Automatic code auditing method and device, computer equipment and storage medium

Abstract

The invention relates to an automatic code auditing method and device, computer equipment and a storage medium. The automatic code auditing method comprises the steps of obtaining a grammar structure, a control flow and a data flow of a to-be-audited code; constructing a context graph of the to-be-audited code according to the grammatical structure, the control flow and the data flow of the to-be-audited code; obtaining a multi-modal collaborative vulnerability detection method, wherein the multi-modal collaborative vulnerability detection method comprises a static analysis method based on rule matching, a symbolic execution method based on a code path, a large model reasoning method based on semantic understanding and weights of the methods; and identifying one or more code vulnerabilities, the vulnerability type of each code vulnerability and the confidence coefficient according to the context graph of the to-be-audited code and the multi-modal collaborative vulnerability detection method. According to the method, the audit codes of various vulnerability types can be processed while the code audit efficiency can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of code audit processing, in particular to an automatic code audit method and device, computer equipment and a storage medium. BACKGROUND

[0002] In the current software development field, code audit is a key link to ensure security and reliability. Traditional audit methods rely on manual audit or rule-based engine tools, but there are the following problems:

[0003] 1. Low efficiency of manual audit: manual audit is time-consuming and labor-intensive, and it is difficult to deal with massive codes;

[0004] 2. Rule-based engine tools: rely on predefined rules, cannot handle logic vulnerabilities, and need to frequently update rule libraries. SUMMARY

[0005] Therefore, it is necessary to provide an automatic code audit method, device, computer equipment and storage medium to solve the above technical problems, which can improve the code audit efficiency and handle various types of audit codes without relying on manual audit or using rule engine for audit processing.

[0006] An automatic code audit method comprises: obtaining the syntax structure, control flow and data flow of the code to be audited; constructing a context graph of the code to be audited according to the syntax structure, control flow and data flow of the code to be audited; obtaining a multi-modal collaborative vulnerability detection method, which includes a rule-based matching static analysis method, a code path-based symbolic execution method and a semantic understanding-based large model reasoning method, and the weights of each method; identifying one or more code vulnerabilities, the vulnerability types of each code vulnerability and the confidence according to the context graph of the code to be audited and the multi-modal collaborative vulnerability detection method; wherein the vulnerability type of each code vulnerability is used to match the vulnerability repair scheme for code repair, the vulnerability repair scheme is used to repair the corresponding code vulnerability, and the confidence of each code vulnerability is used to indicate the repair priority of each code vulnerability.

[0007] In one embodiment, the context graph of the code to be audited is constructed according to the syntax structure, control flow and data flow of the code to be audited, comprising: identifying functions and first variables from the syntax structure of the code to be audited, identifying basic blocks determined by code splitting from the syntax structure of the code to be audited, and identifying second variables from the data flow; merging the functions, first variables, basic blocks and second variables into nodes; merging the multi-dimensional relationships of the control flow and data flow into a graph; and constructing the context graph of the code to be audited according to the merged nodes and the merged graph.

[0008] In one of the embodiments, the automatic code auditing method further comprises: obtaining a historical version code of the code to be audited, determining the attributes of the merged nodes according to the historical version code, and adding attributes to the merged nodes; obtaining a dependency file of the code to be audited, extracting the dependency relationship of the merged nodes from the dependency file, identifying the dependent code of the merged nodes according to the dependency relationship, and constructing the link relationship between the merged nodes and the dependent code; obtaining the log of the runtime of the code to be audited, associating the log to the control flow, and identifying and marking the high-frequency execution path in the control flow through the log, wherein the marked high-frequency execution path is preferentially executed when repairing the code vulnerabilities; constructing the context graph of the code to be audited according to the merged nodes and the merged graph, comprising: constructing the context graph of the code to be audited according to the merged nodes with added attributes and constructed dependency relationship, and the merged graph containing the control flow with the marked high-frequency execution path.

[0009] In one of the embodiments, merging the function, the first variable, the basic block and the second variable into a node comprises: taking the function as a first node, obtaining the variables and the basic blocks associated with the function, and associating the variables and the basic blocks associated with the function to the first node, wherein the associated variables include the first variable and / or the second variable; if the second variable is a local variable, associating the second variable to the first node; if the second variable is a global variable, taking the second variable as a second node; wherein the first node and the second node are different, and the merged node includes the first node and the second node.

[0010] In one of the embodiments, merging the multi-dimensional relationship of the control flow and the data flow into a graph comprises: obtaining the execution frequency of each execution edge in the control flow, determining the weight of the control flow according to the execution frequency of each execution edge in the control flow; calculating the weight of the data flow according to the usage frequency of the variables in the data flow and the cross-module transmission depth; and merging the multi-dimensional relationship of the control flow and the data flow into a graph according to the weight of the control flow and the weight of the data flow.

[0011] In one of the embodiments, the automatic code auditing method further comprises: identifying the repair priority of each code vulnerability according to the confidence degree of each code vulnerability; obtaining the vulnerability repair scheme of each code vulnerability according to the vulnerability type of each code vulnerability; repairing each code vulnerability according to the code repair priority of each code vulnerability and the vulnerability repair scheme of each code vulnerability, and obtaining the audited code after the repair; and generating a code auditing report according to the audited code and the vulnerability type of each code vulnerability.

[0012] In one of the embodiments, the vulnerability repair scheme of each code vulnerability is obtained according to the vulnerability type of each code vulnerability, including: if the vulnerability type of any code vulnerability is the SQL injection type, the corresponding vulnerability repair scheme is the parameterized query repair method; if the vulnerability type of any code vulnerability is the race condition type, the corresponding vulnerability repair scheme is the locking repair method; if the vulnerability type of any code vulnerability is the buffer type, the corresponding vulnerability repair scheme is the repair method based on boundary check and security library construction.

[0013] An automatic code auditing device, comprising: a first obtaining module configured to obtain the syntax structure, control flow and data flow of a code to be audited; a second obtaining module configured to construct a context graph of the code to be audited according to the syntax structure, control flow and data flow of the code to be audited; a third obtaining module configured to obtain a multi-modal collaborative vulnerability detection method, the multi-modal collaborative vulnerability detection method comprising a rule matching based static analysis method, a code path based symbolic execution method and a semantic understanding based large model reasoning method, and the weights of each method; and an identifying module configured to identify one or more code vulnerabilities, the vulnerability type of each code vulnerability and the confidence according to the context graph of the code to be audited and the multi-modal collaborative vulnerability detection method; wherein the vulnerability type of each code vulnerability is used to match a vulnerability repair scheme of code repair, the vulnerability repair scheme is used to repair the corresponding code vulnerability, and the confidence of each code vulnerability is used to indicate the repair priority of each code vulnerability.

[0014] A computer device, comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the steps of the method of any one of the above embodiments when executing the computer program.

[0015] A computer readable storage medium, having a computer program stored thereon, wherein the computer program is executable by a processor to implement the steps of the method of any one of the above embodiments.

