Vulnerability analysis method based on large model and SAST, program product and equipment

Abstract

The embodiment of the invention provides a vulnerability analysis method based on a large model and SAST, a program product and equipment. The vulnerability analysis method based on the large model and the SAST comprises the steps that according to vulnerability information of any vulnerability in a vulnerability information base, a life cycle diagram of the vulnerability is generated; based on the life cycle diagram, obtaining a code context where the vulnerability is located from a project code; analyzing the code context by adopting a large model to obtain a vulnerability cause and an execution function of the vulnerability; backtracking and searching an entry function of the vulnerability from the execution function in a global call graph; wherein the global call graph is generated by analyzing the project code by adopting an SAST tool; outputting an analysis result of the vulnerability; wherein the analysis result comprises the vulnerability cause, the execution function and the entry function. According to the embodiment of the invention, the vulnerability availability information of various vulnerabilities in the open source project can be stably and accurately provided.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software security, in particular to a vulnerability analysis method based on a large model and SAST, a program product and equipment. BACKGROUND

[0002] In recent years, more and more enterprise development teams quote various open source components to develop software. Although it can reduce a lot of basic work and improve the efficiency of software development in the software development process, when the open source software is widely used, the open source project such as the open source software that has not been updated to the repair version in time or exists private branch and the system applying the open source software will face the risk brought by the vulnerability of the open source component.

[0003] The traditional vulnerability analysis method mainly matches the version number of the open source component in the open source project with the version number of the open source component where each vulnerability is announced by the vulnerability information source, to determine whether there is each vulnerability in the project. This vulnerability analysis method not only easily fails in the case that the code fragment of the open source component is cut, renamed, confused or grammatically changed, but also lacks analysis of complete taint propagation chain, and it is difficult to further analyze vulnerability exploitability. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a vulnerability analysis method based on a large model and SAST, a program product and equipment, to realize the technical effect of stably and accurately providing vulnerability exploitability information of various vulnerabilities in an open source project.

[0005] In a first aspect, the embodiments of the present application provide a vulnerability analysis method based on a large model and SAST, comprising: generating a life cycle graph of any vulnerability in a vulnerability information library according to vulnerability information of the vulnerability; obtaining a code context where the vulnerability is located from the project code based on the life cycle graph; analyzing the code context by using a large model to obtain a vulnerability cause and an execution function of the vulnerability; backtracking to find an entry function of the vulnerability from the execution function in a global call graph; wherein the global call graph is generated by analyzing the project code by using a SAST tool; outputting an analysis result of the vulnerability; wherein the analysis result comprises the vulnerability cause, the execution function and the entry function.

[0006] In the implementation process, by generating a life cycle graph of the vulnerability according to vulnerability information of any vulnerability in the vulnerability information library, obtaining a code context where the vulnerability is located from the project code based on the life cycle graph, analyzing the code context by using a large model to obtain a vulnerability cause and an execution function of the vulnerability, and in a global call graph generated by analyzing the project code by using a SAST tool, backtracking to find an entry function of the vulnerability from the execution function, the vulnerability cause, the execution function, and the entry function are arranged as an analysis result output of the vulnerability, which can analyze the vulnerability cause and the execution function of the vulnerability from the code context covering the life cycle of the vulnerability in the project code by using the natural language understanding, processing, and learning capabilities of the large model, ensures that the vulnerability cause and the execution function of the vulnerability in the project code can be stably and accurately analyzed in the case of modification of the project code, and the entry function of the vulnerability is backtracked from the execution function as a point of pollution convergence in the global call graph generated by using the SAST tool, ensures that the entry function of the vulnerability that can reach the outside in the project code is found in the complete and accurate global call graph, so as to stably and accurately provide the vulnerability exploitability information of various vulnerabilities in the open source project.

[0007] Further, the vulnerability information of the vulnerability includes a plurality of code change records for the vulnerability. The vulnerability information of any vulnerability in the vulnerability information library is used to generate a life cycle graph of the vulnerability, including: The repair code change record for repairing the vulnerability is filtered from the plurality of code change records. The introduction code change record for introducing the vulnerability is backtracked from the repair code change record in the plurality of code change records. The repair code change record is taken as a repair node, the introduction code change record is taken as an introduction node, and a connection edge is added between the introduction node and the repair node to generate the life cycle graph.

[0008] In the implementation process, the repair code change record for repairing the vulnerability is filtered from the plurality of code change records for the vulnerability, the introduction code change record for introducing the vulnerability is backtracked from the repair code change record in the plurality of code change records, the repair code change record is taken as a repair node, the introduction code change record is taken as an introduction node, and a connection edge is added between the introduction node and the repair node to generate a life cycle graph of the vulnerability, which can accurately generate a graph covering the life cycle of the vulnerability based on the introduction code change record and the repair code change record.

[0009] Further, the repair code change record satisfies one or more of the following filtering conditions: The description information or the associated pull request of the repair code change record includes a vulnerability number of the vulnerability. The code change content of the repair code change record includes a problem number associated with a vulnerability report of the vulnerability. The semantic category of the code change content is a repair category; wherein the semantic category of the code change content is determined by the large model.

[0010] In the above implementation process, by considering the description information of the code change record, the associated pull request, the code change content, and the semantic category of the code change content, etc. Multiple information is used to filter repair code change records from multiple code change records, which can ensure that repair code change records are accurately filtered from multiple code change records.

[0011] Further, after generating the life cycle graph of the vulnerability according to the vulnerability information of any vulnerability in the vulnerability information library, it further includes: In the case where the credibility index of the life cycle graph does not meet the standard, in response to a user's update request for the life cycle graph, update the life cycle graph.

[0012] In the above implementation process, by updating the life cycle graph in the case where the credibility index of the life cycle graph of the vulnerability does not meet the standard, in response to a user's update request for the life cycle graph, the code context covering the life cycle of the vulnerability in the project code can be accurately obtained.

[0013] Further, the life cycle graph includes an introduction node and a repair node, the introduction node indicates an introduction code change record for introducing the vulnerability, and the repair node indicates a repair code change record for repairing the vulnerability. The code context in which the vulnerability is located is obtained from the project code based on the life cycle graph, including: Based on the life cycle graph, determine the introduction code change record and the repair code change record; Determine the version of the project code including the introduction code change record as the baseline version, and determine the version of the project code including the repair code change record as the target version; According to the code change content between the baseline version and the target version, and the risk code segment in the project code affected by the code change content, the code context is constructed.

