Code vulnerability detection method and system based on CPG-RAG

Abstract

The invention relates to the technical field of vulnerability source code detection, and provides a code vulnerability detection method and system based on CPG-RAG. The method comprises the steps of 1, collecting a known vulnerability list, and storing corresponding vulnerability information in an RAG local knowledge base; wherein the vulnerability information comprises a code vector and auxiliary information; 2, inputting a to-be-detected vulnerability code, and converting the to-be-detected vulnerability code into a code attribute graph (CPG) form; 3, performing graph embedding representation on the CPG to obtain a to-be-detected vulnerability code vector; 4, performing vector similarity matching in the RAG local knowledge base by using the to-be-detected code vector, and constructing a vulnerability detection cue word based on a matching result and corresponding auxiliary information in the local knowledge base; and 5, based on the vulnerability detection cue word, calling a large language model for analysis to obtain a vulnerability detection result of the to-be-detected vulnerability code.

Description

Technical Field

[0001] This invention relates to the field of vulnerability source code detection technology, and in particular to a code vulnerability detection method and system based on CPG-RAG. Background Technology

[0002] With the acceleration of digitalization, the complexity of software systems is increasing exponentially, and the security risks caused by vulnerabilities have become a global focus. According to Verizon's 2023 Data Breach Investigations Report, 76% of cybersecurity incidents originated directly from software vulnerabilities, with high-risk vulnerabilities having an average remediation cycle of up to 97 days, exposing the serious lag of traditional detection methods. Early vulnerability detection technologies mainly relied on static analysis (such as rule matching and symbolic execution) and dynamic analysis (such as fuzzing and taint tracking). Although widely used in industry, they generally suffer from bottlenecks such as high false positive rates, low coverage, and insufficient cross-language generalization capabilities. However, while these traditional vulnerability detection methods have improved software security to some extent, they still have many significant shortcomings. First, these traditional methods have obvious limitations in vulnerability detection capabilities, often failing to effectively discover unknown new vulnerabilities and complex, deep-seated vulnerabilities. Second, the frequent occurrence of false positives and false negatives not only increases the workload of security teams but also forces them to spend a significant amount of valuable time on tedious manual reviews. Furthermore, these traditional methods prove particularly inefficient when dealing with large-scale codebases and dynamically changing runtime environments, making them ill-suited to the demands of rapid iteration and complex architectures in modern software development. More critically, traditional methods generally lack a deep understanding of business logic and contextual awareness, thus hindering a comprehensive and accurate assessment of the actual risk level of vulnerabilities. These significant shortcomings strongly urge the entire industry to actively explore and seek more advanced and efficient vulnerability detection technologies to further enhance the overall security of software.

[0003] With the rapid development and widespread application of deep learning technology, people have begun to try to leverage the powerful learning capabilities of deep learning models to predict and identify potential security vulnerabilities in source code. However, although existing deep learning models have achieved some success in vulnerability detection, they still face many serious challenges. For example, when models need to handle cross-language code, they often struggle to accurately capture semantic patterns and structural dependencies in the code; simultaneously, in the vulnerability detection process of large-scale projects, the recall rate of the models is often insufficient, making it difficult to comprehensively cover all potential vulnerabilities. Furthermore, because these deep learning models generally lack interpretability, security experts still need to invest a significant amount of manpower in meticulous review and verification based on the model's prediction results. Subsequently, Large Language Models (LLMs), represented by GPT-4, CodeLlama, and DeepSeek-R1, have demonstrated superior semantic reasoning capabilities thanks to their pre-training foundation of massive code corpora. These large language models can accurately identify potential code risk patterns directly from multiple dimensions such as code comments, API context, and cross-function call chains. Furthermore, with the continuous development and improvement of large language models, the visualization of their reasoning process is also gradually improving. This greatly enhances the interpretability of large models, providing security experts with more intuitive and convenient review tools. However, despite the enormous potential of large language models in the field of vulnerability detection, their isolated application still faces a dual challenge: on the one hand, although the model's semantic understanding capability is extremely powerful, it still has certain shortcomings in the extraction of code structure features; on the other hand, most existing large language models are general-purpose language models, lacking specialization and refinement for the field of code vulnerability detection. Summary of the Invention

[0004] To address the problems of semantic gaps and high false positive rates in the detection of complex vulnerabilities caused by the difficulty of effectively representing the syntactic structure and semantic information of existing code vulnerability detection methods, this invention proposes a code vulnerability detection method and system based on CPG-RAG. By using graph embedding technology, code syntax, control flow, and data dependencies are converted into vectors sensitive to graph structure. Combined with the RAG framework to retrieve vulnerability knowledge base and design a layered Prompt strategy to guide a large language model to achieve structure-sensitive vulnerability localization and path analysis, the accuracy of code vulnerability detection can be improved.

