Vulnerability repairing method and system based on grammar semantic tree

Abstract

The invention discloses a bug repairing method and system based on a grammar semantic tree, and the method comprises the steps: extracting a repairing mode fusing a grammar structure and a semantic intention from a historical bug repairing case, and guaranteeing the accuracy of the mode through program slicing guided by a key entity and iterative verification; on the basis of a double-constraint mechanism of grammar mergibility and semantic consistency, a specific mode is generalized to construct a hierarchical grammar semantic tree knowledge base; a knowledge base is used for generating a plurality of candidate patches for new vulnerabilities, single high-quality patches are generated through structure, grammar and semantic three-dimensional clustering and in-cluster integration and fusion, and the patches are output after heuristic sorting. According to the method, the defects that in the prior art, semantic understanding is shallow, and patch quality is unstable are overcome, and repairing accuracy, generalization ability and engineering practicability are remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computer software security, and in particular to a vulnerability repair method and system based on a syntax semantic tree that fuses syntax structure and semantic intent. BACKGROUND

[0002] Software vulnerabilities, as potential defects and weak links in software systems, have long been a serious challenge in the field of information security. Attackers or malicious actors can exploit these vulnerabilities to perform unauthorized malicious operations, leading to security incidents such as data breaches, service disruptions, system crashes, and potentially causing significant economic losses and social impacts. With the increasing size and complexity of software systems, as well as the widespread use of open-source software, the number of potential vulnerabilities in software continues to grow. In recent years, the number of publicly disclosed vulnerabilities has shown a rapid upward trend, which has attracted widespread attention from academia and industry. In this context, how to quickly, accurately and efficiently repair vulnerabilities after they are discovered to shorten the attack window and reduce potential risks has become a crucial and highly practical issue.

[0003] Traditional vulnerability repair relies heavily on manual operations by developers. Developers need to first understand the root cause of the vulnerability, analyze the code context, then design and implement the repair patch, and finally test and verify. This process not only consumes time and effort, but also is prone to introducing errors or incomplete repairs due to human factors. In the face of the growing number of vulnerabilities and the urgent requirement for repair time, relying solely on manual repair has become difficult to meet the needs of modern software security maintenance. Therefore, vulnerability repair technology based on syntax semantic trees has emerged, with the core goal of replacing or assisting developers in generating vulnerability patches through automated tools, thereby significantly shortening the repair cycle, reducing labor costs, and improving the standardization and reliability of the repair process.

[0004] Existing vulnerability repair techniques based on syntax semantic trees can be mainly divided into two categories: program analysis-based techniques and learning-based techniques. Program analysis-based techniques represent a traditional approach, such as symbolic execution, constraint solving, etc. This approach usually pursues correctness in theory, trying to ensure that the generated patch can eliminate vulnerabilities and not introduce new defects through formal methods. However, this approach often faces the problem of path explosion in practical applications, resulting in huge computational overhead and difficulty in extending to large and complex software projects, limiting its practicality.

[0005] In recent years, with the rapid development of artificial intelligence technology, especially the powerful capabilities of large language models in code understanding and generation, learning-based AVR technology, especially LLM-driven technology, has become a hot topic in current research. This kind of technology can better understand the context semantics of the code by learning patterns from massive historical code and vulnerability repair data, and generate patch codes that conform to the syntax habits, showing great application potential. However, the existing LLM-based AVR methods also have obvious limitations. First, LLM may not accurately diagnose the root cause of the vulnerability without specific guidance, resulting in superficial modifications of the generated patches, or even being misled by irrelevant information in the code, generating redundant changes unrelated to the vulnerability. Second, the generation process of LLM has inherent randomness, usually producing a large number of candidate patches with varying quality in one go, and these results are mixed with correct, partially correct, and even completely wrong solutions, which brings a huge burden to the review, verification and selection of developers. In addition, the patches generated by a single LLM often only reflect a single repair logic, and for complex vulnerabilities, multiple modifications from different angles may be needed to achieve complete repair, while the existing methods lack an effective mechanism to integrate the "collective wisdom" of multiple candidate patches.

[0006] In summary, the current vulnerability repair technology based on syntax semantic tree, whether based on program analysis or learning-based methods, has different degrees of deficiencies in the accuracy, reliability, generalization ability and practicality of the repair scheme. Therefore, there is an urgent need in the field for a new vulnerability repair method based on syntax semantic tree that can deeply integrate code syntax structure and semantic intent, has high-quality knowledge abstraction and integration capabilities, and can generate a single reliable repair scheme to overcome the shortcomings of existing technologies and improve the practical application value of vulnerability repair technology based on syntax semantic tree. SUMMARY

[0007] The present application provides a vulnerability repair method and system based on syntax semantic tree to overcome the shortcomings of the prior art.