[0016] The automatic code auditing method, device, computer device and storage medium described above obtain the syntax structure, control flow and data flow of the code to be audited; construct a context graph of the code to be audited according to the syntax structure, control flow and data flow of the code to be audited; obtain a multi-modal collaborative vulnerability detection method, the multi-modal collaborative vulnerability detection method including a static analysis method based on rule matching, a symbolic execution method based on code path and a large model reasoning method based on semantic understanding and the weights of the methods; identify one or more code vulnerabilities, the vulnerability types of the code vulnerabilities and the confidence levels of the code vulnerabilities according to the context graph of the code to be audited and the multi-modal collaborative vulnerability detection method. The vulnerability types of the code vulnerabilities are used to match vulnerability repair schemes for code repair, the vulnerability repair schemes are used to repair the corresponding code vulnerabilities, and the confidence levels of the code vulnerabilities are used to indicate the repair priorities of the code vulnerabilities. Therefore, complex vulnerabilities that cannot be detected by traditional rule-based engine tools can be detected through the context graph and the multi-modal collaborative vulnerability detection method, and the auditing result provides the vulnerability types and the confidence levels, which can assist the automatic repair of code vulnerabilities and shorten the code vulnerability processing period. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 An application environment diagram of an automatic code auditing method in an embodiment;

[0018] Figure 2 A flowchart of an automatic code auditing method in an embodiment;

[0019] Figure 3 A flowchart of a collaborative processing of a static analysis method, a symbolic execution method and a large model reasoning method in an embodiment;

[0020] Figure 4 A flowchart of an automatic code auditing method in a specific embodiment;

[0021] Figure 5 A structural block diagram of an automatic code auditing device in an embodiment;

[0022] Figure 6 An internal structure diagram of a computer device in an embodiment. DETAILED DESCRIPTION

[0023] In order to make the objects, technical solutions and advantages of the present application clearer, further detailed description will be made to the present application in combination with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0024] An automatic code auditing method provided by the present application is applied in an application environment as shown in Figure 1 The automatic code auditing method provided by the present application is applied in an application environment as shown inFigure 1 As shown, the code audit system 100 is configured to perform an automated code audit method of the present application. Specifically, as shown in Figure 1 As shown, the terminal 200 uploads the code to be audited to the code audit system 100. The code audit system 100 obtains the syntax structure, control flow and data flow of the code to be audited; constructs a context graph of the code to be audited according to the syntax structure, control flow and data flow of the code to be audited; obtains a multi-modal collaborative vulnerability detection method, which includes a rule matching-based static analysis method, a code path-based symbolic execution method and a semantic understanding-based large model reasoning method, and the weights of each method; identifies one or more code vulnerabilities, the vulnerability types of each code vulnerability and the confidence according to the context graph of the code to be audited and the multi-modal collaborative vulnerability detection method; wherein the vulnerability type of each code vulnerability is used to match a vulnerability repair scheme for code repair, the vulnerability repair scheme is used to repair the corresponding code vulnerability, and the confidence of each code vulnerability is used to indicate the repair priority of each code vulnerability. Further, the code audit system 100 can also output the audit result to the terminal 200, i.e., one or more code vulnerabilities of the code to be audited, the vulnerability types of each code vulnerability and the confidence.

[0025] In one embodiment, as shown in Figure 2 An automated code audit method is provided, which is applied to the code audit system 100 in Figure 1 for example. The method includes the following steps:

[0026] S201, obtaining the syntax structure, control flow and data flow of the code to be audited.

[0027] In this embodiment, before the step of obtaining the syntax structure, control flow and data flow of the code to be audited, the automated code audit method further includes: performing code cleaning on the code to be audited to remove comments, log statements, spaces and sensitive codes of the code to be audited, to obtain a first code; performing format standardization processing on the first code to obtain a second code; and parsing the second code through an abstract syntax tree to obtain a parsed sequence code. Further, S201 specifically includes: obtaining the syntax structure, control flow and data flow of the code to be audited from the parsed sequence code.

[0028] First, the purpose of code cleaning is to remove irrelevant interference content and retain the core logic code. For example, remove comments, log statements, useless spaces and sensitive information, etc. Specifically, the implementation scheme is as follows:

[0029] (1) Comment and document removal:

[0030] Regular expression matching: Design matching rules for different languages (such as Python's #, """ in Java / / , / ** / ).

[0031] AST parsing assistance: Directly strip comment nodes through Abstract Syntax Tree (AST) (such as Python's ast module, Java's JavaParser).

[0032] (2) Remove unused code:

[0033] Static code detection: Identify unused variables and functions based on Control Flow Analysis (CFA) (such as the no-unused-vars rule of ESLint).

[0034] Dynamic log filtering: Remove debugging statements such as console.log, System.out.println through pattern matching (keep exception logs).

[0035] Sensitive information desensitization: Use hardcoded credential detection. Specific methods can be: Regular matching password =.*, api_key \ s * = \ s * ["'].* ["'] pattern, replace with placeholder <redacted>.

[0036] Secondly, the goal of format standardization is to unify code style and eliminate the impact of format differences on analysis. For example, eliminate indentation and bracket position. Specifically, the implementation scheme adopts a general formatting tool chain:

[0037] Language-specific tools:

[0038] Python: black or autopep8 enforces PEP8 style;

[0039] Java / C++: clang-format unifies indentation and bracket line breaks;

[0040] JavaScript: prettier configures uniform rules;

[0041] Custom rule engine: rewrite code structure after parsing AST, such as forcing if statement line breaks and uniform indentation to 4 spaces.

[0042] Syntax tree reconstruction: parse non-standard code into AST and regenerate code according to standard rules, such as Python's ast.unparse.

[0043] Furthermore, multi-language adaptation can also be implemented, aiming to support syntax parsing and feature extraction for mainstream programming languages. Specifically, the implementation scheme:

[0044] (1) Language recognition and routing

[0045] File extension detection:.py→Python,.java→Java, etc.

[0046] Code content heuristic judgment: such as def keyword→Python, public class→Java.

[0047] (2) Unified intermediate representation (IR)

[0048] Cross-language AST conversion: convert each language AST to a common IR (such as LLVM IR, custom JSON structure).

[0049] (3) Language-specific processing plugins

[0050] Implement differentiated logic for each language, such as Python decorator processing and Java annotation parsing.

[0051] Finally, after parsing the code snippet through the Abstract Syntax Tree (AST), it is converted into a processable Token sequence, retaining context information such as variable scope and function call relationships.

[0052] In an example, the specific implementation of the above-mentioned obtaining the syntax structure, control flow and data flow of the code to be audited includes:

[0053] 1. Syntax structure: extract static syntax elements of the code, such as variable declaration, function definition, class structure, expression, etc. Implementation: generate hierarchical syntax units through abstract syntax tree (AST) parsing.

