An automated code audit method, device, computer equipment and storage medium

Abstract

The application relates to an automatic code auditing method and device, computer equipment and a storage medium, comprising the following steps: obtaining the syntax structure, control flow and data flow of a code to be audited; constructing a context graph of the code to be audited according to the syntax structure, control flow and data flow of the code to be audited; obtaining a multi-modal collaborative vulnerability detection method, wherein the multi-modal collaborative vulnerability detection method comprises a static analysis method based on rule matching, a symbolic execution method based on a code path and a large model reasoning method based on semantic understanding, and the weights of the methods; and identifying one or more code vulnerabilities, the vulnerability types of the code vulnerabilities and the confidence according to the context graph of the code to be audited and the multi-modal collaborative vulnerability detection method. The method can improve the code auditing efficiency and process auditing codes of various vulnerability types.

Description

Technical Field

[0001] This application relates to the field of code auditing processing technology, and in particular to an automated code auditing method, apparatus, computer equipment, and storage medium. Background Technology

[0002] In the current software development field, code auditing is a crucial step in ensuring security and reliability. Traditional auditing methods rely on manual auditing or rule-based engine tools, but these methods suffer from the following problems:

[0003] 1. Manual auditing is inefficient: Manual auditing is time-consuming and labor-intensive, and it is difficult to handle massive amounts of code;

[0004] 2. Rule-based engine tools: rely on predefined rules, cannot handle logical loopholes, and require frequent updates to the rule base. Summary of the Invention

[0005] Therefore, it is necessary to provide an automated code auditing method, device, computer equipment, and storage medium to address the aforementioned technical problems. This method eliminates the need for manual auditing and rule engines, thereby improving code auditing efficiency and handling audit code with various vulnerability types.

[0006] An automated code auditing method includes: acquiring the syntax structure, control flow, and data flow of the code to be audited; constructing a context graph of the code to be audited based on the syntax structure, control flow, and data flow; acquiring a multimodal collaborative vulnerability detection method, which includes a rule-matching-based static analysis method, a code path-based symbolic execution method, and a semantic understanding-based large-model inference method, as well as the weights of each method; identifying one or more code vulnerabilities, the vulnerability type of each vulnerability, and the confidence level based on the context graph of the code to be audited and the multimodal collaborative vulnerability detection method; wherein, the vulnerability type of each vulnerability is used to match a vulnerability remediation scheme for code repair, the vulnerability remediation scheme is used to repair the corresponding code vulnerability, and the confidence level of each vulnerability is used to indicate the remediation priority of each vulnerability.

[0007] In one embodiment, constructing a context graph of the code to be audited based on its syntax structure, control flow, and data flow includes: identifying functions and a first variable from the syntax structure of the code to be audited; identifying basic blocks determined by code splitting from the code to be audited; and identifying a second variable from the data flow; merging functions, the first variable, the basic blocks, and the second variable into nodes; merging the multidimensional relationships between control flow and data flow into a graph; and constructing a context graph of the code to be audited based on the merged nodes and the merged graph.

[0008] In one embodiment, an automated code auditing method further includes: obtaining historical version code of the code to be audited, determining the attributes of the merged nodes based on the historical version code, and adding attributes to the merged nodes; obtaining the dependency files of the code to be audited, extracting the dependency relationships of the merged nodes from the dependency files, identifying the dependent code of the merged nodes based on the dependency relationships, and constructing the link relationship between the merged nodes and the dependent code; obtaining the runtime logs of the code to be audited, associating the logs with the control flow, and identifying and marking frequently executed paths in the control flow through the logs, wherein the marked frequently executed paths are executed first when code vulnerabilities are fixed; and constructing a context graph of the code to be audited based on the merged nodes and the merged graph, including: constructing the context graph of the code to be audited based on the merged nodes with added attributes and constructed dependency relationships, and the merged graph of the control flow containing the marked frequently executed paths.

[0009] In one embodiment, merging the function, the first variable, the basic block, and the second variable into a node includes: using the function as the first node, obtaining the variables and basic blocks associated with the function, and associating the variables and basic blocks associated with the function to the first node, wherein the associated variables include the first variable and / or the second variable; if the second variable is a local variable, then associating the second variable to the first node; if the second variable is a global variable, then using the second variable as the second node; wherein the first node and the second node are different, and the merged node includes both the first node and the second node.

[0010] In one embodiment, the multidimensional relationship between control flow and data flow is merged into a graph, including: obtaining the execution frequency of each execution edge in the control flow, determining the weight of the control flow based on the execution frequency of each execution edge in the control flow; calculating the weight of the data flow based on the number of times variables are used and the cross-module transfer depth in the data flow; and merging the multidimensional relationship between control flow and data flow into a graph based on the weight of the control flow and the weight of the data flow.

[0011] In one embodiment, an automated code auditing method further includes: identifying the remediation priority of each code vulnerability based on the confidence level of each vulnerability; obtaining a vulnerability remediation plan for each code vulnerability based on the vulnerability type of each vulnerability; remediating each code vulnerability based on the code remediation priority and the vulnerability remediation plan of each vulnerability, and obtaining audit code after remediation; and generating a code audit report based on the audit code and the vulnerability type of each vulnerability.

[0012] In one embodiment, a vulnerability remediation plan is obtained for each code vulnerability based on its vulnerability type, including: if any code vulnerability is of the SQL injection type, the corresponding vulnerability remediation plan is a parameterized query remediation method; if any code vulnerability is of the race condition type, the corresponding vulnerability remediation plan is a locking remediation method; if any code vulnerability is of the buffer type, the corresponding vulnerability remediation plan is a remediation method based on boundary checks and security library construction.

[0013] An automated code auditing device includes: a first acquisition module for acquiring the syntax structure, control flow, and data flow of the code to be audited; a second acquisition module for constructing a context graph of the code to be audited based on the syntax structure, control flow, and data flow; a third acquisition module for acquiring a multimodal collaborative vulnerability detection method, which includes a rule-matching-based static analysis method, a code path-based symbolic execution method, and a semantic understanding-based large-model inference method, as well as the weights of each method; and an identification module for identifying one or more code vulnerabilities, the vulnerability type of each vulnerability, and the confidence level based on the context graph of the code to be audited and the multimodal collaborative vulnerability detection method; wherein the vulnerability type of each vulnerability is used to match a vulnerability remediation scheme for code repair, the vulnerability remediation scheme is used to repair the corresponding code vulnerability, and the confidence level of each vulnerability is used to indicate the remediation priority of each vulnerability.

[0014] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of any of the methods described above.

[0015] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the methods described above.

