Program defect detection method for heterogeneous fusion of symbolic execution tree and LLM vector space

Abstract

The invention provides a symbolic execution tree and LLM vector space heterogeneous fusion program defect detection method, relates to the technical field of program static analysis, and solves the problems of path explosion and overhigh constraint solution complexity in C / C + + program defect detection of traditional symbolic execution. The method comprises the steps that firstly, a symbolic execution tree of a target program to be detected is constructed, key feature information is extracted from the symbolic execution tree and converted into multi-dimensional feature representation, and corresponding symbolic execution feature vectors are formed; then constructing a mapping model, realizing a mapping process from the symbolic execution feature vector to an LLM vector space, and obtaining an LLM mapping result; symbolic execution analysis is achieved based on the symbolic execution tree, LLM analysis is achieved based on the LLM mapping result, and finally two kinds of analysis results are fused to obtain a program defect detection result. For optimization training of the mapping model, a comparative learning strategy is also adopted. According to the invention, accurate detection of complex program defects can be effectively realized, and the detection efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of program static analysis, and particularly relates to a program defect detection method based on heterogeneous fusion of symbolic execution tree and LLM vector space. BACKGROUND

[0002] Program analysis is a key technology in software engineering, used to identify potential defects in software and optimize software performance. Symbolic execution, as an important method in this field, systematically explores the execution paths of a program by symbolizing its inputs rather than using concrete values. This technique has significant advantages, including accurately tracking program state changes, effectively revealing hidden execution paths, highly automated, avoiding the tedious process of manually writing test cases, and strong defect detection capability, especially good at finding boundary condition errors that traditional methods cannot capture. These characteristics make symbolic execution play a key role in improving software reliability and security methods.

[0003] However, with the expansion of software size and increase in complexity, symbolic execution faces serious challenges in practical applications. Program execution paths may grow geometrically, leading to the path explosion problem, making the analysis process unable to complete within a reasonable time. In addition, when dealing with complex mathematical operations, dynamic array access or multi-level pointer operations, constraint solvers often struggle to efficiently handle related constraints, failing to find feasible solutions in a timely manner. Symbolic execution also lacks understanding of the deep semantics of code, making it difficult to identify patterns or potential design defects in the code, which limits its applicability in complex scenarios.

[0004] In recent years, large language model technology has shown strong capabilities in code understanding and generation. Through large-scale training, these models can capture the semantic information and programming patterns of code, providing a new perspective for automated code analysis. Large language models are based on sequential text processing and can generate or interpret code snippets, performing outstandingly in assisted development tasks. However, there are inherent limitations in directly applying large language models to program analysis: models mainly process linear text structures, making it difficult to effectively handle tree or graph structure data in program analysis, such as control flow graphs or data dependency graphs; at the same time, the probabilistic output characteristics of the model are in conflict with the determinism and accuracy required by program analysis, resulting in unreliable analysis results; existing methods fail to effectively integrate the semantic understanding capabilities of large language models with traditional symbolic execution techniques, hindering the improvement of overall analysis effectiveness.

[0005] Therefore, in the current technical environment, symbolic execution and large language models each have their own shortcomings and are difficult to independently cope with the complex requirements of program analysis. The path explosion and constraint solving bottleneck of symbolic execution limit its scalability, while the structured data processing defects and probabilistic output of large language models weaken the reliability of analysis. The current program analysis field urgently needs a new solution to effectively improve the efficiency and depth of analysis. SUMMARY

[0006] The purpose of the present application is to solve the problem of path explosion and high complexity of constraint solving faced by traditional symbolic execution in C / C++ program defect detection, therefore a symbolic execution tree and LLM vector space heterogeneous fusion program defect detection method is proposed. The present application realizes accurate detection of complex defects by establishing the mapping relationship between the symbolic execution tree and the LLM (i.e. large language model) vector representation, while improving the detection efficiency and reducing the use threshold of related application systems.