[0005] In a first aspect, the present invention provides a code vulnerability detection method based on CPG-RAG, comprising:

[0006] Step 1: Collect a list of known vulnerabilities and store the corresponding vulnerability information in the RAG local knowledge base; wherein the vulnerability information includes code vectors and auxiliary information;

[0007] Step 2: Input the vulnerability code to be detected, and convert the vulnerability code into the form of a Code Attribute Graph (CPG); the CPG integrates four types of graphs: Abstract Syntax Tree (AST), Control Flow Graph (CFG), Data Dependency Graph (DDG), and Program Dependency Graph (PDG);

[0008] Step 3: Perform graph embedding representation on the CPG to obtain the vulnerability code vector to be detected;

[0009] Step 4: Use the code vector to be detected to perform vector similarity matching in the RAG local knowledge base, and construct vulnerability detection prompt words based on the matching results and the corresponding auxiliary information in the local knowledge base;

[0010] Step 5: Based on the vulnerability detection hints, call the large language model for analysis to obtain the vulnerability detection results of the code to be detected.

[0011] Further, in step 1, the code vector is obtained according to the following steps: first, the known vulnerability code is converted into the form of a code attribute graph (CPG), and then the CPG corresponding to the known vulnerability code is represented by graph embedding to obtain the code vector of the known vulnerability code.

[0012] Furthermore, in step 1, known vulnerabilities are analyzed during the storage process to generate auxiliary information; the auxiliary information includes code description, vulnerability type, and vulnerability pattern.

[0013] Furthermore, the DeepSeek-R1 model is used to analyze known vulnerabilities during the storage process.

[0014] Furthermore, the graph embedding representation specifically includes:

[0015] The multiple edge attributes between two nodes in the CPG are aggregated into a list and used as attributes in a one-sided directed graph. The node features and edge features in the CPG graph are extracted, and weights are assigned to different edge features.

[0016] The nodes and edges in the CPG graph are vectorized using the BERT model to obtain two-dimensional vectors.

[0017] The two-dimensional vector is embedded using an embedding model to generate a code vector.

[0018] Furthermore, in step 1, a hazard source and a trigger point are defined in the CPG corresponding to the known vulnerability, and a path from the hazard source and the trigger point is found in the graph; wherein the hazard source is the source of the vulnerability, and the trigger point is the location where the vulnerability occurs.

[0019] Furthermore, the vector similarity matching specifically includes:

[0020] First, cosine similarity is used for the first stage of screening, selecting vulnerable code with a cosine similarity greater than a preset threshold.

[0021] Then, Euclidean distance is used to filter the second node. The Euclidean distance between the vulnerability code after the first stage of filtering and the vector of the vulnerability code to be detected is calculated, and the k closest vulnerability codes are selected as the vector similarity matching results.

[0022] Furthermore, the design of the vulnerability detection prompts follows these principles:

[0023] 1) The task explicitly instructed to be performed by the large language model is code vulnerability detection;

[0024] 2) Provide contextual information to help large language models understand the background and environment of the code;

[0025] 3) Use similar code as examples to guide the model in analyzing the code;

[0026] 4) Instruct the large language model to output results in a structured manner.

[0027] Furthermore, the large language model adopts a locally deployed DeepSeek-R1-32B model.

[0028] Secondly, the present invention provides a code vulnerability detection system based on CPG-RAG, comprising:

[0029] The RAG local knowledge base construction module is used to collect a list of known vulnerabilities and vectorize and store the corresponding vulnerability information in the RAG local knowledge base; wherein the vulnerability information includes code vectors and auxiliary information.