[0008] To achieve the above invention purposes, the technical solutions adopted by the present application are as follows:

[0009] A vulnerability repair method based on syntax semantic tree, comprising:

[0010] S1, extracting repair patterns from a plurality of historical vulnerability repair cases, the repair patterns including syntax patterns representing code structure transformation rules and semantic patterns representing repair behavior semantic intent;

[0011] S2. generalizing based on the repair patterns by a double constraint mechanism of simultaneously satisfying the syntactic structure mergability and the semantic logical consistency, to construct a hierarchical syntactic semantic tree knowledge base;

[0012] S3. generating and synthesizing repair patches for the target vulnerability code by using the syntactic semantic tree knowledge base, including: generating a plurality of candidate repair patches, performing multi-dimensional clustering and intra-cluster integration on the candidate repair patches to generate at least one integrated patch, and sorting and outputting all patches.

[0013] Further, the S1 includes:

[0014] S1.1. Extracting a simplified code context directly related to vulnerability repair from repair cases by key entity guided program slicing technology;

[0015] S1.2. Generating the syntax pattern based on the difference between the abstract syntax trees of the pre-repair and post-repair codes;

[0016] S1.3. Analyzing the simplified code context by using a large language model to generate the semantic pattern containing the root cause, repair principle and achieved effect;

[0017] S1.4. Ensuring that the semantic pattern can guide the generation of code consistent with the functional logic of the real repair patch through an iterative verification process.

[0018] Further, the program slicing technology in S1.1 is based on program dependence graph execution to track statements that have data dependencies or control dependencies with key entities.

[0019] Further, the construction of the syntactic semantic tree knowledge base in S2 adopts a bottom-up agglomerative clustering algorithm, and the process includes:

[0020] S2.1. Evaluate the abstract syntax tree structure of two repair patterns to be merged, and fuse by pre-defined generalization rules to verify the syntactic structure mergability;

[0021] S2.2. Use a large language model to infer the hypernyms of the semantic descriptions of the two repair patterns to be merged to verify the semantic logical consistency;

[0022] S2.3. Only when the constraints of S2.1 and S2.2 are met at the same time, perform a merging operation to generate a parent node representing the abstract generalization thereof.

[0023] Further, the pre-defined generalization rules in S2.1 include replacing identifiers with type wildcards, abstracting specific constant values into ranges or types, or merging structurally similar sub-trees into abstract nodes.

[0024] Further, the S3 includes:

[0025] S3.1. Two parallel strategies, pattern-guided generation and direct generation, are used to generate the multiple candidate repair patches;

[0026] S3.2 Calculate the similarity of each candidate patch in the three dimensions of structure, syntax and semantics, and perform clustering based on the fused comprehensive similarity;

[0027] S3.3 Perform consensus fusion and noise pruning on the candidate patches within each cluster to generate a single integrated patch;

[0028] S3.4. Prioritize all integrated patches and independent candidate patches according to preset heuristic rules and then output the results.

[0029] Furthermore, in S3.2:

[0030] Structural similarity is calculated by comparing the control flow graph and data flow graph of the code region after the patch modification;

[0031] Syntactic similarity is measured by calculating the tree edit distance of the patch on the abstract syntax tree;

[0032] Semantic similarity is evaluated by converting repair intentions into vectors through an embedding model and calculating cosine similarity.

[0033] Furthermore, consensus fusion in S3.3 involves identifying and merging high-frequency code modifications shared by all members within the cluster, while noise pruning removes modifications that occur only in a few members and are irrelevant to the core repair logic.

[0034] This invention also discloses a vulnerability repair system based on syntax and semantic trees, used to implement the above-mentioned vulnerability repair method based on syntax and semantic trees, the system comprising:

[0035] The remediation pattern extraction module is configured to extract remediation patterns that combine syntax and semantics from historical vulnerability remediation cases; this module specifically includes:

[0036] The context simplification element is used to extract simplified code context directly related to vulnerability remediation from code differences in remediation cases through program slicing techniques guided by key entities.

