Methods for handling code vulnerabilities

Abstract

This application discloses a method for handling code vulnerabilities, relating to the field of vulnerability management technology. The method includes: scanning a target code segment to obtain initial vulnerability data, extracting features to form an initial vulnerability feature set, and obtaining category feature vectors; using a false positive detection model to filter the initial vulnerability feature set to obtain a vulnerability feature set; using a retrieval-enhanced generative agent to determine the false positive vulnerability feature set and non-false positive vulnerability feature set within the vulnerability feature set, as well as the corresponding processing actions; executing the processing actions to obtain the corresponding processing results, thereby determining the actual vulnerability data of the target code segment. This method solves the technical problems of dependency on project-specific code structures, difficulty in cross-project reuse, lengthy and difficult-to-maintain false positive lists as project scale expands, and increased maintenance costs due to code modifications leading to the recurrence of false positives. It achieves real-time analysis and processing, not only with high accuracy but also by generating effective processing solutions, thereby improving work efficiency.

Description

Technical Field

[0001] This application relates to the field of vulnerability management technology, and in particular to a method for handling code vulnerabilities. Background Technology

[0002] In related technologies, one approach is to manually maintain a filter file for false alarms, recording identified false alarms in a filter list (such as a whitelist) so that these detection results can be automatically ignored when security scanning tools are used for subsequent detection. Alternatively, one approach is to match code patterns using preset rules and combine this with contextual logic to determine whether a vulnerability is valid.

[0003] However, in related technologies, relying on filter lists or preset rules has strong project dependence. When a new project introduces similar code, false alarms cannot be automatically identified and filtered. As the project scales up, the false alarm list may become lengthy and difficult to manage, failing to fundamentally reduce the workload of security auditing and increasing maintenance costs. In addition, when the code is modified (such as refactoring, version updates, etc.), the originally recorded false alarms may no longer match the filter rules due to position shift, resulting in false alarms reappearing. Improvements are urgently needed. Summary of the Invention

[0004] This application provides a method for handling code vulnerabilities, which at least addresses the following problems in related technologies: reliance on project-specific code structures makes cross-project reuse difficult; the false positive list becomes lengthy and difficult to maintain as the project scales up; and code modifications cause false positives to reappear due to changes in location, increasing maintenance costs.

[0005] This application provides a method for handling code vulnerabilities, comprising the following steps: scanning a target code segment of the software under test to obtain initial vulnerability data corresponding to the target code segment; extracting at least one initial vulnerability feature from the initial vulnerability data to form an initial vulnerability feature set; obtaining a category feature vector corresponding to the initial vulnerability feature set; inputting the initial vulnerability feature set and the category feature vector into a pre-built false positive detection model to filter the initial vulnerability feature set using the false positive detection model to obtain a vulnerability feature set that meets preset conditions; inputting the vulnerability feature set into a pre-built retrieval enhancement generation agent to determine the false positive vulnerability feature set and the non-false positive vulnerability feature set in the vulnerability feature set, as well as the first processing action corresponding to the false positive vulnerability feature set and the second processing action corresponding to the non-false positive vulnerability feature set; executing the first processing action and the second processing action respectively to obtain the first processing result of the false positive vulnerability feature set and the second processing result of the non-false positive vulnerability feature set, and determining the actual vulnerability data of the target code segment based on the false positive vulnerability feature set, the non-false positive vulnerability feature set, the first processing result, and the second processing result.

[0006] This application also provides a code vulnerability processing apparatus, comprising: an acquisition module, configured to scan target code segments of software under test to acquire initial vulnerability data corresponding to the target code segments, extract at least one initial vulnerability feature from the initial vulnerability data to form an initial vulnerability feature set, and acquire a category feature vector corresponding to the initial vulnerability feature set; a generation module, configured to input the initial vulnerability feature set and the category feature vector into a pre-built false positive detection model to filter the initial vulnerability feature set using the false positive detection model to obtain a vulnerability feature set that meets preset conditions; and a first determination module, configured to input the vulnerability feature set into a pre-built... In the retrieval-enhanced generative agent, the retrieval-enhanced generative agent is used to determine the false positive vulnerability feature set and the non-false positive vulnerability feature set in the vulnerability feature set, as well as the first processing action corresponding to the false positive vulnerability feature set and the second processing action corresponding to the non-false positive vulnerability feature set; the second determining module is used to execute the first processing action and the second processing action respectively to obtain the first processing result of the false positive vulnerability feature set and the second processing result of the non-false positive vulnerability feature set, and determine the actual vulnerability data of the target code segment based on the false positive vulnerability feature set, the non-false positive vulnerability feature set, the first processing result and the second processing result.

[0007] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for implementing the steps of the above-described code vulnerability handling method when executing the computer program.

[0008] This application also provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the steps of the above-described code vulnerability handling method.

[0009] This application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of handling any of the above-described code vulnerabilities.

[0010] This application utilizes a method to scan target code fragments of the software under test to obtain initial vulnerability data. By extracting vulnerability features, an initial vulnerability feature set is formed, leading to corresponding category feature vectors. A false positive detection model is then used to filter this initial feature set, resulting in a vulnerability feature set that meets certain conditions. A pre-built retrieval-enhanced generative agent is then used to determine the false positive and non-false positive vulnerability feature sets, along with corresponding processing actions. Executing these actions yields the corresponding processing results, thus identifying the actual vulnerability data. Therefore, this method addresses technical issues such as reliance on project-specific code structures, difficulty in cross-project reuse, lengthy and difficult-to-maintain false positive lists as project scales increase, and the recurrence of false positives due to location changes caused by code modifications, increasing maintenance costs. It achieves real-time analysis and processing of scanned vulnerability data, accurately detecting false positive features in code scanning and generating effective processing solutions, thereby improving the accuracy of security scanning and increasing work efficiency. Attached Figure Description

[0011] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a flowchart illustrating a method for handling code vulnerabilities according to an embodiment of this application;

[0013] Figure 2 A flowchart illustrating feature selection according to embodiments of this application;

[0014] Figure 3 This is a flowchart illustrating the construction of a Rag agent according to an embodiment of this application;

[0015] Figure 4 A flowchart illustrating the execution of the intelligent vulnerability management platform provided in the embodiments of this application;

[0016] Figure 5 This is a block diagram of a code vulnerability processing apparatus provided according to an embodiment of this application.

[0017] Figure label:

[0018] Among them, 10-code vulnerability processing device; 100-first acquisition module, 200-generation module, 300-first determination module, 400-second determination module. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0020] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0021] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0022] The embodiments of this application provide a method for handling code vulnerabilities. The method is described in detail below in conjunction with the execution flow of the code vulnerability handling method.