[0054] 2. Control flow: analyze the execution path of the code, such as conditional branching, loop, exception handling, etc. Implementation: build control flow graph (CFG), mark basic blocks and jump relationships.

[0055] 3. Data flow: track variable definition and use: such as variable passing, dependency relationship, uninitialized risk, etc. Implementation: build variable life cycle graph through data flow analysis (DFA).

[0056] Specifically, input the code to be audited → AST parsing (syntax structure) → CFG generation (control flow) → data flow analysis.

[0057] S202, according to the syntax structure, control flow and data flow of the code to be audited, build the context graph of the code to be audited.

[0058] In an embodiment, the above-mentioned constructing the context graph of the code to be audited according to the syntax structure, control flow and data flow of the code to be audited includes: identifying functions and first variables from the syntax structure of the code to be audited, identifying basic blocks determined by code splitting from the syntax structure of the code to be audited, and identifying second variables from the data flow; merging the functions, first variables, basic blocks and second variables into nodes; merging the multi-dimensional relationships of the control flow and data flow into a graph; and constructing the context graph of the code to be audited according to the merged nodes and the merged graph.

[0059] Wherein, in an example, before the step of constructing the context graph of the code to be audited according to the merged nodes and the merged graph, it further includes: obtaining the historical version code of the code to be audited, determining the attributes of the merged nodes according to the historical version code, and adding attributes to the merged nodes; obtaining the dependency file of the code to be audited, extracting the dependency relationship of the merged nodes from the dependency file, identifying the dependent code of the merged nodes according to the dependency relationship, and constructing the link relationship between the merged nodes and the dependent code; obtaining the log of the runtime of the code to be audited, associating the log to the control flow, and identifying and marking the high-frequency execution path in the control flow through the log, wherein the marked high-frequency execution path is preferentially executed in the code vulnerability repair; wherein, according to the merged nodes and the merged graph, constructing the context graph of the code to be audited includes: constructing the context graph of the code to be audited according to the merged nodes with added attributes and constructed dependency relationship, and the merged graph containing the control flow with the marked high-frequency execution path.

[0060] In one embodiment, the merging the function, the first variable, the basic block and the second variable into the node comprises: taking the function as a first node, obtaining variables and basic blocks associated with the function, and associating the variables and the basic blocks associated with the function to the first node, the associated variables comprising the first variable and / or the second variable; if the second variable is a local variable, associating the second variable to the first node; if the second variable is a global variable, taking the second variable as a second node; wherein the first node and the second node are different, and the merged node comprises the first node and the second node.

[0061] In one embodiment, the merging the multi-dimensional relationship of the control flow and the data flow into the graph comprises: obtaining execution frequencies of each execution edge in the control flow, determining weights of the control flow according to the execution frequencies of each execution edge in the control flow; calculating weights of the data flow according to usage times and cross-module transmission depths of variables in the data flow; and merging the multi-dimensional relationship of the control flow and the data flow into the graph according to the weights of the control flow and the weights of the data flow.

[0062] First, input the code file (such as service.py) to be audited, the version history (Git log), the dependency file (such as requirements.txt), and the runtime log (such as the Kafka message). Extract the static context through the syntax structure, extract the dynamic execution path through the control flow, and track the variable life cycle through the data flow.

[0063] The processing procedure of extracting the static context through the syntax structure comprises:

[0064] AST parsing: extract static elements such as function / class definition, interface signature, and global variable.

[0065] Static context labeling: map the code elements to entity nodes in the graph, and attach language feature labels such as the @Transactional annotation.

[0066] Among them, the association of the syntax structure and the historical version code: code change analysis, associate function modification records through the Git blame information, and mark high-frequency change nodes as "unstable entities".

[0067] The processing procedure of extracting the dynamic execution path through the control flow comprises:

[0068] CFG generation: split the code into basic blocks (Basic Block), and connect the jump logic with the directed edge.

[0069] Dynamic context enhancement: convert the control flow path into a relationship edge in the graph, and mark the condition constraint.

[0070] Among them, the association of control flow and runtime logs: path coverage verification, combined with the DEBUG[path:block_C] information in the log, mark the actual high-frequency execution path as "hot path" ("hot_path": true).

[0071] The process of tracking the variable life cycle through data flow:

[0072] Def-Use Chain analysis: track the whole process of variable from definition to use, and identify cross-function transmission.

[0073] Data dependency modeling: add data flow edges to the graph and mark the transmission direction.

[0074] Association of data flow and dependency relationship: cross-module data flow. If variable x is finally transmitted to a third-party library, such as requests.post(x), link to the API node of the library in the graph, and mark the security risk, such as "potential_SSRF": true.

[0075] Secondly, build the context graph, including the following operations:

[0076] Node merging: merge the entities of syntax structure (function / variable), control flow (basic block), and data flow (variable) into unified nodes, and eliminate redundancy.

[0077] Relationship integration: control flow edges (ControlFlow) and data flow edges (DataFlow) coexist, forming a multi-dimensional relationship network.

[0078] External context injection: add last_modified and author attributes to nodes through historical version code. Add library nodes (such as MySQL) through dependency relationships and link to the code nodes that call it. Add execution_count and avg_latency performance indicators to edges through runtime logs.

[0079] Among them, the context graph constructed is stored using the Neo4j graph database, which supports efficient queries such as finding all code paths that call unencrypted APIs.

[0080] Specifically, the specific operation of building the context graph above is:

[0081] 1. Node merging (Node Merging)

[0082] Merge syntax structure, control flow, and data flow entities into unified nodes to eliminate redundant information while retaining multi-dimensional features. Merge rules and implementation:

[0083]

[0084]

[0085] De-duplication algorithm (Example)

[0086]

[0087] 2. Relationship Integration

[0088] Integrate multi-dimensional relationships like control flow, data flow, etc. into a unified graph, supporting complex queries.

[0089]

[0090] Example: Cross-language Relationship Integration

[0091] / / Control flow and data flow coexistence query

[0092] MATCH(func:Function)-[:HAS_CONTROL_FLOW]->(block{branch_type:"if"})

[0093] WHERE EXISTS{(block)-[:HAS_DATA_FLOW{direction:"forward"}]->(var)}

[0094] RETURN func.name,block.condition,var.name

[0095] Dynamic weight calculation:

[0096] Control flow edge weight: dynamically adjust based on execution frequency (log statistics), such as weight = log(execution_count + 1).

[0097] Data flow edge weight: calculate based on variable usage frequency and cross-module transmission depth, such as weight = 1 + 0.5 * depth.

[0098] 3. External Context Enrichment

[0099] 3.1 Version history injection

[0100] Data association: associate commit hashes to code lines through Git's blame information, calculate modification frequency and recent change time.

[0101] Example attributes:

[0102]

[0103] Impact Analysis: Nodes with high frequency of modification are marked as unstable, increasing sensitivity during vulnerability detection.