[0037] The syntax pattern extraction unit is used to generate syntax patterns describing the rules of code structure transformation based on the differences in the abstract syntax tree of the code before and after the repair, using a tree difference algorithm.

[0038] The semantic pattern extraction unit is used to analyze the context of the simplified code using a large language model to generate a semantic pattern that describes the root cause, principles, and effects of the repair.

[0039] An iterative verification unit is configured to correct the semantic pattern through a generation-verification loop to ensure that the semantic pattern can guide the generation of a correct patch;

[0040] A repair pattern generalization module is connected to the repair pattern extraction module and is configured to construct a hierarchical syntax semantic tree knowledge base based on the extracted repair pattern.

[0041] A syntax merging evaluation unit is configured to evaluate the abstract syntax tree structure of the repair pattern to be merged to verify the mergability of the syntax structure through a pre-defined generalization rule.

[0042] A semantic consistency verification unit is configured to use a large language model to infer the hypernyms of the semantic description of the repair pattern to be merged to verify the semantic logic consistency.

[0043] The syntax semantic tree is constructed by a bottom-up agglomerative clustering algorithm, the leaf nodes are specific repair patterns, and the non-leaf nodes are abstract repair patterns generated by merging through syntax and semantic constraints.

[0044] A patch synthesis module is connected to the repair pattern generalization module and is configured to use the syntax semantic tree knowledge base to generate and synthesize an optimal repair patch for new vulnerability code.

[0045] A candidate generation unit is configured to use two parallel strategies of pattern-guided generation and direct generation to generate multiple candidate repair patches.

[0046] A clustering unit is configured to calculate the similarity of the candidate patches from three dimensions of structure, syntax and semantics, and group them through a hierarchical clustering algorithm.

[0047] An integration unit is configured to perform consensus fusion and noise pruning on the candidate patches in each clustering cluster to generate a single integrated patch.

[0048] A sorting unit is configured to sort all integrated patches and independent candidate patches according to a pre-defined heuristic rule and then output.

[0049] The application further discloses a computer device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the above-mentioned vulnerability repair method based on the syntax semantic tree when executing the computer program.

[0050] The application further discloses a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the above-mentioned vulnerability repair method based on the syntax semantic tree.

[0051] Compared with the prior art, the application has the following advantages:

[0052] 1. The present application fundamentally improves the accuracy of vulnerability root cause diagnosis by introducing key entity guided program slicing technology and iterative verification mechanism. In the repair pattern extraction stage, the system not only captures the structural changes of the code, but also deeply analyzes the semantic intent behind the repair through a large language model, forming a complete repair pattern driven by syntax and semantics. Compared with the existing technology which only relies on syntax matching or LLM black box generation, the repair pattern output by the present application has higher confidence. More importantly, in the patch synthesis stage, a multi-dimensional clustering and intra-cluster integration strategy is innovatively adopted to fuse the collective wisdom of multiple candidate patches, effectively eliminating the one-sidedness and random noise that may exist in a single solution, and finally generating a single, optimal integrated patch, which has achieved a qualitative leap in accuracy and reliability.

[0053] 2. The core breakthrough of the present application is the construction of a hierarchical syntax semantic tree knowledge base, which is strictly constrained by the syntactic structure mergability and semantic logic consistency. This mechanism ensures that the abstract repair patterns in the knowledge base are truly based on logical association, rather than simple syntactic coincidence aggregation. Therefore, when the system encounters "zero-day" vulnerabilities or new vulnerability variants that have not appeared in the training data, it can use the abstracted repair principles in the knowledge base for effective analogical reasoning, rather than rigid template matching. This deep semantic understanding-based generalization capability enables the present application to break through the limitations of historical data and respond to complex and variable real software security threats.

[0054] 3. To address the pain points of existing AVR technology, such as output chaos and heavy review burden on developers, the present application designs a complete patch synthesis and ordering delivery process. The system ultimately presents to the user is not a list of candidate solutions containing a large amount of redundancy and errors without processing, but a refined patch list after clustering, integration and priority sorting. Among them, the highest ranked solution is the most reliable solution that integrates group consensus. This "out-of-the-box" delivery method greatly simplifies the decision-making process of developers, enabling them to quickly adopt the most reliable repair solution, thereby significantly reducing the time and resource cost invested in the manual review, testing and verification stages, and improving the engineering application value of automatic repair technology.