[0014] In the implementation process, by introducing the nodes based on the life cycle diagram and the repair nodes, the introduced code change record and the repair code change record are determined, the version including the introduced code change record in the project code is determined as the baseline version, and the version including the repair code change record in the project code is determined as the target version. According to the code change content between the baseline version and the target version, and the risk code fragments affected by the code change content in the project code, the code context is constructed. The code context where the vulnerability is located can be comprehensively and accurately obtained from the project code by considering the code change content between the baseline version and the target version, and the risk code fragments affected by the code change content in the project code.

[0015] Further, before the code context is analyzed by using the large model to obtain the vulnerability cause and the execution function of the vulnerability, the method further comprises: generating a local call graph according to the code change file for the vulnerability; using the large model to determine whether the target code fragment is missing in the code context according to the local call graph; if yes, adding the target code fragment in the code context and updating the code context.

[0016] In the implementation process, by generating a local call graph according to the code change file for the vulnerability, using the large model to determine whether the target code fragment is missing in the code context according to the local call graph, and adding the target code fragment in the code context and updating the code context if the target code fragment is missing, the function or method that the code context is missing can be effectively avoided, and the code context where the vulnerability is located can be completely and accurately obtained from the project code.

[0017] Further, the generating a local call graph according to the code change file for the vulnerability comprises: obtaining a project code fragment corresponding to the code change file from the project code; determining the call relationship between each call object in the project code fragment based on the code structure of the project code fragment; generating the local call graph according to the call relationship between each call object.

[0018] In the implementation process, by obtaining a project code fragment corresponding to the code change file from the project code, determining the call relationship between each call object in the project code fragment based on the code structure of the project code fragment, and generating the local call graph according to the call relationship between each call object, the call relationship between each call object in the code change file can be accurately identified by analyzing the source code structure of the code change file, and the local call graph of the code change file can be accurately generated.

[0019] Further, the large model is used to analyze the code context to obtain the vulnerability cause and the execution function of the vulnerability. The large model is used to match the code context with each pre-configured vulnerability defect pattern, and determine the vulnerability cause according to a matching result. The large model is used to locate the execution function in the code context according to the vulnerability cause.

[0020] In the implementation process, by pre-configuring the vulnerability defect pattern, using the large model to match the code context with each pre-configured vulnerability defect pattern, and determining the vulnerability cause according to a matching result, and then locating the execution function in the code context according to the vulnerability cause, it can be ensured that the vulnerability cause and the execution function of the vulnerability in the project code can be stably and accurately analyzed even in the case of project code modification, and the analysis speed of the vulnerability cause and the execution function is improved.

[0021] Further, the method further includes: The large model is used to format the execution function.

[0022] In the implementation process, by using the large model to format the execution function of the vulnerability, the execution function can be directly referenced in the subsequent patch generation stage.

[0023] In a second aspect, an embodiment of the present application provides a vulnerability analysis device based on a large model and SAST, including: A life cycle graph generation module is configured to generate a life cycle graph of any vulnerability in a vulnerability information library according to vulnerability information of the vulnerability. A code context acquisition module is configured to acquire a code context in which the vulnerability is located from project code based on the life cycle graph. A first vulnerability analysis module is configured to use a large model to analyze the code context to obtain a vulnerability cause and an execution function of the vulnerability. A second vulnerability analysis module is configured to backtrack to find an entry function of the vulnerability from the execution function in a global call graph, wherein the global call graph is generated by using a SAST tool to analyze the project code. An analysis result output module is configured to output an analysis result of the vulnerability, wherein the analysis result includes the vulnerability cause, the execution function, and the entry function.

[0024] In a third aspect, an embodiment of the present application provides a computer program product, including instructions, which, when executed by a computer, cause the computer to implement the method described above.

[0025] In a fourth aspect, an electronic device is provided, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; the processor implements the method described above when executing the computer program.

[0026] In a fifth aspect, a computer readable storage medium is provided, which includes a stored computer program; wherein the computer readable storage medium controls a device where the computer readable storage medium is located to execute the method described above when the computer program runs. BRIEF DESCRIPTION OF DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0028] Figure 1 A flowchart of a vulnerability analysis method based on a large model and SAST provided by the first embodiment of the present application; Figure 2 A flowchart of establishing a vulnerability information library for the first embodiment of the present application; Figure 3 A structural diagram of a vulnerability analysis device based on a large model and SAST provided by the second embodiment of the present application; Figure 4 A structural diagram of an electronic device provided by the third embodiment of the present application. DETAILED DESCRIPTION

[0029] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0030] It should be noted that: similar reference numerals and letters represent similar items in the following drawings, therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. Meanwhile, in the description of the present application, the terms "first", "second", etc. are only used for distinguishing description, and cannot be understood as indicating or implying relative importance.

[0031] In recent years, more and more enterprise development teams quote various open source components to develop software. Although a lot of basic work can be reduced in the software development process, improving the efficiency of software development, when the open source software is widely used, the open source project such as the open source software that has not been updated to the repair version in time or exists the private branch and the system applying the open source software will face the risk brought by the vulnerability once the open source component discloses the vulnerability.

[0032] In the related art, the vulnerability analysis method mainly matches the version number of the open source component in the open source project with the version number of the open source component where each vulnerability is announced by the vulnerability information source, to determine whether there is each vulnerability in the project. This vulnerability analysis method not only easily fails in the case that the code fragment of the open source component is cropped, renamed, obfuscated or syntax changed, but also lacks analysis of complete taint propagation chain, and it is difficult to further analyze vulnerability exploitability.

