraction framework, which simplifies complex code structures and semantics into highly generalized API usage summaries. This method overcomes code redundancy and context noise problems, and extracts essential information directly related to vulnerabilities, providing high-quality, low-noise context enhancement for large language models.

[0043] The application includes primitive API definition and extraction methods for any programming language; various variant implementations of four-dimensional feature extraction; primitive API mapping strategies for different vulnerability types; and any conversion and representation methods from code to API summaries. As long as the purpose of extracting security-related API usage features from code is achieved, regardless of the specific analysis algorithm or data structure used, it falls within the scope of this protection point.

[0044] 4. Large language model vulnerability detection

[0045] The application includes the following techniques: a method for inputting target function source code and API summary context into a large language model; a method based on role-playing prompt technology; a reasoning method using chain-of-thought prompt strategy; a method for providing contrast example prompts; a method for adjusting prompt methods and parameter configurations for different model characteristics; and a method for normalizing model output results.

[0046] The application designs a special Prompt engineering system suitable for code vulnerability detection, effectively guides large language models to focus on code security analysis through structured prompts and diversified strategy combinations (role playing, chain thinking, contrast examples, etc.), overcomes the limitations of models in complex code reasoning, and significantly improves the sensitivity and accuracy of model vulnerability.

[0047] The application includes various methods of fusing source code with context information, prompt design strategies suitable for different large language models (such as GPT series, LLaMA series, etc.), various vulnerability detection-specific prompt templates, and various implementation methods of model parameter configuration and output processing. Regardless of the specific large language model or prompt engineering technology used, as long as the core idea of using structured prompts to guide the model for vulnerability detection is adopted, it falls within the scope of this protection.

[0048] The technical solutions provided by the application have the following technical effects:

[0049] First, the accuracy of cross-function vulnerability detection is greatly improved. To address the lack of context in function-level vulnerability detection methods, the application uses static analysis techniques to analyze multi-layer function calls, obtaining sufficient cross-function context information, and providing it to the large language model in the form of primitive API summaries to supplement the function being detected. This allows the model to understand the global call chain reasons for vulnerability and reduces false positives and false negatives caused by missing context. Experimental results show that the application significantly improves vulnerability detection performance without significantly increasing computational overhead: compared with the baseline method without context enhancement, the accuracy is improved by 12.77 percentage points, the precision is improved by 10.05 percentage points, and the F1 value is improved by 9.25 percentage points. This significant performance improvement fully demonstrates the importance of providing appropriate context for vulnerability detection.

[0050] Second, it effectively reduces analysis noise and resource consumption. To address the problem of high warehouse-level analysis noise and high overhead, the application limits the call depth and focuses on primitive APIs, extracting only key context related to vulnerability risks and avoiding blind search of the entire codebase. On the one hand, primitive API abstraction filters out complex calls and trivial details unrelated to vulnerabilities, making the model input more refined and improving the reliability of the detection results. On the other hand, analyzing only a limited number of call relationships and related code greatly reduces the computational load of static analysis, avoiding path explosion and performance bottlenecks caused by global analysis. Therefore, while providing context-enhanced information, the application controls additional resource overhead to a minimum, without burdening existing development processes.

[0051] Thirdly, the code vulnerability reasoning ability of the large language model is significantly enhanced. The present application makes up for the deficiency of the large model in direct reasoning by means of a carefully designed prompt engineering strategy. The role-playing prompt enables the model to strictly focus on the vulnerability detection task and avoid irrelevant content interference. The chain-of-thought and contrastive example prompts guide the model to analyze the code logic and security differences in a step-by-step manner, thereby obtaining a more reliable and consistent reasoning process. In combination with these means, the large language model can more accurately understand the code semantics and context association and output stable and reliable vulnerability detection conclusions. This not only improves the accuracy of single detection, but also improves the generalization performance of the model on different samples. In summary, the technical solution provided by the present application realizes high-accuracy detection of complex cross-function vulnerabilities without increasing excessive resource consumption, improves the effectiveness and reliability of automated code security analysis, and has important significance for software security protection. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 A flow chart of the vulnerability detection method of the present application is shown. DETAILED DESCRIPTION

[0053] The present application provides a context-enhanced vulnerability detection method based on a large language model, as shown in Figure 1 The method generally includes three core stages: data preprocessing, primitive API abstraction extraction, and large language model vulnerability detection. The specific steps and system modules of the technical solution will be described below in conjunction with the drawings.