[0016] The aforementioned automated code auditing method, apparatus, computer equipment, and storage medium acquire the syntax structure, control flow, and data flow of the code to be audited; construct a context graph of the code to be audited based on the syntax structure, control flow, and data flow; acquire a multimodal collaborative vulnerability detection method, which includes a rule-matching-based static analysis method, a code path-based symbolic execution method, and a semantic understanding-based large-model inference method, as well as the weights of each method; identify one or more code vulnerabilities, the vulnerability type of each vulnerability, and its confidence level based on the context graph and the multimodal collaborative vulnerability detection method; wherein, the vulnerability type of each vulnerability is used to match a vulnerability remediation scheme for code repair, the vulnerability remediation scheme is used to repair the corresponding vulnerability, and the confidence level of each vulnerability is used to indicate the remediation priority of each vulnerability. Therefore, by using the context graph and the multimodal collaborative vulnerability detection method, complex vulnerabilities that traditional rule-based engine tools cannot detect can be detected, and the audit results provide vulnerability types and confidence levels, which can assist in the automated remediation of code vulnerabilities and shorten the code vulnerability processing cycle. Attached Figure Description

[0017] Figure 1 This is a diagram illustrating the application environment of an automated code auditing method in one embodiment.

[0018] Figure 2 This is a flowchart illustrating an automated code auditing method in one embodiment;

[0019] Figure 3 This is a schematic diagram illustrating the collaborative processing of static analysis method, symbolic execution method and large model inference method in one embodiment;

[0020] Figure 4 This is a flowchart illustrating an automated code auditing method in a specific embodiment;

[0021] Figure 5 A structural block diagram of an automated code auditing device in one embodiment;

[0022] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0024] This application provides an automated code auditing method, applicable to, for example... Figure 1 The application environment shown. For example... Figure 1 As shown, the code auditing system 100 is used to execute an automated code auditing method according to this application. Specifically, as... Figure 1 As shown, terminal 200 uploads code to be audited to code auditing system 100. Code auditing system 100 obtains the syntax structure, control flow, and data flow of the code to be audited; constructs a context graph of the code to be audited based on the syntax structure, control flow, and data flow; obtains a multimodal collaborative vulnerability detection method, which includes a rule-matching-based static analysis method, a code path-based symbolic execution method, and a semantic understanding-based large-model inference method, as well as the weights of each method; identifies one or more code vulnerabilities, their vulnerability types, and confidence levels based on the context graph and the multimodal collaborative vulnerability detection method; wherein, the vulnerability type of each code vulnerability is used to match a vulnerability remediation scheme for code repair, the vulnerability remediation scheme is used to repair the corresponding code vulnerability, and the confidence level of each code vulnerability is used to indicate the remediation priority of each code vulnerability. Furthermore, code auditing system 100 can also output audit results to terminal 200, namely, one or more code vulnerabilities in the code to be audited, their vulnerability types, and confidence levels.

[0025] In one embodiment, such as Figure 2 As shown, an automated code auditing method is provided, which can be applied to... Figure 1 Taking the code auditing system 100 in China as an example, the following steps are included:

[0026] S201, obtain the syntax structure, control flow, and data flow of the code to be audited.

[0027] In this embodiment, before obtaining the syntax structure, control flow, and data flow of the code to be audited, an automated code auditing method further includes: cleaning the code to be audited to remove comments, log statements, spaces, and sensitive code, obtaining first code; standardizing the format of the first code to obtain second code; and parsing the second code using an abstract syntax tree to obtain parsed sequence code. Furthermore, step S201 specifically includes: obtaining the syntax structure, control flow, and data flow of the code to be audited from the parsed sequence code.

[0028] First, the goal of code cleaning is to remove distracting content irrelevant to code auditing while retaining core logic code. For example, removing comments, log statements, unnecessary spaces, and sensitive information. Specifically, the implementation plan is as follows:

[0029] (1) Comments and document removal:

[0030] Regular expression matching: Design matching rules for different languages ​​(such as # and """ in Python, and / / and / ** / in Java).

[0031] AST parsing aids: Directly extracting comment nodes through an Abstract Syntax Tree (AST) (such as Python's ast module and JavaParser).

[0032] (2) Deletion of useless code:

[0033] Static code analysis: Identifies unused variables and functions based on control flow analysis (CFA) (e.g., using ESLint's no-unused-vars rule).

[0034] Dynamic log filtering: Removes debug statements such as console.log and System.out.println by pattern matching (while retaining exception logs).

[0035] Sensitive information desensitization: Hard-coded credentials are used for detection. Specifically, this can be achieved by using regular expressions to match patterns such as `password=.*` and `api_key\s*=\s*["'].*["']`, replacing them with placeholders. <redacted>.

[0036] Secondly, the goal of format standardization is to unify code style and eliminate the impact of format differences on analysis. For example, eliminate indentation and bracket position. Specifically, the implementation scheme adopts a general formatting tool chain:

[0037] Language-specific tools:

[0038] Python: black or autopep8 enforces PEP8 style;

[0039] Java / C++: clang-format unifies indentation and bracket line breaks;

[0040] JavaScript: prettier configures uniform rules;

[0041] Custom rule engine: rewrite code structure after parsing AST, such as forcing if statement line breaks and uniform indentation to 4 spaces.

[0042] Syntax tree reconstruction: parse non-standard code into AST and regenerate code according to standard rules, such as Python's ast.unparse.

[0043] Furthermore, multi-language adaptation can also be implemented, aiming to support syntax parsing and feature extraction for mainstream programming languages. Specifically, the implementation scheme:

[0044] (1) Language recognition and routing

[0045] File extension detection:.py→Python,.java→Java, etc.

[0046] Code content heuristic judgment: such as def keyword→Python, public class→Java.

[0047] (2) Unified intermediate representation (IR)

[0048] Cross-language AST conversion: convert each language AST to a common IR (such as LLVMIR, custom JSON structure).

[0049] (3) Language-specific processing plugins

[0050] Implement differentiated logic for each language, such as Python decorator processing and Java annotation parsing.

[0051] Finally, after parsing the code snippet through the Abstract Syntax Tree (AST), it is converted into a processable Token sequence, retaining context information such as variable scope and function call relationships.

[0052] In an example, the specific implementation of the above-mentioned obtaining the syntax structure, control flow and data flow of the code to be audited includes:

[0053] 1. Syntax structure: extract static syntax elements of the code, such as variable declaration, function definition, class structure, expression, etc. Implementation: generate hierarchical syntax units through abstract syntax tree (AST) parsing.

[0054] 2. Control flow: analyze the execution path of the code, such as conditional branching, loop, exception handling, etc. Implementation: build control flow graph (CFG), mark basic blocks and jump relationships.

[0055] 3. Data flow: track variable definition and use: such as variable passing, dependency relationship, uninitialized risk, etc. Implementation: build variable life cycle graph through data flow analysis (DFA).

[0056] Specifically, input the code to be audited → AST parsing (syntax structure) → CFG generation (control flow) → data flow analysis.

[0057] S202, according to the syntax structure, control flow and data flow of the code to be audited, build the context graph of the code to be audited.