[0033] Therefore, the present application proposes a vulnerability analysis method based on a large model and SAST, which generates a vulnerability life cycle graph according to the vulnerability information of any vulnerability in the vulnerability information library, obtains the code context where the vulnerability is located from the project code based on the life cycle graph, analyzes the code context by using a large model to obtain the vulnerability cause and execution function of the vulnerability, and finds the entry function of the vulnerability by backtracking in the global call graph generated by analyzing the project code by using the SAST tool. The vulnerability cause, execution function and entry function are arranged as the analysis result output of the vulnerability, which can analyze the vulnerability cause and execution function of the vulnerability from the code context covering the vulnerability life cycle in the project code by using the natural language understanding, processing and learning ability of the large model, ensure that the vulnerability cause and execution function of the vulnerability in the project code can be stably and accurately analyzed even in the case of project code modification, and find the entry function of the vulnerability reachable outside in the complete and accurate global call graph by taking the execution function as the taint sink, so as to realize stably and accurately providing the vulnerability exploitability information of various vulnerabilities in the open source project.

[0034] The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments.

[0035] The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Figure 1 A vulnerability analysis method based on a large model and SAST is described in the embodiments of the present application. The method provided in the embodiments of the present application can be executed by related terminal devices, and the user terminal is taken as an example for description hereinafter.

[0036] Please refer to Figure 1 , Figure 1A flowchart of a vulnerability analysis method based on a large model and SAST is provided for the first embodiment of the present application. The first embodiment of the present application provides a vulnerability analysis method based on a large model and SAST, including steps S101-S105: S101, according to the vulnerability information of any vulnerability in the vulnerability information library, generating the life cycle graph of the vulnerability.

[0037] As an example, according to the actual application requirement, the vulnerability information of multiple vulnerabilities is collected in advance to establish a vulnerability information library.

[0038] In actual application, the vulnerability information library stores the vulnerability information of multiple vulnerabilities, and the vulnerability information of each vulnerability includes vulnerability number, vulnerability PoC (Proof of Concept, a concept proof code or method for verifying the existence of a vulnerability), vulnerability report, multiple code change records (commit, a snapshot containing code change content), description information of each code change record in the multiple code change records, and pull request (Pull Request, PR) associated with each code change record.

[0039] For each vulnerability in the vulnerability information library, according to the vulnerability information of the vulnerability, the life cycle graph of the vulnerability is generated.

[0040] It should be noted that the life cycle graph of the vulnerability is a graph indicating the entire process from the generation of the vulnerability to the solution, which is equivalent to a timeline covering the entire life cycle of the vulnerability.

[0041] S102, based on the life cycle graph, obtaining the code context where the vulnerability is located from the project code.

[0042] As an example, after obtaining the life cycle graph of the vulnerability, the code context where the vulnerability is located is obtained from the project code of the open source project.

[0043] S103, using a large model to analyze the code context to obtain the vulnerability cause and execution function of the vulnerability.

[0044] As an example, after obtaining the code context where the vulnerability is located, a pre-established large model is used to analyze the code context to obtain the vulnerability cause and execution function of the vulnerability.

[0045] The large model refers to an artificial intelligence large model. In actual application, a large language model (Large Language Model, LLM) can be selected as the large model. The large language model refers to a deep learning model trained using a large amount of text data, so that the model can generate natural language text or understand the meaning of language text. These models can perform multiple language tasks by training on a large dataset.

[0046] By adopting a large model to analyze the vulnerability cause and execution function of the vulnerability from the code context, the natural language understanding, processing and learning ability of the large model can be utilized to ensure that the vulnerability cause and execution function of the vulnerability can be stably and accurately analyzed and reasoned from the code context even if the project code is modified.

[0047] S104, backtracking to find the entry function of the vulnerability from the execution function in the global call graph; wherein the global call graph is generated by analyzing the project code by using the SAST tool.

[0048] As an example, after determining the project code of the open source project, the SAST tool is used to analyze the project code to generate the global call graph.

[0049] It should be noted that the global call graph refers to a graph indicating the calling relationship between various calling objects such as functions and / or methods in the entire project code.

[0050] SAST (Static Application Security Testing) is also called white box testing, which is a tool for detecting potential security vulnerabilities in an application. SAST tool does not need to actually run the application, but only needs to perform syntax and semantic checking, structure analysis and logical reasoning on the source code or compiled binary files of the application to find potential security vulnerabilities.

[0051] By generating the global call graph by using the SAST tool to analyze the project code, the syntax and semantic checking, structure analysis and logical reasoning ability of the SAST tool on the code can be utilized to ensure that the global call graph of the project code is accurately generated.

[0052] After obtaining the global call graph of the project code and the execution function of the function, the execution function of the vulnerability is taken as a sink, and all entry functions reachable from the vulnerability are found by backtracking from the execution function of the vulnerability in the global call graph, and the entry function of the vulnerability is obtained, and the entry function of the vulnerability is also the source of the vulnerability. Based on the execution function and the entry function of the vulnerability, the vulnerability propagation chain "source→sink" of the vulnerability can be preliminarily determined.

[0053] S105, outputting the analysis result of the vulnerability; wherein the analysis result includes the vulnerability cause, the execution function and the entry function.

[0054] As an example, after obtaining the vulnerability cause, execution function and entry function of the vulnerability, the analysis result of the vulnerability is generated and outputted, and the analysis result of the vulnerability includes the vulnerability cause, execution function and entry function of the vulnerability.

[0055] In actual application, the vulnerability cause, the execution function and the entry function of the vulnerability can be sorted into the analysis result of the vulnerability in SARIF (JSON text conforming to SARIF standard) format for output.

[0056] By sorting the vulnerability cause, the execution function and the entry function of the vulnerability into the analysis result of the vulnerability for output, the information reflecting the vulnerability exploitability of the vulnerability cause, the execution function and the entry function of the vulnerability can be provided to the user together, and the user can analyze the vulnerability exploitability according to the vulnerability cause and the vulnerability taint propagation chain of the vulnerability.

[0057] According to the vulnerability information of any vulnerability in the vulnerability information library, the life cycle graph of the vulnerability is generated, the code context where the vulnerability is located is obtained from the project code based on the life cycle graph, the vulnerability cause and the execution function of the vulnerability are obtained by analyzing the code context by using a large model, the entry function of the vulnerability is found by backtracking in the global call graph generated by analyzing the project code by using a SAST tool from the execution function, and the vulnerability cause, the execution function and the entry function are sorted into the analysis result of the vulnerability for output. According to the code context covering the life cycle of the vulnerability in the project code, the natural language understanding, processing and learning ability of the large model are used to analyze the vulnerability cause and the execution function of the vulnerability, so that the vulnerability cause and the execution function of the vulnerability in the project code can be stably and accurately analyzed even in the case of project code modification. According to the global call graph generated by using the SAST tool, the entry function of the vulnerability is found by backtracking from the execution function as the taint sink, so that the entry function of the vulnerability that can reach the outside in the complete and accurate global call graph is found, thereby realizing the stable and accurate provision of the vulnerability exploitability information of various vulnerabilities in the open source project.