[0023] Specifically, Figure 1 This is a flowchart of a code vulnerability handling method provided according to an embodiment of this application.

[0024] like Figure 1 As shown, the method for handling this code vulnerability includes the following steps:

[0025] In step S101, the target code segment of the software under test is scanned to obtain the initial vulnerability data corresponding to the target code segment. At least one initial vulnerability feature is extracted from the initial vulnerability data to form an initial vulnerability feature set, and the category feature vector corresponding to the initial vulnerability feature set is obtained.

[0026] It is understood that, in the embodiments of this application, the category feature vector may include, but is not limited to, false positive vectors and non-false positive vectors. The specific settings can be made by those skilled in the art according to the actual situation, and this application does not impose any specific restrictions.

[0027] In some embodiments, the present application can scan the target code segment of the software under test to obtain the initial vulnerability data corresponding to the target code segment, thereby extracting at least one initial vulnerability feature from the initial vulnerability data, and summarizing these features to form an initial vulnerability feature set, thereby obtaining the category feature vector corresponding to the initial vulnerability feature set.

[0028] For example, embodiments of this application can collect target code fragments in security scans, which may include, but are not limited to, false alarm data and non-false alarm data from different languages, projects, and products, and the number of false alarm and non-false alarm data is not significantly different.

[0029] Furthermore, in this embodiment of the application, the extracted target code fragments can be represented by an abstract syntax tree and a structured representation of the syntax features of the code to obtain initial vulnerability data, and initial vulnerability features can be extracted from them, including the number of lines of code, cyclomatic complexity, node type, number of loop layers, nesting depth, number of calls, etc. The coding language type and scanning tool type are also used as initial vulnerability features, thereby forming an initial vulnerability feature set, and obtaining the category feature vector corresponding to the initial vulnerability feature set.

[0030] Optionally, in one embodiment of this application, before inputting the initial vulnerability feature set and category feature vector into the pre-constructed false positive detection model, the method further includes: scanning the target code segment of the target software to obtain initial target vulnerability data corresponding to the target code segment; extracting at least one initial target vulnerability feature from the initial target vulnerability data to form an initial target vulnerability feature set to obtain a category target feature vector corresponding to the initial target vulnerability feature set; constructing a first evaluation function based on the correlation between at least one initial target vulnerability feature and the category target feature vector in the initial target vulnerability feature set to calculate a first correlation value between the initial target vulnerability feature and the category target feature vector; constructing a second evaluation function based on the correlation between different initial target vulnerability features in the initial target vulnerability feature set to calculate a second correlation value between different initial target vulnerability features; constructing a third evaluation function based on the first and second evaluation functions to calculate a third correlation value between a subset of initial target vulnerability features and the category target feature vector; and constructing an evaluation function for the false positive detection model based on the first, second, and third evaluation functions.

[0031] It is understood that, in the embodiments of this application, the evaluation function is used to measure the ability of a feature or set to distinguish different categories of data. It can be used to evaluate the merits of candidate subsets and is one of the important factors affecting feature selection performance.

[0032] Furthermore, embodiments of this application may employ symmetric uncertainty (abbreviated as symmetric uncertainty). The evaluation criteria are used to measure the degree of correlation between features and classes, and between features themselves. That is, for variables... , The symmetric uncertainty between them can be, but is not limited to, expressed as:

[0033] ,

[0034] in, The amount of mutual information between two variables; The information entropy of a variable; The value range is [0-1]. The larger the value, the stronger the correlation between the two; otherwise, the weaker the correlation.

[0035] In some embodiments, this application can be based on an initial target vulnerability feature set ( ,in, The total number of initial target vulnerability features. The correlation between the initial target vulnerability features and the category target feature vector (as a category feature vector) is used to construct the first evaluation function.

[0036] Among them, the initial target vulnerability characteristics and category feature vectors The correlation between them can be expressed, but is not limited to, as:

[0037] ,

[0038] Furthermore, embodiments of this application can construct a first evaluation function, and then use the first evaluation function to calculate a first correlation value between the initial target vulnerability feature and the category target feature vector.

[0039] In some embodiments, the present application may construct a second evaluation function based on the correlation between different initial target vulnerability features in the initial target vulnerability feature set.

[0040] Among them, the initial target vulnerability characteristics and initial target vulnerability characteristics The correlation between them can be, but is not limited to, expressed as:

[0041] ,

[0042] Furthermore, embodiments of this application can construct a second evaluation function, and then use the second evaluation function to calculate a second correlation value between different initial target vulnerability features.

[0043] In some embodiments, the present application may construct a third evaluation function based on the first evaluation function and the second evaluation function.

[0044] It can be understood that the embodiments of this application may employ set and class correlation (abbreviated as...). To measure the relevance of a subset of features to a class, i.e.:

[0045] ,

[0046] in, The number of features; The value range is [0-1]. The larger the value, the stronger the correlation between the feature set and the class; otherwise, the less correlated they are. This represents the average correlation between all features and classes. The average correlation between features can be expressed, but is not limited to, as follows:

[0047] ,

[0048] ,

[0049] Furthermore, embodiments of this application can construct a third evaluation function, and then use the third evaluation function to calculate a third correlation value between the initial target vulnerability feature subset and the category target feature vector.

[0050] Before inputting the initial vulnerability feature set and category feature vector into the false positive detection model, this embodiment of the application can obtain the initial target vulnerability data and feature set and category target feature vector by scanning the target code fragment, and then construct the first and second evaluation functions to calculate the correlation values ​​between the initial target vulnerability features and category target feature vectors, and between different initial target vulnerability features. Based on the first and second evaluation functions, a third evaluation function is constructed to calculate the correlation values ​​between the initial target vulnerability feature subset and the category target feature vector. Finally, the evaluation function of the false positive detection model is constructed. By constructing the evaluation function, inference efficiency is improved, model overfitting is avoided, the model's generalization ability is improved, and the model has project adaptation ability and evolutionary learning ability.

[0051] In step S102, the initial vulnerability feature set and category feature vector are input into the pre-built false alarm detection model so as to use the false alarm detection model to filter the initial vulnerability feature set and obtain a vulnerability feature set that meets the preset conditions.

[0052] It is understood that, in order to improve the efficiency of false positive detection, the embodiments of this application use a feature set after feature selection when constructing the false positive detection model. This can be understood as the embodiments of this application performing feature selection based on clustering, thereby filtering out a vulnerability feature set with low redundancy and high class relevance, thus improving the efficiency and accuracy of the false positive detection model. Feature selection is the process of selecting a vulnerability feature set that meets certain conditions from the initial vulnerability feature set according to a certain evaluation function, such as the optimal feature subset. The process of performing feature selection may include, but is not limited to, removing irrelevant features, feature clustering, and removing redundant features. This application does not impose specific limitations; the specific process is as follows: Figure 2 As shown.