[0007] The present application adopts the following technical solutions to achieve the purpose: A symbolic execution tree and LLM vector space heterogeneous fusion program defect detection method, comprising the following steps: S1, constructing a symbolic execution tree of a target program to be detected and extracting key feature information therefrom; S2, converting the extracted key feature information into a multi-dimensional feature representation to form a corresponding symbolic execution feature vector; S3, constructing a mapping model to realize the mapping process of the symbolic execution feature vector to the LLM vector space through the mapping model, obtaining the LLM mapping result as the basis for LLM analysis; S4, implementing symbolic execution analysis based on the symbolic execution tree and LLM analysis based on the LLM mapping result; fusing the two types of analysis results to obtain the program defect detection result; In step S3, the constructed mapping model is optimized and trained using a contrastive learning strategy, and the mapping process of the target program to be detected is realized by the trained mapping model.

[0008] Specifically, in step S1, the target program to be detected is subjected to symbolic execution analysis to generate an execution path tree containing path constraint conditions, which serves as the basis for extracting key feature information and obtaining symbolic execution analysis results for fusion in step S4.

[0009] Specifically, in step S1, the extracted key feature information includes: a set of path constraint conditions, a variable symbol state change trajectory, control flow branch decision information, memory access mode features, and a function call relationship graph.

[0010] Further, in step S2, the key feature information to be converted is stored in a structured data form, the information types in the structured data including semantic information, variable state, and control flow atlas; wherein the semantic information maintains the corresponding constraints by encoding different types of constraint relations and logical operators; the variable state changes capture the state evolution process of the variable in different execution paths through a time sequence encoding method; the control flow atlas uses a graph neural network to vectorize the control flow structure of the target program to be detected, thereby converting the complex control flow graph into a preset fixed dimension vector form; the three information types form different dimensional feature vectors suitable for machine learning processing after processing.

[0011] Preferably, based on the semantic information, a multi-layer feature fusion network is used to integrate the different dimensional feature vectors corresponding to the semantic information, variable state, and control flow atlas respectively, to form a unified multi-dimensional feature representation, thereby obtaining a corresponding symbolic execution feature vector as the input basis of the mapping model in step S3.

[0012] Preferably, in step S3, the mapping model is a multi-layer perception, i.e., the mapping function in the mapping model is realized by an MLP network in the multi-layer perception; the MLP network maps the symbolic execution feature vector to the LLM vector space through multi-layer nonlinear transformation, which can maintain the semantic consistency and structural integrity of the features.

[0013] Preferably, when constructing the mapping model, an attention mechanism is configured for the mapping model, which assigns corresponding importance weights to the different dimensional feature vectors in the symbolic execution feature vector; the importance weights are preset according to the influence degree of each dimensional feature vector on the LLM mapping result, which can effectively improve the accuracy and robustness of the mapping process.

[0014] Preferably, when optimizing and training the mapping model, training samples are obtained in advance, code fragments with similar semantics or corresponding defect features are taken as positive samples, and code fragments of different types or irrelevant are taken as negative samples; the contrast loss function used in the contrast learning strategy maximizes the similarity of the positive samples in the vector space while minimizing the similarity of the negative samples, to guide the mapping model to complete the optimization understanding of the feature representation and realize the contrast learning training.

[0015] Preferably, the training samples are divided according to different difficulty levels preset, and different difficulty levels of training samples are dynamically selected according to the current boundary condition performance of the mapping model in the contrast learning training, to realize the step-by-step optimization understanding of the feature representation by the mapping model, which can effectively improve the generalization ability and robustness of the mapping model.

[0016] Preferably, in step S4, the confidence evaluation is performed on the analysis results of the symbolic execution and the LLM analysis results, respectively, to obtain the uncertainty of the corresponding results, and then different preset weighted fusion strategies are adopted in the fusion to obtain the fusion results; the fusion process can give full play to the respective advantages of the two analysis methods and realize complementary advantages; the uncertainty of the fusion results is also evaluated, and then the optimal analysis strategy and resource allocation scheme are determined in the detection of the same type of target program, and the fusion results are described into semantic text by the LLM to obtain the program defect detection results; the quantification of the uncertainty can be realized by Bayesian inference or ensemble learning.