[0058] In optional embodiments, the method further includes steps S106-S107: S106, the vulnerability information of each vulnerability is grabbed from a plurality of vulnerability intelligence sources.

[0059] As an example, according to actual application requirements, a plurality of vulnerability intelligence sources are selected, for example Figure 2As shown, the CNNVD (China National Vulnerability Database of Information Security, a national information security vulnerability database constructed and operated by the China Information Security Evaluation Center), NVD (National Vulnerability Database, a comprehensive vulnerability database maintained by the National Institute of Standards and Technology), CVE.org (the official website of the Common Vulnerabilities and Exposures (CVE) project, which discloses vulnerabilities and provides a unique number, i.e., a CVE number, for all disclosed vulnerabilities), GitHub Advisory (a security advisory service platform provided by GitHub), and Snyk (a service platform dedicated to security assessment of open source components) are selected.

[0060] A web crawler tool is used to crawl vulnerability information of each vulnerability from multiple vulnerability intelligence sources.

[0061] For example, an Airflow-based timing crawler scheduler is constructed to perform 24h incremental synchronization on multiple vulnerability intelligence sources such as CNNVD, NVD, CVE.org, GitHub Advisory, and Snyk, and the crawled vulnerability information of each vulnerability is stored in a database in JSON, XML, and RSS formats as objects and records the time stamp to realize a traceable snapshot version. Among them, the ETag / Last-Modified header can be used on the crawler side to avoid repeated crawling, and Bloom-Filter can be used to quickly judge duplicates to avoid crawling duplicate information.

[0062] In S107, the vulnerability information of each vulnerability is preprocessed, the preprocessed vulnerability information of each vulnerability is stored in a database, and a vulnerability information database is obtained.

[0063] As an example, after obtaining the vulnerability information of each vulnerability, the vulnerability information of each vulnerability is preprocessed, such as de-duplication processing and normalization, to obtain the preprocessed vulnerability information of each vulnerability, and the preprocessed vulnerability information of each vulnerability is stored in a database to obtain a vulnerability information database.

[0064] If new vulnerability information of a new vulnerability is subsequently crawled from multiple vulnerability intelligence sources, the new vulnerability information of the new vulnerability is preprocessed to obtain preprocessed vulnerability information of the new vulnerability, and the preprocessed vulnerability information of the new vulnerability can be directly stored in the vulnerability information database to update the vulnerability information database.

[0065] In actual application, the preprocessed vulnerability information of each vulnerability can be converted into structured data and stored in a database.

[0066] The embodiment of the application can collect the vulnerability information of multiple vulnerabilities from multiple vulnerability intelligence sources, and store the preprocessed vulnerability information of each vulnerability in a database, so as to obtain a vulnerability information library, which is beneficial to improve the data volume of the vulnerability information library.

[0067] In an optional embodiment, the vulnerability information of the vulnerability includes multiple code change records for the vulnerability; and the generating of the life cycle graph of the vulnerability according to the vulnerability information of any vulnerability in the vulnerability information library includes: screening a repair code change record for repairing the vulnerability from the multiple code change records; and backtracking to find an introduction code change record for introducing the vulnerability from the repair code change record in the multiple code change records; taking the repair code change record as a repair node, taking the introduction code change record as an introduction node, and adding a connection edge between the introduction node and the repair node to generate the life cycle graph.

[0068] For example, the vulnerability information of each vulnerability in the vulnerability information library usually includes multiple code change records for the vulnerability, such as a code change record submitted for repairing the vulnerability, a code change record submitted for upgrading the function of the module where the vulnerability is located, and a code change record submitted for restructuring the structure of the module where the vulnerability is located, and the like.

[0069] The multiple code change records may not all be repair code change records for repairing the vulnerability, that is, the repair code change records for repairing the vulnerability, and the repair code change records are screened from the multiple code change records after obtaining the multiple code change records for the vulnerability.

[0070] After obtaining the repair code change records, the introduction code change records for introducing the vulnerability are backtracked from the repair code change records in the multiple code change records.

[0071] In actual application, the SZZ algorithm can be run, and the git blame is used to backtrace the introduction code change records from the repair code change records in the multiple code change records.

[0072] In the multi-branch scenario, a DAG (Directed Acyclic Graph) needs to be constructed to maintain the consistency of the project code version topology.

[0073] After obtaining the repair code change record and the introduction code change record, a life cycle graph of the vulnerability is generated by taking the repair code change record as a repair node, taking the introduction code change record as an introduction node, and adding a connection edge between the introduction node and the repair node.

[0074] In actual application, the creation time of the vulnerability report of the vulnerability can also be determined as the discovery time of the vulnerability to create a discovery node, the time when the repair code change record is merged into the project code trunk is determined according to the pull request associated with the vulnerability to create a merge node, and the time when the repair code change record is first released with the project code is determined to create a release node, and connection edges are added between the introduction node, the discovery node, the repair node, the merge node and the release node to generate a life cycle graph of the vulnerability, such as “introduction node→discovery node→repair node→merge node→release node”, and the attribute information of each node includes fingerprint information commit-hash, committer, commit time, associated pull request or issue.

[0075] The embodiments of the present application can accurately generate a graph covering the life cycle of the vulnerability based on the introduction code change record and the repair code change record by screening the repair code change record for repairing the vulnerability from the plurality of code change records for the vulnerability, backtracking the introduction code change record for introducing the vulnerability from the repair code change record, taking the repair code change record as a repair node, taking the introduction code change record as an introduction node, and adding a connection edge between the introduction node and the repair node to generate a life cycle graph of the vulnerability.

[0076] In optional embodiments, the repair code change record satisfies one or more of the following screening conditions: the description information or the associated pull request of the repair code change record includes the vulnerability number of the vulnerability; the code change content of the repair code change record includes the issue number associated with the vulnerability report of the vulnerability; the semantic category of the code change content is repair; wherein the semantic category of the code change content is determined by a large model.