[0055] 4.The syntax semantic tree is not only a tool for instant repair, but also constitutes an extensible and evolving structured knowledge management system. The hierarchical architecture design enables new vulnerability repair cases to be integrated into the knowledge base through incremental learning. With the passage of time and the accumulation of data, the repair patterns in the knowledge base will become increasingly rich and accurate, and the repair capability will continue to improve. This self-evolving feature ensures that the system can adapt to the changing software vulnerability patterns over a long period of time, overcoming the limitations of traditional methods that are difficult to update, and has a long life cycle and application potential. BRIEF DESCRIPTION OF DRAWINGS

[0056] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the description of the embodiments of the present application. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0057] Figure 1 is the overall architecture diagram of the vulnerability repair method based on the syntax semantic tree of an embodiment of the present application;

[0058] Figure 2 is the syntax semantic tree construction algorithm diagram in the embodiment of the present application. DETAILED DESCRIPTION

[0059] The technical solutions in the embodiments of the present application will be described clearly and completely in the following with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0060] As shown in Figure 1 , the vulnerability repair method based on the syntax semantic tree provided by the embodiment of the present application comprises the following steps:

[0061] I. Preparation and data source

[0062] Before starting the automatic process of the present method, the following preparation work needs to be done:

[0063] 1. Construction of historical vulnerability repair database:

[0064] Data source: Collect code commits (Commit) containing explicit vulnerability repair records from public software code repositories (such as GitHub, GitLab) security announcements (such as CVE detail pages).

[0065] Data Preprocessing: Parse each commit to extract its vulnerable code (VulnerableCode) and patched code (PatchedCode) before and after the fix, and associate the corresponding vulnerability metadata, such as CWEID, vulnerability description, etc.

[0066] Data Storage: Store the cleaned data in a structured database, with each record containing fields such as VulnerableCode, PatchedCode, commit hash, CWEID, etc., as the original data source for subsequent pattern extraction.

[0067] 2. Tool and Environment Configuration:

[0068] Program Analysis Tool: Configure mature static analysis tools to generate Abstract Syntax Tree (AST), Program Dependency Graph (PDG), Control Flow Graph (CFG), and Data Flow Graph (DFG). For example, you can use toolchains based on Eclipse JDT, PyCG, or LLVM.

[0069] Large Language Model (LLM) Service: Access one or more high-performance LLM APIs (such as DeepSeek-V3, GPT-4, or proprietary models) for semantic analysis, pattern description, and code generation tasks.

[0070] Computing Resources: Prepare servers with sufficient CPU, memory, and GPU resources to support large-scale code analysis and model inference calculations.

[0071] II. Repair Pattern Extraction Phase

[0072] This phase aims to convert unstructured code changes into structured repair patterns.

[0073] Step S1.1: Context Simplification

[0074] Input: Code differences (Diff) of a single historical repair case.

[0075] Process:

[0076] a. Key Entity Identification: Input the code differences and vulnerability description into the LLM, and through a carefully designed prompt, guide the model to identify the core modification points of this repair, i.e., "key entities". Prompt example: "Please analyze the following code repair and point out which variables, functions, or expressions are the most critical steps in fixing the vulnerability."

[0077] b. Procedure slicing: Use static analysis tools to construct PDGs for the pre- and post-fix code with the identified key entities as slicing criteria. Then, perform forward slicing (trace data flow out) and backward slicing (trace data flow in) on the PDGs to obtain all statements that have direct or indirect data dependencies and control dependencies with the key entities.

[0078] Output: A refined set of code context snippets that excludes irrelevant code, significantly reducing the complexity of subsequent analysis.

[0079] Step S1.2: Syntax pattern extraction

[0080] Input: Refined pre- and post-fix code snippets.

[0081] Process:

[0082] a. AST generation and differencing: Use a parser (e.g., Tree-sitter) to convert both code snippets into ASTs. Then, apply a tree differencing algorithm (e.g., GumTree algorithm) to compute the minimal EditScript between the two ASTs.

[0083] b. Template generalization: Replace specific identifiers (e.g., variable name userInput) in the EditScript with type wildcards (e.g., <string>Variable), replacing specific literals (such as the number 1024) with type designators (such as <integer>Literal), thus forming an abstract syntax transformation template.

[0084] c. Guard condition generation: Analyze the AST structure around the modification point, extract the context pattern that must exist for this modification to be triggered, and form a guard condition.

[0085] Output: A structured syntax pattern, containing a Transformer and a Guard.

[0086] Steps S1.3 and S1.4: Semantic pattern extraction and iterative validation

[0087] Input: Refined code context, vulnerability metadata (e.g., CWE ID).