[0104] 3.2 Dependency Injection

[0105] Dependency Resolution: Parse pom.xml / requirements.txt, build dependency tree and map to graph:

[0106]

[0107] Security Enhancement: Associate with CVE database, mark dependent versions with vulnerabilities (e.g. Redis-6.2 has CVE-2021-32761).

[0108] 3.3 Runtime Log Injection

[0109] Log Association: Use distributed trace ID (e.g. OpenTelemetry's trace_id) to associate logs to control flow edges:

[0110]

[0111] Hot Path Marking:

[0112] Mark paths with execution_count > 1000 as hot_path, prioritize optimization.

[0113] 4. Complete Graph Generation Example

[0114] Input code snippet:

[0115]

[0116] Version History: Last modified by Alice, modification count 3.

[0117] Runtime Log: This function has an average execution time of 50ms and an error rate of 1%.

[0118] Graph Output (Neo4j Cypher)

[0119]

[0120]

[0121] S203, obtain a multi-modal collaborative vulnerability detection method, the multi-modal collaborative vulnerability detection method includes a rule matching-based static analysis method, a code path-based symbolic execution method, a semantic understanding-based large model reasoning method and weights of each method.

[0122] In this embodiment, a multi-modal collaborative vulnerability detection method is pre-configured. The multi-modal collaborative vulnerability detection method includes a static analysis method based on rule matching, a symbolic execution method based on code path, a large model reasoning method based on semantic understanding, and the weights of each method. The multi-modal collaborative vulnerability detection method detects code vulnerabilities of the code to be audited through the cooperation of each method.

[0123] Among them, the static analysis method detects known code vulnerability patterns based on a rule engine, such as code vulnerabilities of hard-coded passwords and code vulnerabilities of SQL splicing. The symbolic execution method uses a program symbolic execution engine to simulate code path execution to discover potential code logic vulnerabilities, such as code vulnerabilities of race conditions and code vulnerabilities of integer overflow. The large model reasoning method uses a large model to process the input code to be audited and the context graph, and outputs the vulnerability type and confidence score of the code vulnerability. The results of each method are fused by a weighted algorithm to comprehensively determine the final code vulnerability. For example, the weight of the static analysis method is 0.3, the weight of the symbolic execution method is 0.2, and the weight of the large model reasoning method is 0.5.

[0124] The processing logic of the static analysis method is to process the syntax structure, control flow, data flow, nodes and relationships of the context graph based on pre-defined rules to quickly detect known code vulnerability patterns. For example, the pre-defined rules use tools such as Semgrep and CodeQL to define rules through a vulnerability rule library, and extract code snippets that match the rule patterns from the context graph. The variables are tracked across functions through the edges of the data flow, such as user input passing from the API layer to the DAO layer. Finally, the marked vulnerability location, vulnerability type and confidence are output, where the confidence is determined based on the rule matching strength. The index of the context graph can accelerate pattern queries, such as quickly locating all database call nodes. In addition, historical version marked "fixed" nodes can be combined to avoid repeated warnings.

[0125] The processing logic of the symbolic execution method is to dynamically explore the code path based on the control flow path, constraint conditions and variable dependencies in the context graph to discover code logic vulnerabilities such as race conditions and integer overflow. The specific processing steps include:

[0126] Path extraction: Extract key control flow subgraphs such as loops and conditional branches from the context graph.

[0127] Symbolic variables: Replace input variables with symbolic values while preserving constraints.

[0128] Constraint solving: Use an SMT solver to verify the feasibility of the code path and detect boundary condition vulnerabilities.

[0129] Output: unreachable code paths, potential overflow points, and triggered constraints.

[0130] Among them, the above-mentioned symbolic execution method uses the context graph in the following way: load the initial value of the variable from the context graph as a constraint condition. For example, the global configuration MAX_SIZE = 100. Identify external input sources through the edges of the data flow, and mark them as high-risk symbols. For example, x comes from a network request, and x is marked as a high-risk symbol.

[0131] The processing logic of the large model inference method is to identify complex code vulnerabilities that cannot be covered by rules from the complete subgraph of the context graph. The complete subgraph of the context graph includes code fragments + version / dependency / log context, and the complex code vulnerabilities include business logic vulnerabilities. Specifically, the following processing steps are included:

[0132] Subgraph serialization: convert the context graph into a text prompt that the large model can understand.

[0133] The prompt engineering of the large model includes designing targeted problems and model inference. The large model can use the CodeLlama-34B model. For example, design a targeted problem: please analyze the security risks of the following code, and include whether there are concurrency problems and whether there is a lack of key audit logs in combination with its high-frequency modifications and log behaviors. The output structure of the fine-tuned code large model is:

[0134]

[0135]

[0136] Among them, the above-mentioned large model inference method uses the context graph in the following way: extract associated vulnerability history from the context graph, such as the code file to be audited has fixed a race condition vulnerability, which is used as a prompt word for the large model. And feedback the new vulnerability pattern detected by the large model to the rule library of the static analysis method to realize automatic iteration.

[0137] In addition, the above-mentioned static analysis method, symbolic execution method, and large model inference method use three engines for collaborative processing. Combined with Figure 3 As shown, the collaborative processing strategy of the three is that the static analysis method is preferred, the symbolic execution method is used for verification, and the large model inference method is used for completion. Specifically:

[0138] Static analysis method first: quickly filter high-risk nodes such as SQL calls, and narrow the scope of symbolic execution / large model processing.

[0139] Symbolic execution method for verification: in-depth verification of the code paths alarmed by the static analysis method, such as confirming whether SQL injection is reachable.

[0140] The large model inference method is used for completion: semantic reasoning is performed on complex scenarios that cannot be modeled by the symbolic execution method, such as business logic vulnerability scenarios.

[0141] In addition, the Platt Scaling method can be used to calibrate the output confidence and reduce false positives.

[0142] S204, according to the context graph of the to-be-audited code and the multi-modal collaborative vulnerability detection method, one or more code vulnerabilities, the vulnerability types of each code vulnerability, and the confidence are identified; wherein the vulnerability type of each code vulnerability is used to match the vulnerability repair scheme of code repair, the vulnerability repair scheme is used to repair the corresponding code vulnerability, and the confidence of each code vulnerability is used to indicate the repair priority of each code vulnerability.

[0143] In one embodiment, after the above step S204, it further includes: identifying the repair priority of each code vulnerability according to the confidence of each code vulnerability; obtaining the vulnerability repair scheme of each code vulnerability according to the vulnerability type of each code vulnerability; repairing each code vulnerability according to the code repair priority of each code vulnerability and the vulnerability repair scheme of each code vulnerability, and obtaining the audited code after repair; and generating a code audit report according to the audited code and the vulnerability type of each code vulnerability.

[0144] Among them, the above-mentioned obtaining the vulnerability repair scheme of each code vulnerability according to the vulnerability type of each code vulnerability includes: if the vulnerability type of any code vulnerability is SQL injection type, the corresponding vulnerability repair scheme is parameterized query repair method; if the vulnerability type of any code vulnerability is race condition type, the corresponding vulnerability repair scheme is locking repair method; if the vulnerability type of any code vulnerability is buffer type, the corresponding vulnerability repair scheme is a repair method based on boundary check and security library construction.