[0017] In summary, due to the adoption of the technical solutions, the application has the following beneficial effects: The application significantly improves the comprehensive performance of program defect detection. In terms of analysis efficiency, the exponential growth trend of the execution path is effectively controlled through the intelligent path screening mechanism, and the calculation resource consumption is optimized to a reasonable range, so that large-scale program analysis has engineering feasibility. This improvement fundamentally solves the operation bottleneck problem caused by the path explosion in the traditional method.

[0018] In terms of detection capability, the application combines the advantages of precise state tracking of symbolic execution and the deep semantic understanding capability of large language models. Through this collaborative mechanism, not only can the numerical boundary anomalies in the program be accurately captured, but also the deep errors involving complex data structure operations and programming mode defects can be identified, which significantly improves the coverage range and recognition accuracy of multi-dimensional defects.

[0019] The method of the application can be applied in the corresponding system to generate a defect diagnosis report with explainability. Through natural semantic description, the defect triggering path and error cause are intuitively presented, which greatly reduces the understanding threshold of the analysis results, so that non-professional users can also quickly locate the problem source. Through such user-friendly output form, the usability and promotion value of the related system tool can be enhanced.

[0020] The application realizes the deep complementarity of the advantages of the two technologies by establishing the mapping relationship between the program structure features and the semantic vector space; it not only overcomes the inherent limitations of symbolic execution in complex constraint solving and path selection, but also avoids the defects of insufficient determinacy of language models in program analysis, providing a new technical path for efficient and accurate program verification. BRIEF DESCRIPTION OF DRAWINGS

[0021] The embodiments and technical solutions of the application are further illustrated by the following drawings, specifically including 8 drawings, as follows: Figure 1 It is a schematic diagram of the overall flow of the program defect detection method of the application; Figure 2 It is a schematic diagram of the C++ code segment of the application. Figure 3 A symbolic execution tree construction flowchart is shown as an example of the present application. Figure 4 A symbolic execution feature vector extraction and fusion schematic diagram is shown as an example of the present application. Figure 5 A mapping model structure and its composition schematic diagram is shown as an example of the present application. Figure 6 A flowchart of the mapping model contrast learning training in the present application is shown. Figure 7 A flowchart of fusing two types of analysis results is shown as an example of the present application. Figure 8 A schematic diagram of the overall architecture of the system to which the method of the present application is applied. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all. The components of the embodiments of the present application described and shown in the drawings can be arranged and designed in various different configurations.

[0023] Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present application without creative labor are within the scope of protection of the present application.

[0024] Embodiment 1 A symbolic execution tree and LLM vector space heterogeneous fusion program defect detection method, Figure 1 The overall flowchart of the method is shown, which can be referred to simultaneously. The key steps of the method can be summarized as follows: S1, construct a symbolic execution tree of the target program to be detected and extract key feature information therefrom; S2, convert the extracted key feature information into a multi-dimensional feature representation to form a corresponding symbolic execution feature vector; S3, construct a mapping model, realize the mapping process of the symbolic execution feature vector to the LLM vector space through the mapping model, obtain the LLM mapping result as the basis of LLM analysis; S4, implement symbolic execution analysis based on the symbolic execution tree, implement LLM analysis based on the LLM mapping result; fuse the two types of analysis results to obtain the program defect detection result.

[0025] In step S3, the constructed mapping model is preferably optimized and trained by adopting a contrast learning strategy, and the mapping process of the target program to be detected is realized by the trained mapping model.

[0026] The method of the embodiment is based on the precise path analysis capability of symbolic execution and the semantic understanding advantage of LLM to form a complementary detection framework. The overall process is based on the above steps, including constructing a symbolic execution tree of the program to extract key features, converting the features into vector representations, mapping them to the LLM space for embedding analysis, and finally fusing the analysis results of the two types to output defect detection. This method can effectively improve the accuracy and robustness of detection while avoiding the limitations of a single technology.

[0027] The following is a detailed introduction and preferred explanation of the details in the method according to the steps of the method.

[0028] First, in step S1, the target program to be detected is subjected to symbolic execution analysis to generate an execution path tree containing path constraint conditions, which serves as the basis for extracting key feature information and obtaining symbolic execution analysis results for fusion in step S4. The extracted key feature information includes: path constraint condition set, variable symbolic state change trajectory, control flow branch decision information, memory access pattern feature, and function call relationship graph.