[0053] In addition, certain conditions may be set by those skilled in the art according to the actual situation, and this application does not impose specific restrictions.

[0054] In some embodiments, this application can filter the initial vulnerability feature set based on category feature vectors using a pre-built false positive detection model, thereby obtaining a vulnerability feature set that meets certain conditions. Furthermore, this application can also preprocess the initial vulnerability feature set, such as deduplication and normalization; this application does not impose specific limitations.

[0055] For example, embodiments of this application can utilize a pre-built false positive detection system to perform real-time and accurate false positive detection on an initial vulnerability feature set. Furthermore, to construct a stable and efficient false positive detection model, embodiments of this application can perform the following operations on the initial vulnerability feature set:

[0056] An initial target vulnerability feature set corresponding to the initial vulnerability feature set is obtained, and the initial target vulnerability feature set is trained and validated using a ten-fold cross-validation method. Specifically, the initial target vulnerability feature set is divided into ten parts, nine parts are selected for training, and one part is used for validation to obtain the classification accuracy. This process is repeated ten times, and the average of the ten classification accuracy rates is calculated as the final classification accuracy. Multiple classifiers (such as Naive Bayes, Support Vector Machine, and Random Forest) are selected to classify the initial target vulnerability feature set, and the classifier with the highest classification accuracy is selected as the classifier for the false positive detection model, thus obtaining the final false positive detection model.

[0057] Optionally, in one embodiment of this application, an initial vulnerability feature set and a category feature vector are input into a pre-built false alarm detection model to filter the initial vulnerability feature set using the false alarm detection model to obtain a vulnerability feature set that meets preset conditions. This includes: calculating a first correlation value between different initial vulnerability features and category feature vectors based on a first evaluation function in the false alarm detection model; determining whether the first correlation value is less than a preset threshold; if the first correlation value is less than the preset threshold, removing the corresponding initial vulnerability feature to determine the vulnerability feature set; and if the first correlation value is greater than or equal to the preset threshold, retaining the corresponding initial vulnerability feature to determine the vulnerability feature set.

[0058] In some embodiments, the present application can use a false alarm detection model to screen the initial vulnerability feature set. That is, the first correlation value between different initial vulnerability features and category feature vectors is calculated by a first evaluation function, and it is determined whether the first correlation value is less than a certain threshold. If it is less than a certain threshold, the corresponding initial vulnerability feature is removed, thereby determining the vulnerability feature set. If it is greater than or equal to a certain threshold, the corresponding initial vulnerability feature is retained, thereby determining the vulnerability feature set. The certain threshold can be set by those skilled in the art according to the actual situation, and the present application does not impose specific limitations.

[0059] For example, in combination Figure 2 As shown in the embodiment of this application, when moving irrelevant features, the degree of correlation between each initial vulnerability feature and the category feature vector can be calculated through a first evaluation function to obtain a first correlation value. The initial vulnerability features are then sorted in descending order based on the first correlation value, and a certain threshold is set. The feature set is obtained by retaining features whose first relevance value is greater than a certain threshold. .

[0060] This application embodiment calculates the correlation between the initial vulnerability features and the category feature vector through the first evaluation function in the false positive detection model, and removes features with a first correlation value less than a certain threshold, thereby reducing interference from irrelevant features, improving detection accuracy, reducing computational complexity, and improving model efficiency. It can be flexibly adjusted according to different application scenarios and needs to improve the model's operating efficiency.

[0061] Optionally, in one embodiment of this application, an initial vulnerability feature set and category feature vector are input into a pre-built false alarm detection model to filter the initial vulnerability feature set using the false alarm detection model, thereby obtaining a vulnerability feature set that meets preset conditions. This includes: calculating a second correlation value between different initial vulnerability features based on a second evaluation function in the false alarm detection model, and constructing a feature association set for different initial vulnerability features based on the second correlation value; determining an initial cluster subset and other cluster subsets of the feature association set based on different initial vulnerability features and the feature association set; traversing other cluster subsets with the initial cluster subset as a reference to determine the corresponding remaining feature set and initial cluster set; and calculating the corresponding final cluster set based on the remaining feature set and the initial cluster set, thereby determining the vulnerability feature set using the final cluster set.

[0062] In some embodiments, the present application embodiments may utilize a second evaluation function to calculate a second correlation value between different initial vulnerability features, and construct a feature association set for different initial vulnerability features based on the second correlation value. Thus, based on different initial vulnerability features and feature association sets, an initial cluster subset and other cluster subsets of the feature association set are determined. Using the initial cluster subset as a reference, other cluster subsets are traversed to determine the corresponding remaining feature set and initial cluster set. Then, based on the remaining feature set and initial cluster set, the corresponding final cluster set is calculated, thereby determining the vulnerability feature set.

[0063] For example, in combination Figure 2 As shown, in the embodiment of this application, during feature clustering, the vulnerability feature set can be... Each feature in The second evaluation function is used to calculate the second correlation value between the feature and other features. The larger the second correlation value, the stronger the correlation, indicating that the two features are more similar. Furthermore, in this embodiment, the correlation between features can be sorted in descending order to obtain the feature association set corresponding to the degree of association, which can be, but is not limited to, represented as: ,in, Refers to ranking Two features (let's say) The second correlation value between them can be calculated using a formula that can, but is not limited to, express the following:

[0064] ,

[0065] Furthermore, embodiments of this application can be used for... The data in the file is processed as follows: [The data is retrieved / retrieved]. Two corresponding features Use them as the initial cluster subset ,other As other cluster subsets, and using the initial cluster subset as a reference, traverse the other cluster subsets to determine the corresponding remaining feature sets. and the initial cluster set , where each cluster subset It contains at least one feature.

[0066] Furthermore, in this embodiment of the application, the corresponding final cluster set is calculated based on the remaining feature set and the initial cluster set, thereby determining the vulnerability feature set.

[0067] This application embodiment calculates the correlation values ​​between initial vulnerability features through the second evaluation function in the false alarm detection model, thereby constructing a feature association set. Based on this, an initial cluster subset and other cluster subsets are determined. Using the initial cluster subset as a reference, the remaining feature set and the initial cluster set are determined through traversal, and the final cluster set is obtained, thereby determining the vulnerability feature set. Through feature clustering driven by the second evaluation function, dynamic grouping optimization based on the intrinsic correlation between features is achieved, feature redundancy is intelligently eliminated, and a leap in false alarm detection accuracy is realized.