[0077] As an example, after obtaining the plurality of code change records for the vulnerability, one or more of the following methods can be used to screen the repair code change record for repairing the vulnerability from the plurality of code change records: 1. When submitting a code change log to fix a vulnerability, the vulnerability ID is usually added to the description of the code change log or the associated pull request. Search among multiple code change logs for those with the vulnerability ID in their descriptions or associated pull requests, and identify the found code change logs as the code change logs for fixing the vulnerability. For example, the vulnerability ID (CVE_ID) may be present in the commit message of the code change log or the PR title of the associated pull request.

[0078] 2. When submitting a code change log to fix a vulnerability, an issue number associated with the vulnerability report is usually added to the code change content of the code change log. For each code change log among multiple code change logs, it is determined whether the code change content of the code change log contains an issue number associated with the vulnerability report for that vulnerability. If it does, the code change log is considered to be used to fix the vulnerability and is identified as a code change log for fixing the vulnerability; otherwise, the code change log is determined not to be a code change log for fixing the vulnerability.

[0079] 3. When submitting a code change log for patching, it's possible that the relevant information in the code change log will not be modified. For each code change log among multiple code change logs, a large model is used to determine the semantic category of the code change content. If the semantic category of the code change content is patching, then the code change log is considered to be used to patch the vulnerability and is identified as a patch code change log. If the semantic category of the code change content is upgrade, refactoring, or other categories, then the code change log is considered not to be used to patch the vulnerability and is identified as a patch code change log.

[0080] This application embodiment considers various aspects such as the description information of the code change record, the associated pull request, the code change content, and the semantic category of the code change content to filter and repair code change records from multiple code change records, which can ensure that the code change records to be filtered and repaired are completely and accurately selected from multiple code change records.

[0081] In an optional embodiment, after generating a lifecycle diagram of a vulnerability based on the vulnerability information of any vulnerability in the vulnerability information database, the method further includes: updating the lifecycle diagram in response to a user's update request if the credibility index of the lifecycle diagram does not meet the standard.

[0082] As an example, after obtaining the lifecycle graph of the vulnerability, the credibility index of the lifecycle graph is evaluated to determine whether the credibility index meets the standard.

[0083] In actual application, the credibility index can be evaluated by comprehensively considering the submitter identity "Owner / Contributor" of each code change record involved in the life cycle graph, the discussion heat of the associated issue, and the semantic relevance between the code change record for repairing the vulnerability and the vulnerability PoC, etc. The specific evaluation rules can be pre-set according to actual business requirements.

[0084] After obtaining the credibility index of the life cycle graph, it is determined whether the credibility index meets the standard.

[0085] In actual application, the credibility index threshold value can be pre-set, and the value of the credibility index is compared with the pre-set credibility index threshold value. If the value of the credibility index is less than the credibility index threshold value, such as 0.4, it is determined that the credibility index does not meet the standard, and at this time it is considered that the life cycle graph is not credible, and the subsequent operation cannot be performed until the life cycle graph is updated in response to the user's update request. If the value of the credibility index is greater than or equal to the credibility index threshold value, it is determined that the credibility index meets the standard, and the subsequent operation can be performed.

[0086] In actual application, in order to timely remind the user to update the life cycle graph when the credibility index does not meet the standard, a recheck mark can be added to the life cycle graph, or a recheck reminder message for the life cycle graph can be generated and sent, so as to facilitate the user to timely check and update the life cycle graph.

[0087] The embodiments of the present application can ensure that the code context covering the life cycle of the vulnerability in the project code is accurately obtained by updating the life cycle graph in response to the user's update request for the life cycle graph when the credibility index of the life cycle graph of the vulnerability does not meet the standard.

[0088] In optional embodiments, the life cycle graph includes an introduction node and a repair node, the introduction node indicates an introduction code change record for introducing the vulnerability, and the repair node indicates a repair code change record for repairing the vulnerability; the code context in which the vulnerability is located is obtained from the project code based on the life cycle graph, including: determining the introduction code change record and the repair code change record based on the life cycle graph; determining a baseline version of the project code including the introduction code change record as the baseline version, and determining a target version of the project code including the repair code change record as the target version; and constructing the code context according to the code change content between the baseline version and the target version, and the risk code segment in the project code affected by the code change content.

[0089] As an example, the vulnerability life cycle graph includes an introduction node indicating an introduction code change record for introducing the vulnerability and a repair node indicating a repair code change record for repairing the vulnerability. Based on the vulnerability life cycle graph, the introduction code change record and the repair code change record can be determined.

[0090] The version of the project code including the introduction code change record is determined as the baseline version, and the version of the project code including the repair code change record is determined as the target version.

[0091] The code change content between the baseline version and the target version, and the risk code fragments in the project code affected by the code change content, such as functions or classes added, deleted or modified by the code change content, are obtained. According to the code change content between the baseline version and the target version, and the risk code fragments in the project code affected by the code change content, the code context is constructed.

[0092] In practical application, the code change content between the baseline version and the target version, and the risk code fragments in the project code affected by the code change content can be obtained by bidirectional comparison of the baseline version and the target version, and the specific execution process is as follows: 1. Obtain the code change content diff between the baseline version {base} and the target version {head}: preferentially call the API (Application Programming Interface) of GitHub, such as the API with the address “ / compare / {base}...{head}” to obtain the diff, and if the acquisition fails, fall back to the local bare repository to run the command “git diff --unified=0 --no-color” to obtain the diff. 2. Obtain the risk code fragments in the project code affected by the code change content: parse the diff into an AST (Abstract Syntax Tree) using the Tree-Sitter tool to obtain the code structure of the diff, and based on the code structure of the diff, identify the add, delete and modify operations at the function or class level, wherein the GumTree tool is further called to obtain the code movement and renaming information for C / C++ language programming code, thereby obtaining the risk code fragments in the project code affected by the diff.

[0093] In practical application, another large model, such as the Llama-3-70B “patch-summarizer” fine-tuning model, can also be used to make natural language explanations on the code structure of the diff, and output three abstracts of “affected interface, repair method, and potential bypass point”.