[0088] Process:

[0089] a. Initial semantic description generation: Design prompts to guide the LLM to generate structured semantic descriptions. Example prompts: "Please analyze the provided code fix by identifying: 1. The root cause of the vulnerability; 2. The core principle followed for this repair; 3. The security effect achieved after the repair."

[0090] Output: A structured semantic pattern containing three fields: Root Cause, Repair Principle, and Effect.

[0091] III. Building a syntax-semantic tree knowledge base

[0092] The goal of this phase is to organize a large collection of specific repair patterns into a hierarchical, generalizable knowledge base.

[0093] Steps S2.1 and S2.2: Dual constraint merging mechanism

[0094] Input: A large collection of specific patterns output from the repair pattern extraction phase.

[0095] Process: Implement a clustering algorithm as shown in Figure 2 In each iteration:

[0096] a. Merge_syn: For any two patterns and, attempt to generalize and merge the nodes in their syntax templates according to predefined rules. For example, if both patterns are repairing array out-of-bounds, one changes size-1 to size and the other changes length-1 to length, then they can be generalized to change <lengthexpression>-1 is changed to <lengthexpression>.

[0097] b. Semantic consistency verification (Merge_sem): The semantic descriptions (root cause, fix principle) of two patterns are input into LLM, which is required to judge whether there is a common superordinate concept. For example, judge whether "fix file path traversal" and "fix URL parameter traversal" can be generalized as "fix path resolution problem caused by unverified user input". If LLM gives a positive judgment and can generate a reasonable superordinate description, the verification is passed.

[0098] c. Merge execution: Only when both syntax and semantics are verified, a new parent node is created, which inherits the generalized syntax template and superordinate semantic description, and is as its child node.

[0099] Output: One or more syntax and semantic trees organized by different vulnerability categories (such as CWE classification), which constitute the core knowledge base of the system.

[0100] Detailed algorithm steps:

[0101] Step 1: Initialization

[0102] The input of the algorithm is a set containing all specific fix patterns extracted from the first stage, which serves as the initial working set.

[0103] Initialize an empty set to store the final constructed tree (or single pattern) as the root node.

[0104] Step 2: Main loop

[0105] The algorithm enters a main loop, and the termination condition of the loop is that the working set becomes empty.

[0106] Step 3: Selection of benchmark pattern

[0107] At the beginning of each iteration of the main loop, a pattern is selected from the working set as the benchmark pattern for pairing in this round of iteration.

[0108] Step 4: Generation and screening of candidate merge pairs

[0109] The algorithm will traverse all other patterns in the working set except the benchmark pattern, and pair each one with the benchmark pattern.

[0110] For each pair, the algorithm will perform a double constraint review: that is, it will judge whether the pair of patterns meets the syntax structure mergability and semantic logical consistency at the same time.

[0111] Only when a pair passes both of the above checks, the new pattern generated by their combination is considered as a valid merge candidate and added to a temporary candidate pool.

[0112] Step 5: Selection and execution of the optimal merge scheme

[0113] After the review of all pairs is completed, the algorithm checks the temporary candidate pool.

[0114] Case A (existence of valid merge): If the candidate pool is not empty, the algorithm selects the merge candidate with the highest score from the pool as the optimal merge scheme for this round according to the predefined syntactic structure similarity score.

[0115] Tree structure update: The system creates a new parent node (i.e., the abstract pattern corresponding to the optimal merge scheme) and links the two child patterns (i.e., the benchmark pattern and its paired pattern) that constitute the scheme to the parent node.

[0116] Working set update: The two merged child patterns are removed from the working set, and the newly generated parent pattern is added to the working set for subsequent iterations.

[0117] Case B (nonexistence of valid merge): If the candidate pool is empty, it means that the benchmark pattern cannot be effectively merged with any other pattern in the current working set.

[0118] Node finalization: The benchmark pattern is considered as the top node of a branch (i.e., the root of a tree), and its construction process is completed.

[0119] Working set update: The benchmark pattern is removed from the working set and added to the final output collection.

[0120] Step 6: Algorithm termination and output

[0121] The main loop (Step 2) continues to execute until the working set is empty.

[0122] After the algorithm terminates, its output is the complete syntactic semantic tree collection represented by all finalized root nodes.

[0123] IV. Patch synthesis phase

[0124] This phase is an online process for generating reliable patches for new vulnerabilities.