[0029] In the process of constructing the symbolic execution tree, the potential execution paths of the target program to be detected are systematically explored through deep symbolic execution analysis. This process simulates the behavior of the program under various input conditions and dynamically constructs a structured execution path tree. This tree structure not only records the branching and merging of program execution flow, but also carries detailed constraint conditions and environmental state information on each path, serving as a key basis for subsequent feature extraction.

[0030] After the execution path tree is formed, multi-dimensional key feature information can be extracted from it. The path constraint condition set is one of the core features, which accurately describes the input conditions required to trigger a specific path, providing a formal expression for understanding program logic branching. The variable symbolic state change trajectory records the history of symbolic value evolution of key variables during program execution, revealing the potential patterns of data flow transmission and conversion. The control flow branch decision information captures the choices made by the program at conditional judgment points and their context-dependent relationships, reflecting the complexity of program flow control. The memory access pattern feature focuses on analyzing the read-write sequence, address range, and access frequency of the program to the memory region, in order to identify possible memory-related abnormal patterns such as boundary crossing, leakage, or conflict. The function call relationship graph abstracts the call hierarchy, parameter passing path, and execution context switching logic between program modules, describing the overall outline of the program structure.

[0031] The extracted feature information above collectively constitutes a structured representation of the program runtime behavior, with high information density and semantic relevance. It not only provides the raw material for subsequent symbolic execution feature vector encoding, but also serves as an important component of the symbolic execution analysis results in step S4, directly serving the final heterogeneous analysis fusion process. This embodiment ensures the complete conversion from the bottom execution path to the high-level semantic feature through this feature extraction mechanism, which is the analysis basis of the fusion framework.

[0032] In step S2, the key feature information to be converted is stored in a structured data form, and the information types in the structured data include semantic information, variable state, and control flow atlas; wherein the semantic information maintains the corresponding constraints by encoding different types of constraint relationships and logical operators; the variable state changes capture the state evolution process of variables in different execution paths through time series encoding; the control flow atlas uses graph neural networks to vectorize the control flow structure of the target program to be detected, thereby converting the complex control flow graph into a preset fixed-dimensional vector form; the three types of information are processed respectively to form feature vectors of different dimensions suitable for machine learning processing.

[0033] Based on semantic information, this embodiment uses a multi-layer feature fusion network to integrate the different dimensional feature vectors corresponding to semantic information, variable state, and control flow atlas respectively, forming a unified multi-dimensional feature representation, thereby obtaining the corresponding symbolic execution feature vector as the input basis of the mapping model in step S3.

[0034] In this embodiment, feature information is organized and managed in a structured data form, ensuring data consistency and accessibility. This embodiment divides the key features into three categories: semantic information, variable state, and control flow atlas, each category retaining the core attributes of the original data. Among them, the semantic information abstractly represents the constraint relationships and logical operators in the program through encoding techniques, such as converting equations or inequalities in path constraints into symbolic form to maintain their logical integrity and computability. Variable state information uses time series encoding methods to capture the continuous change process of variables in the program execution path, such as recording the dynamic evolution of variable values through sequence models to reveal data flow patterns. The control flow atlas is processed by graph neural networks to convert the control flow structure of the program into a fixed-dimensional vector representation, such as extracting node and edge features through graph embedding techniques to simplify the expression of complex control logic.

[0035] These information types, after encoding, form independent feature vectors, each with different dimensions to adapt to the input requirements of machine learning models. The semantic information vector usually contains a symbolic form of logical constraints, the variable state vector embodies the dynamic characteristics of time series, and the control flow graph vector captures the topological relationship of the graph structure. To integrate these heterogeneous features, the embodiment adopts a multi-layer feature fusion network for processing. This network gradually fuses vectors of different dimensions through stacked neural network layers, such as using fully connected layers or attention mechanisms to align feature spaces, ensuring that semantic, state, and control flow information complement each other during the fusion process. The fusion process first normalizes and adjusts the dimensions of each vector, then extracts common features through nonlinear transformation, and finally generates a unified multi-dimensional feature representation. The symbolic execution feature vector obtained by integrating the above not only retains the rich information of the original features, but also enhances the relevance between features, making it easier for subsequent analysis.