[0054] As shown in Figure 1 The flow chart of the vulnerability detection method of the present application includes the following steps:

[0055] S1: Data preprocessing:

[0056] Determine the code analysis range and preprocess the code data.

[0057] First, select the target function to be detected and its related calling context, and set the three-layer calling analysis depth. The default analysis range is three layers of calling because existing research shows that about 75% of cross-program vulnerabilities have a calling depth of no more than three layers. After determining the range, perform static program analysis on the target function and all functions called directly or indirectly by the target function to construct the corresponding code property graph (CPG, Code Property Graph). The code property graph is a unified representation that integrates abstract syntax tree, control flow graph, data flow graph, and other code properties, which can comprehensively depict the structure and semantic information within a function and across functions. In this step, the CPG of the target function and the related called functions is generated using a code parsing tool such as Joern, and the calling relationship between functions is extracted to lay the foundation for subsequent context analysis. After preprocessing, a set of code representations of each function and its calling relationship within the specified range is obtained.

[0058] S2: Primitive API abstraction extraction:

[0059] Based on the code representation obtained in the first step of data preprocessing, cross-function deep analysis is performed, and a primitive API usage summary is extracted as context enhancement information for vulnerability detection.

[0060] Specifically, control flow analysis and data flow analysis are performed for the target function and its multi-layered called functions, and API call behaviors related to security vulnerabilities are mined. The present application focuses on the use of primitive APIs (Primitive API), which are usually underlying resource operation functions (such as memory management, file opening and closing, etc.) and are prone to cause vulnerabilities. For different types of vulnerabilities, the primitive APIs involved are also different, as shown in Table 1. For example, a memory leak vulnerability refers to a program that allocates memory but fails to release it at the appropriate place, so the primitive APIs involved include program memory allocation (malloc() / calloc() / realloc()) and leakage (free()). The selection of primitive APIs can be based on commonly used standard libraries and system calls (such as stdlib.h and stdio.h functions in C language), covering memory allocation and release, file / network resource application and closing, etc. Complex called functions are abstracted and represented by corresponding primitive API sequences, thereby greatly simplifying the analysis objects.

[0061] Table 1 Primitive API

[0062]

[0063] During the abstraction of primitive APIs, the present application extracts API usage features from the following four dimensions:

[0064] Firstly, fuzzy branches, i.e. without distinguishing specific execution paths, record whether a certain primitive API is called in "all branches", "part of branches" or "no branch" in the call chain of each called function in the target function within the limited call depth. Fuzzy branch information provides a global overview of API calls, effectively reducing irrelevant detail noise while preserving key control flow features.

[0065] Secondly, precise paths, i.e. further record the specific control conditions and path information that trigger the call of primitive APIs. By traversing all control flow branches in the call chain of each called function within the limited call depth, it is captured that under which conditions (such as if judgment of a specific branch) the corresponding API will be called, and these key condition paths are added to the summary. Precise path summary provides accurate conditional execution context for understanding vulnerabilities.

[0066] Thirdly, the call frequency, i.e., the number of times each primitive API appears in the call chain of each called function. The call frequency as a quantitative indicator reflects the frequency of resource operations, which helps to find abnormal resource usage patterns. For example, an abnormally high call frequency may indicate a resource release or omission problem.