[0145] For example, as in the above embodiment, the structured results output after the context graph is processed by the static analysis method, the symbolic execution method and the large model inference method are as follows:

[0146]

[0147] Among them, the confidence is used to determine the priority of code vulnerability repair, such as high confidence priority processing. The context is used to generate targeted repair code, such as identifying that order_id needs to be parameterized. The vulnerability type is used to match the predefined repair strategy template, such as SQL injection→parameterized query.

[0148] Specifically, the priority ranking logic is: confidence > 0.9, which needs to be repaired immediately. The confidence belongs to [0.7, 0.9], and it is repaired within 24 hours. The code impact range of the vulnerability code is obtained through context graph analysis, and the call chain breadth and data flow depth of the vulnerability code are determined. The call chain breadth can count all the entrances of the code vulnerability function, such as the number of API interfaces. The data flow depth can check whether the code vulnerability variable is passed to the core module, such as the core module being the payment service module.

[0149] Specifically, the repair steps of the code vulnerability of the code to be audited include:

[0150] Step 1: Obtain the context of the vulnerability

[0151] Directly use the context field containing the code segment and data flow output in the last step to query the supplementary information of the context graph in real time, such as dependent library version and associated test cases.

[0152] Example: If the code vulnerability involves MySQL, check whether the library version in the context graph supports the preprocessor statement.

[0153] Step 2: Matching of vulnerability repair scheme

[0154] Predefine the strategy library of vulnerability repair scheme, and define the vulnerability type, vulnerability repair scheme strategy and applicable language in the strategy library. For example:

[0155]

[0156]

[0159] In addition, the vulnerability repair scheme can also be dynamically expanded. Based on the historical repair records of large model analysis, new vulnerability repair schemes are generated, such as "use Redis distributed lock to replace local lock".

[0160] Step 3: Repair the vulnerability code

[0161] Based on the template of the vulnerability repair scheme, the example is as follows:

[0162] python

[0163] Before repair

[0164] query = f"SELECT * FROM users WHERE id = {user_id}";

[0165] After repair (template filling)

[0166] query="SELECT * FROM users WHERE id=%s"

[0167] cursor.execute(query, (user_id,)) # Parameterized.

[0168] Large model-based vulnerability repair plan:

[0169] Input prompt words:

[0170] text

[0171] Please repair the following SQL injection vulnerability, requirements:

[0172] 1. Use Python's psycopg2 parameterized query

[0173] 2. Preserve the original query semantics

[0174] 3. Add error logs

[0175] Original code:

[0176] query=f'SELECT * FROM orders WHERE id={order_id}'

[0177] Model output:

[0178]

[0179] Step 4: Candidate solution verification

[0180] Compilation / static checking: Ensure that the generated code has no syntax errors.

[0181] Test case association: Extract associated test cases from the context graph, and verify whether the repair passes.

[0182] The following provides a complete process example

[0183] Input code vulnerability:

[0184]

[0185]

[0186] The automatic repair process includes:

[0187] Priority determination: Confidence 0.95 (P0 and impact administrator interface (high risk), determine the highest priority.

[0188] Strategy selection: Match the "SQL injection → parameterized query" vulnerability repair plan.

[0189] Code generation:

[0190] python

[0191] cursor.execute("DELETE FROM users WHERE id=%s",(user_id,))

[0192] Verification and deployment: the associated test test_admin_user_delete passes, a PR is generated and the security team is notified.

[0193] The above-mentioned automatic code auditing and automatic code vulnerability repair method:

[0194] Precise context awareness: the context graph provides complete variable passing, call chain and business label.

[0195] Dynamic vulnerability repair scheme adaptation: adjust the repair rules by combining historical repair and team preferences.

[0196] Closed-loop verification: ensure that the repair does not introduce regression problems through associated test cases.

[0197] Based on the automatic code auditing method provided in each of the above embodiments, combined Figure 4 As shown in the following, a specific description is given:

[0198] First, give a brief description of each part:

[0199] 1. Preprocessing code semantic parsing: use a pre-trained large model such as CodeGPT to perform multi-level semantic analysis on the code to be audited, extract syntax structure, control flow and data flow features.

[0200] 2. Dynamic context modeling: combine historical versions of the code base, dependency relationships and runtime logs to build a dynamic context graph, enhancing the accuracy of vulnerability detection.

[0201] 3. Multi-modal collaborative vulnerability detection engine: integrate static analysis, symbolic execution and large model reasoning to support identification of common vulnerabilities such as SQL injection, XSS, buffer overflow and logical vulnerabilities.

[0202] 4. Generation of adaptive repair recommendations: based on the detection results, automatically generate repair code snippets and provide priority ranking.

[0203] 5. Lightweight deployment interface: embed the development process through REST API or IDE plug-ins, supporting mainstream languages such as Java, Python, C / C++.

[0204] Implementation steps:

[0205] -Step 1: Input and preprocess the code to be audited, clean up irrelevant data and standardize the format;

[0206] - Step 2: Extract semantic features of the code to be audited using a large model, and perform dynamic association analysis in conjunction with the context graph;

[0207] - Step 3: The multimodal collaborative vulnerability detection engine detects vulnerabilities in parallel and outputs confidence scores and detailed reports;

[0208] Step 4: Generate repair suggestions and push them to developers, supporting both manual review and automated repair.

[0209] Among them, the vulnerability detection algorithm in the multimodal collaborative vulnerability detection engine is as follows:

[0210] Python

[0211] defdetect_vulnerability(code_snippet,context_graph):

[0212] #Input: code snippet + context graph

[0213] #Output: Vulnerability list and confidence level

[0214] #Step 1: Static analysis to detect known patterns.

[0215] static_results=static_analyzer.run(code_snippet);

[0216] #Step 2: Symbolic execution explores path constraints.

[0217] symbolic_results=symbolic_executor.simulate(code_snippet);

[0218] #Step 3: Large model reasoning combined with context.

[0219] model_input={"code":code_snippet,"context":context_graph}

[0220] model_output=llm_inference(model_input);

[0221] #Results Fusion and Calibration

[0222] final_results = fusion_policy(static_results, symbolic_results, model_output)

[0223] return calibrate_confidence(final_results).

[0224] Among them, the large model lightweight deployment scheme:

[0225] Model compression: using LoRA (Low Rank Adaptation) technology, reducing model parameter quantity by 70%, adapting to single machine GPU deployment.

[0226] Incremental update: through Online Learning mechanism, regularly inject new vulnerability samples to update model weight.

[0227] The above existing technical advantages

[0228] 1. Deep semantic understanding: large model breaks through the limitations of rule engine, identifies logical vulnerabilities and new attack patterns.

[0229] 2. Dynamic context fusion: historical version and dependency analysis improve vulnerability positioning accuracy.