[0036] As a key input, the symbolic execution feature vector provides a stable and efficient data foundation for subsequent mapping models. The above transformation process of the embodiment can significantly improve the robustness and generalization ability of feature representation, avoiding the problem of information silos and providing a basis for heterogeneous analysis fusion. Through this structured encoding and intelligent fusion mechanism, the key details of program behavior are effectively abstracted into machine learning-friendly forms, supporting more accurate defect detection.

[0037] In step S3, the mapping model is a multi-layer perception, i.e., the mapping function in the mapping model is implemented by an MLP network in the multi-layer perception; the MLP network maps the symbolic execution feature vector to the LLM vector space through multi-layer nonlinear transformation, which can maintain the semantic consistency and structural integrity of the features. When constructing the mapping model, the mapping model is configured with an attention mechanism, which assigns corresponding importance weights to the feature vectors of different dimensions in the symbolic execution feature vector; the importance weights are preset according to the influence degree of each dimension feature vector on the LLM mapping result, which can effectively improve the accuracy and robustness of the mapping process.

[0038] In the implementation of the mapping model, the embodiment adopts a multi-layer perception as the core architecture, which enables the model to perform nonlinear transformation through stacked neural network layers, efficiently converting the input symbolic execution feature vector to the LLM vector space. This process ensures the semantic consistency and structural integrity of the original features, such as preserving key logical relationships through activation functions and weight adjustments, avoiding information loss during the mapping process. The design of the multi-layer perception allows the model to abstract feature levels gradually, from low-level details to high-level semantics, thereby generating embedding representations compatible with the LMM space.

[0039] To enhance the mapping performance, as a preferred embodiment of the present application, an attention mechanism is integrated into the mapping model, which dynamically assesses the relative importance of each dimension in the symbolic execution feature vector. Specifically, it forms an attention module that assigns weights according to pre-set rules based on the influence of each dimension on the final LLM mapping result; for example, high-impact features such as semantic constraints or state change trajectories are given greater weight, while secondary features are appropriately weakened. This weighting strategy enables the model to adaptively focus on key information, reducing noise interference and improving the accuracy of overall analysis. At the same time, the attention mechanism is implemented through learnable parameters, further optimizing weight distribution during training to ensure the model's generalization ability in different program scenarios.

[0040] By combining the nonlinear transformation of multi-layer perceptron and the intelligent weighting of attention mechanism, the mapping model of the present embodiment significantly improves accuracy and robustness. The output results, as the basis for LLM analysis, not only retain the rich connotations of symbolic execution features, but also achieve smooth alignment with the large language model space, providing reliable input for subsequent heterogeneous fusion detection. This design effectively addresses the heterogeneity problem between feature dimensions, enhancing the adaptability of the overall framework.

[0041] As a preferred embodiment of the present application, when optimizing the mapping model, pre-acquire training samples, and use code fragments with similar semantics or corresponding defect features as positive samples, and use different types or irrelevant code fragments as negative samples; the contrast loss function used in the contrast learning strategy maximizes the similarity of positive samples in vector space while minimizing the similarity of negative samples, guiding the mapping model to complete the optimization of feature representation and achieving contrast learning training. Divide the training samples according to the pre-set different difficulty levels, and dynamically select training samples of different difficulty levels according to the current boundary situation performance of the mapping model in the contrast learning training, to realize the gradual optimization of the mapping model for feature representation. This design can effectively improve the generalization ability and robustness of the mapping model.

[0042] In the present embodiment, for the optimization training process of the mapping model, first, a training sample set needs to be constructed. These samples are composed of code fragments, among which fragments with similar semantic features or the same defect type are defined as positive samples, while fragments with significant semantic differences or irrelevant fragments are defined as negative samples. This sample division mechanism captures the similarity and difference of program features, providing a learning basis for the model. Positive samples usually correspond to code regions that share logical constraints or vulnerability patterns, while negative samples cover diverse irrelevant scenarios, ensuring the comprehensiveness and representativeness of the training data.