[0067] Fourthly, the key variable, i.e., the key variable or data object involved in the primitive API operation. By combining control flow and data flow analysis, when a certain primitive API is detected in a certain control flow branch, the target variable affected by the primitive API is identified and added to the summary. Key variable information helps to locate the specific object affected by the vulnerability (e.g., a pointer variable that is repeatedly released).

[0068] In summary, through multi-dimensional primitive API abstraction, the present application extracts highly generalized and closely related context information. These summary information is then attached or embedded into the code context of the target function as input prompts for large language models.

[0069] S3: Large language model vulnerability detection: the source code of the target function and its attached primitive API summary are jointly input as prompts to the large language model for automatic vulnerability detection and judgment.

[0070] In the vulnerability detection phase, the present application uses a variety of Prompt engineering strategies to improve the model's understanding and reasoning ability of code and context. For example, role-playing prompts allow the model to work as a "vulnerability detection expert" and only give accurate conclusions and necessary explanations to ensure that the output is focused on vulnerability diagnosis and is concise and professional. Chain of thought prompts guide the model to first analyze the code function and structure in detail, and then judge whether a vulnerability exists based on the analysis results. This chain reasoning approach improves the interpretability and accuracy of model decision-making. In addition, contrast example prompts are provided, i.e., before formal detection, the model is provided with a number of safe code and vulnerability code comparison examples (such as code snippets before and after patching and vulnerability repair), helping the model understand the differences between safe and unsafe code, thereby improving the sensitivity and stability of the judgment.

[0071] In combination with the above strategies, the present application adjusts the prompt method and model parameter configuration according to different model characteristics, for example, by adjusting the temperature parameter to appropriately reduce randomness to obtain more stable and reliable output results. The model service module receives the prompt input and performs reasoning analysis by the large language model in the backend. The model can use a locally deployed CodeLLaMA model or call a cloud LLM service of DeepSeek and GPT model, and then output the vulnerability detection result. For example, the model will give a judgment on whether the target code has a vulnerability (yes / no), and provide an explanation of the vulnerability type or reason for the developer's reference when needed.

[0072] Alternative solution of the technical solution provided by the present application:

[0073] (1) Context enhancement scheme based on dynamic taint analysis

[0074] In this scheme, the acquisition of context enhancement information does not rely on static analysis and primitive API abstraction, but adopts dynamic taint analysis technology. Specifically, first, the target program is monitored through code instrumentation technology, and data from untrusted sources is marked as "taint" at runtime, and the propagation path of these taint data during program execution is tracked. When the taint data affects the key program points (such as memory allocation size parameters, pointer dereference operations, control flow decisions, etc.), the system records the relevant execution path and data flow. Subsequently, a complete taint propagation graph is constructed, which reveals how data flows across function boundaries and ultimately affects security-sensitive operations. Taint analysis focuses particularly on dangerous intersection points, i.e., program locations where taint data intersects with security-critical operations (such as memcpy, memory release, etc.). The system extracts these intersection points and their propagation links as structured abstractions, forming code context enhancement information. This scheme can more accurately capture data-related vulnerabilities (such as buffer overflow, format string vulnerability, etc.) compared to the original scheme, and can automatically identify complex cross-function data dependencies, reducing the need for manual specification of analysis scope.

[0075] (2) Context construction scheme based on patch difference analysis

[0076] The core idea of this scheme is to use historical vulnerability repair experience to guide current code vulnerability identification. The system first builds a large-scale vulnerability-patch comparison library, extracting the differences between vulnerability code and its corresponding patch from historical repair records of open-source software. Further, the system abstracts and classifies these differences at the semantic level, summarizing the characteristic repair patterns of different types of vulnerabilities, such as: increasing buffer size check, adding null pointer check, correcting resource release order, etc. In the vulnerability detection phase, the system performs structured comparison between the target function code and the vulnerability patterns in the patch library, identifying similar code structures to known vulnerability patterns. For successfully matched patterns, the system extracts the corresponding historical repair methods and security coding practices, providing these comparative information as context rich in semantics to the large language model. In addition, the system can also generate a hypothetical "safe version code" based on the pattern matching results, which is presented side by side with the original code, helping the model understand potential vulnerability points and their possible repair directions. This scheme uses the idea of "contrastive learning", by explicitly showing the differences between vulnerability code and safe code, significantly improving the model's sensitivity to subtle security defects.