[0068] Optionally, in one embodiment of this application, taking the initial cluster subset as a reference, traversing other cluster subsets to determine the corresponding remaining feature set and initial cluster set includes: determining whether the initial cluster subset contains at least one other cluster feature from another cluster subset; if the initial cluster subset contains at least one other cluster feature, then determining the remaining feature set based on the other cluster features not included; if the initial cluster subset does not contain other cluster features, then determining the initial cluster set based on the other cluster subsets corresponding to the other cluster features.

[0069] In some embodiments of this application, during the process of determining the remaining feature set and the initial cluster set, it can be determined whether the initial cluster subset contains one of the other cluster features of other cluster subsets. If it does, the other cluster features that are not included are added to the remaining feature set, thereby determining the remaining feature set; if it does not, the other cluster subsets are combined into a new initial cluster set, thereby determining the initial cluster set.

[0070] For example, the embodiments of this application are for ,Pick The two corresponding features, if Include If one feature is included, then the other unincluded feature is added to the remaining feature set. In the middle; if None of them include If two features are selected, then these two features are combined to form a new initial cluster set. .

[0071] In this embodiment, the initial cluster subset is used as a reference to traverse other cluster subsets. By determining whether it contains features from other cluster subsets, the remaining feature set and the initial cluster set are determined. The remaining feature set is formed by extracting features that are not included, thus avoiding feature omission. The complete cluster subset is directly used as the initial cluster set, preserving complete semantics and reducing computational complexity.

[0072] Optionally, in one embodiment of this application, calculating the corresponding final cluster set based on the remaining feature set and the initial cluster set includes: calculating a first correlation value between the remaining features and the corresponding category feature vector based on a first evaluation function in the false alarm detection model; sorting the remaining features according to a first target sorting method based on the first correlation value to obtain sorted remaining features, and determining the final remaining feature set based on the sorted remaining features; traversing the final remaining feature set and the initial cluster set to calculate the effective information of different final remaining features in the initial cluster subset; determining whether the effective information meets a preset information condition; if the effective information meets the preset information condition, adding the corresponding final remaining feature to the corresponding initial cluster subset to obtain the final cluster subset, and obtaining the final cluster set based on the final cluster subset.

[0073] In some embodiments, this application can utilize a first evaluation function to calculate a first correlation value between the remaining features and the corresponding category feature vectors, and sort them according to a first target sorting method (such as from largest to smallest, smallest to largest, etc., which is not specifically limited in this application), thereby obtaining the sorted remaining features. Based on the sorted remaining features, a final remaining feature set is determined. The final remaining feature set and the initial cluster set are traversed, and the effective information of different final remaining features in the initial cluster subset is calculated. It is then determined whether the effective information meets certain information conditions. If so, the corresponding final remaining feature is added to the corresponding initial cluster subset to obtain the final cluster subset, thereby determining the final cluster set. These certain information conditions can be set by those skilled in the art according to actual circumstances, and are not specifically limited in this application.

[0074] For example, embodiments of this application can use the remaining feature set The remaining features are sorted in descending order according to the first correlation value between the features and the category feature vectors, thereby determining the final remaining feature set. traversal The final residual features in Perform the following operations: Traverse the initial cluster set Each initial cluster subset and calculate exist The useful information brought by the middle: Let In cluster subset If the feature contains the least amount of effective information, then the feature... Join In, that is , , After traversing all features, the final cluster set is obtained.

[0075] Among them, features In cluster subset The computational methods that bring effective information can be, but are not limited to, expressed as: computation Correlation with categorical feature vectors , recorded as ;calculate Correlation between categorical feature vectors , recorded as Valid information - .

[0076] This application embodiment uses a first evaluation function to calculate the first correlation value between the remaining features and the category feature vector, and determines the final remaining feature set after sorting. By traversing it and the initial cluster set, the corresponding effective information is calculated, and the final cluster set is obtained when the effective information meets certain information conditions, thereby improving computational efficiency, reducing maintenance costs, and strengthening the ability to suppress false alarms.

[0077] Optionally, in one embodiment of this application, determining the vulnerability feature set using the final cluster set includes: calculating a first correlation value between different cluster features and corresponding category feature vectors in the final cluster set based on a first evaluation function in the false positive detection model; sorting the different cluster features according to a second target sorting method based on the first correlation value to obtain a sorted cluster set; traversing the sorted cluster set and determining the corresponding initial cluster feature set to calculate the effective information of different sorted cluster features in the initial cluster feature set; and determining the vulnerability feature set based on the effective information.

[0078] In some embodiments, the present application embodiments may use a first evaluation function to calculate the first correlation value between different clustering features and corresponding category feature vectors in the final clustering set, and sort them according to a second target sorting method (such as from smallest to largest, from largest to smallest, etc., the present application does not make specific restrictions), thereby obtaining a sorted clustering set, and traversing the sorted clustering set to determine the corresponding initial clustering feature set, and calculating the effective information, thereby determining the vulnerability feature set.

[0079] For example, in combination Figure 2 As shown, embodiments of this application can, when removing redundant features, optimize the final cluster set. For each cluster subset, the following operations are performed: Calculate the first correlation value using the first evaluation function, and then sort the final cluster sets in descending order according to the first correlation value, thus obtaining the sorted cluster sets. .

[0080] Furthermore, embodiments of this application can... The first feature As the initial cluster feature set , ; obtain The first feature , ,calculate exist The effective information brought in, if the effective information is greater than 0, then ; Traversal Repeat the above operation on all clustered subsets until... All sets in the subset are empty, thus obtaining the final clustering feature set. This allows us to determine the vulnerability signature set.

[0081] This application embodiment calculates the first correlation value between different clustering features and corresponding category feature vectors through a first evaluation function, sorts them, determines the initial clustering feature level, calculates effective information, and then determines the vulnerability feature set. This quantification method avoids subjective judgment, provides an objective and accurate basis for feature selection, ensures that the selected features are highly correlated with the vulnerability category, improves the accuracy of feature selection, enhances the effectiveness of vulnerability detection, improves model running efficiency, does not depend on specific vulnerability types or application scenarios, has strong versatility, and can adapt to various complex actual situations.

[0082] Optionally, in one embodiment of this application, before inputting the vulnerability feature set into the pre-built retrieval enhancement generation agent, the method further includes: obtaining a target vulnerability feature set; constructing a vector database based on the target vulnerability feature set; filtering to obtain the target final candidate feature vector based on the vector database; constructing a large language model based on the target final candidate feature vector; and constructing a retrieval enhancement generation agent based on the vector database and the large language model.