[0043] The training adopts a contrast learning strategy, the core of which is the design of a contrast loss function. The function calculates the distance of samples in the vector space, forcing the maximization of the similarity between positive sample pairs and the minimization of the similarity between negative sample pairs. This process drives the model to deeply understand the internal correlation of feature representations, such as strengthening the matching of semantic constraints and weakening the interference of noise. Through iterative optimization, the mapping model gradually learns to accurately map symbolic execution feature vectors to the LLM space, maintaining semantic consistency and structural integrity, and establishing a foundation for subsequent analysis.

[0044] To enhance the training effect, samples are also divided into different difficulty levels. These levels are based on the complexity or difficulty of distinguishing samples, such as simple samples corresponding to low-difference features, and difficult samples involving high-confusion scenarios. During the training process, the sample selection strategy is dynamically adjusted according to the current performance of the mapping model. When the model is in the early training stage or has low performance boundaries, simple samples are preferred to stabilize learning; as the model optimizes, difficult samples are gradually introduced to challenge its generalization ability. This dynamic mechanism can achieve progressive optimization, allowing the mapping model to gradually adapt to various complex features and avoid falling into local optima too early.

[0045] This training method enables the mapping model to more accurately capture key information when dealing with unknown program features and reduces the risk of overfitting. At the same time, the dynamic sample selection mechanism enhances training efficiency and ensures stable output of the model in different application scenarios. Overall, this optimization training mechanism strengthens the reliability of feature mapping and provides strong support for the heterogeneous fusion detection framework, greatly helping to improve the overall performance of defect detection.

[0046] In step S4, the confidence of the symbolic execution analysis result and the LLM analysis result is evaluated, respectively, to obtain the uncertainty of the corresponding result, and then different preset weighted fusion strategies are used for fusion to obtain the fusion result; the fusion process can fully utilize the advantages of the two analysis methods and achieve complementary advantages; the uncertainty of the fusion result is also evaluated, and then the optimal analysis strategy and resource allocation scheme are determined for the same type of target program detection, and the LLM describes the fusion result as a semantic text output to obtain the program defect detection result; the quantification of uncertainty can be achieved by Bayesian inference or ensemble learning.

[0047] In the final fusion stage of defect detection, the embodiment performs confidence assessment on the symbolic execution analysis results and the LLM analysis results respectively, quantifying the uncertainty levels of the two types of results. The assessment process can use probability modeling techniques, such as calculating posterior probability distribution through Bayesian inference, or generating multi-model prediction variance using ensemble learning, to objectively measure the reliability of the analysis results. Confidence assessment provides a key basis for subsequent fusion, enabling the identification of high-confidence conclusions and potential error areas.

[0048] Based on confidence assessment, the embodiment uses a dynamic weighting strategy for heterogeneous result fusion. This strategy assigns different weights according to the uncertainty levels of the two types of results: when the symbolic execution analysis has high confidence, it is given greater weight to take advantage of its path accuracy; when the LLM analysis is more reliable in semantic understanding, its weight proportion is increased. This dynamic balancing mechanism effectively combines the logical rigor of symbolic execution and the semantic abstraction ability of LLM, achieving complementary advantages. The fusion results not only contain defect judgment conclusions, but also retain their own uncertainty quantification values, providing a reference dimension for subsequent analysis.

[0049] The uncertainty value of the fusion results also serves subsequent detection optimization. In the same type of target program detection, this value can be used to guide resource allocation strategies: for low-uncertainty conclusions, repeated analysis resources can be reduced; for high-uncertainty results, more in-depth symbolic execution or enhanced LLM analysis can be triggered. Through this dynamic resource scheduling mechanism, the overall detection efficiency can be significantly improved.

[0050] Finally, the LLM converts the fusion results into semantic text output. This process preserves the accuracy of the original conclusions while describing the defect location, type, and trigger conditions in natural language, such as expressing the memory access pattern anomaly as "there is a buffer overflow risk at line X, which may be triggered when the input satisfies condition Y." This dual protection mechanism ensures technical rigor while improving the operability and readability of the results, forming a complete defect detection closed loop.