[0125] Step S3.1: Candidate patch generation

[0126] Input: The newly emerged vulnerability code snippet and its context.

[0127] Process:

[0128] a. Pattern-guided generation: First, analyze the potential root cause of the new vulnerability using LLM. Then, search in the syntax-semantics tree knowledge base to find the most semantically matching fix pattern. Use the syntax template and semantic principles of this pattern as strong constraints to guide LLM to generate patches via Prompt instructions. For example: "Please follow the principle of 'normalizing user input' and apply the code structure of 'adding an input validation function call' to fix the following code..."

[0129] b. Direct generation: Meanwhile, in another parallel thread, only provide the vulnerability code and root cause analysis to LLM, instructing it to: "Please directly fix the security vulnerability in the following code."

[0130] Output: A set of dozens of candidate patches.

[0131] Step S3.2: Multi-dimensional patch clustering

[0132] Input: Set of candidate patches.

[0133] Process:

[0134] a. Feature extraction: For each candidate patch, calculate a feature vector in three dimensions:

[0135] Structural similarity: Generate the CFG and DFG of the modified patch code, and calculate graph isomorphism or edit distance.

[0136] Syntactic similarity: Calculate the tree edit distance between the patch AST and the original vulnerability AST.

[0137] Semantic similarity: Convert the patch code into a vector using a code embedding model (such as CodeBERT), and calculate the cosine similarity.

[0138] b. Weighted clustering: Assign weights to the three similarities (such as structure: 0.4, syntax: 0.3, semantics: 0.3), and calculate a comprehensive similarity matrix. Use the hierarchical agglomerative clustering (HAC) algorithm to divide the patches into multiple clusters (Clusters) according to the pre-set similarity threshold.

[0139] Step S3.3: Cluster-integrated and refined

[0140] Input: Multiple candidate patches within each clustering cluster.

[0141] Process: For each cluster, guide LLM to perform the following operations:

[0142] a. Consensus fusion: Analyze all patches within the cluster to find common core modification points (for example, all patches add the same input validation function call), and use them as the skeleton of the integrated patch.

[0143] b. Noise pruning: Identify and remove minor modifications (e.g., code formatting, log statement addition, etc.) that only appear in individual patches and are not related to the core fix logic.

[0144] Output: A single, optimized integrated patch is generated for each cluster.

[0145] Step S3.4: Heuristic ranking delivery

[0146] Process: All integrated patches and unclustered individual patches are ranked. The ranking rule prioritizes collective wisdom: the more members within a cluster, the higher the ranking, as it represents a higher consensus. Secondly, the simplicity of the patch (fewer modified lines) and semantic matching degree are considered.

[0147] Output: A ranked list of patches in descending order of priority, and the top-ranked patch is recommended to the developer as the highest-confidence fix solution.

[0148] Five, implementation effect

[0149] Through the above specific embodiments, the present application can automatically learn from massive historical repairs, build a high-quality generalizable knowledge base, and generate a single, reliable, and high-quality repair patch for new vulnerabilities, significantly improving the accuracy, reliability, and practicality of vulnerability repair based on syntax and semantic trees.

[0150] In another embodiment, a syntax and semantic tree-based vulnerability repair system is provided, which corresponds to the syntax and semantic tree-based vulnerability repair method in the above embodiment. The functions of each module are described in detail as follows:

[0151] The repair pattern extraction module is configured to extract repair patterns that integrate syntax and semantics from historical vulnerability repair cases; the module specifically includes:

[0152] The context simplification unit is used to extract the simplified code context directly related to vulnerability repair from the code difference of the repair case through key entity-guided program slicing technology;

[0153] The syntax pattern extraction unit is used to generate syntax patterns describing code structure transformation rules based on the abstract syntax tree difference of the pre-repair and post-repair codes through tree difference algorithm;

[0154] The semantic pattern extraction unit is used to analyze the simplified code context using a large language model to generate semantic patterns describing the root cause, principle, and effect of the repair;

[0155] The iterative verification unit is used to correct the semantic patterns through a generate-verify loop to ensure that they can guide the generation of functional correct patches;

[0156] The repair mode generalization module is connected with the repair mode extraction module and is configured to construct a hierarchical syntax semantic tree knowledge base based on the extracted repair mode. The module specifically includes:

[0157] The syntax merging evaluation unit is used to evaluate the abstract syntax tree structure of the repair mode to be merged, and verify the mergability of the syntax structure through a predefined generalization rule.