[0094] The embodiment of the application determines the introduction code change record and the repair code change record based on the introduction node and the repair node based on the life cycle graph, determines the version including the introduction code change record in the project code as the baseline version, and determines the version including the repair code change record in the project code as the target version, constructs the code context according to the code change content between the baseline version and the target version and the risk code fragment affected by the code change content in the project code, and can comprehensively and accurately obtain the code context where the vulnerability is located from the project code by considering the code change content between the baseline version and the target version and the risk code fragment affected by the code change content in the project code.

[0095] In an optional embodiment, before the code context is analyzed by using the large model to obtain the vulnerability cause and the execution function of the vulnerability, the method further includes: generating a local call graph according to the code change file for the vulnerability; determining whether the code context is missing a target code fragment according to the local call graph by using the large model; if yes, adding the target code fragment in the code context and updating the code context.

[0096] As an example, in the process of obtaining the code context where the vulnerability is located from the project code, the code change file for the vulnerability, that is, the code file modified for the vulnerability, such as FixContext.files_changed list, can also be obtained.

[0097] According to the code change file for the vulnerability, the calling relationship between each calling object in the code change file is determined, and a local call graph, such as ImportCallGraph, is generated.

[0098] It should be noted that the local call graph refers to a graph indicating the calling relationship between each calling object, such as functions and / or methods, in the code change file.

[0099] After obtaining the local call graph, the large model determines whether the code context is missing a target code fragment according to the local call graph, and if yes, adds the target code fragment in the code context and updates the code context, otherwise maintains the code context unchanged.

[0100] In actual application, ImportCallGraph and the code context are input into the large model, and the large model is used to determine whether the code context is missing a target code fragment, that is, a code fragment containing a calling object, according to ImportCallGraph, and if yes, it is considered that the target code fragment needs to be supplemented to accurately analyze the vulnerability, at this time, the GitHub API can be called to automatically pull the corresponding target code fragment and add it in the code context, until the large model feedbacks that the code context is complete, and the updated code context is output.

[0101] The embodiment of the application can effectively avoid the code context missing its dependent functions or methods, and ensure that the code context where the vulnerability is located is completely obtained from the project code.

[0102] In optional embodiments, the generating a local call graph according to the code change file for the vulnerability comprises: obtaining a project code segment corresponding to the code change file from the project code; determining the call relationship between each call object in the project code segment based on the code structure of the project code segment; and generating a local call graph according to the call relationship between each call object.

[0103] As an example, after obtaining the code change file for the vulnerability, a project code segment corresponding to the code change file is obtained from the project code, the code structure of the project code segment is determined, each call object in the project code segment and the call relationship between each call object are identified based on the code structure of the project code segment, and a local call graph is generated according to the call relationship between each call object.

[0104] In actual application, the complete source code of the code change file can be pulled by calling GitHub Raw API, the source code is parsed into AST using Tree-Sitter tool to obtain the code structure of the source code, all import / include statements and function definitions are identified based on the code structure of the source code, and a local call graph ImportCallGraph is generated according to all import / include statements and function definitions.

[0105] The embodiment of the application can accurately identify the call relationship between each call object in the code change file by analyzing the source code structure of the code change file, and ensure that the local call graph of the code change file is accurately generated.

[0106] In optional embodiments, the analyzing the code context by using a large model to obtain the vulnerability cause and the execution function of the vulnerability comprises: matching the code context with each vulnerability defect pattern pre-configured by using a large model, and determining the vulnerability cause according to the matching result; and locating the execution function in the code context according to the vulnerability cause by using a large model.

[0107] As an example, after obtaining the code context where the vulnerability is located from the project code, the large model is used to match the code context with each pre-configured vulnerability defect pattern, and the cause of the vulnerability is determined according to the matching result, such as if the code context matches a pre-configured vulnerability defect pattern, it is considered that the cause of the vulnerability is related to the vulnerability defect pattern, at this time the cause of the vulnerability can be determined as the cause of the vulnerability corresponding to the vulnerability defect pattern, and then the large model is used to locate the execution function in the code context according to the cause of the vulnerability, so as to obtain the cause of the vulnerability and the execution function.

[0108] In actual application, the prompt template can be used to configure the vulnerability defect pattern for the large model, such as input verification missing, sensitive API calling and race condition, etc. The large model can be used to output the cause of the vulnerability as a structured object, such as the cause of the vulnerability is a RootCause object, and the RootCause object includes a vulnerability defect pattern pattern, a code location where the vulnerability is located location and description information description. The large model can be used to locate the function or method that actually exists the vulnerability in the code context according to the RootCause object, that is, the execution function VulnFunc, and the output execution function includes file path, function name, start and end line number and calling signature.

[0109] In actual application, subsequent SAST tools can be used to perform static data flow analysis on the project code, such as CodeQL CFG, to generate a global call graph, taking VulnFunc as a sink, to find all entry functions that can reach the vulnerability externally, such as Controller / API / CLI, etc., to obtain the entry function EntryFuncs of the vulnerability.

[0110] The embodiments of the present application can pre-configure vulnerability defect patterns, use a large model to match code context with each pre-configured vulnerability defect pattern, and determine the cause of the vulnerability according to the matching result, and then locate the execution function in the code context according to the cause of the vulnerability, which can ensure that the cause of the vulnerability and the execution function in the project code can be stably and accurately analyzed even if the project code is modified, and the analysis speed of the cause of the vulnerability and the execution function is improved.

[0111] In optional embodiments, the method further includes step S106: S106, using a large model to format the execution function.

[0112] As an example, considering that the execution function of the vulnerability needs to be referenced in the subsequent patch generation stage, after obtaining the execution function of the vulnerability, the large model is used to format the execution function.

[0113] In practical applications, the large model can be used to retain the function definition and other key code of the execution function, and return in the form of a Markdown code block, while adding information such as parameters, return values, and exception descriptions, to facilitate subsequent patch generation references.

[0114] The embodiments of the present application can directly reference the execution function in the subsequent patch generation stage by formatting the execution function of the vulnerability using a large model.