[0230] 3. Closed-loop repair process: from detection to repair suggestion generation, full-process automation.

[0231] 4. Enterprise-level scalability: support for distributed analysis of 100 billion-level code base (based on Ray framework horizontal expansion).

[0232] It should be understood that although each step in the flowchart is displayed in sequence according to the direction of the arrow, these steps are not necessarily executed in the order indicated by the arrow. Unless otherwise stated in this article, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least part of the steps in the drawing can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily sequential, but can be executed with at least part of other steps or other steps. Sub-steps or stages of the sub-steps or stages are executed in rotation or alternation.

[0233] The present application also provides an automatic code auditing device. As Figure 5 As shown, an automatic code auditing device includes a first acquisition module 501, a second acquisition module 502, a third acquisition module 503, and an identification module 504. The first acquisition module 501 is configured to acquire the syntax structure, control flow, and data flow of the code to be audited. The second acquisition module 502 is configured to construct a context graph of the code to be audited according to the syntax structure, control flow, and data flow of the code to be audited. The third acquisition module 503 is configured to acquire a multi-modal collaborative vulnerability detection method, which includes a rule matching-based static analysis method, a code path-based symbolic execution method, and a semantic understanding-based large model reasoning method, and the weights of the methods. The identification module 504 is configured to identify one or more code vulnerabilities, the vulnerability types of the code vulnerabilities, and the confidence levels of the code vulnerabilities according to the context graph of the code to be audited and the multi-modal collaborative vulnerability detection method. The vulnerability types of the code vulnerabilities are used to match vulnerability repair solutions for code repair, the vulnerability repair solutions are used to repair the corresponding code vulnerabilities, and the confidence levels of the code vulnerabilities are used to indicate the repair priorities of the code vulnerabilities.

[0234] In one of the embodiments, the context graph of the code to be audited is constructed according to the syntax structure, control flow, and data flow of the code to be audited, including: identifying functions and first variables from the syntax structure of the code to be audited, identifying basic blocks determined by code splitting from the syntax structure of the code to be audited, and identifying second variables from the data flow; combining the functions, first variables, basic blocks, and second variables into nodes; combining the multi-dimensional relationships of the control flow and data flow into a graph; and constructing the context graph of the code to be audited according to the combined nodes and combined graph.

[0235] In one of the embodiments, the automatic code auditing device further includes a fourth acquisition module configured to acquire a historical version code of the code to be audited, determine the attributes of the combined nodes according to the historical version code, and add the attributes to the combined nodes; acquire a dependency file of the code to be audited, extract the dependency relationships of the combined nodes from the dependency file, identify the dependent codes of the combined nodes according to the dependency relationships, and construct the linkage relationships between the combined nodes and the dependent codes; acquire logs during the runtime of the code to be audited, associate the logs to the control flow, and identify and mark the paths with high-frequency execution in the control flow through the logs, wherein the marked paths with high-frequency execution are preferentially executed during the repair of the code vulnerabilities; and construct the context graph of the code to be audited according to the combined nodes and combined graph, including: constructing the context graph of the code to be audited according to the combined nodes with added attributes and constructed dependency relationships, and the combined graph containing the control flow with the marked paths with high-frequency execution.

[0236] In one of the embodiments, the function, the first variable, the basic block and the second variable are combined into a node, including: taking the function as a first node, obtaining the variables and the basic block associated with the function, and associating the variables and the basic block associated with the function to the first node, the associated variables including the first variable and / or the second variable; if the second variable is a local variable, associating the second variable to the first node; if the second variable is a global variable, taking the second variable as a second node; wherein the first node and the second node are not the same, and the combined node includes the first node and the second node.

[0237] In one of the embodiments, the multi-dimensional relationship of the control flow and the data flow is combined into a graph, including: obtaining the execution frequency of each execution edge in the control flow, and determining the weight of the control flow according to the execution frequency of each execution edge in the control flow; calculating the weight of the data flow according to the usage frequency and the cross-module transmission depth of the variable in the data flow; and combining the multi-dimensional relationship of the control flow and the data flow into a graph according to the weight of the control flow and the weight of the data flow.

[0238] In one of the embodiments, the automatic code auditing device further includes a generation module configured to identify a repair priority of each code vulnerability according to the confidence of each code vulnerability; obtain a vulnerability repair scheme of each code vulnerability according to the vulnerability type of each code vulnerability; repair each code vulnerability according to the code repair priority of each code vulnerability and the vulnerability repair scheme of each code vulnerability, and obtain an audited code after the repair; and generate a code auditing report according to the audited code and the vulnerability type of each code vulnerability.

[0239] In one of the embodiments, the vulnerability repair scheme of each code vulnerability is obtained according to the vulnerability type of each code vulnerability, including: if the vulnerability type of any code vulnerability is a SQL injection type, the corresponding vulnerability repair scheme is a parameterized query repair method; if the vulnerability type of any code vulnerability is a race condition type, the corresponding vulnerability repair scheme is a locking repair method; and if the vulnerability type of any code vulnerability is a buffer type, the corresponding vulnerability repair scheme is a repair method based on boundary check and security library construction.

[0240] The specific limitations of the automatic code auditing device can be referred to the limitations of the automatic code auditing method in the foregoing, and will not be repeated here. Each module in the automatic code auditing device can be realized by software, hardware and a combination thereof in whole or in part. Each module can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so as to be called and executed by the processor to perform the operations corresponding to each module.

[0241] In one embodiment, a computer device is provided, which can be a server, and an internal structure diagram of the computer device can be as shown in Figure 6 As shown in the figure. The computer device includes a processor, a memory, a network interface and a database connected by a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store the code to be audited. The network interface of the computer device is used to communicate with the external terminal through the network connection. The computer program is executed by the processor to implement an automatic code auditing method.

[0242] Those skilled in the art can understand that, Figure 6 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0243] In one embodiment, a computer device is provided, comprising a memory, a processor and a computer program stored on the memory and executable on the processor, and the processor executes the computer program to implement the following steps: obtaining the syntax structure, control flow and data flow of the code to be audited; constructing a context graph of the code to be audited according to the syntax structure, control flow and data flow of the code to be audited; obtaining a multi-modal collaborative vulnerability detection method, the multi-modal collaborative vulnerability detection method including a rule-based matching static analysis method, a code path-based symbolic execution method and a semantic understanding-based large model reasoning method, and the weight of each method; identifying one or more code vulnerabilities, the vulnerability type of each code vulnerability and the confidence according to the context graph of the code to be audited and the multi-modal collaborative vulnerability detection method; wherein the vulnerability type of each code vulnerability is used to match a vulnerability repair scheme for code repair, the vulnerability repair scheme is used to repair the corresponding code vulnerability, and the confidence of each code vulnerability is used to indicate the repair priority of each code vulnerability.