[0058] In an embodiment, the above-mentioned constructing the context graph of the code to be audited according to the syntax structure, control flow and data flow of the code to be audited includes: identifying functions and first variables from the syntax structure of the code to be audited, identifying basic blocks determined by code splitting from the syntax structure of the code to be audited, and identifying second variables from the data flow; merging the functions, first variables, basic blocks and second variables into nodes; merging the multi-dimensional relationships of the control flow and data flow into a graph; and constructing the context graph of the code to be audited according to the merged nodes and the merged graph.

[0059] Wherein, in an example, before the step of constructing the context graph of the code to be audited according to the merged nodes and the merged graph, it further includes: obtaining the historical version code of the code to be audited, determining the attributes of the merged nodes according to the historical version code, and adding attributes to the merged nodes; obtaining the dependency file of the code to be audited, extracting the dependency relationship of the merged nodes from the dependency file, identifying the dependent code of the merged nodes according to the dependency relationship, and constructing the link relationship between the merged nodes and the dependent code; obtaining the log of the runtime of the code to be audited, associating the log to the control flow, and identifying and marking the high-frequency execution path in the control flow through the log, wherein the marked high-frequency execution path is preferentially executed in the code vulnerability repair; wherein, according to the merged nodes and the merged graph, constructing the context graph of the code to be audited includes: constructing the context graph of the code to be audited according to the merged nodes with added attributes and constructed dependency relationship, and the merged graph containing the control flow with the marked high-frequency execution path.

[0060] In one embodiment, the merging the function, the first variable, the basic block and the second variable into the node comprises: taking the function as a first node, obtaining variables and basic blocks associated with the function, and associating the variables and the basic blocks associated with the function to the first node, the associated variables comprising the first variable and / or the second variable; if the second variable is a local variable, associating the second variable to the first node; if the second variable is a global variable, taking the second variable as a second node; wherein the first node and the second node are different, and the merged node comprises the first node and the second node.

[0061] In one embodiment, the merging the multi-dimensional relationship of the control flow and the data flow into the graph comprises: obtaining execution frequencies of each execution edge in the control flow, determining weights of the control flow according to the execution frequencies of each execution edge in the control flow; calculating weights of the data flow according to usage times and cross-module transmission depths of variables in the data flow; and merging the multi-dimensional relationship of the control flow and the data flow into the graph according to the weights of the control flow and the weights of the data flow.

[0062] First, input the code file (such as service.py) to be audited, the version history (Git log), the dependency file (such as requirements.txt), and the runtime log (such as the Kafka message). Extract the static context through the syntax structure, extract the dynamic execution path through the control flow, and track the variable life cycle through the data flow.

[0063] The processing procedure of extracting the static context through the syntax structure comprises:

[0064] AST parsing: extract static elements such as function / class definition, interface signature, and global variable.

[0065] Static context labeling: map the code elements to entity nodes in the graph, and attach language feature labels such as the @Transactional annotation.

[0066] Among them, the association of the syntax structure and the historical version code: code change analysis, associate function modification records through the Git blame information, and mark high-frequency change nodes as "unstable entities".

[0067] The processing procedure of extracting the dynamic execution path through the control flow comprises:

[0068] CFG generation: split the code into basic blocks (Basic Block), and connect the jump logic with the directed edge.

[0069] Dynamic context enhancement: convert the control flow path into a relationship edge in the graph, and mark the condition constraint.

[0070] Among them, the association between control flow and runtime logs: path coverage verification, combined with the DEBUG[path:block_C] information in the logs, marks the paths that are actually executed frequently as "hot paths" ("hot_path":true).

[0071] The process of tracking the lifecycle of variables through data streams:

[0072] Def-Use Chain Analysis: Tracks the entire process of a variable from definition to use, identifying cross-function passes.

[0073] Data dependency modeling: Add edges for data flow to the graph and label the direction of transmission.

[0074] Data flow and dependency relationships: cross-module data flow. If variable x is ultimately passed to a third-party library, such as requests.post(x), it is linked to the library's API node in the graph and marked with a security risk, such as "potential_SSRF":true.

[0075] Secondly, constructing the context graph involves the following operations:

[0076] Node merging: Merge entities of syntax structure (functions / variables), control flow (basic blocks), and data flow (variables) into a unified node to eliminate redundancy.

[0077] Relationship integration: Control flow edges and data flow edges coexist, forming a multi-dimensional relationship network.

[0078] External context injection: Add `last_modified` and `author` attributes to nodes based on historical code versions. Add library nodes (such as MySQL) based on dependencies and link them to the code nodes that call them. Add performance metrics `execution_count` and `avg_latency` to edges based on runtime logs.

[0079] The constructed context graph is stored using the Neo4j graph database, which supports efficient queries, such as finding all code paths that call unencrypted APIs.

[0080] Specifically, the operations for constructing the context graph described above are as follows:

[0081] 1. Node Merging

[0082] The entities representing syntactic structure, control flow, and data flow are merged into a unified node, eliminating redundant information while preserving multi-dimensional features. Merging rules and implementation:

[0083]

[0084] Redundancy removal algorithm (example)

[0085]

[0086]

[0087] 2. Relationship Integration

[0088] It integrates multi-dimensional relationships such as control flow and data flow into a unified graph, supporting complex queries.

[0089]

[0090] Example: Cross-language relation integration

[0091] / / Query with both control flow and data flow

[0092] MATCH(func:Function)-[:HAS_CONTROL_FLOW]->(block{branch_type:"if"})

[0093] WHERE EXISTS{(block)-[:HAS_DATA_FLOW{direction:"forward"}]->(var)}

[0094] RETURN func.name,block.condition,var.name

[0095] Dynamic weight calculation:

[0096] Control flow edge weights: dynamically adjusted based on execution frequency (log statistics), such as weight = log(execution_count + 1).

[0097] Data flow edge weights: Calculated based on the number of times the variable is used and the depth of cross-module transmission, such as weight = 1 + 0.5 * depth.

[0098] 3. External Context Injection

[0099] Version 3.1 history injection

[0100] Data association: By associating commit hashes with lines of code using Git's blame information, the frequency of modifications and the time of the most recent change can be calculated.

[0101] Example properties:

[0102]

[0103] Impact Analysis: Nodes that are frequently modified are marked as unstable, which increases their sensitivity during vulnerability detection.

[0104] 3.2 Dependency Injection

[0105] Dependency resolution: Parses pom.xml / requirements.txt, constructs the dependency tree, and maps it to the dependency graph.

[0106]

[0107] Security Enhancement: Link to the CVE database and mark dependent versions with vulnerabilities (e.g., Redis-6.2 has CVE-2021-32761).

[0108] 3.3 Runtime Log Injection

[0109] Log association: Use a distributed trace ID (such as OpenTelemetry's trace_id) to associate logs with control flow edges.

[0110]

[0111] Hotspot path marking:

[0112] Paths with execution_count > 1000 are marked as hot_paths and will be processed first during optimization.