[0115] Referring to Figure 3 , Figure 3 A structure diagram of a vulnerability analysis device based on a large model and SAST provided by the second embodiment of the present application. The second embodiment of the present application provides a vulnerability analysis device based on a large model and SAST, comprising: a life cycle graph generation module 201, configured to generate a life cycle graph of a vulnerability according to vulnerability information of any vulnerability in a vulnerability information library; a code context acquisition module 202, configured to acquire a code context where the vulnerability is located from the project code based on the life cycle graph; a first vulnerability analysis module 203, configured to analyze the code context using a large model to obtain a vulnerability cause and an execution function of the vulnerability; a second vulnerability analysis module 204, configured to backtrack to find an entry function of the vulnerability from the execution function in a global call graph; wherein the global call graph is generated by analyzing the project code using an SAST tool; and an analysis result output module 205, configured to output an analysis result of the vulnerability; wherein the analysis result includes the vulnerability cause, the execution function, and the entry function.

[0116] In optional embodiments, the vulnerability information of the vulnerability includes a plurality of code change records for the vulnerability; and the generating of the life cycle graph of the vulnerability according to the vulnerability information of any vulnerability in the vulnerability information library comprises: screening a repair code change record for repairing the vulnerability from the plurality of code change records; backtracking to find an introduction code change record for introducing the vulnerability from the repair code change record in the plurality of code change records; taking the repair code change record as a repair node, taking the introduction code change record as an introduction node, and adding a connection edge between the introduction node and the repair node to generate the life cycle graph.

[0117] In optional embodiments, the repair code change record satisfies one or more of the following screening conditions: the description information or the associated pull request of the repair code change record includes a vulnerability number of the vulnerability; the code change content of the repair code change record includes a problem number associated with the vulnerability report of the vulnerability; and the semantic category of the code change content is a repair category; wherein the semantic category of the code change content is determined using a large model.

[0118] In an optional embodiment, the life cycle graph generation module 201 is further configured to, after generating the life cycle graph of the vulnerability according to the vulnerability information of any vulnerability in the vulnerability information base, and in the case that the credibility index of the life cycle graph does not meet the standard, update the life cycle graph in response to a user's request for updating the life cycle graph.

[0119] In an optional embodiment, the life cycle graph includes an introduction node and a repair node, the introduction node indicating an introduction code change record for introducing the vulnerability, and the repair node indicating a repair code change record for repairing the vulnerability; and the obtaining, based on the life cycle graph, of a code context in which the vulnerability is located from the project code includes: determining the introduction code change record and the repair code change record based on the life cycle graph; determining a version including the introduction code change record in the project code as a baseline version, and determining a version including the repair code change record in the project code as a target version; and constructing the code context according to code change content between the baseline version and the target version, and a risk code segment affected by the code change content in the project code.

[0120] In an optional embodiment, the first vulnerability analysis module 203 is configured to, before the analyzing of the code context by using the large model to obtain the vulnerability cause and the execution function of the vulnerability, generate a local call graph according to the code change file for the vulnerability; determine, by using the large model, whether the code context is missing a target code segment according to the local call graph; and if so, add the target code segment to the code context and update the code context.

[0121] In an optional embodiment, the generating of the local call graph according to the code change file for the vulnerability includes: obtaining a project code segment corresponding to the code change file from the project code; determining a calling relationship between each calling object in the project code segment based on a code structure of the project code segment; and generating the local call graph according to the calling relationship between each calling object.

[0122] In an optional embodiment, the analyzing of the code context by using the large model to obtain the vulnerability cause and the execution function of the vulnerability includes: matching, by using the large model, the code context with each vulnerability defect mode pre-configured, and determining the vulnerability cause according to a matching result; and locating, by using the large model, the execution function in the code context according to the vulnerability cause.

[0123] In an optional embodiment, the first vulnerability analysis module 203 is further configured to format the execution function by using the large model.

[0124] The implementation processes of the functions and roles of the modules in the above apparatus are specifically described in the implementation processes of the corresponding steps in the above method, which will not be described herein.

[0125] The third embodiment of the present application provides a computer program product, which comprises instructions, and when the instructions are executed by a computer, the computer implements the method in the first embodiment of the present application and achieves the same beneficial effects.

[0126] The method in the first embodiment of the present application can be implemented by software, hardware, firmware or any combination thereof, in whole or in part. When implemented by software, the method can be implemented in the form of a computer program product, in whole or in part. The computer program product comprises one or more computer programs or instructions. When the computer programs or instructions are loaded and executed on a computer, the processes or functions in the embodiments of the present application are executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user equipment, a core network device, an OAM (Open Application Model) or other programmable devices.

[0127] The computer programs or instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer programs or instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center through wired or wireless manner. The computer readable storage medium can be any available medium accessible by a computer or a data storage device such as a server, data center and the like integrated with one or more available media. The available media can be a magnetic medium, for example, a floppy disk, a hard disk, a magnetic tape; or an optical medium, for example, a digital video disc; or a semiconductor medium, for example, a solid state disk. The computer readable storage medium can be a volatile or non-volatile storage medium, or can include both volatile and non-volatile storage media.

[0128] Please refer to Figure 4 , Figure 4 The fourth embodiment of the present application provides a structural schematic diagram of an electronic device. The fourth embodiment of the present application provides an electronic device 30, which comprises a processor 301, a memory 302, and a computer program stored in the memory 302 and configured to be executed by the processor 301; when the processor 301 executes the computer program, the method in the first embodiment of the present application is implemented and the same beneficial effects are achieved.

[0129] When the processor 301 reads the computer program from the memory 302 through the bus 303 and executes the computer program, the method in the first embodiment of the present application can be implemented.

[0130] The processor 301 can process digital signals and can include various computing structures. For example, a complex instruction set computer structure, a reduced instruction set computer structure, or a structure implementing a combination of multiple instruction sets. In some examples, the processor 301 can be a microprocessor.

[0131] The memory 302 can be used to store instructions executed by the processor 301 or data related to the execution of the instructions. The instructions and / or data can include code for implementing some or all of the functions of one or more modules described in the embodiments of the present application. The processor 301 of the embodiments can be used to execute the instructions in the memory 302 to implement the method as described in the first embodiment of the present application. The memory 302 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memories well known to those skilled in the art.

[0132] The fifth embodiment of the present application provides a computer readable storage medium, which includes a stored computer program; wherein the computer program, when running, controls the device where the computer readable storage medium is located to perform the method as described in the first embodiment of the present application and can achieve the same beneficial effects.