[0244] In one embodiment, when the processor executes the computer program to implement the step of constructing the context graph of the code to be audited according to the syntax structure, control flow and data flow of the code to be audited, the following steps are implemented: identifying a function and a first variable from the syntax structure of the code to be audited, identifying a basic block determined by code splitting from the code to be audited, and identifying a second variable from the data flow; merging the function, the first variable, the basic block and the second variable into a node; merging the multi-dimensional relationship of the control flow and the data flow into a graph; and constructing the context graph of the code to be audited according to the merged node and the merged graph.

[0245] In one of the embodiments, the processor, when executing the computer program, further implements the following steps: obtaining a historical version code of the to-be-audited code, determining the attributes of the merged nodes according to the historical version code, and adding the attributes to the merged nodes; obtaining a dependency file of the to-be-audited code, extracting the dependency relationship of the merged nodes from the dependency file, identifying the dependent code of the merged nodes according to the dependency relationship, and constructing the link relationship between the merged nodes and the dependent code; obtaining the log of the runtime of the to-be-audited code, associating the log to the control flow, and identifying and marking the high-frequency execution path in the control flow through the log, wherein the marked high-frequency execution path is preferentially executed when repairing the code vulnerabilities; wherein the processor, when executing the computer program to implement the above step of constructing the context graph of the to-be-audited code according to the merged nodes and the merged graph, specifically implements the following steps: constructing the context graph of the to-be-audited code according to the merged nodes with added attributes and constructed dependency relationship, and the merged graph containing the control flow with the marked high-frequency execution path.

[0246] In one of the embodiments, the processor, when executing the computer program to implement the above step of merging the function, the first variable, the basic block and the second variable into the node, specifically implements the following steps: taking the function as a first node, obtaining the variables and the basic blocks associated with the function, and associating the variables and the basic blocks associated with the function to the first node, wherein the associated variables include the first variable and / or the second variable; if the second variable is a local variable, associating the second variable to the first node; if the second variable is a global variable, taking the second variable as a second node; wherein the first node and the second node are different, and the merged node includes the first node and the second node.

[0247] In one of the embodiments, the processor, when executing the computer program to implement the above step of merging the multi-dimensional relationship of the control flow and the data flow into the graph, specifically implements the following steps: obtaining the execution frequency of each execution edge in the control flow, determining the weight of the control flow according to the execution frequency of each execution edge in the control flow; calculating the weight of the data flow according to the usage frequency of the variables in the data flow and the cross-module transmission depth; and merging the multi-dimensional relationship of the control flow and the data flow into the graph according to the weight of the control flow and the weight of the data flow.

[0248] In one of the embodiments, the processor, when executing the computer program, further implements the following steps: identifying the repair priority of each code vulnerability according to the confidence degree of each code vulnerability; obtaining the vulnerability repair scheme of each code vulnerability according to the vulnerability type of each code vulnerability; repairing each code vulnerability according to the code repair priority of each code vulnerability and the vulnerability repair scheme of each code vulnerability, and obtaining the audited code after the repair; and generating a code audit report according to the audited code and the vulnerability type of each code vulnerability.

[0249] In one of the embodiments, when the processor executes the computer program to implement the step of obtaining the vulnerability repair scheme of each code vulnerability according to the vulnerability type of each code vulnerability, the following steps are implemented: if the vulnerability type of any code vulnerability is the SQL injection type, the corresponding vulnerability repair scheme is the parameterized query repair method; if the vulnerability type of any code vulnerability is the race condition type, the corresponding vulnerability repair scheme is the locking repair method; if the vulnerability type of any code vulnerability is the buffer type, the corresponding vulnerability repair scheme is the repair method based on boundary check and secure library construction.

[0250] In one of the embodiments, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program. When the computer program is executed by a processor, the following steps are implemented: obtaining the syntax structure, control flow and data flow of the to-be-audited code; constructing a context graph of the to-be-audited code according to the syntax structure, control flow and data flow of the to-be-audited code; obtaining a multi-modal collaborative vulnerability detection method, the multi-modal collaborative vulnerability detection method including a rule matching based static analysis method, a code path based symbolic execution method and a semantic understanding based large model reasoning method and weights of each method; identifying one or more code vulnerabilities, a vulnerability type of each code vulnerability and a confidence level according to the context graph of the to-be-audited code and the multi-modal collaborative vulnerability detection method; wherein the vulnerability type of each code vulnerability is used to match a vulnerability repair scheme of code repair, the vulnerability repair scheme is used to repair the corresponding code vulnerability, and the confidence level of each code vulnerability is used to indicate a repair priority of each code vulnerability.

[0251] In one of the embodiments, when the computer program is executed by the processor to implement the step of constructing the context graph of the to-be-audited code according to the syntax structure, control flow and data flow of the to-be-audited code, the following steps are implemented: identifying a function and a first variable from the syntax structure of the to-be-audited code, identifying a basic block determined by code splitting from the to-be-audited code, and identifying a second variable from the data flow; combining the function, the first variable, the basic block and the second variable into a node; combining the multi-dimensional relationship of the control flow and the data flow into a graph; and constructing the context graph of the to-be-audited code according to the combined node and the combined graph.

[0252] In one of the embodiments, the computer program, when executed by the processor, further implements the following steps: obtaining a historical version of the code to be audited, determining the attributes of the merged nodes according to the historical version of the code, and adding the attributes to the merged nodes; obtaining a dependent file of the code to be audited, extracting the dependency relationship of the merged nodes from the dependent file, identifying the dependent code of the merged nodes according to the dependency relationship, and constructing the link relationship between the merged nodes and the dependent code; obtaining the log of the runtime of the code to be audited, associating the log to the control flow, and identifying and marking the high-frequency execution path in the control flow through the log, wherein the marked high-frequency execution path is preferentially executed when repairing the code vulnerabilities; wherein the computer program, when executed by the processor to implement the above-mentioned step of constructing the context graph of the code to be audited according to the merged nodes and the merged graph, specifically implements the following steps: constructing the context graph of the code to be audited according to the merged nodes with added attributes and constructed dependency relationship, and the merged graph containing the control flow with the marked high-frequency execution path.

[0253] In one of the embodiments, the computer program, when executed by the processor to implement the above-mentioned step of merging the function, the first variable, the basic block, and the second variable into the node, specifically implements the following steps: taking the function as the first node, obtaining the variables and the basic blocks associated with the function, and associating the variables and the basic blocks associated with the function to the first node, wherein the associated variables include the first variable and / or the second variable; if the second variable is a local variable, associating the second variable to the first node; if the second variable is a global variable, taking the second variable as the second node; wherein the first node and the second node are different, and the merged node includes the first node and the second node.

[0254] In one of the embodiments, the computer program, when executed by the processor to implement the above-mentioned step of merging the multi-dimensional relationship of the control flow and the data flow into the graph, specifically implements the following steps: obtaining the execution frequency of each execution edge in the control flow, determining the weight of the control flow according to the execution frequency of each execution edge in the control flow; calculating the weight of the data flow according to the usage frequency of the variables in the data flow and the cross-module transmission depth; and merging the multi-dimensional relationship of the control flow and the data flow into the graph according to the weight of the control flow and the weight of the data flow.