[0158] The semantic consistency verification unit is used to perform hypernym inference on the semantic description of the repair mode to be merged by using a large language model, and verify the semantic logic consistency.

[0159] The syntax semantic tree is constructed by a bottom-up agglomerative clustering algorithm, the leaf node is a specific repair mode, and the non-leaf node is an abstract repair mode generated by simultaneous merging through syntax and semantic double constraints.

[0160] The patch synthesis module is connected with the repair mode generalization module and is configured to generate and synthesize an optimal repair patch for new vulnerability code by using the syntax semantic tree knowledge base. The module specifically includes:

[0161] The candidate generation unit is used to generate multiple candidate repair patches by adopting two parallel strategies of pattern-guided generation and direct generation.

[0162] The clustering unit is used to calculate the similarity of the candidate patches from three dimensions of structure, syntax and semantics, and group them by a hierarchical clustering algorithm.

[0163] The integration unit is used to perform consensus fusion and noise pruning on the candidate patches in each clustering cluster, and generate a single integrated patch.

[0164] The sorting unit is used to sort all integrated patches and independent candidate patches in priority according to a preset heuristic rule, and then output.

[0165] In another embodiment of the present application, a terminal device is provided, which comprises a processor and a memory, the memory is configured to store a computer program, the computer program comprises program instructions, and the processor is configured to execute the program instructions stored in the computer storage medium. The processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., which are the computing core and control core of the terminal, and are suitable for implementing one or more instructions, and are particularly suitable for loading and executing one or more instructions to implement corresponding method processes or corresponding functions; the processor in the embodiments of the present application can be used for the operation of the vulnerability repair method based on the syntax semantic tree.

[0166] In another embodiment of the present application, a storage medium is provided, specifically a computer readable storage medium (Memory), which is a memory device in a terminal device, and is configured to store programs and data. It can be understood that the computer readable storage medium herein can include a built-in storage medium in the terminal device, and of course can also include an expansion storage medium supported by the terminal device. The computer readable storage medium provides a storage space, and the storage space stores an operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and the instructions can be one or more computer programs (including program codes). It should be noted that the computer readable storage medium herein can be a high-speed RAM memory, or a non-volatile memory such as at least one disk memory.

[0167] One or more instructions stored in the computer readable storage medium can be loaded and executed by the processor to implement the corresponding steps of the vulnerability repair method based on the syntax semantic tree in the above embodiments; one or more instructions in the computer readable storage medium are loaded and executed by the processor.

[0168] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments of each method. Any reference to memory, storage, database or other medium used in each embodiment provided by the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0169] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of each functional unit and module is exemplified, and in actual application, the above-mentioned functions can be completed by different functional units and modules according to needs, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above.

[0170] The above-mentioned embodiments are only used to illustrate the technical solutions of the present application, but not to limit it; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.< / lengthexpression> < / lengthexpression> < / integer> < / string>

Claims

1. A vulnerability fixing method based on a syntax semantic tree, characterized by, Comprise: S1, extract repair patterns from multiple historical vulnerability repair cases, the repair patterns contain syntax patterns representing code structure transformation rules and semantic patterns representing repair behavior semantic intention; S2, based on the repair patterns, generalize by simultaneously satisfying the dual constraint mechanism of syntax structure mergability and semantic logic consistency, and construct a hierarchical syntax semantic tree knowledge base; S3, for the target vulnerability code, generate and synthesize repair patches using the syntax semantic tree knowledge base, including: generating multiple candidate repair patches, multi-dimensional clustering and intra-cluster integration of the candidate repair patches to generate at least one integrated patch, and sorting and outputting all patches.

2. The vulnerability fixing method based on the syntax semantic tree according to claim 1, characterized in that, The S1 comprises: S1.1, through key entity guided program slicing technology, extract the simplified code context directly related to vulnerability repair from the repair case; S1.2, based on the difference of abstract syntax tree before and after repair, generate the syntax pattern; S1.3, use large language model to analyze the simplified code context, generate the semantic pattern containing root cause, repair principle and effect; S1.4, through iterative verification process, ensure that the semantic pattern can guide the generation of code consistent with the function logic of real repair patch.

3. The vulnerability fixing method based on the syntax semantic tree according to claim 2, characterized in that, The program slicing technology in S1.1 is based on program dependence graph execution to track statements with data dependency or control dependency with key entities.