[0030] The code intermediate representation generation module is used to input the vulnerability code to be detected and convert the vulnerability code to be detected into the form of a code attribute graph (CPG); the CPG integrates four types of graphs: abstract syntax tree (AST), control flow graph (CFG), data dependency graph (DDG), and program dependency graph (PDG).

[0031] An intermediate representation embedding module is used to perform graph embedding representation on the CPG to obtain the vulnerability code vector to be detected.

[0032] The RAG retrieval module is used to perform vector similarity matching in the RAG local knowledge base using the code vector to be detected, and to construct vulnerability detection prompt words based on the matching results and the corresponding auxiliary information in the local knowledge base;

[0033] The large model inference and detection module is used to analyze the vulnerability detection prompts by calling a large language model to obtain the vulnerability detection results of the code to be detected.

[0034] The beneficial effects of this invention are as follows:

[0035] The method provided by this invention first converts the code into a CPG graph, then uses an embedding model to convert the rich graph information into vector information and compares it with vulnerability vector information pre-stored in the database. It then utilizes a dynamic knowledge update mechanism generated by retrieval enhancement to construct a multi-layered vulnerability code detection system.

[0036] This invention first utilizes the Joern tool to uniformly transform multilingual code into a code attribute graph (CPG), overcoming the limitations of traditional methods in static parsing of syntactic structures; secondly, it jointly learns code semantics and graph structure features, significantly improving the representation ability of complex vulnerability patterns; finally, it combines the RAG retrieval strategy to extract Top-k similar patterns from the vulnerability vector database to enhance the inference of large language models, thereby reducing training costs while improving the accuracy of the DeepSeek-R1 model. Attached Figure Description

[0037] Figure 1 A flowchart illustrating a code vulnerability detection method based on CPG-RAG provided in an embodiment of the present invention;

[0038] Figure 2 A schematic diagram illustrating the framework of a CPG-RAG-based code vulnerability detection method provided in an embodiment of the present invention;

[0039] Figure 3 A schematic diagram illustrating auxiliary information provided for embodiments of the present invention;

[0040] Figure 4 This is a schematic diagram of the intermediate characterization embedding process provided in an embodiment of the present invention;

[0041] Figure 5 A schematic diagram of a Prompt provided for an embodiment of the present invention;

[0042] Figure 6 This is a schematic diagram of the result output provided in the embodiments of the present invention;

[0043] Figure 7 This is a schematic diagram of the structure of a code vulnerability detection system based on CPG-RAG provided in an embodiment of the present invention. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the embodiments of this invention will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0045] like Figure 1 As shown in the figure, an embodiment of the present invention provides a code vulnerability detection method based on CPG-RAG, comprising:

[0046] Step 1: Collect a list of known vulnerabilities and store the corresponding vulnerability information in the RAG local knowledge base; the vulnerability information includes code vectors and auxiliary information;

[0047] Step 2: Input the vulnerability code to be detected, and convert the vulnerability code into the form of a Code Property Graph (CPG); CPG integrates four types of graphs: Abstract Syntax Tree (AST), Control Flow Graph (CFG), Data Dependency Graph (DDG), and Program Dependency Graph (PDG);

[0048] Step 3: Perform graph embedding representation on the CPG to obtain the vulnerability code vector to be detected;

[0049] Step 4: Use the code vector to be detected to perform vector similarity matching in the RAG local knowledge base, and construct vulnerability detection prompt words based on the matching results and the corresponding auxiliary information in the local knowledge base;

[0050] Step 5: Based on the vulnerability detection hints, call the large language model for analysis to obtain the vulnerability detection results of the code to be detected.

[0051] The code vulnerability detection method provided in this invention first converts user code into a CPG graph, then uses an embedding model to convert rich graph information into vector information and compares it with vulnerability vector information pre-stored in the database. It then utilizes the dynamic knowledge update mechanism of Retrieval Enhanced Generation (RAG) to construct a multi-layered vulnerability detection method.