[0255] In one of the embodiments, the computer program, when executed by the processor, further implements the following steps: identifying the repair priority of each code vulnerability according to the confidence degree of each code vulnerability; obtaining the vulnerability repair scheme of each code vulnerability according to the vulnerability type of each code vulnerability; repairing each code vulnerability according to the code repair priority of each code vulnerability and the vulnerability repair scheme of each code vulnerability, and obtaining the audited code after the repair; and generating a code audit report according to the audited code and the vulnerability type of each code vulnerability.

[0256] In one of the embodiments, when the computer program is executed by the processor to implement the above-mentioned step of obtaining the vulnerability repair scheme of each code vulnerability according to the vulnerability type of each code vulnerability, the following steps are specifically implemented: if the vulnerability type of any code vulnerability is the SQL injection type, the corresponding vulnerability repair scheme is the parameterized query repair method; if the vulnerability type of any code vulnerability is the race condition type, the corresponding vulnerability repair scheme is the locking repair method; and if the vulnerability type of any code vulnerability is the buffer type, the corresponding vulnerability repair scheme is the repair method based on boundary check and secure library construction.

[0257] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware, and the computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, the processes of the above-mentioned embodiments can be included. Any reference to memory, storage, database or other medium used in the embodiments provided in the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0258] The technical features of the above embodiments can be combined in any manner. To make the description concise, all possible combinations of the technical features in the above embodiments are not described, but as long as the combinations of the technical features do not contradict, they should be considered as the scope of the present disclosure.

[0259] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, some modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of the patent of the present application should be subject to the appended claims.< / redacted>

Claims

1. An automated code audit method, characterized by, The method comprises: acquiring the syntax structure, control flow and data flow of the code to be audited; constructing a context graph of the code to be audited according to the syntax structure, control flow and data flow of the code to be audited; acquiring a multi-modal collaborative vulnerability detection method, wherein the multi-modal collaborative vulnerability detection method comprises a static analysis method based on rule matching, a symbolic execution method based on code path, a large model reasoning method based on semantic understanding and the weights of each method; identifying one or more code vulnerabilities, the vulnerability types of each code vulnerability and the confidence level according to the context graph of the code to be audited and the multi-modal collaborative vulnerability detection method; wherein the vulnerability type of each code vulnerability is used to match a vulnerability repair scheme for code repair, the vulnerability repair scheme is used to repair the corresponding code vulnerability, and the confidence level of each code vulnerability is used to indicate the repair priority of each code vulnerability.

2. The method of claim 1, wherein, The construction of the context graph of the code to be audited according to the syntax structure, control flow and data flow of the code to be audited comprises: identifying functions and first variables from the syntax structure of the code to be audited, identifying basic blocks determined by code splitting from the syntax structure of the code to be audited, and identifying second variables from the data flow; combining the functions, first variables, basic blocks and second variables into nodes; combining the multi-dimensional relationship of the control flow and the data flow into a graph; constructing the context graph of the code to be audited according to the combined nodes and the combined graph.

3. The method of claim 2, wherein, The method further comprises: acquiring the historical version code of the code to be audited, determining the attributes of the combined nodes according to the historical version code, and adding the attributes to the combined nodes; acquiring the dependency file of the code to be audited, extracting the dependency relationship of the combined nodes from the dependency file, identifying the dependent code of the combined nodes according to the dependency relationship, and constructing the linkage relationship between the combined nodes and the dependent code; acquiring the log of the runtime of the code to be audited, associating the log to the control flow, and identifying and marking the high-frequency execution path in the control flow through the log, wherein the marked high-frequency execution path is preferentially executed in code vulnerability repair; The construction of the context graph of the code to be audited according to the combined nodes and the combined graph comprises: constructing the context graph of the code to be audited according to the combined nodes with added attributes and constructed dependency relationship, and the combined graph containing the control flow with the marked high-frequency execution path.

4. The method according to claim 2 or 3, characterized in that, The combination of the functions, first variables, basic blocks and second variables into nodes comprises: taking the function as a first node, acquiring the variables and basic blocks associated with the function, and associating the variables and basic blocks associated with the function to the first node, wherein the associated variables include the first variables and / or the second variables; if the second variable is a local variable, then associating the second variable to the first node; if the second variable is a global variable, then taking the second variable as a second node; The first node and the second node are different, and the merged node includes the first node and the second node.

5. The method according to claim 2 or 3, characterized in that, The merging of the multi-dimensional relationship between the control flow and the data flow into a graph includes: An execution frequency of each execution edge in the control flow is obtained, and a weight of the control flow is determined according to the execution frequency of each execution edge in the control flow; A weight of the data flow is calculated according to a usage frequency of a variable in the data flow and a cross-module transmission depth; The multi-dimensional relationship between the control flow and the data flow is merged into a graph according to the weight of the control flow and the weight of the data flow.

6. The method of claim 1, wherein, The method further includes: A repair priority of each code vulnerability is identified according to the confidence of each code vulnerability; A vulnerability repair scheme of each code vulnerability is obtained according to the vulnerability type of each code vulnerability; Each code vulnerability is repaired according to the code repair priority of each code vulnerability and the vulnerability repair scheme of each code vulnerability, and an audited code is obtained after the repair; A code audit report is generated according to the audited code and the vulnerability type of each code vulnerability.

7. The method of claim 6, wherein, The obtaining of the vulnerability repair scheme of each code vulnerability according to the vulnerability type of each code vulnerability includes: If the vulnerability type of any code vulnerability is an SQL injection type, the corresponding vulnerability repair scheme is a parameterized query repair method; If the vulnerability type of any code vulnerability is a race condition type, the corresponding vulnerability repair scheme is a locking repair method; If the vulnerability type of any code vulnerability is a buffer type, the corresponding vulnerability repair scheme is a repair method based on boundary check and security library construction.

8. An automated code audit apparatus, characterized by, The device includes: A first obtaining module configured to obtain a syntax structure, a control flow and a data flow of a code to be audited; A second obtaining module configured to construct a context graph of the code to be audited according to the syntax structure, the control flow and the data flow of the code to be audited; A third obtaining module configured to obtain a multi-modal collaborative vulnerability detection method, the multi-modal collaborative vulnerability detection method including a static analysis method based on rule matching, a symbolic execution method based on code path and a large model reasoning method based on semantic understanding, and weights of the methods; An identifying module configured to identify one or more code vulnerabilities, a vulnerability type of each code vulnerability and a confidence according to the context graph of the code to be audited and the multi-modal collaborative vulnerability detection method. The vulnerability type of each code vulnerability is used to match a vulnerability repair scheme for code repair, the vulnerability repair scheme is used to repair the corresponding code vulnerability, and the confidence of each code vulnerability is used to indicate a repair priority of each code vulnerability.

9. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the steps of the method in any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 7.

Images