[0083] It is understood that the Retrieval Augmented Generation (Rag) agent pre-built in the embodiments of this application, knowledge base preparation and vector retrieval are the core steps in generating high-quality detection information.

[0084] In this embodiment, the target vulnerability features corresponding to the target vulnerability feature set are used as searchable index vectors to construct a vector database, and the similarity between features is used when retrieving data. As an evaluation criterion, the information most similar to the query data is found in the knowledge base to obtain the final candidate feature vector of the target. Then, a large language model is constructed, and a retrieval-enhanced generative agent is constructed based on the vector database and the large language model.

[0085] For example, the process of constructing the Rag agent in this application embodiment is as follows: Figure 3 As shown, the main content can be:

[0086] Step S301: Knowledge preparation.

[0087] Knowledge preparation includes the vulnerability code snippets corresponding to the index vectors, vulnerability information, and reasons for false positives.

[0088] Furthermore, embodiments of this application can upload the target vulnerability feature set to a vector database, including vulnerable code snippets, target vulnerability features, vulnerability information, reasons for false positives, etc. Here, the target vulnerability features serve as searchable index vectors, and other information serves as associated metadata. The feature vectors replace the traditional calculation of high-dimensional vector similarity, significantly improving retrieval efficiency.

[0089] Step S302: Vector retrieval.

[0090] Step S303: Result generation.

[0091] In this embodiment, the detection model can predict whether a vulnerability is a false alarm based on the target vulnerability features; and based on the prediction results, query a vector database to find all records with the same prediction results as a candidate set; then, calculate the similarity between the target vulnerability features and the feature vectors in the candidate set. The most similar TOP-K records are retrieved from the candidate set to obtain the final candidate feature vector of the target. The final candidate feature vector of the target is then used as a prompt word to input into the large language model to generate a more accurate answer.

[0092] It should be noted that the embodiments of this application adopt... The correlation between feature vectors is calculated. The higher the similarity, the more similar the code snippets are. Therefore, the most similar TOP-K records can be retrieved.

[0093] This application embodiment can acquire a target vulnerability feature set, construct a vector database, and then use the vector database to filter and obtain the final candidate feature vectors of the target, thereby constructing a large language model and then constructing a retrieval-enhanced generative agent. This can more accurately locate features related to the target vulnerability, avoid possible semantic biases, improve retrieval accuracy and efficiency, help the large language model better understand the context and features of the vulnerability, thereby generating more accurate and targeted answers and suggestions, improving the model's performance in vulnerability detection and processing, and enabling the agent to handle vulnerability-related issues more comprehensively and accurately, adapting to complex and ever-changing vulnerability scenarios.

[0094] In step S103, the vulnerability feature set is input into the pre-built retrieval enhancement generation agent to determine the false positive vulnerability feature set and the non-false positive vulnerability feature set in the vulnerability feature set, as well as the first processing action corresponding to the false positive vulnerability feature set and the second processing action corresponding to the non-false positive vulnerability feature set.

[0095] It is understood that the Rag agent in the embodiments of this application can use historical vulnerability data as searchable knowledge, integrate the retrieved information and questions into prompt words and input them into a large language model, thereby generating high-quality and accurate processing information.

[0096] In some embodiments, the present application embodiments may utilize a pre-built Rag agent to determine a set of false positive vulnerability features and a set of non-false positive vulnerability features in the vulnerability feature set, as well as a first processing action corresponding to the set of false positive vulnerability features and a second processing action corresponding to the set of non-false positive vulnerability features.

[0097] Specifically, for the false positive vulnerability feature set, the large language model in the Rag agent can be used to determine the first processing action as the reason for generating the false positive; for the non-false positive vulnerability feature set, the large language model in the Rag agent can be used to determine the second processing action as generating a remediation plan, etc. The specific settings can be made by those skilled in the art according to the actual situation, and this application does not impose specific restrictions.

[0098] Optionally, in one embodiment of this application, the vulnerability feature set is input into a pre-built retrieval enhancement generation agent to determine the false positive vulnerability feature set and the non-false positive vulnerability feature set, as well as the first processing action corresponding to the false positive vulnerability feature set and the second processing action corresponding to the non-false positive vulnerability feature set. This includes: determining the index vector corresponding to the vulnerability feature set based on the vector database in the retrieval enhancement generation agent; using the index vector as an index, filtering from the vector database to obtain initial candidate feature vectors that meet preset detection conditions; filtering based on the initial candidate feature vectors to obtain final candidate feature vectors that meet preset similarity conditions; and using the large language model in the retrieval enhancement generation agent based on the final candidate feature vectors to determine the false positive vulnerability feature set, the non-false positive vulnerability feature set, the first processing action, and the second processing action.

[0099] In some embodiments, this application can use vulnerability features of a vulnerability feature set as an index to filter initial candidate feature vectors that meet certain detection conditions from a vector database. Then, using these initial candidate feature vectors, final candidate feature vectors that meet certain similarity conditions are obtained. This allows the use of a large language model to determine the false positive vulnerability feature set, the non-false positive vulnerability feature set, the first processing action, and the second processing action. The specific detection conditions and similarity conditions can be set by those skilled in the art according to actual circumstances, and this application does not impose specific limitations.

[0100] For example, embodiments of this application can, based on vulnerability features, filter initial candidate feature vectors that meet certain detection conditions from a vector database, forming a candidate set; then, the similarity between the vulnerability features and the feature vectors in the candidate set is calculated. The most similar TOP-K records are retrieved from the candidate set and used as the final candidate feature vector. The final candidate feature vector is then used as a prompt word and input into the large language model to determine the false positive vulnerability feature set, the non-false positive vulnerability feature set, the first processing action, and the second processing action. For the false positive vulnerability feature set, the cause of the false positive is generated; for the non-false positive vulnerability feature set, a remediation plan is generated.

[0101] This application embodiment determines the corresponding index vector by retrieving the vector database in the augmented generative agent, and then uses the index vector as an index to filter out initial candidate feature vectors that meet certain detection conditions. Based on the initial candidate feature vectors, it further filters out final candidate feature vectors that meet certain similarity conditions. By utilizing the large language model in the augmented generative agent, it determines the false positive vulnerability feature set, the non-false positive vulnerability feature set, the first processing action, and the second processing action, thereby improving the accuracy and comprehensiveness of feature retrieval, reducing manual intervention and cumbersome analysis steps, shortening vulnerability processing time, improving processing efficiency, and enabling timely response to security threats in the system. It also has good adaptability and scalability.