[0077] (3) Behavior modeling scheme based on program state machine

[0078] This solution addresses the context enhancement problem from the perspective of formal verification, and the core is to build a state machine model of resource life cycle. In specific implementation, the system first defines a standard state transition automaton for each type of safety-critical resource (such as memory blocks, file handles, locks, etc.), describing the legal state sequence of the resource from creation, use to release. For example, the states of memory resources can include "unallocated", "allocated but uninitialized", "initialized", "released", etc., as well as the legal transition relationship between these states. Subsequently, the system maps the behavior of the target function and the functions on its call chain to the operation sequence on the resource state through static or symbolic execution analysis. Through cross-function state tracking, the system can detect abnormal transitions of resource states, such as "released → used" (use after free), "unallocated → released" (free on null pointer), etc. For the discovered state violations, the system generates a structured summary containing the complete state transition path, the point of abnormal transition, and its triggering conditions. These state machine violation information is provided to the large language model in the form of visual charts and textual descriptions, helping the model accurately understand the root cause and propagation path of resource management errors. Compared with the original solution, this solution has a stronger formal theoretical foundation and can systematically detect resource management vulnerabilities and provide accurate violation evidence.

[0079] (4) Code embedding-based semantic enhancement context solution

[0080] This solution uses deep learning and information retrieval techniques to enhance context information. The system first uses a pre-trained code understanding model (such as CodeBERT, GraphCodeBERT, etc.) to convert the target function and related functions on its call chain into semantic-rich vector representations (embeddings). These embedding vectors capture the syntactic structure and underlying semantics of the code, rather than just superficial lexical features. Based on these semantic embeddings, the system performs similarity retrieval in a pre-built code knowledge base (containing annotated safe / vulnerable code) to find similar code snippets and their security states in terms of functionality and structure. The retrieval results are sorted by similarity, and the system selects the most relevant ones as reference contexts. In the vulnerability detection phase, the system provides the original code and the retrieved similar samples (including safe samples and known vulnerable samples) to the large language model, and designs a special prompt template to guide the model to perform comparative analysis. The model needs to identify the key similarities and differences between the target code and each sample, and based on this comparative reasoning, it makes a more accurate vulnerability judgment. This solution essentially implements the application of Retrieval Augmented Generation (RAG) in code security analysis, effectively improving the reasoning accuracy and analysis depth by expanding the model's reference knowledge range, and is particularly suitable for handling complex or rare vulnerability patterns.

[0081] (5) Multi-granularity parallel analysis and integrated decision solution

[0082] This scheme adopts a multi-level parallel analysis architecture to comprehensively evaluate code security from different granularities and perspectives. The system conducts vulnerability analysis at multiple levels simultaneously: at the syntax level, it identifies dangerous syntax structures through abstract syntax tree pattern matching; at the function level, it performs primitive API call analysis; at the module level, it analyzes inter-component interactions and data transfers; and at the system level, it evaluates global resource management strategies. Each layer of analysis runs independently and generates a corresponding feature vector representing security indicators in different dimensions. Subsequently, the system uses machine learning ensemble models (such as random forests, gradient boosting trees, or neural networks) to integrate these multi-dimensional features, calculate comprehensive vulnerability risk scores and classification labels. The ensemble model output includes not only risk prediction results but also the contribution weights of each feature and key decision paths. In the final reasoning stage, the system provides the original code, multi-level analysis results, and the prediction and explanation of the ensemble model as a multi-dimensional context to a large language model, forming a "human-machine collaborative judgment." This scheme reduces the limitations of a single analysis perspective through multi-angle analysis and feature integration, improving the robustness and adaptability of the detection system. In particular, the introduction of ensemble learning enables the system to balance the advantages and disadvantages of different types of analysis, forming a more comprehensive and accurate judgment while providing structured judgment evidence, enhancing the explainability of the detection results.