[0113] 4. Example of generating a complete atlas

[0114] The input code snippet:

[0115]

[0116] Version history: Last modified by Alice, 3 modifications.

[0117] Runtime log: This function has an average execution time of 50ms and an error rate of 1%. Graph output (Neo4j Cypher)

[0118]

[0119]

[0120] S203, Obtain the multimodal collaborative vulnerability detection method, which includes a rule-matching-based static analysis method, a code path-based symbolic execution method, and a semantic understanding-based large model reasoning method, as well as the weights of each method.

[0121] In this embodiment, a multimodal collaborative vulnerability detection method is pre-configured. This method includes a rule-matching-based static analysis method, a code path-based symbolic execution method, and a semantic understanding-based large-model inference method, along with the weights of each method. The multimodal collaborative vulnerability detection method utilizes the collaborative efforts of these methods to detect code vulnerabilities in the code to be audited.

[0122] The static analysis method uses a rule engine to detect known code vulnerability patterns, such as hard-coded passwords and SQL concatenation vulnerabilities. The symbolic execution method uses a program symbolic execution engine to simulate code path execution to discover potential code logic vulnerabilities, such as race condition vulnerabilities and integer overflow vulnerabilities. The large model inference method uses a large model to process the input auditable code and context graph, outputting vulnerability types and confidence scores. A weighted algorithm is used to fuse the results of each method to comprehensively determine the final code vulnerability. For example, the static analysis method has a weight of 0.3, the symbolic execution method has a weight of 0.2, and the large model inference method has a weight of 0.5.

[0123] The static analysis method processes the syntax structure, control flow, data flow, nodes, and relationships of the context graph based on predefined rules to quickly detect known code vulnerability patterns. For example, predefined rules are defined using a vulnerability rule base, specifically tools like Semgrep and CodeQL, to extract code snippets matching the rule patterns from the context graph. Variables are passed across functions by tracing the edges of the data flow, such as user input being passed from the API layer to the DAO layer. The final output includes the marked vulnerability location, vulnerability type, and confidence level, where the confidence level is determined based on the rule matching strength. Utilizing the context graph's index accelerates pattern lookup, such as quickly locating all database call nodes. Furthermore, combining historical version marking with "fixed" nodes avoids duplicate alerts.

[0124] The symbolic execution method's processing logic is as follows: It dynamically explores the code path, discovers code logic vulnerabilities such as race conditions and integer overflows, based on the control flow paths, constraints, and variable dependencies in the context graph. Specifically, it includes the following processing steps:

[0125] Path extraction: Extract key control flow subgraphs, such as loops and conditional branches, from the context graph.

[0126] Symbolic variables: Replace input variables with symbolic values ​​while preserving constraints.

[0127] Constraint Solving: Use the SMT solver to verify the feasibility of the code path and detect boundary condition vulnerabilities.

[0128] Output: Unreachable code paths, potential overflow points, and the constraints that trigger them.

[0129] The symbolic execution methods described above utilize context graphs in the following ways: Initial values ​​of variables are loaded from the context graph as constraints. For example, a global configuration of MAX_SIZE = 100. External input sources are identified through the edges of the data flow and marked as high-risk symbols. For example, if x comes from a network request, x is marked as a high-risk symbol.

[0130] The processing logic of the large model inference method is as follows: identify complex code vulnerabilities that cannot be covered by the rules from the complete subgraph of the context graph. The complete subgraph of the context graph includes code snippets + version / dependency / log context, and complex code vulnerabilities include business logic vulnerabilities. Specifically, the processing steps are as follows:

[0131] Subgraph serialization: Converts the context graph into textual hints that the large model can understand.

[0132] The large-scale model's hinting engineering includes designing targeted questions and model inference. The large-scale model can use the CodeLlama-34B model. For example, designing targeted questions: Please analyze the security risks of the following code, considering its high-frequency modification and logging behavior, including whether there are concurrency issues and whether critical audit logs are missing. The structured output of the fine-tuned large-scale code model is as follows:

[0133]

[0134]

[0135] The aforementioned large-scale model inference method utilizes context graphs in the following ways: extracting associated vulnerability history from the context graph, such as if the code file to be audited had previously fixed a race condition vulnerability, and using this as a hint word for the large-scale model; and feeding new vulnerability patterns detected by the large-scale model back into the rule base of the static analysis method to achieve automated iteration.

[0136] Furthermore, the aforementioned static analysis method, symbolic execution method, and large-model inference method each utilize three engines for collaborative processing. Figure 3 As shown, the collaborative processing strategy among the three is to prioritize static analysis methods, use symbolic execution methods for verification, and use large model inference methods for completion. Specifically:

[0137] Static analysis methods are preferred: quickly screen high-risk nodes, such as SQL calls, and narrow down the scope of symbolic execution / large model processing.

[0138] Symbolic execution methods are used for verification: deep verification of the code paths alerted by static analysis methods, such as confirming whether SQL injection is reachable.

[0139] Large model reasoning methods are used for completion: semantic reasoning is performed on complex scenarios that cannot be modeled by symbolic execution methods, such as business logic vulnerability scenarios.

[0140] In addition, the Platt Scaling method can be used to calibrate the confidence level of the output, reducing false alarms.

[0141] S204. Based on the context graph of the code to be audited and the multimodal collaborative vulnerability detection method, one or more code vulnerabilities, the vulnerability type of each code vulnerability, and the confidence level are identified. Among them, the vulnerability type of each code vulnerability is used to match the vulnerability remediation plan for code repair, the vulnerability remediation plan is used to repair the corresponding code vulnerability, and the confidence level of each code vulnerability is used to indicate the remediation priority of each code vulnerability.

[0142] In one embodiment, after step S204, the method further includes: identifying the remediation priority of each code vulnerability based on the confidence level of each vulnerability; obtaining a vulnerability remediation plan for each code vulnerability based on the vulnerability type of each vulnerability; remediating each code vulnerability based on the code remediation priority and the vulnerability remediation plan of each vulnerability, and obtaining audit code after remediation; and generating a code audit report based on the audit code and the vulnerability type of each vulnerability.

[0143] The above-mentioned method of obtaining vulnerability remediation solutions for each code vulnerability based on its vulnerability type includes: if any code vulnerability is of the SQL injection type, the corresponding vulnerability remediation solution is parameterized query remediation; if any code vulnerability is of the race condition type, the corresponding vulnerability remediation solution is locking remediation; if any code vulnerability is of the buffer type, the corresponding vulnerability remediation solution is remediation based on boundary checks and security library construction.

[0144] For example, as in the embodiments described above, here are examples of the structured results output by the static analysis method, symbolic execution method, and large model inference method after processing the context graph:

[0145]

[0146]

[0147] The confidence level is used to determine the priority of code vulnerability remediation, such as prioritizing high-confidence vulnerabilities. The context is used to generate targeted remediation code, such as parameterizing `order_id` if it's identified. The vulnerability type is used to match predefined remediation strategy templates, such as SQL injection → parameterized query.