[0102] In step S104, the first processing action and the second processing action are executed respectively to obtain the first processing result of the false positive vulnerability feature set and the second processing result of the non-false positive vulnerability feature set, and the actual vulnerability data of the target code segment is determined based on the false positive vulnerability feature set, the non-false positive vulnerability feature set, the first processing result and the second processing result.

[0103] As one possible implementation, embodiments of this application can determine the corresponding first processing result and second processing result by executing a first processing action and a second processing action, thereby determining the actual vulnerability data in the target code segment.

[0104] For example, in the embodiments of this application, when the processing action of the false alarm vulnerability feature set is to generate a false alarm reason, the false alarm reason can be manually reviewed, and if the feature is determined by manual review to be a false alarm, it can be removed, thereby determining the actual vulnerability data.

[0105] Furthermore, in the embodiments of this application, when the processing action for non-false positive vulnerability feature sets is to generate a remediation plan, the corresponding remediation plan can be executed, and the actual vulnerability data can be determined after the vulnerability remediation is completed.

[0106] Furthermore, embodiments of this application can combine a false positive detection model, a Rag agent, and code scanning tools to construct an intelligent vulnerability management platform, enabling intelligent processing of vulnerability scanning, false positive detection, and vulnerability analysis. The specific process is as follows: Figure 4 As shown.

[0107] In this context, 1 represents scanning the target code segment using a code scanning tool to obtain initial vulnerability data; 2 represents the intelligent vulnerability management platform parsing the initial vulnerability data, extracting features to form an initial vulnerability feature set, and obtaining the category feature vector corresponding to the initial vulnerability feature set; 3 represents using a false positive detection model to parse and reason about the initial vulnerability feature set to obtain a vulnerability feature set; 4 represents the Rag agent retrieving and generating the vulnerability feature set to obtain a false positive vulnerability feature set, a non-false positive vulnerability feature set, and a first processing action corresponding to the false positive vulnerability feature set and a second processing action corresponding to the non-false positive vulnerability feature set; 5 represents synchronizing the false positive vulnerability feature set, the non-false positive vulnerability feature set, the first processing result, and the second processing result to the knowledge base; 6 represents executing the processing action, obtaining the corresponding processing result, and returning the processing result to the intelligent vulnerability management platform, where R&D personnel perform vulnerability processing according to the remediation plan to determine the actual vulnerability data.

[0108] This application only processes vulnerability data, which can not only improve the accuracy of scanning, but also improve work efficiency and optimize the automated vulnerability detection process.

[0109] The code vulnerability handling method proposed in this application involves scanning the target code segment of the software under test to obtain initial vulnerability data. Vulnerability features are extracted to form an initial vulnerability feature set, which in turn yields corresponding category feature vectors. A false positive detection model is then used to filter the initial vulnerability feature set, resulting in a vulnerability feature set that meets certain conditions. A pre-built retrieval-enhanced generative agent is then used to determine the false positive vulnerability feature set and the non-false positive vulnerability feature set, along with corresponding processing actions. Executing these actions yields the corresponding processing results, thereby determining the actual vulnerability data. Therefore, this method addresses technical issues such as reliance on project-specific code structures, difficulty in cross-project reuse, lengthy and difficult-to-maintain false positive lists as project scales increase, and the increased maintenance costs due to code modifications causing false positives to reappear in different locations. It achieves real-time analysis and processing of scanned vulnerability data, accurately detecting false positive features in code scanning and generating effective processing solutions, thereby improving the accuracy of security scanning and increasing work efficiency.

[0110] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0111] Embodiments of this application also provide a code vulnerability handling apparatus.

[0112] Figure 5 This is a block diagram of a code vulnerability processing apparatus provided according to an embodiment of this application.

[0113] like Figure 5 As shown, the processing device 10 for this code vulnerability includes: a first acquisition module 100, a generation module 200, a first determination module 300, and a second determination module 400.

[0114] The first acquisition module 100 is used to scan the target code segment of the software under test to obtain the initial vulnerability data corresponding to the target code segment, extract at least one initial vulnerability feature from the initial vulnerability data to form an initial vulnerability feature set, and obtain the category feature vector corresponding to the initial vulnerability feature set.

[0115] The generation module 200 is used to input the initial vulnerability feature set and category feature vector into the pre-built false alarm detection model, so as to use the false alarm detection model to filter the initial vulnerability feature set and obtain a vulnerability feature set that meets the preset conditions.

[0116] The first determining module 300 is used to input the vulnerability feature set into a pre-built retrieval enhancement generation agent, so as to use the retrieval enhancement generation agent to determine the false positive vulnerability feature set and the non-false positive vulnerability feature set in the vulnerability feature set, as well as the first processing action corresponding to the false positive vulnerability feature set and the second processing action corresponding to the non-false positive vulnerability feature set.

[0117] The second determining module 400 is used to execute the first processing action and the second processing action respectively to obtain the first processing result of the false positive vulnerability feature set and the second processing result of the non-false positive vulnerability feature set, and to determine the actual vulnerability data of the target code segment based on the false positive vulnerability feature set, the non-false positive vulnerability feature set, the first processing result and the second processing result.

[0118] Optionally, in one embodiment of this application, it further includes: a second acquisition module, a first construction module, a second construction module, a third construction module, and a fourth construction module.

[0119] The second acquisition module is used to scan the target code segment of the target software before inputting the initial vulnerability feature set and category feature vector into the pre-built false alarm detection model, so as to obtain the initial target vulnerability data corresponding to the target code segment, extract at least one initial target vulnerability feature from the initial target vulnerability data, form an initial target vulnerability feature set, and obtain the category target feature vector corresponding to the initial target vulnerability feature set.

[0120] The first construction module is used to construct a first evaluation function based on the correlation between at least one initial target vulnerability feature and a category target feature vector in the initial target vulnerability feature set, so as to use the first evaluation function to calculate a first correlation value between the initial target vulnerability feature and the category target feature vector.

[0121] The second construction module is used to construct a second evaluation function based on the correlation between different initial target vulnerability features in the initial target vulnerability feature set, so as to use the second evaluation function to calculate the second correlation value between different initial target vulnerability features.

[0122] The third building module is used to construct a third evaluation function based on the first and second evaluation functions, so as to use the third evaluation function to calculate the third correlation value between the initial target vulnerability feature subset and the category target feature vector.

[0123] The fourth building module is used to construct the evaluation function of the false alarm detection model based on the first evaluation function, the second evaluation function, and the third evaluation function.

[0124] Optionally, in one embodiment of this application, the generation module 200 includes: a first calculation unit, a judgment unit, a first determination unit, and a second determination unit.

[0125] The first calculation unit is used to calculate the first correlation value between different initial vulnerability features and category feature vectors based on the first evaluation function in the false alarm detection model.