[0052] like Figure 2 As shown in this embodiment, the above method is described in detail:

[0053] S1: RAG Local Knowledge Base Expansion. Before using RAG technology, knowledge needs to be stored in a database for RAG retrieval. First, a list of vulnerability information is collected and stored to build a knowledge base. When using RAG later, it searches the knowledge base for known vulnerabilities based on vector similarity, effectively enhancing the knowledge base. This allows for more flexible and dynamic expansion of the knowledge base, while also reducing model training overhead and optimizing the local vulnerability information knowledge of large models.

[0054] Specifically, in this embodiment, 3000 known vulnerability entries are pre-stored in the Chromadb database, and the local knowledge base includes vulnerability types such as CWE-119, CWE-89, CWE-787, CWE-125, CWE-476, CWE-20, CWE-79, CWE-362, CWE-416, and CWE-190. The vulnerability information includes code vectors and auxiliary information. For example... Figure 3 As shown, the auxiliary information includes code description, vulnerability type (CWE type), and vulnerability pattern, which improves efficiency and reduces illusions in the subsequent two-stage vulnerability detection. The code vector is obtained according to the following steps: First, the known vulnerability code is converted into a Code Attribute Graph (CPG). Then, the CPG corresponding to the known vulnerability code is represented by graph embedding to obtain the code vector of the known vulnerability code.

[0055] Furthermore, during the storage process, the DeepSeek-R1 model is first used to analyze known vulnerabilities. This is because the present invention considers that the thinking patterns of large models are consistent, and the vulnerability analysis and causal auxiliary information generated using the thinking patterns of large models are helpful in subsequently inspiring the large model's thinking. This is also a result of efficiency considerations; using large models to analyze vulnerabilities can save a significant amount of time. Then, the code vectors and auxiliary information are stored together in the RAG local knowledge base (Chromadb vector database), where there is a one-to-one correspondence between code vectors and auxiliary information.

[0056] S2: Code Intermediate Representation Generation. The code to be detected is represented using an intermediate CPG representation, transforming it into a code attribute graph CPG representation. This can reduce noise from different code languages ​​to some extent. In vulnerability detection, it's not necessary to focus on all code information; only information related to the vulnerability is needed. Therefore, further processing is performed on the intermediate representation to extract information more valuable to our vulnerability detection. In this embodiment, the code analysis tool Joern is used to convert the code into a CPG graph.

[0057] Specifically, in order to better utilize code information to provide information for RAG, we transform the code into four types of graphs: Abstract Syntax Tree (AST), Control Flow Graph (CFG), Data Dependency Graph (DDG), and Program Dependency Graph (PDG). These graphs store information from different attribute graphs, which provides a better representation of code information.

[0058] The user code (the vulnerability code to be detected) is stored in a temporary folder because Joern can only process code in folder format. Whether the user provides one or multiple pieces of code, they must first be stored in the same folder. Then, Joern's scripting tools are used to extract the CPG file from the user code. The extracted CPG file is stored locally and will be used in the next step. Since the Joern tool supports parsing nine languages, including C / C++ / Java, the method provided in this invention has the potential for cross-language code analysis.

[0059] Furthermore, S1 employs the same code intermediateization representation method to transform known vulnerabilities. It defines the hazard source and trigger point in the corresponding CPG for each known vulnerability and searches for paths from the hazard source to the trigger point in the graph; where the hazard source is the origin of the vulnerability, and the trigger point is the location where the vulnerability occurs. Such paths are valuable because they directly reflect the vulnerability information: how the vulnerability is introduced and what control or data flow ultimately triggers it. More specifically, such paths constitute a vulnerability pattern, which is what vulnerability detection focuses on most, and therefore should be given greater weight.

[0060] S3: Intermediate Representation Embedding. The CPG graph processed in S2 is then subjected to graph embedding representation to generate the vulnerability code vector to be detected. This step is necessary because the object of RAG operations is a vector.

[0061] Specifically, considering that RAG technology retrieval mostly involves text information, while this invention aims to retrieve code, directly embedding the code as text would ignore the inherent characteristics of the code itself. For example, code differs from natural language; it is a language between humans and computers with different syntax. Additionally, code contains cross-line data flow, control flow, and other information. To address this issue, this embodiment of the invention uses graph embedding to represent the code.