[0148] Specifically, the priority ranking logic is as follows: If the confidence level is greater than 0.9, immediate remediation is required. If the confidence level is between 0.7 and 0.9, remediation is required within 24 hours. Context graph analysis is used to determine the scope of the vulnerable code's impact, identifying the breadth of the call chain and the depth of the data flow. The breadth of the call chain can count all entry points that call the vulnerable function, such as the number of API interfaces. The depth of the data flow can check whether the vulnerable variable is passed to the core module, such as the payment service module.

[0149] Specifically, the steps for fixing code vulnerabilities in the code to be audited include:

[0150] Step 1: Obtaining the vulnerability context

[0151] Use the context field, which contains code snippets and data streams, from the previous step to query supplementary information in the context graph in real time, such as dependency library versions and associated test cases.

[0152] Example: If the code vulnerability involves MySQL, check whether the library version supports prepared statements in the context graph.

[0153] Step 2: Matching Vulnerability Remediation Solutions

[0154] A policy library with predefined vulnerability remediation solutions. This library defines the vulnerability type, the remediation strategy, and the applicable language. For example:

[0155]

[0156]

[0157] Furthermore, vulnerability remediation solutions can be dynamically expanded. Based on historical remediation records analyzed from a large model, new vulnerability remediation solutions can be generated, such as "replacing local locks with Redis distributed locks".

[0158] Step 3: Fix the vulnerable code

[0159] Template-based vulnerability remediation solutions are shown in the following example:

[0160] Python

[0161] #Before Repair

[0162] query=f"SELECT*FROM users WHERE id={user_id}";

[0163] #After repair (template filling)

[0164] query="SELECT*FROM users WHERE id=%s"

[0165] cursor.execute(query,(user_id,)) # Parameterization.

[0166] Vulnerability remediation solutions based on large models:

[0167] Input prompt:

[0168] text

[0169] Please fix the following SQL injection vulnerability. Requirements:

[0170] 1. Using Python's psycopg2 parameterized query

[0171] 2. Preserve the original query semantics

[0172] 3. Add error logs

[0173] Original code:

[0174] query=f'SELECT*FROM orders WHERE id={order_id}'

[0175] Model output:

[0176]

[0177] Step 4: Candidate Solution Validation

[0178] Compilation / static checking: Ensures that the generated code is free of syntax errors.

[0179] Test case association: Extract related test cases from the context graph to verify whether the fix passes.

[0180] The following provides a complete process example.

[0181] Input code vulnerability:

[0182]

[0183] The automatic repair process includes:

[0184] Priority determination: Confidence level 0.95 (P0 and the impact on the administrator interface (high risk) are determined to be the highest priority).

[0185] Strategy selection: Matched the vulnerability remediation solution for "SQL injection → parameterized query".

[0186] Code generation:

[0187] Python

[0188] cursor.execute("DELETE FROM users WHERE id=%s",(user_id,))

[0189] Validation and Deployment: The associated test test_admin_user_delete passed, a PR was generated and the security team was notified.

[0190] The above methods for automated code auditing and automated code vulnerability remediation:

[0191] Precise context awareness: The context graph provides complete variable passing, call chains, and business tags.

[0192] Dynamic vulnerability remediation solutions adapt by combining historical remediation practices with team preferences to adjust and generate remediation rules.

[0193] Closed-loop verification: Ensure that fixes do not introduce regression issues by associating test cases.

[0194] Based on the automated code auditing method provided in the above embodiments, combined with Figure 4 As shown, the following is a detailed explanation:

[0195] First, a brief explanation of each part:

[0196] 1. Preprocessing code semantic parsing: Using pre-trained large models, such as CodeGPT, perform multi-level semantic analysis on the code to be audited to extract syntactic structure, control flow and data flow features.

[0197] 2. Dynamic Context Modeling: By combining historical versions of the codebase, dependencies, and runtime logs, a dynamic context graph is constructed to enhance the accuracy of vulnerability detection.

[0198] 3. Multimodal collaborative vulnerability detection engine: Integrates static analysis, symbolic execution, and large model inference, supporting the identification of common vulnerabilities and logical vulnerabilities such as SQL injection, XSS, and buffer overflow.

[0199] 4. Adaptive repair suggestion generation: Based on the detection results, automatically generate repair code snippets and provide priority sorting.

[0200] 5. Lightweight deployment interface: Embedded in the development process via REST API or IDE plugin, supporting mainstream languages ​​such as Java, Python, and C / C++.

[0201] Implementation steps:

[0202] Step 1: Input and preprocess the code to be audited, clean up irrelevant data and standardize the format;

[0203] - Step 2: Extract semantic features of the code to be audited using a large model, and perform dynamic association analysis in conjunction with the context graph;

[0204] - Step 3: The multimodal collaborative vulnerability detection engine detects vulnerabilities in parallel and outputs confidence scores and detailed reports;

[0205] Step 4: Generate repair suggestions and push them to developers, supporting both manual review and automated repair.

[0206] Among them, the vulnerability detection algorithm in the multimodal collaborative vulnerability detection engine is as follows:

[0207] Python

[0208] defdetect_vulnerability(code_snippet,context_graph):

[0209] #Input: code snippet + context graph

[0210] #Output: Vulnerability list and confidence level

[0211] #Step 1: Static analysis to detect known patterns.

[0212] static_results=static_analyzer.run(code_snippet);

[0213] #Step 2: Symbolic execution explores path constraints.

[0214] symbolic_results=symbolic_executor.simulate(code_snippet);

[0215] #Step 3: Large model reasoning combined with context.

[0216] model_input={"code":code_snippet,"context":context_graph}

[0217] model_output=llm_inference(model_input);

[0218] #Results Fusion and Calibration

[0219] final_results=fusion_policy(static_results,symbolic_results,model_output)

[0220] return calibrate_confidence(final_results).

[0221] Among them, the lightweight deployment solution for large models:

[0222] Model compression: Using LoRA (low-rank adaptation) technology, the number of model parameters is reduced by 70%, making it suitable for single-machine GPU deployment.

[0223] Incremental update: New vulnerability samples are periodically injected through an online learning mechanism to update the model weights.

[0224] The aforementioned technological advantages

[0225] 1. Deep semantic understanding: Large models break through the limitations of rule engines, identifying logical vulnerabilities and new attack patterns.

[0226] 2. Dynamic context fusion: Historical version and dependency analysis improve the accuracy of vulnerability location.

[0227] 3. Closed-loop repair process: The entire process, from detection to repair suggestion generation, is automated.

[0228] 4. Enterprise-level scalability: Supports distributed analysis of codebases with hundreds of billions of entries (horizontal scaling based on the Ray framework).