[0126] The judgment unit is used to determine whether the first correlation value is less than a preset threshold.

[0127] The first determining unit is used to remove the corresponding initial vulnerability features when the first correlation value is less than a preset threshold, so as to determine the vulnerability feature set.

[0128] The second determining unit is used to retain the corresponding initial vulnerability features when the first relevant value is greater than or equal to a preset threshold, so as to determine the vulnerability feature set.

[0129] Optionally, in one embodiment of this application, the generation module 200 includes: a second calculation unit, a third determination unit, a fourth determination unit, and a third calculation unit.

[0130] The second calculation unit is used to calculate the second correlation value between different initial vulnerability features based on the second evaluation function in the false alarm detection model, so as to construct a feature association set of different initial vulnerability features according to the second correlation value.

[0131] The third determining unit is used to determine the initial cluster subset and other cluster subsets of the feature association set based on different initial vulnerability characteristics and feature association sets.

[0132] The fourth determining unit is used to traverse other cluster subsets with the initial cluster subset as a reference in order to determine the corresponding remaining feature set and the initial cluster set.

[0133] The third calculation unit is used to calculate the corresponding final cluster set based on the remaining feature set and the initial cluster set, so as to determine the vulnerability feature set using the final cluster set.

[0134] Optionally, in one embodiment of this application, the fourth determining unit includes: a first judging subunit, a first determining subunit, and a second determining subunit.

[0135] The first judgment subunit is used to determine whether the initial cluster subset contains at least one other cluster feature from another cluster subset.

[0136] The first determining subunit is used to determine the remaining feature set based on other clustering features that are not included, when the initial clustering subset contains at least one other clustering feature.

[0137] The second determining subunit is used to determine the initial cluster set based on other cluster subsets corresponding to other cluster features when the initial cluster subset does not contain other cluster features.

[0138] Optionally, in one embodiment of this application, the third calculation unit includes: a first calculation subunit, a third determination subunit, a second calculation subunit, a second judgment subunit, and a generation subunit.

[0139] The first computational subunit is used to calculate the first correlation value between the remaining features and the corresponding category feature vectors based on the first evaluation function in the false alarm detection model.

[0140] The third determining subunit is used to sort the remaining features according to the first target sorting method based on the first correlation value, so as to obtain the sorted remaining features, and to determine the final remaining feature set based on the sorted remaining features.

[0141] The second computational subunit is used to traverse the final residual feature set and the initial cluster set to calculate the effective information of different final residual features in the initial cluster subset.

[0142] The second judgment subunit is used to determine whether the valid information meets the preset information conditions.

[0143] The generation sub-unit is used to add the corresponding final residual features to the corresponding initial cluster subset when the effective information meets the preset information conditions, so as to obtain the final cluster subset and obtain the final cluster set based on the final cluster subset.

[0144] Optionally, in one embodiment of this application, the third calculation unit includes: a third calculation subunit, a fourth calculation subunit, and a fourth determination subunit.

[0145] The third calculation subunit is used to calculate the first correlation value between different cluster features and corresponding category feature vectors in the final cluster set based on the first evaluation function in the false alarm detection model, and to sort the different cluster features according to the second objective sorting method based on the first correlation value to obtain the sorted cluster set.

[0146] The fourth calculation subunit is used to traverse the sorted cluster sets and determine the corresponding initial cluster feature set in order to calculate the effective information of different sorted cluster features in the initial cluster feature set.

[0147] The fourth determination subunit is used to determine the vulnerability feature set based on valid information.

[0148] Optionally, in one embodiment of this application, it further includes: a third acquisition module, a fifth construction module, a filtering module, a sixth construction module, and a seventh construction module.

[0149] The third acquisition module is used to acquire the target vulnerability feature set before inputting the vulnerability feature set into the pre-built retrieval enhancement generation agent.

[0150] The fifth building module is used to construct a vector database based on the target vulnerability feature set.

[0151] The filtering module is used to filter and obtain the final candidate feature vectors of the target based on the vector database.

[0152] The sixth building module is used to construct a large language model based on the final candidate feature vectors of the target.

[0153] The seventh building block is used to construct a retrieval-enhanced generative agent based on a vector database and a large language model.

[0154] Optionally, in one embodiment of this application, the first determining module 300 includes: a fifth determining unit, a first filtering unit, a second filtering unit, and a sixth determining unit.

[0155] The fifth determining unit is used to determine the index vector corresponding to the vulnerability feature set based on the vector database in the retrieved enhanced generator agent.

[0156] The first filtering unit is used to filter initial candidate feature vectors that meet preset detection conditions from the vector database using the index vector as the index.

[0157] The second filtering unit is used to filter the initial candidate feature vectors to obtain the final candidate feature vectors that meet the preset similarity conditions.

[0158] The sixth determining unit is used to determine the false positive vulnerability feature set, the non-false positive vulnerability feature set, the first processing action, and the second processing action based on the final candidate feature vector and by using the large language model in the retrieved enhanced generative agent.

[0159] The code vulnerability processing apparatus proposed in this application scans the target code segment of the software under test to obtain initial vulnerability data. It then extracts vulnerability features to form an initial vulnerability feature set, which in turn generates corresponding category feature vectors. A false positive detection model is used to filter the initial vulnerability feature set, resulting in a vulnerability feature set that meets certain conditions. A pre-built retrieval-enhanced generative agent is then used to determine the false positive vulnerability feature set and the non-false positive vulnerability feature set, along with corresponding processing actions. By executing these actions, the corresponding processing results are obtained, thus determining the actual vulnerability data. Therefore, this approach addresses technical issues such as reliance on project-specific code structures, difficulty in cross-project reuse, lengthy and difficult-to-maintain false positive lists as project scales increase, and the increased maintenance costs due to code modifications causing false positives to reappear in different locations. It achieves real-time analysis and processing of scanned vulnerability data, accurately detecting false positive features in code scanning and generating effective processing solutions, thereby improving the accuracy of security scanning and increasing work efficiency.

[0160] For a description of the features in the embodiment corresponding to the code vulnerability handling device, please refer to the relevant description of the embodiment corresponding to the code vulnerability handling method, which will not be repeated here.

[0161] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the above-described embodiments of the method for handling code vulnerabilities.

[0162] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described code vulnerability handling method embodiments at runtime.

[0163] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0164] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described code vulnerability handling method embodiments.

[0165] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described code vulnerability handling method embodiments.