[0062] In the specific operational steps, the first step is to use a CPG graph to represent the code and process the read CPG graph object. Since the read CPG graph is a multi-sided directed graph, it should be converted into a one-sided directed graph. To achieve this, the multiple edge attributes between two nodes in the CPG graph are first aggregated into a list and used as attributes in the one-sided directed graph. Then, the node features and edge features of the CPG graph are extracted. Four types of edge features are extracted from the CPG graph: AST, DDG, CFG, and CDG, and weights are manually assigned to different edge features. This setting is because vulnerabilities have different causes. For example, the core cause of data flow vulnerabilities (memory leaks, injection attacks, etc.) lies in the uncontrolled data propagation between variables; CFG edges characterize conditional branches and loop structures, which are crucial for detecting logical vulnerabilities (such as authentication bypass). Next, the BERT model is used to vectorize the nodes and edges in the CPG graph to obtain a two-dimensional vector format. The two-dimensional vector is mainly used for subsequent embedding generation. In order to better represent the graph vector, the graph structure feature calculation function is added. Finally, the processed CPG graph is embedded using an embedding model. In this embodiment of the invention, the embedding model is the GCN model. This step completes the vector representation of the code's structure, syntax, semantics, and other information, which is an important step in the subsequent RAG retrieval module.

[0063] Furthermore, in S1, the same intermediate representation embedding is used to perform graph embedding representation on the CPG corresponding to the known vulnerabilities. Unlike the process described above, as... Figure 4 As shown, when performing graph embedding representation in S1, it is necessary to find the paths of hazard sources and trigger points defined in the CPG graph through the feature extraction module. These paths will have a greater weight when performing graph embedding representation of the CPG. The feature extraction module includes BERT encoding of node labels, feature vector concatenation, and centrality index calculation; feature vector concatenation is the process of concatenating multiple vectors into one vector; the centrality index is used to measure the importance of nodes in the graph.

[0064] S4: RAG Retrieval. This step uses RAG for information retrieval to address the illusion problem and lack of professional knowledge in large models. Vulnerability information is pre-vectorized and stored, and a dynamic knowledge base is built to overcome the inherent static knowledge limitations of large models, achieving accurate and reliable knowledge enhancement. Domain-specific knowledge in vulnerability detection is stored in the database in vector form. A similarity matching algorithm is used to search for and match user queries, ensuring that the model generates results based on the most relevant data, avoiding the "illusion" problem. It also supports an incremental update mechanism, dynamically integrating new knowledge without retraining. This "plug-in knowledge base" model ensures the traceability of generated content (through citation annotation and metadata management) while reducing the computational cost of domain adaptation. This invention suggests that the combination of a knowledge base and the understanding and reasoning capabilities of large models can be used in the field of vulnerability detection.

[0065] Specifically, the Chromadb vector database was used for efficient storage and retrieval of code embedding vectors. 3000 vulnerability code embeddings were pre-stored in the Chromadb database, and the processing steps for these pre-stored vulnerability code were consistent with those for user-defined code.

[0066] For user code (vulnerable code to be detected), its converted vector is first matched for similarity in Chromadb. This embodiment of the invention uses a multi-dimensional embedding. Specifically, firstly, cosine similarity is used for the first stage of screening to filter out vulnerabilities with a cosine similarity greater than a preset threshold (the preset threshold in this embodiment is 0.5); in the second stage, the Euclidean distance between the filtered vulnerabilities and the vulnerability code vector to be detected is calculated, and the k closest Euclidean distances are selected.

[0067] The formula for calculating cosine similarity is as follows:

[0068]

[0069] Where q is the vector representation of the user code, d i It is the vector representation of the i-th stored code in the database.

[0070] After two stages of screening, the top-k most similar information is finally selected, where k is an integer. Since there is a one-to-one correspondence between vectors and auxiliary information in the pre-stored Chromadb, the corresponding auxiliary information is also selected while these vectors are being selected. This information will be encapsulated in the prompt to enhance the inference results of the large language model.