[0229] It should be understood that although the steps in the flowchart are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the accompanying drawings may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0230] This application also provides an automated code auditing device. For example... Figure 5 As shown, an automated code auditing device includes a first acquisition module 501, a second acquisition module 502, a third acquisition module 503, and an identification module 504. The first acquisition module 501 acquires the syntax structure, control flow, and data flow of the code to be audited. The second acquisition module 502 constructs a context graph of the code to be audited based on the syntax structure, control flow, and data flow. The third acquisition module 503 acquires a multimodal collaborative vulnerability detection method, which includes a rule-matching-based static analysis method, a code path-based symbolic execution method, and a semantic understanding-based large-model inference method, as well as the weights of each method. The identification module 504 identifies one or more code vulnerabilities, their vulnerability types, and confidence levels based on the context graph of the code to be audited and the multimodal collaborative vulnerability detection method. The vulnerability types of each code vulnerability are used to match vulnerability remediation schemes for code repair, the vulnerability remediation schemes are used to repair the corresponding code vulnerabilities, and the confidence levels of each code vulnerability are used to indicate the remediation priority of each code vulnerability.

[0231] In one embodiment, constructing a context graph of the code to be audited based on its syntax structure, control flow, and data flow includes: identifying functions and a first variable from the syntax structure of the code to be audited; identifying basic blocks determined by code splitting from the code to be audited; and identifying a second variable from the data flow; merging functions, the first variable, the basic blocks, and the second variable into nodes; merging the multidimensional relationships between control flow and data flow into a graph; and constructing a context graph of the code to be audited based on the merged nodes and the merged graph.

[0232] In one embodiment, an automated code auditing device further includes a fourth acquisition module, configured to acquire historical version code of the code to be audited, determine the attributes of the merged nodes based on the historical version code, and add attributes to the merged nodes; acquire the dependency files of the code to be audited, extract the dependency relationships of the merged nodes from the dependency files, identify the dependent code of the merged nodes based on the dependency relationships, and construct the link relationship between the merged nodes and the dependent code; acquire the runtime logs of the code to be audited, associate the logs with the control flow, and identify and mark the frequently executed paths in the control flow through the logs, wherein the marked frequently executed paths are executed first when code vulnerabilities are fixed; wherein constructing a context graph of the code to be audited based on the merged nodes and the merged graph includes: constructing a context graph of the code to be audited based on the merged nodes with added attributes and constructed dependency relationships and the merged graph of the control flow containing the marked frequently executed paths.

[0233] In one embodiment, merging the function, the first variable, the basic block, and the second variable into a node includes: using the function as the first node, obtaining the variables and basic blocks associated with the function, and associating the variables and basic blocks associated with the function to the first node, wherein the associated variables include the first variable and / or the second variable; if the second variable is a local variable, then associating the second variable to the first node; if the second variable is a global variable, then using the second variable as the second node; wherein the first node and the second node are different, and the merged node includes both the first node and the second node.

[0234] In one embodiment, the multidimensional relationship between control flow and data flow is merged into a graph, including: obtaining the execution frequency of each execution edge in the control flow, determining the weight of the control flow based on the execution frequency of each execution edge in the control flow; calculating the weight of the data flow based on the number of times variables are used and the cross-module transfer depth in the data flow; and merging the multidimensional relationship between control flow and data flow into a graph based on the weight of the control flow and the weight of the data flow.

[0235] In one embodiment, an automated code auditing device further includes a generation module, configured to identify the remediation priority of each code vulnerability based on the confidence level of each vulnerability; obtain a vulnerability remediation plan for each code vulnerability based on the vulnerability type of each vulnerability; remediate each code vulnerability based on the code remediation priority and the vulnerability remediation plan, thereby obtaining audit code; and generate a code audit report based on the audit code and the vulnerability type of each code vulnerability.

[0236] In one embodiment, a vulnerability remediation plan is obtained for each code vulnerability based on its vulnerability type, including: if any code vulnerability is of the SQL injection type, the corresponding vulnerability remediation plan is a parameterized query remediation method; if any code vulnerability is of the race condition type, the corresponding vulnerability remediation plan is a locking remediation method; if any code vulnerability is of the buffer type, the corresponding vulnerability remediation plan is a remediation method based on boundary checks and security library construction.

[0237] For specific limitations regarding an automated code auditing device, please refer to the limitations regarding an automated code auditing method described above, which will not be repeated here. Each module in the aforementioned automated code auditing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0238] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 6 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database stores code to be audited. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements an automated code auditing method.

[0239] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device on which the present application is intended to be applied. A specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0240] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it performs the following steps: acquiring the syntax structure, control flow, and data flow of code to be audited; constructing a context graph of the code to be audited based on the syntax structure, control flow, and data flow; acquiring a multimodal collaborative vulnerability detection method, which includes a rule-matching-based static analysis method, a code path-based symbolic execution method, and a semantic understanding-based large-model reasoning method, as well as the weights of each method; identifying one or more code vulnerabilities, the vulnerability type of each vulnerability, and the confidence level based on the context graph of the code to be audited and the multimodal collaborative vulnerability detection method; wherein, the vulnerability type of each vulnerability is used to match a vulnerability remediation scheme for code repair, the vulnerability remediation scheme is used to repair the corresponding code vulnerability, and the confidence level of each vulnerability is used to indicate the remediation priority of each vulnerability.

[0241] In one embodiment, when the processor executes a computer program to implement the above-described steps of constructing a context graph of the code to be audited based on its syntax structure, control flow, and data flow, the processor specifically implements the following steps: identifying functions and a first variable from the syntax structure of the code to be audited; identifying basic blocks determined by code splitting from the code to be audited; identifying a second variable from the data flow; merging functions, the first variable, basic blocks, and the second variable into nodes; merging the multidimensional relationships of control flow and data flow into a graph; and constructing a context graph of the code to be audited based on the merged nodes and the merged graph.

[0242] In one embodiment, when the processor executes the computer program, it further implements the following steps: obtaining historical version code of the code to be audited, determining the attributes of the merged nodes based on the historical version code, and adding attributes to the merged nodes; obtaining the dependency files of the code to be audited, extracting the dependency relationships of the merged nodes from the dependency files, identifying the dependent code of the merged nodes based on the dependency relationships, and constructing the link relationship between the merged nodes and the dependent code; obtaining the runtime logs of the code to be audited, associating the logs with the control flow, and identifying and marking the frequently executed paths in the control flow through the logs, wherein the marked frequently executed paths are executed first when code vulnerability is fixed; wherein, when the processor executes the computer program to implement the above-mentioned step of constructing the context graph of the code to be audited based on the merged nodes and the merged graph, it specifically implements the following steps: constructing the context graph of the code to be audited based on the merged nodes with added attributes and constructed dependency relationships, and the merged graph of the control flow containing the marked frequently executed paths.