[0166] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0167] The above provides a detailed description of a method for handling code vulnerabilities provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A method of handling a code vulnerability, characterized by, The method comprises the following steps: scanning a target code segment of a software to be tested to obtain initial vulnerability data corresponding to the target code segment, extracting at least one initial vulnerability feature of the initial vulnerability data to form an initial vulnerability feature set, and obtaining a category feature vector corresponding to the initial vulnerability feature set; inputting the initial vulnerability feature set and the category feature vector into a false positive detection model constructed in advance to filter the initial vulnerability feature set by using the false positive detection model, and obtaining a vulnerability feature set meeting a preset condition; inputting the vulnerability feature set into a retrieval enhancement generation agent constructed in advance to determine a false positive vulnerability feature set and a non-false positive vulnerability feature set in the vulnerability feature set, and a first processing action corresponding to the false positive vulnerability feature set and a second processing action corresponding to the non-false positive vulnerability feature set by using the retrieval enhancement generation agent; respectively executing the first processing action and the second processing action to obtain a first processing result of the false positive vulnerability feature set and a second processing result of the non-false positive vulnerability feature set, and determining actual vulnerability data of the target code segment according to the false positive vulnerability feature set, the non-false positive vulnerability feature set, the first processing result, and the second processing result; wherein, before inputting the initial vulnerability feature set and the category feature vector into the false positive detection model constructed in advance, the method further comprises: scanning a target code segment of a software to be tested to obtain initial vulnerability data corresponding to the target code segment, extracting at least one initial vulnerability feature of the initial vulnerability data to form an initial vulnerability feature set, and obtaining a category feature vector corresponding to the initial vulnerability feature set; constructing a first evaluation function based on the correlation between at least one initial target vulnerability feature in the initial target vulnerability feature set and the category target feature vector, and calculating a first correlation value between the initial target vulnerability feature and the category target feature vector by using the first evaluation function; constructing a second evaluation function based on the correlation between different initial target vulnerability features in the initial target vulnerability feature set, and calculating a second correlation value between the different initial target vulnerability features by using the second evaluation function; constructing a third evaluation function based on the first evaluation function and the second evaluation function, and calculating a third correlation value between an initial target vulnerability feature subset and the category target feature vector by using the third evaluation function; constructing an evaluation function of the false positive detection model based on the first evaluation function, the second evaluation function, and the third evaluation function.

2. The method of claim 1, wherein, The method comprises the following steps: calculating a first correlation value between different initial vulnerability features and the category feature vector based on a first evaluation function in the false positive detection model; determining whether the first correlation value is less than a preset threshold value; If the first correlation value is less than the preset threshold, the corresponding initial vulnerability feature is rejected to determine the vulnerability feature set; If the first correlation value is greater than or equal to the preset threshold, the corresponding initial vulnerability feature is retained to determine the vulnerability feature set.

3. The method of claim 1, wherein, The initial vulnerability feature set and the category feature vector are input into a pre-constructed false alarm detection model to filter the initial vulnerability feature set by using the false alarm detection model to obtain a vulnerability feature set satisfying a preset condition, including: Based on a second evaluation function in the false alarm detection model, a second correlation value between different initial vulnerability features is calculated to construct a feature association set of the different initial vulnerability features according to the second correlation value; Based on the different initial vulnerability features and the feature association set, an initial clustering subset and other clustering subsets of the feature association set are determined; With the initial clustering subset as a reference, the other clustering subsets are traversed to determine a corresponding remaining feature set and an initial clustering set; Based on the remaining feature set and the initial clustering set, a final clustering set is calculated to determine the vulnerability feature set by using the final clustering set.

4. The method of claim 3, wherein, With the initial clustering subset as a reference, the other clustering subsets are traversed to determine a corresponding remaining feature set and an initial clustering set, including: It is judged whether the initial clustering subset contains at least one other clustering feature in the other clustering subsets; If the initial clustering subset contains at least one other clustering feature, the remaining feature set is determined based on the other clustering features not contained; If the initial clustering subset does not contain the other clustering features, the initial clustering set is determined based on the other clustering subsets corresponding to the other clustering features.

5. The method of claim 3, wherein, The calculation of the corresponding final clustering set based on the remaining feature set and the initial clustering set includes: Based on a first evaluation function in the false alarm detection model, a first correlation value between a remaining feature and a corresponding category feature vector is calculated; The remaining features are sorted according to a first target sorting mode based on the first correlation value to obtain sorted remaining features, and a final remaining feature set is determined according to the sorted remaining features; The final remaining feature set and the initial clustering set are traversed to calculate the effective information of different final remaining features in the initial clustering subset; It is judged whether the effective information satisfies a preset information condition; If the effective information satisfies the preset information condition, the corresponding final remaining feature is added to the corresponding initial clustering subset to obtain a final clustering subset, and the final clustering set is obtained according to the final clustering subset.

6. The method of claim 3, wherein, The determination of the vulnerability feature set by using the final clustering set includes: Based on a first evaluation function in the false alarm detection model, a first correlation value between different clustering features in the final clustering set and corresponding category feature vectors is calculated to sort the different clustering features according to a second target sorting mode based on the first correlation value to obtain a sorted clustering set; Traverse the sorted cluster set, and determine the corresponding initial cluster feature set to calculate the effective information of different sorted cluster features in the initial cluster feature set; Based on the effective information, determine the vulnerability feature set.

7. The method of claim 1, wherein, Before inputting the vulnerability feature set into the pre-constructed retrieval enhancement generation agent, further comprising: Obtain a target vulnerability feature set; Based on the target vulnerability feature set, construct a vector database; Based on the vector database, filter to obtain a target final candidate feature vector; Based on the target final candidate feature vector, construct a large language model; Based on the vector database and the large language model, construct the retrieval enhancement generation agent.

8. The method of claim 7, wherein, The inputting the vulnerability feature set into the pre-constructed retrieval enhancement generation agent, to determine the false positive vulnerability feature set and the non-false positive vulnerability feature set in the vulnerability feature set by using the retrieval enhancement generation agent, and the first processing action corresponding to the false positive vulnerability feature set and the second processing action corresponding to the non-false positive vulnerability feature set, comprises: Based on the vector database in the retrieval enhancement generation agent, determine the index vector corresponding to the vulnerability feature set; With the index vector as the index, filter to obtain the initial candidate feature vector satisfying the preset detection condition from the vector database; Based on the initial candidate feature vector, filter to obtain the final candidate feature vector satisfying the preset similarity condition; Based on the final candidate feature vector, use the large language model in the retrieval enhancement generation agent to determine the false positive vulnerability feature set, the non-false positive vulnerability feature set, the first processing action and the second processing action.

9. An electronic device, comprising: Comprise: Memory, processor and computer program stored on the memory and executable on the processor, the processor executes the program to realize the code vulnerability processing method as claimed in any one of claims 1-8.

Images