[0071] S5: Prompt Engineering Optimizes Large Model Inference. DeepSeek-R1 enhances its performance based on similar code. Guided by prompt engineering, it analyzes user code, and similar vulnerable code is used to improve the performance of the large model, enabling it to output more effective answers. Prompt dynamically constructs semantic instructions containing vulnerability information, code context, and CoT (CoT), activating the deep pattern recognition capabilities of LLM in vulnerability detection. Using Prompt, we can overcome the limitations of traditional static analysis tools: injecting relevant vulnerability information through few-shot hints and improving the interpretability of results by outputting inference chains. In summary, Prompt can build an intelligent vulnerability discovery system that combines high accuracy with low false positives.

[0072] Considering that traditional fine-tuning struggles to update the model knowledge base in real time, while the prompt can dynamically load RAG retrieval results, and that the prompt's performance in optimizing DeepSeek-R1 for code analysis tasks can effectively improve the interpretability of LLMs, we designed a specialized prompt structure that fully utilizes auxiliary information from similar code obtained from RAG retrieval. The prompt design of this invention follows these principles:

[0073] (1) Explicitness: The prompt should explicitly indicate that the task the model needs to perform is code vulnerability detection.

[0074] (2) Context provision: The prompt should provide sufficient context information to help the model understand the background and environment of the code.

[0075] (3) Example reference: The suggestion is to use similar code as an example to guide the model on how to analyze the code.

[0076] (4) Structured output: The prompt requires the model to output results in a structured manner to facilitate subsequent processing and understanding.

[0077] like Figure 5 As shown, this is a prompt designed based on the principles described above. Through the step-by-step guidance of the prompt, LLM can effectively enhance the response, and after specifying the output format, an example of the output is shown below. Figure 6 As shown. This embodiment of the invention uses a locally deployed DeepSeek-R1-32B model. The reason for using a locally deployed large model is that it can effectively protect privacy and reduce security issues such as API calls.

[0078] like Figure 7 As shown, this embodiment of the invention also provides a code vulnerability detection system based on CPG-RAG, including:

[0079] The RAG local knowledge base construction module is used to collect a list of known vulnerabilities and vectorize and store the corresponding vulnerability information in the RAG local knowledge base; the vulnerability information includes code vectors and auxiliary information.

[0080] The code intermediate representation generation module is used to input the vulnerability code to be detected and convert it into the form of a code attribute graph (CPG). The CPG integrates four types of graphs: abstract syntax tree (AST), control flow graph (CFG), data dependency graph (DDG), and program dependency graph (PDG).

[0081] The intermediate representation embedding module is used to perform graph embedding representation of CPG to obtain the vulnerability code vector to be detected;

[0082] The RAG retrieval module is used to perform vector similarity matching on the code vector to be detected in the RAG local knowledge base, and to construct vulnerability detection prompts based on the matching results and the corresponding auxiliary information in the local knowledge base.

[0083] The large model inference and detection module is used to analyze vulnerability detection results by calling a large language model based on vulnerability detection prompts, and obtain the vulnerability detection results of the code to be detected.

[0084] To verify the effectiveness of the method proposed in this invention, the following experiment was conducted in this embodiment:

[0085] The experimental environment was configured as follows: the hardware consisted of an Intel(R) Xeon(R) Platinum 8558P processor with a clock speed of 2.7GHz, and eight NVIDIA A100-SXM4-80GB graphics cards forming the computing unit; the software system used the Ubuntu 22.04 operating system, the programming environment was built based on Python 3.12.7, and the Large Language Model used the locally deployed DeepSeek-R1-32B distillation model.

[0086] The following aspects were verified in the experimental stage: (1) the effectiveness of each module in the present invention; (2) the accuracy and false alarm rate of the method provided by the present invention; and (3) the working efficiency of the method provided by the present invention.

[0087] There are two reasons for choosing Big-Vul and DiverseVul as the experimental datasets: (1) Big-Vul and DiverseVul are high-quality real vulnerability datasets; (2) On the other hand, Big-Vul covers 348 GitHub projects, while DiverseVul integrates vulnerability samples from 1,200+ real open-source projects (covering languages ​​such as C / C++, Java, Python, and JavaScript), covering 210 CWE types, with low-frequency vulnerabilities (such as CWE-362: race condition) accounting for 15%, demonstrating good representativeness and diversity. The non-vulnerable code in the experiment came from DiverseVul.

[0088] 300 vulnerability vectors and information were pre-stored in the database. During the experimental phase, 5000 vulnerable code samples and 5000 non-vulnerable code samples were randomly selected from Big-Vul and DiverseVul for testing.