4. The vulnerability fixing method based on the syntax semantic tree according to claim 1, characterized in that, The construction of syntax semantic tree knowledge base in S2 adopts a bottom-up agglomerative clustering algorithm, the process of which includes: S2.1, evaluate the abstract syntax tree structure of two repair patterns to be merged, fuse by pre-defined generalization rules to verify the syntax structure mergability; S2.2, use large language model to infer the hypernyms of the semantic descriptions of the two repair patterns to be merged to verify the semantic logic consistency; S2.3, only when the constraints of S2.1 and S2.2 are satisfied at the same time, perform the merging operation to generate a parent node representing the abstract generalization thereof.

5. The vulnerability fixing method based on the syntax semantic tree according to claim 4, characterized in that, The pre-defined generalization rules in S2.1 include replacing identifiers with type wildcards, abstracting specific constant values into ranges or types, or merging structurally similar sub-trees into abstract nodes.

6. The vulnerability fixing method based on the syntax semantic tree according to claim 1, wherein, The S3 comprises: S3.1, adopt two parallel strategies of pattern guided generation and direct generation to generate the multiple candidate repair patches; S3.2, calculate the similarity of each candidate patch in structure, syntax and semantics three dimensions, and cluster grouping based on the integrated similarity after fusion; S3.3, consensus fusion and noise pruning of candidate patches in each cluster to generate a single integrated patch; S3.4, according to the preset heuristic rules, sort and output all integrated patches and independent candidate patches in priority.

7. The vulnerability fixing method based on the syntax semantic tree according to claim 6, characterized in that, In S3.2: Structural similarity is calculated by comparing the control flow graph and data flow graph of the patch modified code region; Syntax similarity is measured by calculating the tree edit distance of the patch to the abstract syntax tree; Semantic similarity is evaluated by converting repair intention into vector through embedding model and calculating cosine similarity.

8. The vulnerability fixing method based on the syntax semantic tree according to claim 6, characterized in that, The consensus fusion in S3.3 is to identify and merge the high-frequency code modification parts common to all members in the cluster, and the noise pruning is to remove the modifications that only appear in a small number of members and are irrelevant to the core repair logic.

9. A vulnerability fixing system based on a syntax semantic tree, for implementing the vulnerability fixing method based on a syntax semantic tree according to any one of claims 1 to 8, characterized in that, The system comprises: A repair pattern extraction module configured to extract repair patterns that fuse syntax and semantics from historical vulnerability repair cases; the module specifically comprises: A context reduction component for extracting a reduced code context directly related to vulnerability repair from the code differences of repair cases through key entity-guided program slicing techniques; A syntax pattern extraction unit for generating syntax patterns describing code structure transformation rules based on the abstract syntax tree differences of pre- and post-repair codes through tree difference algorithms; A semantic pattern extraction unit for analyzing the reduced code context using a large language model to generate semantic patterns describing the root cause, principles, and effects of repair; An iterative verification unit for correcting semantic patterns through a generate-verify loop to ensure that they can guide the generation of functional patches; A repair pattern generalization module connected to the repair pattern extraction module and configured to construct a hierarchical syntax-semantics tree knowledge base based on the extracted repair patterns; the module specifically comprises: A syntax merging evaluation unit for evaluating the abstract syntax tree structure of repair patterns to be merged and verifying the mergability of the syntax structure through predefined generalization rules; A semantic consistency verification unit for using a large language model to infer the hypernyms of the semantic descriptions of repair patterns to be merged and verifying the semantic logic consistency; The syntax-semantics tree is constructed through a bottom-up agglomerative clustering algorithm, the leaf nodes are specific repair patterns, and the non-leaf nodes are abstract repair patterns generated by merging through both syntax and semantics; A patch synthesis module connected to the repair pattern generalization module and configured to use the syntax-semantics tree knowledge base to generate and synthesize optimal repair patches for new vulnerability codes; the module specifically comprises: A candidate generation unit for using two parallel strategies of pattern-guided generation and direct generation to generate multiple candidate repair patches; A clustering unit for calculating the similarity of candidate patches from three dimensions of structure, syntax, and semantics and grouping them through hierarchical clustering algorithms; An integration unit for consensus fusion and noise pruning of candidate patches within each cluster to generate a single integrated patch; A sorting unit for priority sorting of all integrated patches and independent candidate patches according to preset heuristic rules and outputting.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the vulnerability repair method based on the syntax-semantics tree according to any one of claims 1-8.

Images