[0051] Embodiment 2 Based on Embodiment 1, this embodiment uses a simple C++ code example to briefly describe the relevant steps in the method. The C++ code example is shown in Figure 2 , which is a C++ code example of a potential division by zero error.

[0052] As Figure 3As shown, first, symbolic execution analysis is performed on the code to build a symbolic execution tree containing two main execution paths. The first path corresponds to the case where x≤5, in which case the variable y remains the initial value 10, and the expression z=100 / 10 is calculated to obtain the result 10, and the program executes normally. The second path corresponds to the case where x>5, in which case the variable y is re-assigned to x-10, and when the input parameter x is equal to 10, the value of y becomes 0, and a division by zero error occurs when performing the division operation z=100 / y. The constraint conditions, variable state change information, and control flow branch decision information of the two paths are extracted to provide basic data for subsequent feature vectorization.

[0053] As shown in Figure 4 , based on the analysis results of the symbolic execution tree, a multi-dimensional feature vector representation is constructed. The path constraint feature is represented by binary encoding of different branch conditions, x≤5 corresponds to the feature vector [1, 0], and x>5 corresponds to the feature vector [0, 1]. The variable state feature records the state change process of the key variable, including the initial value of y as 10, the expression x-10 after branching, and the risk identifier as the operand of the division operation. The control flow feature describes the control structure characteristics of the program, including the branch type as if-else conditional judgment, the key operation type as division operation, and the risk level assessment as high risk. Through the feature fusion network, multiple dimensions of feature information are integrated into a unified 128-dimensional feature vector representation.

[0054] As shown in Figure 5 , the constructed symbolic execution feature vector is input into the heterogeneous mapping neural network model, and a multi-layer perceptron network is used for nonlinear transformation. The mapping network includes an input layer, multiple hidden layers, an attention layer, and an output layer, and each layer is processed through activation functions, batch normalization, and residual connections. The attention mechanism dynamically allocates importance weights to different feature dimensions, highlighting the contribution of key feature information to the mapping result. After mapping transformation, a multi-dimensional vector representation compatible with the LLM vector space is obtained, which maintains the semantic information and structural characteristics of the original symbolic execution features.

[0055] The contrastive learning optimization process of the mapping model can be referred to Figure 6 for illustration. The contrastive learning strategy is used to optimize the parameters of the mapping model. The system constructs positive sample pairs by selecting code fragments with similar division by zero vulnerability features, ensuring that they have high similarity in the mapped vector space. At the same time, negative sample pairs are constructed by selecting different types of code fragments as contrastive samples, requiring them to maintain a large distance in the vector space. Through the contrastive loss function, the model parameters are optimized so that the vector representations of similar samples are closer, and the vector representations of dissimilar samples are more separated, thereby improving the discriminability and generalization ability of the feature representation.

[0056] As shown in Figure 7As shown, the heterogeneous fusion reasoning integrates the results of both symbolic execution and LLM analysis methods. The symbolic execution result shows that a potential division-by-zero error is detected for the input parameter x = 10, providing an accurate logical reasoning result. The LLM analysis result identifies the division-by-zero vulnerability pattern in the code through pattern recognition techniques, giving a confidence score of 0.95. Using a weighted fusion strategy, the two results are integrated to obtain a high-confidence division-by-zero vulnerability detection result, and the corresponding repair suggestions are generated, including adding conditional checks and exception handling mechanisms.

[0057] The method process of the embodiment is finally applied to a specific detection system, and the composition architecture can refer to the schematic diagram of FIG. 1. Figure 8 The C / C++ source code is taken as input, and first, path exploration and feature extraction are performed by the symbolic execution engine. Before feature mapping, code semantic analysis and AST parsing can be performed in advance by a determined LLM. The extracted feature information is converted into an LLM-compatible vector representation through a heterogeneous mapping model, and then collaborative analysis is performed through a fusion reasoning engine. Finally, an intelligent analysis report containing a vulnerability detection report, repair suggestions, and risk assessment is output. The entire processing flow realizes seamless integration from symbolic execution to LLM analysis, fully utilizes the complementary advantages of the two technologies, and improves the accuracy of code analysis.