[0089] (1) The effectiveness of each module in this invention

[0090] Table 1 Recall rates after removing each component

[0091]

[0092] Experimental data shows that the GraphRAG-VulDetector model achieves an F1 score of 62.76% in its full configuration. The relative balance between recall (64.47%) and precision (61.14%) validates the model's effective trade-off between false negatives and false positives. When the GCN embedding is removed, using the CodeBert model to directly embed code text results in a 3.88% decrease in recall to 60.59% and a 4.22% decrease in precision from 61.14% to 56.92%. This indicates that GCN's ability to model code structural features affects the code's vector representation capabilities, which in turn affects RAG's retrieval capabilities and ultimately indirectly impacts the comprehensiveness of the Large Language Model's vulnerability localization. Furthermore, removing the RAG component renders the GCN embedding meaningless; therefore, removing RAG effectively removes both GCN and the RAG component. Experiments show that this reduces precision by 8.38% to 52.76%, reflecting the core value of the knowledge enhancement module in suppressing false positives. Looking at the results before and after removing the GCN module, it's clear that the method uses GCN to generate vector representations that are beneficial to the code. This enhanced RAG's capabilities, ultimately resulting in a significant improvement in the response performance of the large language model. However, when the RAG component is removed, meaning the capabilities of the large model itself are used, the effect decreases again, demonstrating that the proposed method improves the capabilities of the large language model.

[0093] (2) The accuracy and false alarm rate of the method provided by this invention

[0094] Table 2. Accuracy and false alarm rates of the present invention compared to traditional static analysis tools.

[0095]

[0096] Experimental data shows that GraphRAG-VulDetector significantly outperforms other tools (F1 = 62.76%) in terms of the balance between precision (61.14%) and recall (64.47%). Its advantage stems from the collaborative mechanism of using GCN to represent CPG and retrieval enhancement (RAG)—GCN generates vectors by extracting control flow graphs to model code structure dependencies, while RAG injects CVE knowledge base constraints to avoid false positives, thus achieving an optimal trade-off between false positives and false negatives. In contrast, although LineVul leads with a high recall of 68.75%, its precision (59.82%) is significantly lower. This is attributed to its Transformer-based row-level attention mechanism, which over-focuses on local code snippets such as single-line buffer operations, leading to the neglect of global logic such as multi-function data flows. While it can cover more potential vulnerabilities, it sacrifices accuracy. GraphRAG-VulDetector's balanced performance makes it more reliable in complex vulnerability detection, while LineVul's high recall is more suitable for scenarios with low tolerance for missed detections. The performance difference between the two reflects the divergence in technical paths between structure awareness and local semantic modeling.

[0097] (3) The working efficiency of the method provided by the present invention

[0098] Table 3 Performance Time Efficiency of Each Component

[0099]

[0100] Under the test suite, the total testing time was approximately 61,788 seconds (about 17 hours) in the CPG formation phase, approximately 3,405 seconds in the CPG embedding to vector phase, and approximately 99,210 seconds (about 27 hours) in the final Large Language Model analysis phase. On average, during the analysis of a single file, forming the CPG took about 6 seconds, converting the CPG to vectors took 0.3 seconds, and the final Large Language Model analysis phase took about 10 seconds. Although the individual time consumption may seem long, the final result is not just a vulnerability determination, but also includes the analysis of causes and other conditions, which can effectively reduce the manual work of experts.

[0101] In summary, the method provided by this invention can utilize LLM for source code vulnerability detection, which improves upon the capabilities of traditional large language models. It significantly outperforms other tools in terms of the balance between detection accuracy and recall. Furthermore, the final result not only provides vulnerability identification but also includes conditional analysis such as causes, which can effectively improve work efficiency.