Claims

1. A context-enhanced vulnerability detection method based on a large language model, characterized in that, Includes the following steps: S1: Data Preprocessing: Determine the scope of code analysis and preprocess the code data; S2: Primitive API Abstraction Extraction: Based on the code representation obtained from data preprocessing, perform in-depth cross-function analysis and extract primitive API usage summaries as contextual enhancement information for vulnerability detection; S3: Large Language Model Vulnerability Detection: The source code of the target function and its attached primitive API summary are fed as prompts into a large language model for automatic vulnerability detection and judgment.

2. The context-enhanced vulnerability detection method based on a large language model according to claim 1, characterized in that, The S1 method is as follows: First, select the target function to be detected and its related calling context, and set the depth of multi-level call analysis; after determining the scope, perform static program analysis on the target function and all functions that are directly or indirectly called, and construct the corresponding code attribute graph (CPG); use code parsing tools to generate the CPG of the target function and related called functions, and extract the calling relationship between functions to lay the foundation for subsequent context analysis. After preprocessing, a set of code representations of each function and its calling relationships within a defined scope is obtained.

3. The context-enhanced vulnerability detection method based on a large language model according to claim 1, characterized in that, The S2 method involves performing control flow and data flow analysis on the target function and its multi-layered called functions to uncover primitive API call behaviors related to security vulnerabilities. The selection of primitive APIs is based on commonly used standard libraries and system calls, covering error-prone operations such as program memory allocation and deallocation, and file / network resource allocation and closing. Complex multi-level called functions are abstracted and represented by the corresponding primitive APIs using a summary. By abstracting primitive APIs from multiple dimensions, highly generalized contextual information closely related to vulnerabilities is extracted. This summary information is then appended or embedded into the code context of the target function as input hints for the large language model.

4. The context-enhanced vulnerability detection method based on a large language model according to claim 3, characterized in that, In the process of primitive API abstraction, API usage characteristics are extracted from the following four dimensions: The first is fuzzy branching, which does not distinguish the specific execution path, but records whether a certain primitive API in the call chain of each called function of the target function is called in "all branches", "partial branches", or "no branches". Second, precise path, which further records the specific control conditions and path information that trigger the primitive API call; by traversing all control flow branches in the call chain of each called function of the target function, it captures under which control flow conditions the corresponding API will be called, and adds these key condition paths to the summary; Third is the call frequency, which is the number of times each primitive API appears in the call chain of each called function of the target function; Fourthly, key variables, namely, the key variables or data objects involved in the primitive API operations; by combining control flow and data flow analysis, when a primitive API is detected in a certain control flow branch, the target variable identifier of its effect is added to the summary.

5. The context-enhanced vulnerability detection method based on a large language model according to claim 1, characterized in that, The S3 approach specifically involves employing various hinting engineering strategies during the vulnerability detection phase of the large language model to enhance the model's understanding and reasoning ability regarding code and primitive API summaries. These strategies include: using role-playing hints to allow the model to work as a "vulnerability detection expert," providing only precise conclusions and necessary explanations to ensure that the output is targeted at vulnerability diagnosis and is concise and professional; and using chain-thinking hints to guide the model to first analyze the code's functionality and structure in detail, and then determine whether a vulnerability exists based on the analysis results. In addition, comparative examples are provided, that is, before formal testing, several examples of secure code and vulnerable code and their corresponding primitive API summaries are provided to the model to help the model understand the differences between secure and insecure code; The prompting method and model parameter configuration are adjusted according to the characteristics of different large language models. After receiving the prompt input, the model performs inference analysis. The model uses the locally deployed CodeLLaMA model or calls the cloud LLM service of DeepSeek and GPT models, and then outputs the vulnerability detection results respectively.

Images