[0133] In summary, the embodiment of the present application provides a vulnerability analysis method, program product and device based on a large model and SAST. The vulnerability analysis method based on a large model and SAST comprises: generating a life cycle graph of a vulnerability according to vulnerability information of any vulnerability in a vulnerability information base; obtaining a code context in which the vulnerability is located from project code based on the life cycle graph; analyzing the code context by using a large model to obtain a vulnerability cause and an execution function of the vulnerability; backtracking to find an entry function of the vulnerability from the execution function in a global call graph; wherein the global call graph is generated by analyzing the project code by using a SAST tool; and outputting an analysis result of the vulnerability; wherein the analysis result comprises the vulnerability cause, the execution function and the entry function. According to the embodiment of the present application, the life cycle graph of the vulnerability is generated according to the vulnerability information of any vulnerability in the vulnerability information base, the code context in which the vulnerability is located is obtained from the project code based on the life cycle graph, the code context is analyzed by using the large model to obtain the vulnerability cause and the execution function of the vulnerability, the entry function of the vulnerability is backtracked from the execution function in the global call graph generated by analyzing the project code by using the SAST tool, the vulnerability cause, the execution function and the entry function are arranged as the analysis result of the vulnerability for output, the vulnerability cause and the execution function of the vulnerability can be analyzed from the code context covering the life cycle of the vulnerability in the project code by using the natural language understanding, processing and learning ability of the large model, it is ensured that the vulnerability cause and the execution function of the vulnerability in the project code can be stably and accurately analyzed in the case of modification of the project code, the entry function of the vulnerability is backtracked from the execution function in the global call graph generated by using the SAST tool, it is ensured that the entry function of the vulnerability reachable to the outside can be found in the complete and accurate global call graph, and thus the vulnerability exploitability information of various vulnerabilities in the open source project can be stably and accurately provided.

[0134] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can also be implemented by other means. The apparatus embodiments described above are only illustrative, for example, the flowcharts and block diagrams in the drawings show the possible implementation architecture, function and operation of the apparatus, method and computer program product according to the embodiments of the present application. In this regard, each block in the flowchart or block diagram can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logic function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different order from that shown in the drawings. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes they can be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for performing the specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0135] In addition, the functional modules in the various embodiments of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0136] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program code storage media.

[0137] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, and thus, once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings.

[0138] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, and thus, once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings.

[0139] It should be noted that the relational terms herein such as first and second and the like are used solely to distinguish one entity or action from another, without necessarily requiring or implying any actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

Claims

1. A vulnerability analysis method based on large models and SAST, characterized in that, include: Generate a lifecycle diagram of the vulnerability based on the vulnerability information of any vulnerability in the vulnerability information database; Based on the lifecycle diagram, the code context in which the vulnerability is located is obtained from the project code; The code context is analyzed using a large model to determine the cause of the vulnerability and the function to be executed. The entry function of the vulnerability is found by tracing back from the executed function in the global call graph; wherein, the global call graph is generated by analyzing the project code using the SAST tool; Output the analysis results of the vulnerability; wherein the analysis results include the cause of the vulnerability, the execution function, and the entry function.

2. The method according to claim 1, characterized in that, The vulnerability information includes multiple code change records related to the vulnerability; The step of generating a lifecycle diagram of a vulnerability based on vulnerability information from any vulnerability database includes: Filter the code change records used to fix the vulnerability from the multiple code change records; From the multiple code change records, trace back from the fix code change records to find the code change records that introduced the vulnerability; Using the repair code change record as the repair node and the import code change record as the import node, a connection edge is added between the import node and the repair node to generate the lifecycle graph.

3. The method according to claim 2, characterized in that, The code change records that meet one or more of the following filtering criteria: The description information of the fix code change record or the associated pull request includes the vulnerability number of the vulnerability. The code change information in the code fix change log includes the issue number associated with the vulnerability report. The semantic category of the code change content is "repair"; wherein, the semantic category of the code change content is determined using the large model.

4. The method according to claim 1, characterized in that, After generating the lifecycle graph of the vulnerability based on the vulnerability information of any vulnerability in the vulnerability information database, the method further includes: If the credibility index of the lifecycle diagram fails to meet the standard, the lifecycle diagram will be updated in response to the user's update request.

5. The method according to claim 1, characterized in that, The lifecycle diagram includes introduction nodes and remediation nodes. The introduction nodes indicate the introduction code change records used to introduce the vulnerability, and the remediation nodes indicate the remediation code change records used to fix the vulnerability. The step of obtaining the code context where the vulnerability resides from the project code based on the lifecycle diagram includes: Based on the lifecycle diagram, the introduced code change record and the repair code change record are determined; The version of the project code that includes the introduced code change record is determined as the baseline version, and the version of the project code that includes the repair code change record is determined as the target version; The code context is constructed based on the code changes between the baseline version and the target version, as well as the risky code segments in the project code affected by the code changes.

6. The method according to claim 1, characterized in that, Before analyzing the code context using a large model to obtain the cause of the vulnerability and the execution function, the method further includes: Based on the code change files targeting the aforementioned vulnerability, generate a partial call graph; The large model is used to determine whether the target code segment is missing from the code context based on the local call graph; If so, add the target code snippet to the code context and update the code context.

7. The method according to claim 6, characterized in that, The step of generating a local call graph based on the code change file targeting the vulnerability includes: Obtain the project code snippet corresponding to the code change file from the project code; Based on the code structure of the project code snippet, the calling relationships between the various calling objects in the project code snippet are determined; The local call graph is generated based on the call relationships between the various calling objects.

8. The method according to claim 1, characterized in that, The method of using a large model to analyze the code context to obtain the vulnerability's cause and execution function includes: Using the large model, the code context is matched with pre-configured vulnerability and defect patterns, and the cause of the vulnerability is determined based on the matching results; Using the aforementioned large model, the execution function is located within the code context based on the cause of the vulnerability.

9. The method according to any one of claims 1 to 8, characterized in that, The method further includes: The execution function is formatted using the large model.

10. A computer program product, characterized in that, The computer program product includes instructions that, when executed by a computer, cause the computer to perform the method according to any one of claims 1 to 9.

11. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; when the processor executes the computer program, it implements the method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program; wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the method according to any one of claims 1 to 9.

Images