[0102] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A code vulnerability detection method based on CPG-RAG, characterized in that, include: Step 1: Collect a list of known vulnerabilities and store the corresponding vulnerability information in the RAG local knowledge base; The vulnerability information includes code vectors and auxiliary information; Step 2: Input the vulnerability code to be detected, and convert the vulnerability code into the form of a Code Attribute Graph (CPG); the CPG integrates four types of graphs: Abstract Syntax Tree (AST), Control Flow Graph (CFG), Data Dependency Graph (DDG), and Program Dependency Graph (PDG); Step 3: Perform graph embedding representation on the CPG to obtain the vulnerability code vector to be detected; Step 4: Use the code vector to be detected to perform vector similarity matching in the RAG local knowledge base, and construct vulnerability detection prompt words based on the matching results and the corresponding auxiliary information in the local knowledge base; Step 5: Based on the vulnerability detection hints, call the large language model for analysis to obtain the vulnerability detection results of the code to be detected.

2. The CPG-RAG-based code vulnerability detection method according to claim 1, characterized in that, In step 1, the code vector is obtained according to the following steps: First, the known vulnerability code is converted into the form of a code attribute graph (CPG). Then, the CPG corresponding to the known vulnerability code is represented by graph embedding to obtain the code vector of the known vulnerability code.

3. The CPG-RAG-based code vulnerability detection method according to claim 1, characterized in that, In step 1, known vulnerabilities are analyzed during the storage process to generate auxiliary information; the auxiliary information includes code description, vulnerability type, and vulnerability pattern.

4. The CPG-RAG-based code vulnerability detection method according to claim 3, characterized in that, The DeepSeek-R1 model was used to analyze known vulnerabilities during the storage process.

5. A code vulnerability detection method based on CPG-RAG according to claim 1 or 2, characterized in that, The graph embedding representation specifically includes: The multiple edge attributes between two nodes in the CPG are aggregated into a list and used as attributes in a one-sided directed graph. The node features and edge features in the CPG graph are extracted, and weights are assigned to different edge features. The nodes and edges in the CPG graph are vectorized using the BERT model to obtain two-dimensional vectors. The two-dimensional vector is embedded using an embedding model to generate a code vector.

6. The CPG-RAG-based code vulnerability detection method according to claim 2, characterized in that, In step 1, the danger source and trigger point are defined in the CPG corresponding to the known vulnerability, and the path from the danger source and trigger point is found in the CPG graph; wherein the danger source is the source of the vulnerability, and the trigger point is the location where the vulnerability occurs.

7. The CPG-RAG-based code vulnerability detection method according to claim 1, characterized in that, The vector similarity matching specifically includes: First, cosine similarity is used for the first stage of screening, selecting vulnerable code with a cosine similarity greater than a preset threshold. Then, Euclidean distance is used to filter the second node. The Euclidean distance between the vulnerability code after the first stage of filtering and the vector of the vulnerability code to be detected is calculated, and the k closest vulnerability codes are selected as the vector similarity matching results.

8. The CPG-RAG-based code vulnerability detection method according to claim 1, characterized in that, The design of the vulnerability detection prompts follows these principles: 1) The task explicitly instructed to be performed by the large language model is code vulnerability detection; 2) Provide contextual information to help large language models understand the background and environment of the code; 3) Use similar code as examples to guide the model in analyzing the code; 4) Instruct the large language model to output results in a structured manner.

9. A code vulnerability detection method based on CPG-RAG according to claim 7, characterized in that, The large language model uses the locally deployed DeepSeek-R1-32B model.

10. A code vulnerability detection system based on CPG-RAG, characterized in that, include: The RAG local knowledge base building module is used to collect a list of known vulnerabilities and vectorize and store the corresponding vulnerability information in the RAG local knowledge base. The vulnerability information includes code vectors and auxiliary information; The code intermediate representation generation module is used to input the vulnerability code to be detected and convert the vulnerability code to be detected into the form of a code attribute graph (CPG); the CPG integrates four types of graphs: abstract syntax tree (AST), control flow graph (CFG), data dependency graph (DDG), and program dependency graph (PDG). An intermediate representation embedding module is used to perform graph embedding representation on the CPG to obtain the vulnerability code vector to be detected. The RAG retrieval module is used to perform vector similarity matching in the RAG local knowledge base using the code vector to be detected, and to construct vulnerability detection prompt words based on the matching results and the corresponding auxiliary information in the local knowledge base; The large model inference and detection module is used to analyze the vulnerability detection prompts by calling a large language model to obtain the vulnerability detection results of the code to be detected.

Images