Claims

1. A method for program defect detection of symbolic execution tree and LLM vector space heterogeneous fusion, characterized in that, The method comprises the following steps: S1, constructing a symbolic execution tree of a target program to be detected and extracting key feature information therefrom; S2, converting the extracted key feature information into a multi-dimensional feature representation to form a corresponding symbolic execution feature vector; S3, constructing a mapping model, realizing a mapping process of the symbolic execution feature vector to an LLM vector space through the mapping model, obtaining an LLM mapping result as a basis for LLM analysis; S4, realizing symbolic execution analysis based on the symbolic execution tree and LLM analysis based on the LLM mapping result; fusing the two types of analysis results to obtain a program defect detection result. In step S3, a contrast learning strategy is used to optimize and train the constructed mapping model, and the mapping process corresponding to the target program to be detected is realized by the trained mapping model.

2. The program defect detection method according to claim 1, characterized by: In step S1, the symbolic execution analysis is performed on the target program to be detected to generate an execution path tree containing path constraint conditions, which serves as the basis for extracting key feature information and obtaining symbolic execution analysis results for fusion in step S4.

3. The program defect detection method according to claim 1, characterized by, In step S1, the extracted key feature information includes a path constraint condition set, a variable symbolic state change trajectory, control flow branch decision information, a memory access mode feature, and a function call relationship graph.

4. The program defect detection method according to claim 1, characterized by: In step S2, the key feature information to be converted is stored in a structured data form, and the information types in the structured data include semantic information, variable state, and control flow graph; wherein the semantic information maintains the corresponding constraints by encoding different types of constraint relationships and logical operators; the state change of the variable state is captured by a time sequence encoding method to obtain the state evolution process of the variable state in different execution paths; the control flow graph adopts a graph neural network to vectorize the control flow structure of the target program to be detected and convert it into a vector form with a preset fixed dimension; after the processing of the three types of information, feature vectors with different dimensions are formed.

5. The program defect detection method according to claim 4, characterized by: Based on the semantic information, a multi-layer feature fusion network is used to integrate the feature vectors with different dimensions corresponding to the semantic information, the variable state, and the control flow graph, to form a unified multi-dimensional feature representation, thereby obtaining a corresponding symbolic execution feature vector as the input basis of the mapping model in step S3.

6. The program defect detection method according to claim 1, characterized by: In step S3, the mapping model is a multi-layer perceptron, and the mapping function in the mapping model is realized by an MLP network in the multi-layer perceptron; the MLP network maps the symbolic execution feature vector to the LLM vector space through multi-layer nonlinear transformation.

7. The program defect detection method according to claim 6, characterized by: When constructing the mapping model, an attention mechanism is configured for the mapping model, and the attention mechanism assigns corresponding importance weights to the feature vectors with different dimensions in the symbolic execution feature vector; the importance weights are preset according to the influence degree of each dimension feature vector on the LLM mapping result.

8. The program defect detection method according to claim 6, characterized by: In the optimization training of the mapping model, training samples are obtained in advance, code segments with similar semantics or corresponding defect features in the training samples are taken as positive samples, and code segments of different types or irrelevant are taken as negative samples; the contrast loss function used in the contrast learning strategy guides the mapping model to complete the optimization understanding of feature representation by maximizing the similarity of positive samples in the vector space and minimizing the similarity of negative samples, so as to realize contrast learning training.

9. The program defect detection method according to claim 8, characterized by: The training samples are divided according to different difficulty levels, and the training samples of different difficulty levels are dynamically selected according to the current boundary condition performance of the mapping model in the contrast learning training, so as to realize the step-by-step optimization understanding of the mapping model to the feature representation.

10. The program defect detection method according to claim 1, characterized by: In step S4, the confidence of the symbolic execution analysis result and the LLM analysis result is evaluated respectively, the uncertainty of the corresponding result is obtained, and different preset weighted fusion strategies are adopted in the fusion to obtain the fusion result; For the fusion result, the uncertainty is also evaluated, and the optimal analysis strategy and resource allocation scheme are determined in the detection of the same type of target program, and the fusion result is described into a semantic text output by the LLM to obtain the program defect detection result.

Images