[0243] In one embodiment, when the processor executes the computer program to implement the above-described steps of merging the function, the first variable, the basic block, and the second variable into a node, the specific steps are as follows: The function is used as the first node; the variables and basic blocks associated with the function are obtained; the variables and basic blocks associated with the function are associated with the first node, and the associated variables include the first variable and / or the second variable; if the second variable is a local variable, it is associated with the first node; if the second variable is a global variable, it is used as the second node; wherein the first node and the second node are different, and the merged node includes both the first node and the second node.

[0244] In one embodiment, when the processor executes the computer program to implement the above-described step of merging the multidimensional relationship between the control flow and the data flow into a graph, the following steps are specifically implemented: obtaining the execution frequency of each execution edge in the control flow, determining the weight of the control flow based on the execution frequency of each execution edge in the control flow; calculating the weight of the data flow based on the number of times variables are used in the data flow and the cross-module transfer depth; and merging the multidimensional relationship between the control flow and the data flow into a graph based on the weight of the control flow and the weight of the data flow.

[0245] In one embodiment, when the processor executes the computer program, it further performs the following steps: identifying the remediation priority of each code vulnerability based on the confidence level of each vulnerability; obtaining a vulnerability remediation plan for each code vulnerability based on the vulnerability type of each vulnerability; remediating each code vulnerability based on the code remediation priority and the vulnerability remediation plan of each vulnerability, and obtaining audit code after remediation; and generating a code audit report based on the audit code and the vulnerability type of each vulnerability.

[0246] In one embodiment, when the processor executes the computer program to implement the above-mentioned step of obtaining the vulnerability remediation scheme for each code vulnerability based on the vulnerability type of each code vulnerability, the following steps are specifically implemented: if the vulnerability type of any code vulnerability is SQL injection, the corresponding vulnerability remediation scheme is parameterized query remediation; if the vulnerability type of any code vulnerability is race condition, the corresponding vulnerability remediation scheme is locking remediation; if the vulnerability type of any code vulnerability is buffer type, the corresponding vulnerability remediation scheme is remediation based on boundary checks and security library construction.

[0247] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, it performs the following steps: obtaining the syntax structure, control flow, and data flow of code to be audited; constructing a context graph of the code to be audited based on the syntax structure, control flow, and data flow; obtaining a multimodal collaborative vulnerability detection method, which includes a rule-matching-based static analysis method, a code path-based symbolic execution method, and a semantic understanding-based large-model inference method, as well as the weights of each method; identifying one or more code vulnerabilities, the vulnerability type of each code vulnerability, and the confidence level based on the context graph of the code to be audited and the multimodal collaborative vulnerability detection method; wherein, the vulnerability type of each code vulnerability is used to match a vulnerability remediation scheme for code repair, the vulnerability remediation scheme is used to repair the corresponding code vulnerability, and the confidence level of each code vulnerability is used to indicate the remediation priority of each code vulnerability.

[0248] In one embodiment, when a computer program is executed by a processor to implement the above-described steps of constructing a context graph of the auditable code based on its syntax structure, control flow, and data flow, the specific steps are as follows: identifying functions and a first variable from the syntax structure of the auditable code; identifying basic blocks determined by code splitting from the auditable code; identifying a second variable from the data flow; merging functions, the first variable, basic blocks, and the second variable into nodes; merging the multidimensional relationships of control flow and data flow into a graph; and constructing a context graph of the auditable code based on the merged nodes and the merged graph.

[0249] In one embodiment, when the computer program is executed by the processor, it further implements the following steps: obtaining historical version code of the code to be audited, determining the attributes of the merged nodes based on the historical version code, and adding attributes to the merged nodes; obtaining the dependency files of the code to be audited, extracting the dependency relationships of the merged nodes from the dependency files, identifying the dependent code of the merged nodes based on the dependency relationships, and constructing the link relationship between the merged nodes and the dependent code; obtaining the runtime logs of the code to be audited, associating the logs with the control flow, and identifying and marking the frequently executed paths in the control flow through the logs, wherein the marked frequently executed paths are executed first when code vulnerability is fixed; wherein, when the computer program is executed by the processor to implement the above-mentioned step of constructing the context graph of the code to be audited based on the merged nodes and the merged graph, it specifically implements the following steps: constructing the context graph of the code to be audited based on the merged nodes with added attributes and constructed dependency relationships and the merged graph of the control flow containing the marked frequently executed paths.

[0250] In one embodiment, when a computer program is executed by a processor to implement the above-described steps of merging a function, a first variable, a basic block, and a second variable into a node, the specific steps are as follows: The function is used as the first node; the variables and basic blocks associated with the function are obtained; the variables and basic blocks associated with the function are associated with the first node, and the associated variables include the first variable and / or the second variable; if the second variable is a local variable, it is associated with the first node; if the second variable is a global variable, it is used as the second node; wherein the first node and the second node are different, and the merged node includes both the first node and the second node.

[0251] In one embodiment, when the computer program is executed by the processor to implement the above-described step of merging the multidimensional relationship between the control flow and the data flow into a graph, the following steps are specifically implemented: obtaining the execution frequency of each execution edge in the control flow, determining the weight of the control flow based on the execution frequency of each execution edge in the control flow; calculating the weight of the data flow based on the number of times variables are used in the data flow and the cross-module transfer depth; and merging the multidimensional relationship between the control flow and the data flow into a graph based on the weight of the control flow and the weight of the data flow.

[0252] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: identifying the remediation priority of each code vulnerability based on the confidence level of each vulnerability; obtaining a vulnerability remediation plan for each code vulnerability based on the vulnerability type of each vulnerability; remediating each code vulnerability based on the code remediation priority and the vulnerability remediation plan of each vulnerability, and obtaining audit code after remediation; and generating a code audit report based on the audit code and the vulnerability type of each vulnerability.

[0253] In one embodiment, when the computer program is executed by the processor to implement the above-described steps of obtaining vulnerability remediation schemes for each code vulnerability based on its vulnerability type, the following steps are specifically implemented: if the vulnerability type of any code vulnerability is SQL injection, the corresponding vulnerability remediation scheme is parameterized query remediation; if the vulnerability type of any code vulnerability is race condition, the corresponding vulnerability remediation scheme is locking remediation; if the vulnerability type of any code vulnerability is buffer type, the corresponding vulnerability remediation scheme is remediation based on boundary checks and security library construction.

[0254] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0255] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0256] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.< / redacted>

Claims

1. An automated code auditing method, characterized in that, The method includes: Obtain the syntax structure, control flow, and data flow of the code to be audited; Construct a context graph of the code to be audited based on its syntax structure, control flow, and data flow; A multimodal collaborative vulnerability detection method is obtained, which includes a rule-matching-based static analysis method, a code path-based symbolic execution method, and a semantic understanding-based large model reasoning method, as well as the weights of each method; Based on the context graph of the code to be audited and the multimodal collaborative vulnerability detection method, one or more code vulnerabilities, the vulnerability type of each vulnerability, and the confidence level are identified. Specifically, the static analysis method processes the syntax structure, control flow, data flow, nodes, and relationships of the context graph based on predefined rules to detect known code vulnerability patterns. The symbolic execution method dynamically explores code paths by analyzing the control flow paths, constraints, and variable dependencies in the context graph to discover code logic vulnerabilities. The large model inference method identifies complex code vulnerabilities that cannot be covered by the rules from the complete subgraph of the context graph, where the complete subgraph includes code fragments, and the complex code vulnerabilities include business logic vulnerabilities. Among them, the vulnerability type of each code vulnerability is used to match the vulnerability remediation scheme of the code repair, the vulnerability remediation scheme is used to repair the corresponding code vulnerability, and the confidence level of each code vulnerability is used to indicate the remediation priority of each code vulnerability. The step of constructing a context graph of the code to be audited based on its syntax structure, control flow, and data flow includes: Identify functions and the first variable from the syntax structure of the code to be audited, identify basic blocks determined by code decomposition from the code to be audited, and identify the second variable from the data flow; The function, the first variable, the basic block, and the second variable are merged into a node; The multidimensional relationship between the control flow and the data flow is merged into a graph; Obtain the historical version code of the code to be audited, determine the attributes of the merged node based on the historical version code, and add the attributes to the merged node; Obtain the dependency files of the code to be audited, extract the dependency relationships of the merged nodes from the dependency files, identify the dependent code of the merged nodes based on the dependency relationships, and construct the link relationship between the merged nodes and the dependent code. Obtain the runtime logs of the code to be audited, associate the logs with the control flow, and identify and mark the frequently executed paths in the control flow through the logs. The marked frequently executed paths are executed first when fixing code vulnerabilities. Construct a context graph of the code to be audited based on the merged nodes with added attributes and built dependencies, as well as the merged graph containing the control flow of paths marked as frequently executed. The step of merging the function, the first variable, the basic block, and the second variable into a node includes: Take the function as the first node, obtain the variables and basic blocks associated with the function, and associate the variables and basic blocks associated with the function with the first node. The associated variables include the first variable and / or the second variable. If the second variable is a local variable, then associate the second variable with the first node; If the second variable is a global variable, then the second variable will be used as the second node; Wherein, the first node and the second node are different, and the merged node includes the first node and the second node; The step of merging the multidimensional relationship between the control flow and the data flow into a graph includes: Obtain the execution frequency of each execution edge in the control flow, and determine the weight of the control flow based on the execution frequency of each execution edge in the control flow; The weight of the data stream is calculated based on the number of times the variables are used in the data stream and the depth of cross-module transmission; The multidimensional relationships between the control flow and the data flow are merged into a graph based on the weights of the control flow and the data flow.

2. The method according to claim 1, characterized in that, The method further includes: The priority of fixing each code vulnerability is identified based on its confidence level. Obtain vulnerability remediation solutions for each code vulnerability based on its vulnerability type; Based on the code patching priority and vulnerability patching plan for each code vulnerability, each code vulnerability is patched, and the resulting audit code is obtained. A code audit report is generated based on the audited code and the vulnerability types of each vulnerability.

3. The method according to claim 2, characterized in that, The process of obtaining a vulnerability remediation plan for each code vulnerability based on its vulnerability type includes: If any code vulnerability is of the SQL injection type, then the corresponding vulnerability remediation solution is the parameterized query remediation method. If any code vulnerability is a race condition type, then the corresponding vulnerability remediation solution is a locking-based remediation method. If any code vulnerability is of the buffer type, the corresponding vulnerability remediation solution is a remediation method based on boundary checks and security library construction.

4. An automated code auditing device, characterized in that, The device includes: The first acquisition module is used to acquire the syntax structure, control flow, and data flow of the code to be audited; The second acquisition module is used to construct a context graph of the code to be audited based on the syntax structure, control flow, and data flow of the code to be audited; The third acquisition module is used to acquire the multimodal collaborative vulnerability detection method, which includes a rule-matching-based static analysis method, a code path-based symbolic execution method, and a semantic understanding-based large model reasoning method, as well as the weights of each method. The identification module is used to identify one or more code vulnerabilities, the vulnerability type of each vulnerability, and the confidence level based on the context graph of the code to be audited and the multimodal collaborative vulnerability detection method. The static analysis method processes the syntax structure, control flow, data flow, nodes, and relationships of the context graph based on predefined rules to detect known code vulnerability patterns. The symbolic execution method dynamically explores code paths by analyzing the control flow paths, constraints, and variable dependencies in the context graph to discover code logic vulnerabilities. The large model inference method identifies complex code vulnerabilities that cannot be covered by the rules from the complete subgraph of the context graph, where the complete subgraph includes code fragments, and the complex code vulnerabilities include business logic vulnerabilities. Among them, the vulnerability type of each code vulnerability is used to match the vulnerability remediation scheme of the code repair, the vulnerability remediation scheme is used to repair the corresponding code vulnerability, and the confidence level of each code vulnerability is used to indicate the remediation priority of each code vulnerability. The step of constructing a context graph of the code to be audited based on its syntax structure, control flow, and data flow includes: Identify functions and the first variable from the syntax structure of the code to be audited, identify basic blocks determined by code decomposition from the code to be audited, and identify the second variable from the data flow; The function, the first variable, the basic block, and the second variable are merged into a node; The multidimensional relationship between the control flow and the data flow is merged into a graph; Obtain the historical version code of the code to be audited, determine the attributes of the merged node based on the historical version code, and add the attributes to the merged node; Obtain the dependency files of the code to be audited, extract the dependency relationships of the merged nodes from the dependency files, identify the dependent code of the merged nodes based on the dependency relationships, and construct the link relationship between the merged nodes and the dependent code. Obtain the runtime logs of the code to be audited, associate the logs with the control flow, and identify and mark the frequently executed paths in the control flow through the logs. The marked frequently executed paths are executed first when fixing code vulnerabilities. Construct a context graph of the code to be audited based on the merged nodes with added attributes and built dependencies, as well as the merged graph containing the control flow of paths marked as frequently executed. The step of merging the function, the first variable, the basic block, and the second variable into a node includes: Take the function as the first node, obtain the variables and basic blocks associated with the function, and associate the variables and basic blocks associated with the function with the first node. The associated variables include the first variable and / or the second variable. If the second variable is a local variable, then associate the second variable with the first node; If the second variable is a global variable, then the second variable will be used as the second node; Wherein, the first node and the second node are different, and the merged node includes the first node and the second node; The step of merging the multidimensional relationship between the control flow and the data flow into a graph includes: Obtain the execution frequency of each execution edge in the control flow, and determine the weight of the control flow based on the execution frequency of each execution edge in the control flow; The weight of the data stream is calculated based on the number of times the variables are used in the data stream and the depth of cross-module transmission; The multidimensional relationships between the control flow and the data flow are merged into a graph based on the weights of the control flow and the data flow.

5. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 3.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 3.

Images